Visa, mastercard unite on AI payments security standards

The Agentic Payments Alliance (APA), launched by Rain on August 18, 2026, unites 26 founding members including Visa, Mastercard, Circle, Solana, and Fiserv to collaboratively establish shared technical and operational standards for agentic commerce. This coalition aims to preempt regulatory uncertainty by defining interoperable protocols that address critical questions around agent identity, spending limits, and real-time authentication, effectively creating an identity-and-authorization layer above existing payment networks without building a new payment infrastructure.

The APA serves as a governance experiment focused on five key areas—agent authorization, fraud detection, loyalty integration, identity standards, and regulatory advocacy—designed to solve friction points that currently hinder scalable, secure autonomous software payments. By fostering industry-wide consensus and interoperability, the alliance aims to unify a fragmented ecosystem that includes both traditional payment processors like Fiserv and crypto-native protocols such as Solana and Avalanche, balancing open decentralized standards with security and compliance to avoid proprietary lock-ins.

Despite differing technical approaches—Visa advocating cryptographic signatures in merchant requests and Mastercard promoting a system spanning traditional rails and blockchain settlement—both giants have joined the APA to ensure interoperability and prevent fragmented, incompatible agent payment systems. As Mastercard’s Sherri Haymond emphasizes, the risk lies not in slow innovation but in innovation outpacing alignment, underscoring the strategic necessity of the alliance to enable scalable adoption of agentic commerce including Agent Pay and programmable stablecoin payments.

Mastercard’s Agent Pay for Machines platform pioneers autonomous machine-to-machine payments by embedding robust governance through four core pillars: credentialing, permissioning, transacting, and settlement. This architecture ensures every AI agent is issued verified credentials, organizations can enforce spending limits and rules, and transactions are processed automatically with guaranteed settlement, effectively integrating traditional payment governance into AI-driven commerce. By treating stablecoins as a complementary settlement rail alongside cards and bank accounts, Mastercard enables rapid, programmable, and cost-efficient transactions, a capability championed by partners like Coinbase, Ripple, and Polygon, which is critical for scaling autonomous commerce.

The Agent Pay platform has galvanized broad industry collaboration, attracting over 30 partners including Stripe, Coinbase, Ripple, Polygon, and the Solana Foundation, signaling widespread recognition of the growth potential in agentic commerce. Mastercard’s ecosystem extends further, working closely with technology giants such as Google, Microsoft, IBM, and PayPal to develop interoperable standards and operational protocols that simplify adoption and foster trust. This collective effort is reflected in Mastercard’s global rollout, enabling all customer banks to participate in agentic commerce and launching live transactions with merchants across multiple markets, although the scale of transactions and merchant participation remains in early stages.

To ease integration and accelerate adoption, Mastercard provides foundational network services including tokenization, authentication, intent validation, and dispute resolution, which collectively lower barriers for banks and merchants entering the agentic commerce ecosystem. These 'on behalf' services form a critical backbone that supports secure, trusted transactions and help institutional players embrace regulated stablecoin payments without abandoning existing infrastructure. As Mastercard’s leadership highlights, establishing these foundational standards and security protocols is essential to enabling scalable and trusted agentic commerce across diverse markets and partners.

Agentic Tokens, pioneered by Visa, represent a breakthrough in securing AI-driven payments by acting as conditional proxies that never expose the user’s full card number. These tokens bind agent credentials tightly to specific agents and purchase contexts, enabling multi-step verification and real-time fraud monitoring that ensures transactions are only authorized within narrowly defined parameters set by the user. This layered security model transforms AI payments from a potential vulnerability into a controlled, auditable process where the AI cannot unilaterally approve payments, reinforcing trust in agentic commerce.

The integration of passkeys and agent-specific tokens further elevates trust and identity verification by combining device-bound possession factors with biometric inherence, aligning with stringent regulatory requirements such as those in Europe. Mastercard’s pilots demonstrate a 17% boost in authentication success rates using passkeys, while PayPal reports improved customer conversion, highlighting the user-friendly yet robust nature of this approach. By embedding these credentials within digital wallets, as advocated by the FIDO Alliance and companies like Google, users gain transparent control over agentic transactions, able to review and select credentials seamlessly alongside payment methods.

Mastercard’s exploration of secure scaling underscores the complexity behind the scenes—what they term the 'piping'—where catalog integration, condition representation, and secure credential transfer must operate flawlessly to maintain seamless consumer experiences. This backend orchestration is critical to ensuring that legitimate agents are invited while malicious actors are excluded, that user identity is rigorously authenticated, and that merchant interactions are genuine. Importantly, Mastercard emphasizes consumer recourse mechanisms even when users never directly engage with merchants, addressing a core trust challenge unique to agentic commerce.

Recognizing the novel challenges posed by AI agents autonomously selecting merchants and prices, industry leaders including Mastercard, Google, and OpenAI are collaborating through pilot programs to define operational and security standards that preserve trust in this evolving ecosystem. As Lee Campbell from Google notes, the unpredictability of agent-mediated purchases demands new protocols to verify agent authorization and transaction legitimacy, a task being tackled through cross-industry partnerships involving major AI platforms and infrastructure providers like Cloudflare. This coordinated effort is crucial to establishing a scalable, secure foundation for agentic commerce.

The Agentic Payments Alliance (APA), launched by Rain and comprising 26 founding members including Visa, Mastercard, Circle, and Solana, represents a landmark cross-industry collaboration to develop interoperable standards and operational protocols for agentic commerce. By uniting traditional finance giants, crypto-native protocols, and technology firms, the APA aims to preempt regulatory fragmentation and establish a unified framework that balances decentralization with security and compliance. This coalition’s proactive approach focuses on critical areas such as agent authorization, fraud detection, loyalty integration, identity standards, and regulatory advocacy to enable autonomous software agents to transact securely and at scale.

Despite differing technical architectures—Visa’s cryptographic Trusted Agent Protocol and Mastercard’s Agent Pay platform integrating card rails with blockchain settlement—the alliance fosters collaboration to ensure interoperability and ecosystem-wide adoption of agentic payments. This unity prevents the emergence of fragmented, proprietary systems by establishing shared rules for identity binding, spending limits, and real-time authentication, effectively creating an OAuth-like authorization layer for money. As Mastercard’s Sherri Haymond warns, the real risk lies not in slow innovation but in misalignment, underscoring the strategic importance of industry-wide standards to enable scalable autonomous commerce.

The APA’s work extends beyond standards development into operationalizing programmable stablecoin payments, adding a logic layer atop existing payment rails to automate business processes such as supplier invoice payments. This innovation leverages stablecoins’ instant settlement and lack of chargeback risks, making them ideal for agentic commerce’s fast, autonomous transactions. The alliance’s broad membership—including stablecoin issuers like Circle, custody providers like Fireblocks, and analytics firms like Chainalysis—reflects a comprehensive ecosystem partnership committed to overcoming security challenges and regulatory uncertainties inherent in this emerging payment paradigm.