Visa Intelligent Commerce is a Visa program that lets artificial intelligence (AI) agents search for, choose and pay for goods on behalf of a cardholder using Visa credentials. Announced on 30 April 2025, it gives the builders of AI shopping assistants a set of interfaces for agent-specific tokens, passkey authentication, spending instructions and transaction data, so that a purchase made by software can be recognised, limited and disputed much like any other card payment.
The program is Visa's answer to the rise of agentic commerce. It is not a new card, a wallet or a chatbot. It is the network-side layer that sits under agent checkout protocols such as the Agentic Commerce Protocol (ACP) and the Agent Payments Protocol (AP2). Its closest rival is Mastercard Agent Pay, announced one day earlier.
Visa Intelligent Commerce in plain terms
Imagine sending a trusted errand-runner to the shops. You would not hand over your whole wallet. You would rather give them a voucher with your name on it, a spending cap, a list of what you want and a date after which it stops working. If the runner buys the wrong thing, the shop and your bank can both see that the voucher was used by the runner, not by you.
Visa Intelligent Commerce turns that voucher into software. The card stays in the bank's systems; the AI assistant receives a stand-in credential tied to it. Before the assistant buys anything, you approve what it may do with a fingerprint or face scan on your phone. Each purchase then carries a fresh code that only works once, and the result is reported back so that everyone in the chain can match the payment to what you asked for.
History
Visa unveiled the program at its Global Product Drop event, naming Anthropic, IBM, Microsoft, Mistral AI, OpenAI, Perplexity, Samsung and Stripe among the AI and technology companies it was working with. In September 2025 it added a Model Context Protocol server so that developers could connect agents directly to the program's application programming interfaces (APIs). On 14 October 2025 Visa introduced the Trusted Agent Protocol, developed with Cloudflare, to help merchants tell legitimate agents from malicious bots.
In November 2025 Visa expanded the program across Asia Pacific and said pilots there would start in early 2026, and in December 2025 it reported that hundreds of agent-initiated transactions had been completed with partners. In April 2026 it extended Agentic Ready, its testing program for agent payments, saying it was already live with more than 20 partners in the United Kingdom and Europe. Visa's developer pages still describe the product as being in development and deployment, and not available in every market.
How it works
A typical agent purchase under the program follows these steps, according to Visa's developer documentation:
- The cardholder adds a Visa card to an AI platform. The platform enrols the card's primary account number (PAN) and Visa provisions a token for the agent, a form of network tokenization.
- The cardholder passes a step-up check set by the card issuer, such as a one-time passcode, and registers a passkey on the device, a credential built on standards from the FIDO Alliance.
- For each task the cardholder approves a payment instruction with the passkey. The instruction records the purchase intent and carries limits such as a maximum amount and an expiry time, the network's version of an agentic mandate.
- When the agent is ready to pay, it requests a credential against that instruction and receives the token plus a one-time cryptogram, which the merchant submits for authorisation in the normal way.
- The outcome is reported back to Visa so the purchase can be matched to the approved instruction.
Because the merchant still receives an ordinary tokenised card transaction, it is processed by the merchant's acquirer through the existing four-party card model.
Trusted Agent Protocol
Online shops have spent years blocking automated traffic, and an AI agent can look exactly like a bot. The Trusted Agent Protocol addresses this by having a registered agent sign its web requests with a key the merchant can check. The signature follows HTTP Message Signatures (RFC 9421, an Internet Engineering Task Force standard) and is aligned with the Web Bot Auth proposal. The specification adds two further signed items, one identifying the consumer or device and one carrying payment details.
Visa published the specification and sample code on GitHub and said it was working with the IETF, the OpenID Foundation and EMVCo to align the work with wider standards. Merchants that have not adopted it can ignore the signatures, so adoption is voluntary.
Limitations and open questions
Several issues remain unsettled as of November 2026:
- Disputes. Card chargeback rules were written for purchases a person made or did not make. A purchase an agent made within its limits, but that the cardholder did not want, does not fit either category neatly.
- Competing standards. Visa, Mastercard, Google, OpenAI and others have each published agent protocols, and merchants may need to support several at once.
- Uneven availability. Production access needs Visa approval and certification, so coverage depends on which issuers, platforms and markets have joined.
- Consumer law. Existing protections for unauthorised payments, such as the US Regulation E for debit cards, assume a human decided to pay. How they apply when software decides has not been tested in court.
Supporters argue that agent tokens are safer than handing an AI the raw card number, which is how many early agent tools worked. Critics note that the system mainly protects the networks' role in online checkout and that real consumer demand for agent shopping is still unproven.