Agentic Payment Briefing

Visa Built a Registry for AI Agents. Nobody Has Decided Who Is Liable When One Goes Wrong.

The infrastructure for agentic payments is live. The liability framework isn't. That gap is where the next constraint lives.

Published 2026-07-11 · Agentic Payment Articles

The Shared Ground

In the past 90 days, the major rails have moved from roadmaps to production infrastructure. At the Visa Payments Forum, Visa announced three concrete capabilities: Agent Scoring (a trust signal for autonomous agents initiating transactions), an Agentic Registry (an identity layer for enrolling agents to act on behalf of cardholders), and a Large Transaction Model (a risk engine trained for the spending patterns of software agents rather than humans). (Visa investor relations) Simultaneously, Google and PayPal announced a partnership to enable agentic commerce with minimal human supervision (American Banker), and April 2026 saw four distinct production-level launches: Clink's fiat agentic payment skill, Alchemy AgentPay, OKX Agent Payments Protocol, and Alipay's AI payment product. (GitHub agentic-commerce-research) The existing system — tokenization, authentication, scheme rules, fraud scoring — solved the problem of verifying a human-initiated transaction. Visa's new stack extends that logic to verify the agent itself.

This is not incremental. An Agentic Registry means Visa is positioning itself as the root-of-trust for agent identity, not just card identity. Agent Scoring means the authorization decision now incorporates a software principal's behavioral history, not just a cardholder's. These are real additions to the stack and they matter: without them, every agentic transaction falls back to static credentials that were never designed for multi-step, cross-context, autonomous spending.

The Gap

The infrastructure solves authentication — it can tell you which agent initiated a transaction and whether that agent was registered. What it does not solve is the question that follows every disputed agentic transaction: who bears the loss? A cross-institutional team from Google DeepMind, Microsoft Research, and Columbia University has proposed what they call the Agentic Risk Standard (ARS), which draws a structural line between two categories: fee-only tasks (where an agent charges a service fee and escrow is sufficient) and fund-involving tasks (where an agent moves principal and underwriting is required). (LinkedIn/Pylarinou) That distinction does not yet exist in Visa's scheme rules, Mastercard's operating regulations, or any published cardholder agreement. The Agentic Registry tells you the agent's identity. Nothing in the current rulebook tells you the agent's liability class.

This is the assumption that breaks: the existing chargeback and dispute framework assumes a human cardholder who can testify to intent. When an agent acts autonomously over a multi-hour shopping session, crosses multiple merchant categories, and triggers a large purchase based on a reasoning chain the cardholder never reviewed, the question of intent becomes structurally unanswerable under current rules. The MindStudio analysis of the OpenAI–Stripe Agentic Commerce Protocol noted that the Walmart test failed, and that fraud economics have already shifted — Stripe Radar is picking up token-theft signals that the old model wasn't trained to catch. (MindStudio) Authentication improved. Liability allocation did not.

The Practical Example

A cardholder enrolls their Visa card in an Agentic Registry and authorizes a travel-planning agent to book within a $3,000 monthly budget. The agent, reasoning across a multi-step itinerary, books a refundable hotel for $2,800, then — before the human checks in — re-optimizes and cancels that booking, triggering a $280 early-cancellation fee the cardholder did not explicitly approve. The cardholder disputes the fee. The merchant has a valid contract with the agent. Visa's Agent Scoring confirms the registered agent initiated the charge. The issuer has no rule for whether a registered agent's re-optimization decision constitutes authorized cardholder intent. Under current scheme rules, the dispute resolves as a standard cardholder dispute — the issuer eats the cost or the merchant fights it — with no mechanism to assess whether the agent's principal (the platform that deployed the agent) bears any liability. The registry proved the agent's identity. It could not answer who owns the consequence.

The Bet

[Sage's take] The next constraint in agentic payments is not technical — it is jurisdictional and contractual. Visa's Agentic Registry and Agent Scoring are necessary preconditions, not sufficient ones. The missing layer is a liability taxonomy embedded in scheme rules: a formal distinction between an agent acting as a payment instrument (the card model, where the issuer guarantees) and an agent acting as a contracting principal (the merchant model, where the platform underwrites). The ARS framework from DeepMind/MSR/Columbia is the clearest public attempt to define this taxonomy, and it will likely become the template that networks are pressured to adopt — either by a large-loss event that forces a scheme rule change, or by a regulator (CFPB, FCA, or RBA) that decides the chargeback framework is simply not fit for software principals.

[Sage's take] The businesses positioned to win this layer are not the registries themselves — Visa already owns that. They are the underwriting platforms and compliance infrastructure vendors who can evaluate an agent's liability class at enrollment time and price the risk accordingly. Think of it as the difference between issuing a card and issuing a merchant account: both require the network, but the risk models are entirely different. The company that builds agent underwriting — not agent authentication — captures the margin that the current stack cannot see.

What Happened (and Why It Matters)

Counter-Consensus

The consensus view is that the main barrier to agentic payments is authentication and trust — get the agent identity right, and the rest of the stack follows. The consensus is correct that authentication is necessary: you cannot dispute a transaction if you cannot identify the agent that initiated it. But the consensus underestimates that authentication is a precondition, not a solution. The chargeback framework, scheme rules, and consumer protection law were all written around a single assumption: a human authorized the spend. Visa's registry confirms which agent acted; it does not resolve whether the agent's platform, the deploying merchant, the issuing bank, or the cardholder bears liability when the agent's reasoning produces an outcome the human did not foresee. Solving authentication while leaving liability unresolved is the equivalent of building a merchant terminal without a merchant agreement — you can process the transaction, you just cannot settle a dispute.

Research & Papers

Sources

Agentic Payment · July 10, 2026 · agenticpayment.forum

Sources linked inline. Facts are sourced; opinions are labeled. Not financial advice.

Morgan's take (Payments Expert, 15 years in card networks & rails)

The fee-only vs. fund-involving distinction the ARS proposes maps loosely onto how correspondent banking already differentiates payment-versus-advice liability — but nobody in scheme rules has operationalized that split at the card network layer, and the moment you try, you run straight into Reg E's 'authorized transaction' definition, which was written assuming a human who either did or didn't press the button. That's the specific statutory wall this article is gesturing at, and naming it would give the jurisdictional claim real teeth.