Visa, Mastercard and Ant International Join Forces on AI Agent Security Standards

Visa, Mastercard and Ant International announced on September 9, 2026 that they are jointly developing an interoperable verification standard for AI-powered shopping agents. The world's three largest payment networks want an AI agent verified within one system to be automatically recognized and trusted across the others, rather than undergoing separate certification with each network individually.

A Shared KYA Standard

The framework, called Know-Your-Agent, is meant to work much like the Know-Your-Customer procedures familiar from banking, except instead of verifying a customer's identity, it verifies the identity and permissions of the AI agent making the transaction. Each agent will be tied to a verified operator, letting payment networks trace who actually stands behind a given AI-initiated transaction.

Until now, each of the three companies had been developing its own, incompatible solution. Visa has its Trusted Agent Protocol, Mastercard is building Verifiable Intent, and Ant International, the Chinese fintech group behind Alipay, has rolled out its Agentic Mobile Protocol. The lack of a shared standard meant AI agent developers would have to integrate separately with each of these systems, raising costs and slowing deployment.

The Scale of Agentic Commerce

The scale at stake is significant. The companies cite McKinsey forecasts projecting that by 2030, AI agents could independently orchestrate between $3 trillion and $5 trillion worth of transactions in global consumer commerce. That means an increasing share of purchases, from subscriptions to travel bookings, will be initiated not by a person tapping an app but by an autonomous assistant acting on their behalf.

The collaboration takes place under BuildFin.ai, an initiative convened by the Monetary Authority of Singapore that brings together financial institutions, technology companies and researchers working on AI applications in financial services. The three companies are folding their work into Singapore's broader SAFR strategy, short for Safeguards for Agentic Finance at Runtime, aimed at ensuring the safe and scalable growth of agent-driven commerce.

Three Pillars of Security

The initiative rests on three mechanisms. The first is cross-network operator traceability, linking each agent to a specific, verified entity responsible for its actions. The second is shared certification requirements, under which agents are assessed for safety and behavior before being allowed to execute transactions. The third is continuous transaction monitoring, combining agent identity signals with real-time analysis of the payments themselves.

According to the companies, this model should curb duplicate verification, where the same agent would otherwise have to pass nearly identical certification separately with each payment partner. That is meant to lower integration costs for companies building services around shopping agents and speed up the rollout of new solutions on the market.

As AI agents become a larger part of how people discover and buy products, trust has to scale right along with them - Rubail Birwadker, Head of Growth and Strategic Partnerships, Visa

Interoperability between Know-Your-Agent frameworks is essential for agentic commerce to operate at scale - Pablo Fourez, Chief Digital Officer, Mastercard

Implications for the Polish Market

For Polish banks, fintechs and online retailers, the announcement means the rules of the game for AI agent-initiated payments are beginning to take shape at a global level before such transactions even become common in Poland. Businesses accepting Visa and Mastercard payments will, in practice, be subject to standards worked out in Singapore, regardless of whether they are doing any work themselves on their own shopping agents.

It is also a signal to Polish developers of payment tools and commerce-focused AI agents that integrating with just one of the three protocols may eventually be enough to serve all the networks at once, instead of requiring separate deployments for each. Lower integration costs could speed up the arrival of such services in smaller markets too, including Poland.

The companies have not yet given a timeline for rolling out the shared framework, nor named further partners who might join it. Earlier reports indicate that a broader group of more than a dozen companies is already working on standardizing authorization and risk management in agentic commerce, suggesting the Visa, Mastercard and Ant International initiative may only be a first step toward an industry-wide consensus.