Three months ago, agentic commerce was a collection of whitepapers and sandbox demos. That changed fast. Between January and March 2026, every major player in payments and AI shipped a production protocol for how agents should discover products, verify identity, authorise payments, and settle transactions.

Google launched the Universal Commerce Protocol. OpenAI and Stripe shipped the Agentic Commerce Protocol. Visa released the Trusted Agent Protocol. Mastercard deployed Agent Pay and Verifiable Intent. Coinbase and Cloudflare founded the x402 settlement protocol. FIS built the first issuer-side agent infrastructure for banks.

The stack is complete. Every layer has at least one production implementation. Some layers have three.

The problem is that nobody agreed on which protocols go where, which ones interoperate, and which ones will become defaults. The companies building agentic commerce are racing to ship before the market decides, because in payments, the company that sets the standard owns the decade.

The first thing an AI agent needs is a way to find products and tell a merchant what it wants to buy.

Google's Universal Commerce Protocol (UCP) is the most ambitious attempt at this layer. Announced at NRF in January 2026, UCP defines the full commerce workflow from product discovery through checkout and order management. It uses a layered architecture: a core Shopping service handles transaction primitives, independently versioned capabilities (Checkout, Orders, Catalog) add functional areas, and extensions allow domain-specific customisation.

The co-development list reads like a roster of American retail: Shopify, Etsy, Wayfair, Target, Walmart. Over 20 partners endorsed it at launch, including Adyen, American Express, Best Buy, Macy's, Stripe, Visa, and Zalando. Merchants can integrate via APIs, Agent-to-Agent (A2A), or MCP, which means UCP sits above the communication protocol rather than prescribing one.

OpenAI's Agentic Commerce Protocol (ACP), maintained jointly with Stripe, takes a narrower approach. Where UCP tries to standardise the entire commerce journey, ACP focuses on checkout. The specification defines how ChatGPT calls a merchant's checkout session endpoint, updates the session as users change items or shipping, and receives order lifecycle events via webhooks.

ACP is already live. OpenAI launched "Buy it in ChatGPT" on February 16 for all US users. Over one million Shopify merchants are accessible. Etsy sellers are active. PayPal's ACP server will bring additional businesses onto the platform in 2026. Worldpay has published an ACP integration guide.

The tension between UCP and ACP is architectural. UCP says: standardise the full journey, from discovery to post-purchase support. ACP says: standardise checkout, let the AI platform handle everything else. Both are open source. Both are in production. Merchants integrating today are choosing, and the choice shapes which AI platform has the deepest commerce capability.

Once an agent finds a product, someone needs to verify that the agent is legitimate and that it has permission to act on a consumer's behalf.

Visa's Trusted Agent Protocol (TAP) addresses this with cryptographic signatures. Agents sign HTTP requests using private keys. Merchants verify those signatures against a trusted key store maintained by Visa's payment scheme. The signed payload includes agent intent, consumer recognition data, and payment information. Timestamps and nonces prevent replay attacks.

The protocol was built in collaboration with Cloudflare and Akamai, which tells you where Visa thinks the enforcement should happen: at the network edge, before the request reaches the merchant. Visa reported a 4,700 percent surge in AI-driven traffic to US retail sites. TAP is Visa's answer to distinguishing legitimate agents from malicious bots at that scale.

Mastercard deployed two complementary frameworks. The Agent Pay Acceptance Framework provides governance for AI agents to transact using tokenisation, strong authentication, and fraud prevention. Verifiable Intent, which we analysed when it launched, adds a cryptographic proof layer. When an agent books a $3,000 trip on your behalf, Verifiable Intent creates a tamper-proof record of what you actually authorised. If you dispute the insurance charge later, that record exists.

The gap between Visa and Mastercard's approaches is subtle but real. TAP focuses on agent authentication: is this agent who it claims to be? Verifiable Intent focuses on consumer authorisation: did the human actually tell the agent to do this? Both questions need answering. Neither protocol answers both.

Protocols become real when they reach the infrastructure that moves money. Two processors moved in Q1.

Fiserv became the first major processor to adopt both Visa's TAP and Mastercard's Agent Pay simultaneously. The Visa Acceptance Platform, a unified API-driven acceptance layer, integrates into Fiserv's European acquiring operations. Mastercard's framework plugs in alongside it. Merchants on Fiserv's platform will gain agentic commerce capability without making a single integration decision.

FIS approached from the issuer side. Its agentic commerce offering, announced in January, gives issuing banks the ability to evaluate AI agents using "Know Your Agent" (KYA) data before authorising transactions. The logic is the same as Know Your Customer for humans: before the bank approves a payment, it needs to know who is asking. FIS is building that identity check for non-human initiators.

The FIS offering is designed to reduce chargebacks for issuers, increase approval rates for merchants, and provide fraud protection for consumers. Initial use cases include transaction authorisation, fraud detection, loyalty, and customer servicing. It ships to all FIS issuing bank clients by end of Q1 2026.

These are the companies whose infrastructure runs underneath the payment networks. When Fiserv and FIS adopt agentic protocols, millions of merchants and thousands of banks gain the capability through upgrades they did not specifically request. That is how standards become defaults. Not through adoption campaigns, but through processor updates.

After discovery, authentication, and processing, the money needs to move.

Traditional card rails remain the default. Santander and Visa completed live agentic payments across Latin America in March. Real money, production networks, transactions initiated by AI agents. JP Morgan and Mirakl announced a joint solution for autonomous agent payments. These transactions settle on existing Visa and Mastercard rails, which means the three-day clearing window, interchange fees, and chargeback framework all apply.

The alternative is x402. Coinbase built a stablecoin settlement protocol into HTTP itself. The x402 Foundation, co-founded with Cloudflare, now includes Google and Visa. Settlement happens onchain in seconds. No intermediary bank. No clearing window. Over 15 million transactions processed, though real daily volume sits at roughly $28,000.

Google's Agent Payments Protocol (AP2) bridges the two approaches. AP2 integrates with x402 for stablecoin settlement and with traditional payment methods for fiat. It is designed to sit between the commerce layer (UCP) and whatever settlement rail the merchant accepts.

The settlement layer is where the philosophical split in agentic commerce is sharpest. Card networks want agent payments on their rails because that preserves interchange revenue and the existing liability framework. Crypto-native protocols want agent payments on stablecoin rails because instant settlement and no intermediaries are better suited to high-frequency, low-value agent transactions. Both arguments have merit. Neither has won.

Here is what the stack looks like today:

Nine components. Six companies. Every layer has a production implementation. On paper, the stack is complete.

In practice, the seams are visible. An agent using OpenAI's ACP for checkout and Visa's TAP for authentication and x402 for settlement would need to navigate three separate protocol specifications, each maintained by a different organisation with different versioning cycles. A merchant on Fiserv's platform using Mastercard's Agent Pay cannot easily accept a transaction from an agent authenticated through Visa's TAP without additional integration.

The protocols were not designed as a stack. They were designed as competing bids for different parts of the same problem. The interoperability work that would make them function as a coherent system has not happened yet.

In payments, the company that controls the standard controls the economics. Visa and Mastercard did not dominate the card industry by issuing better cards. They dominated by writing the network rules that everyone else followed. The same dynamic is playing out in agentic commerce, but with more players and less time.

Google has the broadest position. UCP covers the full journey. AP2 bridges fiat and stablecoin settlement. Google's AI surfaces (Gemini, AI Mode) are where agent commerce conversations start for a growing number of consumers. If UCP becomes the default, Google owns the discovery layer the way it owns search.

OpenAI has the deepest consumer relationship. 800 million weekly ChatGPT users. "Buy it in ChatGPT" is live. ACP is narrower than UCP but it is live in production with real transactions. If consumers buy through ChatGPT, OpenAI controls the checkout surface.

Visa has the trust infrastructure. TAP uses cryptographic signatures verified against Visa's own key store. Every agent that wants to be "trusted" must register with Visa's programme. That is a gatekeeper position.

Mastercard has the liability answer. Verifiable Intent is the only framework that creates a tamper-proof record of consumer authorisation. In a world where agentic dispute rates are an unsolved problem, the company with the audit trail has leverage.

Coinbase has the settlement alternative. If high-frequency agent micropayments cannot economically run on card rails (interchange makes sub-dollar transactions unviable), x402 becomes the default for machine-to-machine settlement.

Fiserv and FIS have the distribution. Protocols are academic until processors ship them. These two companies can make agentic commerce a default capability for millions of merchants and thousands of banks.

Three things.

A unified identity layer. As we covered in our analysis of the identity crisis, 78 percent of organisations have no formal policies for non-human identities. Visa's TAP and Mastercard's Agent Pay each solve part of the problem. Neither creates a universal agent identity that works across protocols. An agent authenticated by Visa is not automatically trusted by a Mastercard merchant.

A dispute resolution framework. The chargeback system was designed for human buyers who can be contacted, questioned, and held accountable. Friendly fraud already accounts for 75 percent of chargebacks. Agent-initiated transactions add a new category: purchases the consumer authorised in the abstract but does not remember specifically. Mastercard's Verifiable Intent is the closest thing to a solution. It is not enough on its own.

Governance. Who decides when protocols conflict? If Google's UCP and OpenAI's ACP both claim to handle checkout but define the session schema differently, who resolves the incompatibility? The x402 Foundation has formal governance. Most other protocols do not. The result is that interoperability depends on bilateral agreements between companies, not a shared standard.

The protocols are hardening. Every month they remain in production, more merchants integrate, more agents adopt them, and the switching cost increases. By the end of 2026, the protocols that have the most merchant integrations will become the de facto standards, regardless of whether they are technically superior.

This is how it went with card networks. By the time Discover launched in 1985, Visa and Mastercard had already established the network rules. Discover built a better product on several dimensions. It did not matter. The rules were already written.

The agentic commerce stack shipped in Q1 2026. The rules are being written now. By Q4, they will be difficult to rewrite.

The agentic commerce stack shipped in a single quarter. The standards war will take longer. Which protocol are you building on, and what happens when the one next to it wins instead?