The three payment giants are building a common trust layer for AI agents — and they say $3 to $5 trillion in commerce depends on getting it right.
When you ask an AI assistant to book a flight, order groceries, or renew a software subscription, you are not really shopping anymore. Your AI agent is. And until this week, the global payments industry had no agreed standard for how to verify, trust, or authenticate those agents when they reach for your credit card.
That gap just got a lot narrower. On September 10, 2026, Ant International, Mastercard, and Visa announced they are collaborating on a Know-Your-Agent (KYA) interoperability framework — a shared set of principles and technical signals designed to let card networks, digital wallets, agent platforms, and merchants recognize trusted AI shoppers across competing ecosystems. The announcement, timed to the World FinTech Festival in Singapore, represents the first time the three dominant global payment networks have aligned on a common approach to agentic commerce.
Why KYA, and Why Now
The timing is not accidental. By most industry projections, AI agents will orchestrate somewhere between $3 trillion and $5 trillion of global consumer commerce by 2030. That figure, which the three companies cited in their joint announcement, encompasses everything from autonomous procurement bots making B2B purchases to personal AI assistants that manage household budgets and execute transactions without human intervention at the point of sale.
The promise is enormous: agents that never forget to renew a subscription, never miss a better price on a repeat order, and can execute complex multi-step purchases — booking a hotel, a rental car, and airport parking in a single conversational turn — faster and more reliably than any human. But the threat surface is equally large. An AI agent that can spend money is also an AI agent that can be hijacked, impersonated, or manipulated into authorizing fraudulent transactions at machine speed.
Traditional fraud detection was built to flag unusual human behavior. An AI agent shopping 24 hours a day, across 17 jurisdictions, placing 400 orders in a single session is not behaving unusually for a legitimate enterprise procurement bot — it just looks exactly like a compromised account on existing systems. The payments industry needed new vocabulary, and new signals, to tell the two apart.
Three Protocols, One Framework
The technical challenge is that the three companies each already had their own answer to this problem — and those answers were incompatible.
Visa developed its Trusted Agent Protocol (TAP), a set of cryptographic attestations that let merchants verify an AI agent’s identity and the scope of permissions its human principal has granted. Mastercard built Verifiable Intent, a system that encodes the human-authorized purpose of a transaction into the payment request itself, so that a downstream network can confirm an agent is acting within sanctioned boundaries. Ant International, whose Alipay platform handles a significant share of consumer payments across Asia, designed the Agentic Mobile Protocol (AMP), optimized for mobile-first markets and wallet-centric architectures that often bypass card rails entirely.
What the KYA framework attempts to do is not replace any of these systems. Instead, it defines a layer of shared signals — a common trust vocabulary — that allows each network to recognize attestations generated by the others. A merchant accepting Visa TAP attestations should be able to recognize and honor a Mastercard Verifiable Intent signal without requiring the agent platform to implement all three protocols separately. Integration complexity decreases; time-to-market for new agentic services falls; and the duplicative agent identity verification that currently forces developers to build three different compliance integrations collapses into one.
What Gets Solved — and What Doesn’t
The KYA framework addresses several concrete problems that have been quietly paralyzing enterprise adoption of agentic commerce.
First, agent identity. Under current card network rules, the entity in a transaction is a human cardholder or a merchant. An AI agent acting on a user’s behalf exists in a regulatory gray zone. KYA gives agents a formal identity layer — verifiable credentials that say “this agent is authorized by this account holder to spend up to this amount on these categories of goods.”
Second, scope enforcement. One of the most common enterprise objections to deploying purchasing agents is the fear of runaway spending or unauthorized categories. KYA’s shared signals allow merchants and networks to verify in real-time that an agent’s purchase falls within the scope its principal originally authorized, without requiring a phone call back to the human every time.
Third, liability clarity. When a fraudulent transaction is made by a compromised AI agent, existing chargeback rules do not clearly assign liability. The KYA framework is expected to provide the audit trail — cryptographically signed by the agent at the point of purchase — that will let arbitration proceed on clear evidentiary grounds.
What KYA does not yet solve is equally important to acknowledge. The announcement describes a framework under development, not a deployed technical standard. The three companies did not provide an implementation timetable, pilot transaction volumes, or a list of merchants and financial institutions that will participate in early testing. Getting from shared principles to actual interoperable code running across Visa’s, Mastercard’s, and Alipay’s production systems is a multi-year engineering and legal undertaking.
There is also the question of who is left out. KYA currently encompasses three networks, which between them cover a large share of global card volume but leave out significant players — PayPal, UnionPay, American Express, and the growing universe of stablecoin-based payment rails that agentic platforms are increasingly exploring as an alternative to traditional card networks.
The Stakes for AI Platform Developers
For the developers building the AI agents that will eventually use these rails, the KYA announcement is both a relief and a call to action.
It is a relief because the alternative — three separate compliance integrations, each with its own legal agreements, technical specifications, and liability regimes — was threatening to make agentic commerce a feature available only to enterprises large enough to absorb the integration cost. A common framework dramatically lowers the barrier for startups and mid-market companies to deploy purchasing agents that can actually complete transactions.
It is a call to action because the framework will almost certainly require agent platforms to implement new cryptographic signing infrastructure, store and transmit agent identity credentials, and maintain audit logs in formats the card networks can interpret. Companies that start building toward these requirements now — before the technical specification is finalized — will be far better positioned than those that wait for a published standard to begin integration.
The broader lesson is one the payments industry has learned before, from EMV chip cards to 3D Secure to open banking: trust standards that arrive after fraud has scaled are expensive. Trust standards that arrive before widespread adoption shape the market. KYA is, at least in intent, an attempt to be early.
A New Category of Financial Infrastructure
What Visa, Mastercard, and Ant International have announced is not, in itself, a product. It is infrastructure — the invisible plumbing that makes other products possible. The companies most immediately affected are not consumers but the agent platform providers, enterprise software vendors, and fintech startups that are right now deciding how to architect the payment capabilities of their AI products.
The KYA framework, if it delivers on its promise, would make AI agents first-class participants in global commerce — entities with verified identities, scoped permissions, and auditable transaction histories, rather than legal fictions transacting through borrowed human credentials. That is a genuinely meaningful shift in how the financial system understands the concept of a buyer.
Whether the three companies can translate a Singapore conference announcement into deployed, interoperable infrastructure — and whether the rest of the payments ecosystem will align rather than fragment — are the questions that will determine whether KYA becomes the foundation of agentic commerce or a footnote in the history of standards that almost happened.
For now, the payments industry has at least agreed on what the problem is. That, in a sector notorious for slow consensus, is not nothing.
