On a single day in March 2026, four things happened. Visa launched a structured testing program for AI agent payments across 21 European banks. World and Coinbase shipped a developer toolkit that lets verified humans delegate their identity to AI agents. Mastercard unveiled a generative AI foundation model trained on billions of transactions. And somewhere in Latin America, a Banco Santander AI agent completed a live purchase over Visa's network without a human clicking a single button.

None of these announcements happened in isolation. Each one addresses a different layer of the same problem: how do you let an AI agent spend money safely, verifiably, and at scale?

Start at the bottom of the stack. Before an AI agent can buy anything, it needs access to a payment rail that recognises it as a legitimate actor.

Visa's Agentic Ready program is the most structured attempt yet to make that happen. Launched on March 17, the program enrolls 21 issuing partners, including Barclays, HSBC UK, Revolut, Commerzbank, Nationwide Building Society, and Banco Santander, to test AI agent-initiated payments in production-grade environments. This is not a sandbox demo. Participating banks run transactions alongside real merchants, establish internal policies, and build operational familiarity with the technology.

The technical architecture has three layers. Tokenisation replaces actual card numbers when agents initiate purchases. Biometric authentication links those tokens to verified account holders. Risk scoring and spending controls let issuers set transaction limits that consumers configure in advance.

"As AI agents increasingly shape how people shop and buy, payments need to keep up," Mathieu Altwegg, Visa Europe, said in the announcement.

Europe is the starting point, but the program builds on earlier work. Santander already completed live agentic payment transactions with Visa across multiple Latin American markets earlier this month. Real money, real networks, full authorisation and settlement.

As we covered in our analysis of those transactions, the operational complexity of running agentic payments across multiple jurisdictions with different regulatory frameworks is significant. Visa is now formalising what Santander proved was possible.

A payment rail without identity verification is just a pipe. The harder question is: how does a merchant, a bank, or a network know that the AI agent making a purchase has genuine human authorisation behind it?

World and Coinbase launched AgentKit to answer that question. The developer toolkit, now in limited beta, lets verified humans delegate their World ID to AI agents. World ID is an iris-scanning biometric identity system. AgentKit extends that verified identity to agents acting on a human's behalf, creating what the companies call "human-backed agents."

The problem it solves is real. Most websites block automated traffic to prevent bot abuse. That same defence inadvertently blocks legitimate AI agents trying to book a restaurant, check flight prices, or complete a purchase. AgentKit differentiates productive agent traffic through cryptographic proof that a verified human is behind the request.

Coinbase brings the payment layer. The company developed the x402 protocol alongside Cloudflare, an open standard that embeds stablecoin payments into web interactions. AgentKit integrates x402 with World ID to create a complete trust stack: identity plus payment in a single flow.

"Payments are the 'how' of agentic commerce, but the identity is the 'who,'" Erik Reppel, head of engineering at Coinbase Developer Platform, told PYMNTS.

As we explored in our examination of the trust gap, consumers trust AI agents operated by retailers they already shop with at roughly three times the rate they trust third-party agents. AgentKit is a bet that cryptographic identity verification can close that gap for agents that do not have the advantage of an existing brand relationship.

Mastercard is building something different. Rather than connecting agents to existing rails, the company is training its own generative AI foundation model to become what it calls an "insights engine" for commerce.

The model is not a large language model. It is a large tabular model: a deep learning network processing structured transaction datasets. The training data includes billions of anonymised payment transactions, merchant location data, fraud signals, authorisation patterns, chargeback histories, and loyalty program data. Mastercard plans to scale this to hundreds of billions of transactions.

The capabilities span cybersecurity, loyalty, personalisation, portfolio optimisation, and data analytics. Initial testing on cybersecurity showed the model outperformed standard machine learning techniques at identifying legitimate high-value transactions while reducing false positives.

"This reflects a broader shift we've been driving across Mastercard's AI roadmap, moving beyond point solutions to foundation-level capabilities that learn from the complexity of global commerce," Greg Ulrich, Mastercard's chief AI and data officer, said. Development involves Nvidia and Databricks.

A card network that can predict transaction behaviour, flag fraud, and personalise offers at the foundation model level is no longer just a pipe that moves money. It is an intelligence layer that sits between the agent and the merchant, one that shapes what gets approved, what gets flagged, and what gets recommended. That is a different kind of power than processing volume.

An AI agent that can pay and prove its identity still needs to find products and verify they are actually in stock. That is two problems, and both are being addressed.

On discovery, the division of labour is becoming clear. As we covered in our piece on Shopify's agentic storefronts, OpenAI retreated from building its own checkout inside ChatGPT and handed that responsibility to Shopify. The AI platform owns the discovery moment. The commerce platform owns the transaction. Products from Shopify merchants are now discoverable and purchasable directly inside ChatGPT conversations.

On inventory, the problem is harder. According to Total Retail, even strong retail operators see item-level inventory accuracy drop to 60 or 65 percent between full physical counts. Receipts, transfers, fitting room try-ons, theft, and inconsistent reconciliation all create distortion between what the system reports and what is actually on the shelf.

For traditional e-commerce, this is a returns problem. For agentic commerce, it is a trust problem. An AI agent that promises a customer their size is in stock, based on data that is 35 percent wrong, will erode confidence faster than any privacy concern.

Emerging interoperability standards, including Google's Universal Commerce Protocol and OpenAI's Agentic Commerce Protocol, standardise how systems communicate. They cannot standardise the accuracy of the data flowing through them. RFID infrastructure that provides real-time, location-aware inventory data is one answer. But most retailers have not deployed it at the item level, and until they do, the truth layer beneath agentic commerce remains unreliable.

One more piece is moving. Mastercard agreed to acquire BVNK, a stablecoin infrastructure platform, for up to $1.8 billion. The deal gives Mastercard direct access to stablecoin-based settlement rails.

This matters for agentic commerce because agent-to-agent transactions may not fit neatly onto traditional card rails. When an AI agent purchases an API call, pays for a data query, or settles a micro-transaction with another agent, stablecoins offer a programmable settlement layer that can clear in seconds without the overhead of card network processing.

Combined with Coinbase's x402 protocol, which embeds stablecoin payments directly into web requests, the settlement infrastructure for machine-to-machine commerce is taking shape alongside the human-facing payment rails.

No single company owns all five layers. That is both the opportunity and the risk.

The card networks are expanding beyond their traditional role. Visa is building the testing infrastructure for agent payments. Mastercard is building the intelligence layer and acquiring stablecoin settlement rails.

The AI platforms are moving into commerce. OpenAI owns the conversational discovery layer. Shopify owns the transaction. Together they control the top of the funnel where agent-driven purchases begin.

The identity providers are carving out new territory. World is extending biometric verification from humans to their agents. Coinbase is connecting identity to stablecoin payment rails through x402.

The layer that remains thinnest is governance. As we documented in our analysis of agentic payment identity, dispute resolution, chargeback frameworks, and liability allocation have not been updated for transactions initiated by AI agents. Every other layer of the stack is being built or tested in production. The legal and regulatory layer is still in draft, where it exists at all.

When an AI agent places an order, verifies its human's identity, selects a payment rail, and settles the transaction, who is the customer? And whose regulation applies?