Agentic Payments in October 2026: How Visa, Mastercard, Stripe and PayPal Let AI Agents Pay, and Who Carries the Risk

An agentic payment is a card payment an AI agent makes for a person. The person sets the instruction, the agent chooses and pays, and the merchant charges the card through its own acquirer as usual. Visa's rulebook has had a name for it since its October 2025 edition, the "Agentic Transaction". Mastercard, American Express, Stripe, PayPal and Adyen all run programmes for it.

On 22 October 2026 the plumbing is ahead of the traffic. The networks have published tokens, signatures and rules, but most live transactions so far were pilots or controlled tests, Stripe's pieces run on preview API versions, and a fraud vendor counted only "hundreds" of completed agent-initiated transactions worldwide by September. One dated change is close: for disputes processed on or after 24 October 2026, two days ahead, Visa widens its Compelling Evidence 3.0 remedy, with one clause about agents.

This article is for payments leads, CTOs and founders of merchants with their own checkout, and for platforms and PSPs. For which AI platforms sell what, start with our agentic commerce guide. Agents paying per request for APIs and content are a separate subject, covered in our x402 and machine payments article.

How an Agent Pays

Four mechanisms recur across the programmes, under different names.

Tokens Issued for Agents

The agent does not hold the card number. Visa's rules require an agent provider using a stored credential to "obtain a Token directly from Visa or an Agentic Payment Enabler". The provider hands the token to the merchant and "Is not involved in the Authorization or Clearing of Transactions, or Settlement of funds."

Mastercard Agent Pay is "a Remote Commerce Tokenization Program". Integrators register with Mastercard, most as Token Requestors, and use Agentic Tokens in one of two forms: Digital Secure Remote Payment (DSRP) data, or a Dynamic Token Verification Code (DTVC) for merchants that do not yet support DSRP.

Delegated Credentials

A delegated credential is a permission to charge, granted to one merchant with limits. Stripe's Shared Payment Token (SPT) is "a scoped grant to use the customer's payment method", which the agent grants to the seller's Stripe profile, "each with usage and expiration limits". PayPal's route into ChatGPT uses "Delegated payment tokens through Braintree". The protocols that carry these credentials are compared in our ACP, UCP and AP2 article.

Agent Signatures the Merchant Verifies

Tokens say how the agent pays; signatures say which agent is at the door. Visa's Trusted Agent Protocol (TAP), released on 14 October 2025 with Cloudflare, builds on HTTP Message Signatures (RFC 9421). It carries the agent's intent, consumer recognition (whether the shopper already has an account with the merchant) and, optionally, payment data. Visa's developer page puts the merchant's job in one line: "A merchant's primary task is to validate this signature." Visa's reference proxy parses the Signature-Input and Signature headers, fetches the key by keyId from an agent registry, and verifies Ed25519 or RSA-PSS-SHA256. Its example:

Signature-Input: sig2=("@authority" "@path"); created=1697123456; keyId="primary-ed25519"; alg="ed25519"

Mastercard's merchant guide uses the same base, with a tag of Agent-pay-auth, agent-browser-auth or agent-payer-auth and a Signature-Agent header pointing to https://agentpay-key-directory.mastercard.com/. Cloudflare lists the checks an edge makes for both: the key by keyid, the created and expires window, a fresh nonce, the tag (agent-browser-auth to browse, agent-payer-auth to pay), then the signature. Web Bot Auth itself is an IETF working-group draft, revision 00 of 1 September 2026, not an RFC.

Intent

The fourth piece is a record of what the person asked for. Visa's rules require the provider to state when the cardholder's instruction expires, obtain the acknowledgement "that they are responsible for actions taken by the Agentic Payment Provider", verify the cardholder's identity, and then "Use only the Cardholder-defined criteria". Mastercard says purchase intent data gives the merchant "an audit trail that may be used to help avoid and/or resolve potential cardholder disputes."

American Express published its Intent Intelligence framework on 13 October 2026. A Create Intent API captures the customer's limits, such as the merchant and a maximum budget, and returns an Intent ID and a Proof of Intent Token, which "can be used to obtain a secure digital payment credential that the agent uses at checkout instead of the customer's actual Card Number." How AP2 expresses the same idea as mandates is in our protocols comparison.

Visa: Intelligent Commerce, TAP and the Rules

Where It Is Live

Visa's Intelligent Commerce page says the product "is currently in the process of deployment". TAP has been on GitHub and the Visa Developer Center since 14 October 2025.

Visa Intelligent Commerce Connect, announced on 8 April 2026, lets merchants accept payments from agents using TAP, ACP, UCP and MPP (Stripe and Tempo's pay-per-request protocol), with Visa and non-Visa cards "Subject to availability". It is "Currently in pilot with select partners", and Visa gives no date for general availability.

In Europe, Visa said on 2 July 2026 that it was running live agent transactions with more than 30 issuers at merchants including lastminute.com and Frasers. Merchants joined through TAP and Visa's Agent Directory, and every transaction was secured with Visa Payment Passkeys. lastminute.com's chief executive called it "Early days".

What the Rules Say

The Visa Core Rules edition of 18 April 2026 was the latest public edition we found on 22 October 2026. Its agentic rules, most first published in October 2025, come down to this:

• Definitions. An Agentic Transaction is e-commerce "undertaken by an Agentic Payment Provider on behalf of a Cardholder", on the cardholder's instruction, with no direct interaction between cardholder and merchant, and completed by the merchant with its own acquirer. The provider is not a merchant, and "an Agentic Payment Provider is considered to be the Cardholder for an Agentic Transaction."
• The provider must enrol in Visa Intelligent Commerce, use Visa tokens for stored credentials, never transact card-present, and never combine purchases into one transaction (banned since 18 October 2025). It must get consent and verify identity, pass the merchant the cardholder's name, billing and shipping address and email, accept the merchant's refund and cancellation terms on the cardholder's behalf, and keep an order confirmation available for at least 120 days. Visa may disqualify it.
• The cardholder "is responsible for any actions taken by an Agentic Payment Provider as part of an Agentic Transaction as if the Cardholder initiated the Transaction."
• The merchant "must not require a Cardholder to waive the right to dispute a Transaction, including an Agentic Transaction, with the Issuer."
• The issuer must not decline agent transactions "in a systematic or wholesale manner" unless there is an immediate fraud threat or another exception applies, and must pay for "An Agentic Transaction processed in accordance with a Cardholder's payment instructions".

Compelling Evidence 3.0 From 24 October 2026

CE3.0 is Visa's defence against friendly fraud under Dispute Condition 10.4 (Other Fraud, Card-Absent Environment): earlier undisputed transactions by the same customer qualify the acquirer for liability protection. For disputes processed on or after 24 October 2026, two days ahead, Visa widens it "to further reduce friendly fraud".

The prior transactions no longer need "The same Payment Credential". The new condition is that "The same Card or a Payment Credential associated with that Card (for example: a Token) was used at one or more Merchants in 2 previous Transactions" not reported as fraud, processed more than 120 and no more than 365 days before the dispute. They must still match on the device ID or fingerprint, or the IP address, plus at least one more element, and device ID and fingerprint now count as one.

The agentic clause is in that list: the customer login ID now "includes login IDs for an Agentic Payment Provider and Merchant's e-commerce site or application", in clear text. Three cautions:

• It is optional. The rules say "An Acquirer may submit Compelling Evidence".
• It is not an agent rule. It is a general friendly-fraud change with one agent clause.
• The agent login ID is out of reach for now. The agent passes the merchant the cardholder's name, addresses and email, not its own login ID, and we found no Visa source on how a merchant would get one.

Stripe autofills CE3.0 evidence where a dispute is eligible. On 22 October its page still described the old criteria.

Mastercard Agent Pay

Mastercard's Agent Pay Acceptance Framework of 14 October 2025 "begins by registering and verifying AI agents before they are permitted to transact on the Mastercard network." Merchants verify agents with Web Bot Auth at the CDN, which Mastercard says needs no new code, and the agent submits a DTVC in the existing checkout form as "an agentic token formatted for standard card payment fields".

Mastercard's merchant guide advises "Use rate limiting instead of blanket bot blocking" and says the backend "optionally validates the hash but processes the checkout through existing flows". On risk it is direct: "Standard fraud detection, chargeback rights, and dispute resolution processes apply to agentic transactions." Its Level 2 page adds: never require consumers to waive dispute rights, and refund through the original tokenised payment method. The guide is undated, and its scheme-specific parts are "Subject to change".

Where it is live:

• United States. Mastercard said on 10 September 2025 that all US cardholders would be enabled "By the holiday season". We found no source confirming it happened.
• Europe. Santander's agent payment on 2 March 2026 ran "in a controlled environment" and "does not constitute a commercial rollout at this stage."
• Latin America. The transactions reported on 24 March 2026 were all "performed in controlled environments", though nearly 100% of the region's issuers are enabled for agentic tokens.

American Express

Amex's ACE Developer Kit, announced on 14 April 2026, is for "select developers", and two of its five services, Agent Registration and Cart Context, are "still under development", says its agentic commerce page.

Its Agent Purchase Protection is promised "In the future". It would cover "charges related to AI agent error" where the purchase "deviates from the Card Member-authenticated purchase intent", for US credit cards, through agents registered with Amex and integrated with the kit, and "only after the Card Member has initiated a return (where possible) with the merchant". Subjective intent ("best", "really nice") may not qualify, and "Full terms and conditions will be made available in the future."

Stripe, PayPal, Adyen, Checkout.com and Worldpay

Stripe

Stripe's Agentic Commerce Suite, launched on 11 December 2025, and its SPTs are available in the US, Canada and 32 European countries and territories, on preview API versions such as 2026-09-30.preview.

• Stripe-managed checkout. Stripe shares your catalogue with agents, runs checkout with tax and shipping, charges the SPT and sends checkout.session.completed. You still supply terms, privacy and return policies, a tax code per taxable product ("incomplete configuration can cause checkouts to fail"), a CSV catalogue with current inventory, fulfilment on the webhook, and a connection request to each agent. An optional order approval hook gets four seconds: "If your hook doesn't respond within this time, Stripe declines the payment."
• Your UCP checkout, Stripe for payment. Declare com.stripe.payments in your UCP profile, take the SPT from the /checkout-sessions/{id}/complete request, and charge it by passing it in payment_method_data[shared_payment_granted_token] on a PaymentIntent.
• Another processor. The SPT Resolve API returns network credentials once per token. Without your PCI Attestation of Compliance on file, Stripe encrypts them "with a public key whose corresponding private key you can't access", such as your processor's, and you record the payment with POST /v1/payment_records/report_payment.

On 3 March 2026 Stripe extended SPTs to Mastercard Agent Pay and Visa Intelligent Commerce tokens, Klarna and Affirm: "Any seller already processing payments with Stripe automatically supports these new payment methods for agentic transactions." Refunds use the existing flow.

PayPal

PayPal announced Agent Ready on 28 October 2025 for existing merchants, "with no additional technical lift", due in early 2026. In January 2026 it was live on Copilot and Perplexity, with ChatGPT, Gemini and AI Mode "coming soon". Its documentation now describes ACP for ChatGPT through Braintree delegated tokens, and UCP for Google AI Mode and Gemini through a Google Pay handler, via Braintree or PayPal's Orders v2 API. The Braintree UCP route needs Google Pay and "UCP merchant registration with Google". Access is not self-serve: merchants "must complete this form" to request it.

Adyen, Checkout.com and Worldpay

Adyen Agentic, announced on 16 June 2026, is "in limited availability for enterprise merchants operating in the U.S." Checkout.com (25 November 2025) and Worldpay (29 October 2025) announced ACP support for ChatGPT's Instant Checkout, and Worldpay announced UCP work with Google on 28 January 2026. OpenAI has since stepped back from Instant Checkout so that merchants can "use their own checkout experiences", so read those ACP releases with their dates in mind.

Who Carries the Risk

Side by side, the sources leave the risk roughly where it sat before agents.

There is no agent dispute reason: the dispute chapter of the April 2026 Visa Rules mentions agents only in the two CE3.0 login-ID lines, so agent purchases are disputed under the ordinary conditions. "My agent did it" is not, on its own, a fraud claim under Visa's rules, because the cardholder answers for the agent. That does not make the merchant safe: the cardholder keeps the right to dispute, and the merchant may not ask for it to be waived.

No network rule we found moves liability to the agent platform. Checkout.com wrote in December 2025 that with clear evidence of delegation "responsibility may shift upstream", which is a PSP's opinion. A Forrester survey found consumers expect the AI platform to answer for an agent's mistakes, which is an expectation, not a rule.

The Law: EU, UK and US

European Union

The Payment Services Regulation (PSR), negotiated with PSD3, reached provisional agreement on 27 November 2025, confirmed by Coreper on 22 April 2026, according to a Council note of 2 October 2026. It is not adopted: Parliament's procedure file shows "Awaiting Council's 1st reading position", with a plenary indicated for 14 December 2026. The agreed text applies 21 months after entry into force, so not before 2028 in practice.

Its Article 85 requires strong customer authentication for remote payment orders, linked "to a specific amount and a specific payee", and for "ordering the creation or replacement of a tokenised payment instrument via a remote channel". Merchant-initiated transactions need it when the mandate is set up, not for each later payment. The texts never mention AI agents: "artificial intelligence" appears once, in a recital on fraud monitoring, and every "agent" is a payment institution's agent. How Article 85 treats an AI agent holding a token is a matter of interpretation.

United Kingdom

HM Treasury's consultation closed on 6 October 2026. It says the current regulations "were designed before the development of AI and may not fully facilitate the use of agentic AI", and asks whether the rules on authentication, consent and liability for unauthorised payments need updating for agentic payments. We found no published response by 22 October. On 19 October the FCA's Jessica Rusu said the FCA will develop "a trusted framework for agentic finance", with no date attached.

United States

We found no CFPB guidance. A January 2026 paper from the Consumer Bankers Association, a bank trade body, says regulators "have not issued specific guidance", and calls it "at best, unclear" whether authorising an agent amounts to "actual, implied, or apparent authority to use" a credit card under Regulation Z.

How Much Is Actually Happening

• Merchant Risk Council. The MRC's 2026 report, co-sponsored by Visa Acceptance Solutions and Verifi, surveyed 1,278 merchant professionals in 37 countries in November and December 2025. Of those, 19% said they are set up to accept agentic AI payments and 15% have no plans. Among the MRC's own members, 46% have no plans.
• PYMNTS. A report commissioned by Visa Acceptance Solutions found that 23% of merchants in the US, Brazil and the UAE can clearly identify AI-driven traffic and purchases.
• Accertify. The fraud vendor counted "hundreds of completed agent-initiated transactions globally" as of September 2026, "well under 1%" of transactions and "measured in basis points".
• Consumers. In Forrester's April 2026 survey of online adults in the US, UK and Canada, three-quarters said they were uncomfortable letting an agent pay on its own, even with spending limits.

"Set up to accept" is self-reported readiness, not volume. And Visa co-sponsored one merchant survey and commissioned the other.

What a Merchant With Its Own Checkout Should Do Now

Nothing here has a deadline: we found no Visa or Mastercard date by which a merchant must adopt TAP, Agent Pay or Web Bot Auth. The work is about not losing the orders agents bring, and keeping the evidence to defend them.

1. Stop blocking the agents you want. Review CAPTCHAs and blanket bot rules on product and checkout pages. Cloudflare blocks bots it classifies as Agent on pages that show ads, by default for domains onboarded since 15 September 2026; check what your edge does.
2. Accept agent tokens in your normal flow. A DTVC arrives in the card fields you already have. Ask your acquirer or PSP whether agentic tokens and agent identifiers already reach your authorisations.
3. Decide where signatures are verified. Akamai's edge validates Web Bot Auth signatures, and Akamai has announced TAP support with Visa. Cloudflare announced managed rules for TAP and Agent Pay in October 2025; we found none shipped, so ask your provider. On your own edge, Visa's reference proxy shows what to build.
4. Pick a protocol path only when a programme calls you. Stripe for payment behind your UCP checkout; PayPal and Braintree for ACP or UCP, by request; or SPT Resolve to your own processor, with your PCI Attestation of Compliance lodged with Stripe first.
5. Keep refunds and disputes as they are. Refund agent orders to the original payment method, and make sure nothing in your terms asks the cardholder to waive dispute rights.
6. Log what CE3.0 would need. Per order: IP address, device ID or fingerprint, customer login ID, delivery address, a description of the goods, and any agent signature result and intent data you received. CE3.0 is optional, but evidence you never kept cannot be submitted.
7. Brief fraud and support teams. The agent passes on the cardholder's name, addresses and email with each order.

Worth watching: Visa's October 2026 rules edition, Intelligent Commerce Connect leaving its pilot, Amex's full protection terms, Cloudflare's managed rules, the EU plenary in December and HM Treasury's response.

Where to Get Help

We build the merchant side of agentic payments for checkouts not on a hosted platform: agent signature verification at the edge or in the application, SPT and UCP payment integrations with Stripe or PayPal, per-order logging that keeps CE3.0 evidence, and bot rules that let registered agents through. Our AI agent development and MCP integration service is where that work starts. We are engineers, not lawyers: for your terms, your dispute policy and what the PSR will mean for you, bring in a payments lawyer in each market you sell to, and we build to their answer.

Write to office@c9group.dev with your checkout stack, your PSP and acquirer, your CDN and the countries you sell in, and we will tell you which of these programmes reach you today and what accepting them would take.