Visa introduced the Trusted Agent Protocol in October 2025 alongside more than 10 launch partners, positioning it as an ecosystem-led standard for AI commerce built on existing web infrastructure. The protocol uses cryptographic message signatures based on RFC 9421 (HTTP Message Signatures) and aligns with WebAuthn, allowing merchants to verify that an AI agent is legitimate and authorised to act on a consumer's behalf.

TAP sits within Visa's broader Visa Intelligent Commerce (VIC) suite, which now has over 100 partners building across the agentic commerce ecosystem, with more than 30 actively developing in the VIC sandbox.

By March 2026, VIC has completed live agentic transactions with Santander across five Latin American markets, as we covered in our analysis of the Santander-Visa pilot. Visa has also released a card-based Machine Payments Protocol spec and SDK with Stripe and Tempo, extending TAP's trust layer to autonomous agent payments.

Solves the bot problem first. Visa's core insight is that merchants face an identity crisis before they face a payments problem. As we explored in our analysis of the agentic commerce standards race, the proliferation of AI agents creates a verification challenge at the merchant surface. TAP addresses this directly: every request from a trusted agent carries a cryptographic signature locked to the specific merchant website and page, preventing replay attacks and credential misuse.Open-sourced on GitHub with real developer tooling. TAP is published on GitHub with specifications, a sample agent registry, and RFC 9421 signature verification implementation. The Visa Developer Center hosts getting-started guides and a Trusted Agent Registry for managing agent public keys. Developers can inspect the code today.

12 launch partners spanning the payments stack. The partner list reads like a merchant acquirer rollcall: Adyen, Ant International, Checkout.com, Coinbase, CyberSource, Elavon, Fiserv, Microsoft, Nuvei, Shopify, Stripe, and Worldpay. Akamai has since integrated TAP with its edge-based bot protection. As we covered in our analysis of the Fiserv integration, Fiserv deploying TAP across its infrastructure puts agent verification within reach of millions of merchants.

Standards-aligned, not proprietary. TAP is built on IETF (RFC 9421), WebAuthn, and OpenID Foundation standards. Visa has aligned with EMVCo and is collaborating with Coinbase on x402 protocol interoperability for stablecoin-based agent payments. The protocol does not require Visa rails to function, which is a deliberate design choice that broadens adoption potential.

VIC provides the operational wrapper. The broader suite includes an MCP Server for connecting AI agents to Visa APIs, an Agent Acceptance Toolkit (both in pilot), and the Agentic Ready programme launched in Europe to help issuers test agent-initiated transactions in production.

TAP verifies agents, not intent. Visa's protocol proves an agent is who it claims to be. It does not prove the agent acted within the consumer's instructions. That is the gap Mastercard's Verifiable Intent framework addresses. For merchants adjudicating disputes over what an agent was authorised to purchase, TAP alone may not be sufficient.

Live transaction volume is still limited. The Santander pilot across Argentina, Brazil, Chile, Mexico, and Uruguay completed controlled transactions (books and chocolates). Visa predicts millions of consumers will use AI agents for purchases by the 2026 holiday season, but production volume at scale has not been demonstrated yet.

Documentation is early-stage. The Visa Developer Center provides specifications and getting-started guides, but the depth does not match Stripe's developer documentation. The MCP Server and Agent Acceptance Toolkit are both in pilot, not generally available. Developers building today are working with early tooling.

Visa has not disclosed specific pricing for TAP or Visa Intelligent Commerce services. The protocol is open and available on GitHub at no cost. Agentic transactions on Visa rails flow through standard interchange and network fee structures. The VIC sandbox is available to approved partners, and the Agentic Ready programme provides issuers with a structured pathway to production.

Visa TAP inherits the compliance posture of the Visa network: PCI DSS compliance, EMVCo standards alignment, and regulatory coverage across 200+ countries and territories. The protocol is built on IETF RFC 9421 and WebAuthn. Each agent signature is time-scoped, single-use, and bound to the specific merchant and page, preventing replay attacks.

Overall: 4.0/5

Visa Trusted Agent Protocol is the strongest merchant-facing agent verification standard in the market. For acquirers, payment processors, and merchants that need to distinguish legitimate AI agents from bots before a transaction begins, TAP provides a production-ready cryptographic framework backed by 12 of the largest payment infrastructure companies globally.

It is not a complete agentic commerce stack. Teams that also need intent verification should evaluate Mastercard's Verifiable Intent alongside TAP. Developers wanting a self-serve, full-stack agent payments toolkit will find Stripe's Agent Toolkit faster to prototype with.

With VIC expanding across Asia Pacific, Europe, and Latin America, and the Stripe MPP collaboration extending card-based agent payments, Visa is building the trust perimeter for a market it expects to serve millions of consumers by the end of 2026.

Explore Visa Trusted Agent Protocol: developer.visa.com/capabilities/trusted-agent-protocol

If AI agents are the next generation of online shoppers, the first question every merchant must answer is not how to take their money. It is how to know they are real.