Visa and Mastercard Just Made AI Agents a Card-Network Problem — and Stripe and PayPal Are Already Inside the Tent

The narrative that Visa and Mastercard plus Ant International form a 'consortium' overstates the formal coordination, but understates the functional alignment. Three distinct moves since September 2025 have created a shared trust framework anyway — and Antom sits at the intersection of all three.

Three technical requirements show up across every framework, and they are not interchangeable marketing language. They are concrete engineering obligations that any agent, merchant, or processor has to implement to participate.

Visa's Trusted Agent Protocol, launched October 14, 2025, was the first to publish a working implementation: agents must register a public key in Visa's parallel Agent Pay framework, formalized in Agent Pay for Machines on June 10, 2026, leans on its 'Verifiable Intent' co-developed with Google and adds guaranteed settlement across cards, accounts, and stablecoins. Cloudflare has shipped reference validators so merchants can accept either network's signed-agent traffic while keeping bot/WAF rules in place.

EMVCo's September 4, 2026 draft goes one step further. Its 'Intent Services' concept is a shared coordination layer where any participant — issuer, network, merchant, or wallet — can register, retrieve, and update the consumer's authorized intent over the lifetime of an agent action. That is structurally new: it converts intent from a one-time signature into a stateful object, which Ant International had already previewed through its own Agent Trust Rating mechanism in the Agentic Mobile Protocol open-sourced April 27, 2026.

The most common misreading of the Visa/Mastercard moves is that they will 'disintermediate' Stripe and PayPal. The opposite is happening: both processors are listed as launch partners on the network protocols themselves, and Stripe's co-developed Agentic Commerce Protocol with OpenAI for ChatGPT Instant Checkout (Sept 29, 2025) is designed to interoperate with Visa is named on Google's Agent Payments Protocol (AP2) alongside Mastercard, American Express, Ant International, and Coinbase.

For Stripe — a private company that processed $1.9 trillion of payment volume in 2025 (up 34% YoY, roughly 1.6% of global GDP) and tendered at a $159 billion valuation in February 2026 — the asymmetry is sharper. Its December 2025 Agentic Commerce Suite, its OpenAI partnership, and its August 2026 acquisition of OpenRouter for ~$8 billion are all defensive moves to keep Stripe as the connective tissue between agents and merchants. But every layer above settlement — agent registration, intent verification, KYA, dispute rules — is being defined by the networks, not by Stripe.

Visa's October 14, 2025 Trusted Agent Protocol release opened with a striking number from Adobe Digital Insights: AI-driven traffic to US retail websites had surged 4,700% year-on-year by July 2025. That figure is the underlying catalyst for the network race — and it explains why the urgency is asymmetric across the value chain.

The traffic data puts a deadline on the network move. Merchants cannot distinguish legitimate AI shopping agents from scrapers and credential-stuffing bots at scale — Visa reported on December 18, 2025 that it had completed 'hundreds' of secure agent-initiated transactions with 100+ partners and forecast millions of consumers using AI agents for purchases by the 2026 holiday season. The merchant stack needs to whitelist a registered agent before the holiday volume arrives; whoever owns that whitelist becomes the gatekeeper.

Network payment economics are built on a specific structure: take rate on authorization, plus value-added services layered on top. The agentic trust layer adds three new surfaces where networks can monetize: agent directory registration, signed-intent verification, and dispute resolution for ambiguous agent actions.

Below the networks sit the issuers and acquirers — Fiserv, Block, and Shift4 on the acquiring side; bank issuers on the issuing side. Fiserv's presence in the Agentic Payments Alliance and its Mastercard agent-pay partnership give it an early integration path; Block (formerly Square) is notably absent from the launch partner lists for both Visa TAP and Mastercard Agent Pay, leaving its Cash App and Square seller flows exposed to being wrapped by someone else's trust layer. Cloudflare's role is distinct — it sells the validator and managed-ruleset plumbing that merchants use to accept or reject signed-agent traffic, so it gets paid regardless of which network wins the directory race.

Two calendar events bracket the trade. The short-term clock is the 2026 holiday season — Visa has publicly committed to millions of consumers using AI agents for purchases, Mastercard's Agent Pay for Machines is built for continuous high-frequency transactions, and PayPal's Agent Ready (June 2026) is specifically a Braintree-side launch. The Sept 30, 2026 EMVCo comment window is the proximate catalyst that turns draft framework into ratified standard.

The long-term frame is the McKinsey $3–5 trillion global agentic commerce estimate by 2030, with US B2C retail alone at up to $1 trillion. Even a conservative read — Ant International's own $28 billion forecast with46% CAGR — implies take-rate revenue that flows disproportionately to the entity owning authentication. At a blended 0.3% incremental take rate on a $1 trillion US retail agentic flow, the trust layer alone is a $3 billion annual revenue pool that did not exist twelve months ago.