What Banks Need for Agent-Initiated Payments

In late 2025, Visa released the Trusted Agent Protocol. The open framework helps merchants distinguish bots from authorized artificial intelligence (AI) agents. Google launched AP2 with more than 60 partners, including PayPal, Coinbase, and Mastercard. Mastercard launched Agent Pay with Microsoft and IBM.

These protocols support real transactions. Visa expects millions of consumers to use AI agents for purchases during the 2026 holiday season.

At Visa, I helped design the tokenization infrastructure behind Apple Pay, Android Pay, and Samsung Pay. The Visa Token Service application programming interface (API) provides part of the identity and token layer. Agent protocols extend that model. An authorized agent, rather than a person using a phone, can now start the transaction.

Many banks do not have controls for agent-initiated transactions. Their fraud systems use human behavior patterns. Their compliance processes assume that a person starts each transaction. Their vendor contracts often do not assign liability for agent actions.

Banks can prepare before regulators issue specific guidance. They can define agent identity, transaction authority, liability, monitoring, and audit requirements now. This work will reduce delays when transaction volumes increase.

We built KnowYourAgent to apply explicit identity controls to AI agents. Know Your Customer (KYC) controls establish human identity. Financial institutions need an equivalent control model for agents. That model must connect each agent to its owner, authority, credentials, and transaction history.