Visa, Mastercard, and Ant International agree to make their competing AI-agent 'trust' systems talk to each other -- but two bigger agent-payment protocols still don't

Visa, Mastercard, and Ant International announced on September 9 that they'll work to make their three separate AI-agent trust systems interoperable -- a Know-Your-Agent (KYA) framework meant to let a card network, wallet, or agent platform recognize and verify a shopping agent no matter which company's protocol it originally certified against. Until now each ran its own closed system: Visa's Trusted Agent Protocol, Mastercard's Verifiable Intent, and Ant's Agentic Mobile Protocol.

That fragmentation was a real cost, not just an inconvenience: an agent capable of shopping across multiple networks would otherwise have needed separate certification with each one, duplicating the same security and identity checks three times over -- a tax on exactly the kind of cross-network agent the $3-5 trillion projection below assumes will exist by 2030. A wallet or merchant integrating all three protocols separately also had to maintain three different definitions of what a "trusted agent" even is, with no guarantee the definitions agreed.

The mechanics, per that announcement, run through three pillars: operator traceability (every agent is linked back to a validated operator, cardholder, or business, so its activity can be attributed to a real party), shared certification requirements (a common security-and-behavior bar an agent has to clear across all three networks), and continuous transaction monitoring (ongoing checks using identity and risk signals, not just a one-time credential).

Each company frames the deal around the same anxiety: an agent making purchases has to be trusted by systems it never directly deals with. "As AI agents become a bigger part of how people discover and buy, trust must scale with them," said Rubail Birwadker, Visa's global head of growth products. Mastercard's chief digital officer, Pablo Fourez, put the stakes more bluntly: interoperability across KYA frameworks, he said, is essential to making agentic commerce work at scale -- an admission that none of the three protocols was going to get there alone.

That scale is real money, at least on paper. McKinsey has projected AI agents could orchestrate $3 trillion to $5 trillion of global consumer commerce by 2030 -- the figure the three companies cite to describe the market they're building toward. Separate PYMNTS Intelligence research from March found nearly 90% of enterprises already call bot management a major challenge, and put the annual cost of outdated digital-identity controls -- fraud, false declines, lost customers -- at roughly $100 billion. None of those three numbers describes AI agents specifically; the ledger below states what each one actually covers.

It's also worth being skeptical of what "aligning" three protocols actually commits anyone to on day one. Each network still owns its own certification bar -- Visa still decides what clears Trusted Agent Protocol, Mastercard still decides what clears Verifiable Intent -- and Tuesday's announcement describes shared principles the three will build toward, not a single unified spec replacing all three today. The gap between announcing an alignment effort and a merchant actually being able to accept one credential across all three networks is exactly the gap BuildFin.ai is supposed to close, and it hasn't closed it yet.

What KYA doesn't do is touch the other half of an agentic purchase: actually checking out and proving a payment was authorized. Two other protocols already handle that layer, with real deployments behind them. Google's Agent Payments Protocol (AP2) -- built with more than 60 partners, including Mastercard itself -- issues a cryptographically signed "mandate" as proof a user actually authorized a purchase. OpenAI and Stripe's Agentic Commerce Protocol (ACP), an Apache-licensed spec first released in September 2025, standardizes the actual agent-to-merchant checkout conversation and powered ChatGPT's Instant Checkout with Etsy sellers starting in February 2026. The two are built to work together, not compete -- and neither is part of this announcement. (Mastercard is a listed partner in both this KYA effort and Google's separate AP2 layer -- payment networks appear to be hedging across every agent-trust effort at once, not betting on one.)

“We look forward to expanding collaboration as the industry draws on richer signals -- capabilities, behavior, execution performance and risk data -- to enhance trust.” — Jiang-Ming Yang, Ant International Chief Innovation Officer

The three companies say the collaboration advances next through BuildFin.ai, an industry platform in Singapore convened by the Monetary Authority of Singapore. No technical specification, timeline, or pilot has been named yet. An interoperability framework between three trust systems is real progress over three closed ones; it is not yet the same thing as an agent actually clearing one credential check and being trusted everywhere. Whether that timeline is fast or slow depends on a comparison this announcement doesn't invite but the reader should make anyway: ACP went from its September 2025 release to a live checkout deployment with real merchants in about five months. KYA's own three companies have not yet said when -- or whether -- the same pace applies here.