Visa, Mastercard and Ant agreed on a Know Your Agent framework

The card networks just decided that AI agents need passports. They also decided who issues them.

Visa, Mastercard, and Ant International announced a joint Know Your Agent framework in mid-September 2026. The goal is one way to onboard and identify an AI agent across networks.

The name is deliberate. Know Your Customer built the rules for human account holders, and this copies the shape.

The question it answers is narrow. Before a payment settles, is this agent registered and accountable, or an anonymous bot?

The three firms put a number on the prize. They cite projections of $3 trillion to $5 trillion in agent-orchestrated consumer commerce.

That is the 2030 figure. Treat it as ambition, not data.

All three already run their own protocols. This initiative is about making the signals readable across them.

Ant International's Chief Innovation Officer Jiang-Ming Yang described the next step. Richer signals, meaning capabilities, behavior, execution performance, and risk data.

Read that list again. It is a credit file for software.

The pitch is less friction. One verification instead of three, lower integration cost, faster launch for new agent services.

The implied claim is bigger. Agents become a recognized class of market participant with a standing identity.

Pieces of this are shipped and running.

Visa built its Trusted Agent Protocol with Cloudflare, sitting at the web request layer. Cloudflare announced that work with Visa, Mastercard, and American Express in October 2025.

Mastercard launched Agent Pay on April 29, 2025. Microsoft, IBM, and Braintree were the initial partners.

That product ran a pilot with Citi and US Bank from September 2025. Those are real issuers, not a demo.

Now the discount. This month's announcement is a framework, not a shipped credential.

No live cross-network agent passport exists. Each firm still runs its own stack.

Nobody has published the numbers that would matter either. No rejection rate, no fraud loss avoided, no volume settled under a verified agent identity.

The mandate is human. A person still sets the scope, the spending limit, and the duration.

Dispute resolution is human too. A chargeback lands on an account with a name on it.

Then the unanswered question. Who pays when a properly credentialed agent buys the wrong thing?

Identity is not authority, and authority is not liability. The networks solved the first and skipped the third.

The security layer says the same thing from another angle. A report this month counted 17,800 public AI add-ons across 6.7 million installations.

They pull instructions from unverified outside sources. Some impersonated major AI labs and could run arbitrary code.

CrowdStrike responded with Falcon Guardian. It finds and blocks unapproved agents on company machines.

That is the state of play. Verify the agent at checkout, and the agent itself may be running someone else's instructions.

Start with the obvious pool. Card networks earn on being the trusted middle of every transaction.

Agentic commerce threatens that seat directly. An agent does not need a card to pay another agent.

So the networks are building the registry. Whoever runs the registry runs the toll booth.

That is the strategy in one line. Not defending the card, defending the position.

Now look at the competition. Coinbase's x402 protocol has handled more than 165 million payments worth about $50 million.

Roughly 99% of those settled in USDC. No card network appears anywhere in that chain.

Average payment size is about 30 cents. Interchange economics do not work at that size, which is exactly why the rails diverged.

Then the issuing banks. They must wire agent token architecture into their own authorization systems.

That is a build, not a purchase. Every issuer now has an agent project it did not plan for.

Then the fraud vendors. Forter and HUMAN Security consume these signals today, and a new layer is forming beneath them.

Agent identity as a checkout requirement: two to three years. Three of the largest networks agreeing is what makes that fast.

A credential that travels everywhere: much longer. Networks earn on not being interchangeable, so full portability fights their own economics.

Liability rules: slower still, and they are the binding constraint. Nobody hands an agent an open-ended spending mandate yet.

That waits on a court ruling or a network rule. Until then, scope stays narrow by design.

The rulebook is not aligned either. Treasury's GENIUS Act proposal in August put self-custodial software outside the licensed perimeter.

An agent with its own wallet has no intermediary to license. The registry answer and the statute answer point in opposite directions.

Watch for the first published loss number. A network disclosing agent fraud losses is when this stops being a standards story.

Watch the merchant side too. When a large retailer refuses unverified agents, the registry has teeth.

Territory: +machines on transacting, +incumbents on the gate.

Agents gain a standing identity to spend with, while the networks own the registry that grants it.