Three Rivals, One ID Card for Bots: Visa, Mastercard and Ant International Align on a Know-Your-Agent Standard

On September 10, 2026, three of the world’s largest payment organizations — Visa, Mastercard and Ant International — announced they have begun collaborating on a Know-Your-Agent (KYA) interoperability framework, a shared set of principles for onboarding, identifying and continuously monitoring the AI agents that are rapidly taking over online shopping. The announcement, made via a joint release timed to appearances in São Paulo, is the payments industry’s most concrete step yet toward answering a question that has hovered over agentic commerce since its inception: when a bot checks out on your behalf, who exactly is it, and who vouches for it?

Why payment networks are suddenly standardizing bot identity

AI agents have moved past recommending products. In 2026 they book flights, reorder groceries, negotiate subscriptions and complete purchases end-to-end on behalf of users — and the volume is only going one direction. The joint release cites McKinsey projections that by 2030, AI agents will orchestrate somewhere between US$3 trillion and US$5 trillion of global consumer commerce.

Every one of those transactions poses a problem the card industry has never faced before: the entity presenting credentials at checkout is not the human who owns the money. Traditional fraud stacks — device fingerprinting, 3-D Secure challenges, velocity rules built around a person’s browsing patterns — simply do not map onto a software actor that may fire a thousand transactions from a data center at 3 a.m. with perfect legitimacy.

Each of the three companies had already built its own answer. Visa shipped the Trusted Agent Protocol (TAP) as part of its Intelligent Commerce push, a framework for verifying agents and blocking malicious bots before they reach the payment flow. Mastercard built Verifiable Intent, designed to prove that an autonomous action reflects the cardholder’s actual consent. Ant International open-sourced its Agentic Mobile Protocol (AMP) in April 2026, extending agent payments across the wallet ecosystems of Asia, where Alipay+ now connects 150 million merchants to more than 50 digital wallets reaching some 2 billion user accounts.

Three protocols, three trust stacks, three integration paths. For any agent platform or marketplace wanting to operate globally, that meant verifying the same bot three separate times against three separate rulebooks — duplicative, slow, and expensive exactly where the industry wants velocity. The KYA collaboration is an admission that this fragmentation, not consumer readiness, had become the bottleneck.

What the framework actually covers

The collaboration is deliberately scoped as a bridge, not a merger. Each network “preserve[s] its own verification and decisioning processes,” per the release — Visa, Mastercard and Ant are aligning the signals their systems exchange, not ceding control of risk decisions to a shared authority. The framework centers on three pillars:

• Cross-network operator traceability. Every agent must be linked to a validated operator — a cardholder, business or organization — so that attribution of agent activity is always possible. An anonymous agent is, by definition, an unbankable one.
• Shared certification requirements. Agents are assessed against common security and behavioral requirements to confirm they operate as expected, so certification earned against one network’s bar is meaningful to the others.
• Continuous transaction monitoring. Identity is not a one-time gate. Agents are evaluated on an ongoing basis using a combination of identity and transaction-related signals, supporting continuous re-assessment and, implicitly, revocation.

Crucially, the trio is not starting from a blank page. The framework builds on the Safeguards for Agentic Finance at Runtime (SAFR) framework, unveiled earlier by the Monetary Authority of Singapore, and the actual technical work will be advanced through BuildFin.ai, an industry platform convened by MAS that brings together financial institutions, technology providers and researchers in Singapore to develop responsible AI for financial services. In other words, the interoperability layer of global agentic commerce is being forged in a Singaporean regulator’s sandbox, not in a Silicon Valley boardroom.

What the executives said

The framing from each company tracked its commercial position. Rubail Birwadker, Visa’s Global Head of Growth Products and Strategic Partnerships, argued that “trust must scale” with agents as they become a bigger part of how people discover and buy, positioning Visa’s Trusted Agent Protocol as foundational infrastructure for the shift.

Mastercard Chief Digital Officer Pablo Fourez called interoperability across KYA frameworks “essential to making agentic commerce work at scale,” emphasizing that merchants, platforms, wallets and issuers need “a consistent way to recognise trusted agents, verify that actions reflect the user’s intent, and preserve accountability across the transaction.”

Jiang-Ming Yang, Chief Innovation Officer of Ant International, made the wallet-network case: interoperable KYA between card and wallet networks is “critical for securing trust” for payment partners and merchants, and pointed to a future of “richer signals — capabilities, behavior, execution performance, and risk data” feeding agent trust decisions.

The open questions

For all the coordination on principles, the announcement is short on governance specifics — and observers noted the gaps. There is no named governance body, no published technical specification, and no rollout timeline. The companies say they will “explore opportunities to work towards common principles,” language that leaves considerable distance between intention and enforced standard.

Consumer trust also remains the demand-side problem. Citing recent survey data, coverage of the announcement noted that only around 14% of consumers currently trust AI to complete purchases without verification. A shared trust layer may raise that number over time — or may become the compliance ceiling beneath which individual networks compete on risk appetite.

There is a strategic reading, too. Aligning on KYA erects a common entry barrier around the three incumbents’ rails: any agent that wants transacting rights at scale will need to pass a certification regime effectively co-designed by Visa, Mastercard and Ant. Rivalling card networks coordinating identity standards is the kind of behavior that antitrust watchers — particularly after this year’s heightened scrutiny of AI-adjacent deals — tend to examine closely.

Why it matters

Payments history rhymes: EMV standardized chip authentication, 3-D Secure standardized challenge flows, and each standardization unlocked a step-change in transaction volume across previously incompatible networks. KYA is the same play for autonomous buyers. If the three companies can turn today’s press release into shipped, enforceable specs, the practical effect is that an AI agent verified once can spend anywhere — and be revoked everywhere, which may prove the more consequential half of the bargain.

The work happens next in Singapore, under MAS’s BuildFin.ai umbrella, building on SAFR’s runtime safeguards. For banks, wallets and agent platforms, the message is to start treating agent identity as infrastructure — as load-bearing as a PAN or a device fingerprint — because the networks that move the world’s money have decided, together, that the next account holder walking through the door probably won’t be human.

Based on the joint Business Wire release, CNBC, TechNode Global, and McKinsey’s agentic commerce research, as of September 10, 2026.