Mastercard Agent Pay vs. Visa Intelligent Commerce: What's Actually Live in 2026
_Last updated: 2026-06-07_
Mastercard Agent Pay and Visa Intelligent Commerce are the two big network plays for AI agent transactions. Both moved fast: Mastercard rolled Agent Pay's agentic tokens out across US cardholders in late 2025 and completed Europe's first live end-to-end agent payment with Santander in March 2026; Visa confirmed hundreds of completed agent-initiated transactions in closed-beta pilots in December 2025. Neither, though, removes the need for a control plane that enforces policy between the agent and the card.
Key takeaways
- Mastercard Agent Pay uses agent-scoped tokenized credentials and a verified-agent registry to tell autonomous transactions apart from human ones.
- Visa Intelligent Commerce extends Visa's existing token infrastructure for agents: tokenized credentials, payment passkeys, and user-set limits, with required approvals as a control option. Visa TAP is a separate open spec for proving agent identity to merchants.
- The Santander × Mastercard payment in March 2026 was the first publicly confirmed live end-to-end agent payment in Europe, run in a controlled environment on live banking infrastructure. Real milestone, still early.
- Both offer some built-in controls (preset limits, MCC restrictions), but neither enforces your business logic or gives per-agent attribution.
- A control plane like Shatale sits between your agent and the network, enforcing the rules the network can't know.
---
What is Mastercard Agent Pay?
Mastercard's infrastructure layer for AI-initiated payments. It adds two things standard card rails don't have:
Agentic token credentials. Normal tokens are tied to a device or a card-on-file. Agent Pay tokens are scoped to an AI agent, carrying metadata about its identity and authorization context, so issuers and merchants can tell a human payment from an agent one and apply different rules to each.
A verified-agent registry. Mastercard is building a registry of certified agents, a way for merchants and issuers to confirm a transaction came from a known, verified agent rather than an unknown script. Think KYB for bots. (How to verify agent identity is its own topic, see [how to KYC an AI agent](/blog/how-to-kyc-ai-agent).)
The Santander milestone. In March 2026, Mastercard and Santander completed what they called Europe's first live end-to-end payment executed by an AI agent, run in a controlled environment, but processed through Santander's live payments infrastructure inside a regulated banking framework. Santander is explicit that this isn't a commercial rollout yet. It matters because it shows the stack works under real conditions, not just on paper.
Built-in controls. Issuers on Agent Pay can set preset limits and MCC restrictions on agent credentials, "this token transacts only with SaaS vendors (MCC 7372) up to $500/month." Useful. But it's configured at the issuer level, not at the granularity of your individual agents or your business policies.
---
What is Visa Intelligent Commerce (and Visa TAP)?
Visa Intelligent Commerce, announced in April 2025, is Visa's program for delegated agent payments. Visa TAP (Trusted Agent Protocol, published with Cloudflare in October 2025) is a separate open spec solving a different problem: it lets agents cryptographically sign their identity into HTTP requests so merchants can verify a legitimate agent at checkout.
Intelligent Commerce extends Visa's existing token infrastructure rather than building a separate track. The agent transacts with a tokenized credential linked to the cardholder's existing Visa card, plus payment passkeys to confirm identity, the real card number is never exposed to the agent.
User-set controls are the standout feature: agent transactions run inside permissions the user defines, spending limits, merchant categories, required approvals, so a charge outside that envelope needs a human sign-off before it completes.
Status: closed-beta pilots, scaling. In December 2025, Visa said hundreds of agent-initiated transactions had been completed in closed-beta pilots with partners like Skyfire, Nekuda, PayOS, and Ramp, with 100+ partners in the program and pilots extending to Europe and Asia Pacific in 2026. It also announced an OpenAI partnership on June 10, 2026. But it's not open enrollment, access still runs through Visa's partner program.
---
Side-by-side
| Feature | Mastercard Agent Pay | Visa Intelligent Commerce |
|---|---|---|
| Agent-specific token credentials | Yes (Agentic Tokens, MDES extension) | Yes (tokenized credentials + payment passkeys) |
| Agent verification / registry | Yes ("Know Your Agent" registration) | Via Trusted Agent Protocol's registered agent keys |
| Confirmed live agent payments | Yes. Santander, Europe, March 2026 (controlled environment) | Yes, hundreds in closed-beta pilots (Dec 2025) |
| Built-in spending limits | Yes (issuer-configured) | Yes (user-set, issuer-approved) |
| MCC restrictions | Yes | Yes |
| Required-approval option | Issuer option | Yes (user-set control) |
| General availability | US rollout late 2025, expanding | Pilots, expanding through 2026 |
| Enrollment path | Via issuing bank | Via Visa partner program |
both networks are heading the same place, agent-aware rails with some controls baked in. Mastercard leads on agent verification infrastructure. Visa's user-set permissions stand out for putting a human checkpoint inside the payment flow itself.
---
What's pilot vs. production?
Production: Mastercard Agent Pay's core token infrastructure (US rollout completed late 2025, Citi and US Bank first); standard Visa/Mastercard card-on-file tokens used by agents today (which is how most agent payments actually happen right now, no agent-specific rails, just regular tokens).
Pilot / limited: the Santander live payment (controlled environment, not commercial rollout); Visa Intelligent Commerce closed-beta pilots; Visa TAP merchant-side verification, with early acquirer support (Adyen since January 2026).
Not yet announced: cross-network interoperability and network-level policy APIs you can program against. Agent-to-agent payments got a first move with Mastercard's Agent Pay for Machines, announced June 10, 2026, very early days.
The practical read: deploy an agent that spends today and you're almost certainly on standard card infrastructure, not agent-specific rails. The network innovations are coming, but they're not yet something most teams can configure directly.
---
How does a control plane complement the networks?
Both networks provide controls at the issuer layer, limits and restrictions the bank sets when it issues the credential. That's one enforcement layer, and it's valuable.
What the networks can't do:
- Enforce your business-specific rules ("agent A can spend on category X, agent B can't").
- Attribute a charge to a specific agent in your system for accounting.
- Apply per-workflow caps that reset on your schedule, not the card cycle.
- Trigger your internal approval workflow before the payment clears.
- Log every authorization attempt with the agent context your engineers need to debug.
That's the gap a control plane fills: it sits between the agent and the card credential and enforces policy at the authorization moment, before the transaction reaches the network. Network controls are a second layer, not a first.
The clean mental model: network controls are what the issuer enforces on their side; a control plane is what you enforce on yours. Both matter; neither is enough alone.
---
Frequently asked questions
Is Mastercard Agent Pay available to businesses now?
Enrollment runs through issuing-bank partners, not directly from Mastercard. The US rollout completed in late 2025 (Citi and US Bank piloted first), and the program is expanding internationally through 2026. Access depends on whether your issuer has switched it on.
What is Visa TAP?
Visa's Trusted Agent Protocol, an open spec published with Cloudflare in October 2025. Agents cryptographically sign their identity into HTTP requests so merchants can verify a legitimate agent at or before checkout. It's separate from Visa Intelligent Commerce, which handles the tokenized credentials agents actually pay with.
Did Mastercard and Santander really complete a live agent payment?
Yes. In March 2026 they publicly confirmed Europe's first live end-to-end payment executed by an AI agent on Agent Pay infrastructure, processed through Santander's live payments systems inside a regulated banking framework, though in a controlled environment rather than a commercial rollout.
Can I use Mastercard Agent Pay limits instead of a control plane?
The issuer-configured limits give you a spending floor but not per-agent granularity, internal attribution, or enforcement of your own business logic. Most teams need both: network-layer controls for what the issuer enforces, and a control plane for what you enforce.
---