How do Visa and Mastercard agent payments work?
Visa's Trusted Agent Protocol and Mastercard Agent Pay let a registered AI agent prove who it is by signing its requests, then pay with a card token issued for that agent. They sit underneath checkout protocols like UCP and ACP. ARC can't see adoption from outside, so it labels them not measured.
Plain-language explainer
These are payment-network programmes. A registered agent signs its HTTP requests so a merchant or its CDN can tell it apart from an unknown bot. It then pays with a card token minted for that agent. Visa publishes the Trusted Agent Protocol. Mastercard publishes Agent Pay. Both sit on Web Bot Auth and HTTP message signatures (RFC 9421).
How signing and tokens work
The agent signs the request. The merchant's edge checks the signature. The charge uses a network token for the agent, not the shopper's raw card number pasted into a form. ARC is not a registered agent, so this description is the vendors' account of the design.
Where they sit vs UCP and ACP
UCP and ACP are how an agent and a store agree a checkout. Visa and Mastercard are how a recognised agent can pay. They do not replace the checkout protocols.
Why adoption can't be seen from outside
ARC open dataset snapshot 2026-10-12
Declared: Not measuredNot measuredNot visible from outside
Valid: Not measuredNot measuredNot visible from outside
Usable: Not measuredNot measuredNot visible from outside
Transacts: Not measuredNot measuredNot visible from outside
Signature checks happen when a registered agent visits. ARC cannot see that from the outside. Not measured is not zero, and it is not a mark against any store.
What merchants should ask their payment provider
Do you verify signed agent requests? Which programmes do you recognise? Does that require a CDN setting? Those answers belong to the provider.
Frequently asked questions
- How do Visa and Mastercard agent payments work?
- Visa's Trusted Agent Protocol and Mastercard Agent Pay let a registered AI agent prove who it is by signing its requests, then pay with a card token issued for that agent. They sit underneath checkout protocols like UCP and ACP. ARC can't see adoption from outside, so it labels them not measured.
- Do I need to do anything as a merchant?
- Ask your payment provider and CDN. Signatures are checked on their side.
- Can ARC tell if a store accepts agent payments?
- No. ARC labels this not measured because it can't be seen from outside.
- Do these replace UCP or ACP?
- No, they sit underneath them.
On ARC
Cite this: ARC, arcreport.ai, accessed 2026-10-13, CC-BY-4.0. Protocol figures: ARC open dataset snapshot 2026-10-12 (12 October 2026). Index browser figures: ARC open dataset snapshot 2026-10-12. Platform figures: ARC saved checks, accessed 2026-10-13.
Every figure is labelled Measured, Inferred or Not measured. Not measured is not zero. A missing result is not a mark against a store. ARC stops before payment.