Visa Trusted Agent Protocol vs Mastercard Agent Pay: Which Network Layer Wins in 2026?

AI-referred retail traffic to US sites grew 393 percent year over year in Q1 2026 and converted roughly 42 percent better than traditional search, according to Adobe Analytics.

B2B Centr tracks the infrastructure layer of AI commerce so revenue teams can make integration decisions before the standards settle rather than after.

Visa and Mastercard have both spent the last eighteen months building network-level answers to the same question, which is how a merchant can trust a payment that no human clicked, and they have arrived at architectures that are genuinely different rather than cosmetically different.

This article breaks down both frameworks in detail, compares them across architecture, adoption, liability, cost and developer experience, and gives you a clear read on which network layer is actually winning in 2026 and what that means for your roadmap.

Key Takeaways

• Visa TAP verifies the agent. Mastercard Agent Pay tokenizes the payment and the intent.
• Neither protocol wins outright. Most merchants inherit both through their existing processor.
• Visa went live at European merchant checkouts in July 2026 with 30-plus issuers.
• Mastercard launched Agent Pay for Machines in June 2026 with 30-plus named partners.
• Merchants keep fraud and chargeback exposure regardless of which network layer initiates the payment.

The 2026 Agentic Commerce Market: A Category That Cannot Agree on Its Own Size

Before comparing protocols, understand that the market they serve has no agreed definition, and the forecasts differ by orders of magnitude as a result.

The spread between the narrowest and broadest figures is roughly 243x. Almost none of that gap is disagreement about growth rates.

Nearly all of it is disagreement about what counts as an agentic transaction. When a vendor quotes a market number, ask whether it counts agent-executed purchases or agent-influenced ones.

Consumer readiness is outpacing the infrastructure. IBM's Institute for Business Value found in January 2026 that 45 percent of consumers already use AI somewhere in the buying journey, Visa puts the figure at 47 percent of US shoppers, Kearney reports 60 percent expect to use AI agents within twelve months, and OpenAI has said ChatGPT handles roughly 50 million shopping queries per day.

For B2B, Gartner's projection is the one for your planning slide: if 90 percent of B2B purchases are agent-intermediated by 2028, procurement, pricing and lead generation strategy all change shape inside a two-year window.

Why Both Networks Moved: The Bot Problem in Reverse

Visa launched TAP citing a 4,700 percent surge in AI-driven traffic to US retail sites. That number explains the entire category better than any market forecast does.

Merchants spent a decade building infrastructure to block automated traffic. Imperva's 2025 Bad Bot Report found 51 percent of internet traffic is now bot-generated, 37 percent of it malicious, and agentic traffic specifically surged 450 percent in 2025.

A legitimate shopping agent and a malicious script probing for card numbers look almost identical at the network edge.

The commercial consequence is false declines. Studies attributed to Javelin suggest false declines cost merchants roughly 13 times more than actual fraud, yet only about 64 percent of merchants track their false-decline rate. Chargebacks911 warned in 2026 that agentic traffic is being misclassified as bot traffic at scale.

Both networks sell merchants the same promise: a cryptographic answer to "should I let this thing check out?" They just answer it at different points in the stack, which connects directly to building a resilient cybersecurity stack.

What Visa Trusted Agent Protocol Actually Is

Visa unveiled the Trusted Agent Protocol on 14 October 2025, co-developed with Cloudflare and more than ten launch partners. The specification is published openly on GitHub and in the Visa Developer Center, with a reference implementation, header schemas and JSON-Schema files for the signed claim payloads.

Mechanically, TAP adds cryptographic agent identity to the existing HTTPS request flow. An agent attaches signed headers to every request, and the merchant, or more often its CDN or edge provider, verifies the signature against a Visa-operated directory of registered agent public keys.

The critical architectural detail is that no money moves over TAP. It is a trust layer sitting above the payment, which is why the spec can be vendor-neutral in a way a payment protocol cannot. It also contemplates a future federated directory so Visa's operational role does not become a permanent control point.

Adoption footprint as of mid-2026:

• Launch working group included Adyen, Stripe, Worldpay, Cybersource, Elavon and Nuvei; Akamai joined in December 2025
• Visa reported 100-plus global partners, 30-plus building in the Intelligent Commerce sandbox, 20-plus integrating in production
• Fiserv became the first major processor to adopt TAP at scale in January 2026
• Visa Intelligent Commerce Connect launched April 2026, accepting TAP, MPP, ACP and UCP through one integration
• On 2 July 2026 in Paris, Visa announced the first live agentic payments at independent European merchant checkouts including lastminute.com, Frasers, Cleverbridge and BrickDepot, backed by 30-plus issuing banks
• CaixaBank completed its first AI-agent-initiated transaction on real card data the same week; Nuvei ran a live proof of concept with Visa and fashion brand Kings and Priests, targeting availability in H2 2026

What Mastercard Agent Pay Actually Is

Mastercard announced Agent Pay on 29 April 2025 with Microsoft, IBM and Braintree. Where Visa built an identity layer, Mastercard extended its existing tokenization rail.

Agent Pay introduces Agentic Tokens, built on the same MDES tokenization that powers contactless payments, card-on-file and Payment Passkeys.

A cardholder enrols an agent through their issuing bank's app, the bank requests a token scoped with maximum spend per session and allowed merchants or categories, the agent presents it at checkout, and Mastercard's network checks session, limit and merchant scope before authorizing.

The scope-violation decision happens at the Mastercard network layer, not at the issuer or merchant. Agent providers do not build scope enforcement themselves, and users can revoke a specific agent's token without touching the underlying card.

Layered on top is Verifiable Intent, co-developed with Google, a tamper-resistant record of what the user actually authorized.

If Agentic Tokens are control over the instrument, Verifiable Intent is verification of the reason for purchase. Formal pilots began in February 2026.

Adoption footprint as of mid-2026:

• Full US rollout completed November 2025, with Citi and US Bank as first issuers; PayPal signed an Agent Pay Acceptance Framework on 27 October 2025
• Latin America launch December 2025 with Checkout.com, Davivienda, Evertec, Getnet, MagaluPay and Yuno, in a region where close to 100 percent of issuers are already tokenization-enabled
• January 2026: Agent Suite announced with Stripe, Google and Ant International's Antom, plus entry into Google's Universal Commerce Protocol coalition
• The Agent Toolkit exposes Mastercard APIs through a Model Context Protocol server, giving developers direct access from Claude, Cursor or GitHub Copilot
• April 2026: authenticated agentic transactions went live in Singapore and Malaysia with UOB and local bank partners
• 10 June 2026: Agent Pay for Machines launched with 30-plus partners including Adyen, BVNK, Cloudflare, Coinbase, Global Payments, OKX, Stripe, Tempo and RippleX

If the MCP server detail matters to your engineering team, our guide to the Model Context Protocol covers the plumbing underneath it.

Head to Head: The Architecture Comparison

The practical translation: Visa wants to be the DNS of agent identity, Mastercard the permissioning layer of agent spending.

Visa's model gives merchants something to act on before the payment starts. Mastercard's gives issuers and consumers something to act on once the agent is already trusted.

They are not mutually exclusive, and most serious processors are certifying against both. Nuvei stated its intention to certify against Visa Intelligent Commerce and Mastercard Agent Pay through a single compatibility layer.

Who Is Winning: The Numbers Behind the Narrative

Both networks are healthy, and both frame agentic commerce as long-term market expansion rather than near-term revenue.

Visa framed agentic commerce as expanding its addressable market four ways: accelerating digitization, multiplying transaction counts as agents split purchases, digitizing B2B payments through virtual cards and tokenization, and lifting general economic growth by an estimated 80 to 150 basis points of GDP.

Mastercard CEO Michael Miebach argued card networks stay central because merchants and consumers require reach, security and predictable experiences, positioning Agent Pay for Machines as the only network protocol currently facilitating low-ticket, high-velocity machine-to-machine payments.

On raw distribution, Visa is ahead. The July 2026 European go-live with named merchants and 30-plus issuers is the most concrete production milestone either network has published.

On developer experience and forward architecture, Mastercard is ahead. The MCP server in the Agent Toolkit, blockchain-anchored permission records on Polygon, Solana and Base, and native stablecoin settlement in AP4M point to a stack designed for machine-to-machine commerce rather than retrofitted for it.

Liability, Disputes and the Part Nobody Advertises

This is where merchant enthusiasm usually meets reality.

Under Mastercard Agent Pay, liability follows standard tokenized-transaction rules: the issuer carries fraud liability when the token is validly issued and the policy is honoured at authorization, and consumer chargeback rights remain intact.

Under Visa TAP, verified agent transactions receive the same authorization-time scoring as human-initiated card transactions, which is the entire commercial point: no manual review queue for agent traffic.

What neither framework removes is merchant exposure. Merchants still accept the payment, manage fraud, absorb chargebacks and carry regulatory responsibility even when an agent initiated the transaction.

When a consumer says they authorized an agent to shop but never intended that specific purchase, order confirmations and IP addresses do not settle the argument the way they do for human checkout.

For context, Mastercard's State of Chargebacks 2025 found friendly fraud already accounts for more than 45 percent of all chargebacks, and the Merchant Risk Council's 2026 report named refund and policy abuse the number one merchant threat for the first time.

Agentic authorization ambiguity lands on top of a dispute environment that was already deteriorating.

Where AP2, ACP, MPP and x402 Fit

Neither network protocol operates alone. The wider 2026 stack:

• AP2 (Google, 60-plus partners) is a cross-network governance layer using signed Mandates, designed to cross-reference with both TAP and Verifiable Intent.
• ACP and UCP govern catalogue, cart and checkout semantics.
• MPP is on the IETF standards track, the only agentic payment protocol using the same open process that produced HTTP and TLS.
• x402 moved to Linux Foundation stewardship in April 2026 under a vendor-neutral foundation.
• MCP is the tool-calling layer underneath most of it, now governed under the Linux Foundation's Agentic AI Infrastructure Foundation.

For a full breakdown of how these interlock, see our comparison of AP2, ACP, x402 and MPP in 2026.

What This Means for B2B Teams Specifically

Most agentic commerce coverage is consumer retail. The B2B implications are larger and arrive with less warning.

Visa called out B2B as one of its four expansion vectors, pointing at agents automating payment initiation directly from invoices and contracts, with virtual cards and tokenization becoming preferred instruments. If Gartner is even directionally right about 2028, three things follow.

First, your product data becomes machine-readable or it becomes invisible. Schema.org Product markup and GS1 GTINs are the baseline, with agent-friendly checkout endpoints close behind. This is the commerce equivalent of the shift already underway in AI search visibility for B2B SaaS.

Second, procurement gatekeeping changes. If an agent shortlists three vendors before a human sees a name, the buying committee shrinks and evaluation criteria become explicit and comparable, which reshapes how agentic prospecting needs to be built.

Third, compliance obligations arrive early. EU AI Act enforcement milestones in August 2026 are expected to push identity credentials for autonomous agents in regulated sectors, while Regulation E and state-level AI laws still leave gaps around authorization and dispute rights. Our breakdown of Article 50 disclosure obligations covers the adjacent transparency requirements.

A Practical 90-Day Readiness Plan

1. Ask your processor one question. Do you support TAP and Mastercard Agent Pay, and on what timeline? For most merchants the integration delta is zero, and the answer determines everything else.
2. Measure your false-decline rate. If you are in the 36 percent not tracking it, you cannot quantify what agentic misclassification already costs you.
3. Check your edge provider. If your CDN blocks verified agents, TAP support at the processor level will not save the transaction.
4. Structure your catalogue. Schema.org Product markup, GTINs, machine-readable pricing and availability.
5. Rebuild your dispute evidence trail. Capture agent identity, mandate reference and authorization scope on every agent-initiated order.
6. Do not pick a side. Dual certification costs materially less than absence from one network's agent flow.

Conclusion

B2B Centr exists to translate infrastructure shifts into decisions your team can act on this quarter rather than next year.

The honest answer to which network layer wins in 2026 is that neither does, and that the search for a single winner is the wrong lens.

Visa's Trusted Agent Protocol is winning the identity layer, with an open specification, edge distribution through Cloudflare and Akamai, and the first live agentic checkouts at named European merchants in July 2026.

Mastercard Agent Pay is winning the permissioning and machine-to-machine layer, with network-enforced token scoping, Verifiable Intent co-developed with Google, an MCP-native toolkit, and Agent Pay for Machines shipping in June 2026 with multi-rail stablecoin settlement.

Both will be in your payment stack whether you plan for them or not, because both arrive through your processor.

The merchants who benefit are the ones preparing catalogue, edge configuration and dispute evidence now, while agentic volume is still single-digit percentages of ecommerce rather than double.

Read Next

• Is Agentic Commerce Safe? Fraud and Consumer Protection in AI-Driven Payments
• How to Make Your Checkout AI-Agent-Ready: The Merchant's Guide to Agentic Commerce
• Agent Payment Protocols Compared: AP2, ACP, x402 and MPP in 2026

FAQs

1. What is the difference between Visa Trusted Agent Protocol and Mastercard Agent Pay?

The difference between Visa Trusted Agent Protocol and Mastercard Agent Pay is the layer each operates at. Visa TAP is an identity protocol adding cryptographically signed headers to HTTPS requests so merchants can verify an agent before checkout, and no money moves over it. Mastercard Agent Pay is a payment programme issuing scoped Agentic Tokens through the cardholder's issuing bank, enforcing spend limits, merchant categories and session scope at the network layer.

2. Which network layer wins agentic commerce in 2026?

The network layer that wins agentic commerce in 2026 is neither one exclusively. Visa leads on production merchant deployment, going live at European checkouts including lastminute.com and Frasers in July 2026 with 30-plus issuing banks. Mastercard leads on developer experience and machine-to-machine architecture, with an MCP-native Agent Toolkit and Agent Pay for Machines supporting microtransactions and stablecoin settlement. Most merchants will end up supporting both through their existing processor.

3. Do merchants need to integrate Visa Trusted Agent Protocol directly?

Merchants do not need to integrate Visa Trusted Agent Protocol directly in most cases. TAP verification runs at the network, processor and CDN layer, so if your processor supports it, your existing integration inherits agent-payment support with no separate build. The practical action is confirming support with your acquirer or PSP and your edge provider, since the merchant-side delta is usually zero.

4. Who is liable when an AI agent makes a fraudulent purchase in 2026?

Liability when an AI agent makes a fraudulent purchase in 2026 generally follows existing tokenized-transaction rules: the issuer carries fraud liability when the token was validly issued and the authorization policy honoured, and consumer chargeback rights remain intact. Merchants still retain responsibility for fraud screening, chargeback absorption and regulatory compliance, so practical exposure has not moved.

5. How should B2B companies prepare for agentic payments in 2026?

B2B companies should prepare for agentic payments in 2026 by confirming processor support for both Visa TAP and Mastercard Agent Pay, measuring and reducing their false-decline rate, verifying their CDN passes verified agents rather than blocking them, publishing machine-readable product and pricing data using schema.org and GTIN standards, and capturing agent identity and authorization scope on every agent-initiated order.

Disclaimer: This content is provided for informational purposes only and does not constitute legal, financial, or compliance advice. Protocol versions, governance arrangements, and partner counts cited here reflect publicly announced milestones as of August 2026 and are moving quickly. Adoption figures come from vendor and foundation announcements with differing methodologies and should be treated as directional signals rather than guaranteed outcomes.