Every card network is racing to answer the same question: how do you let an AI agent spend a person’s money safely? The EMVCo agentic payments framework, published this week, is the card industry’s standards body stepping into that race not with its own payment product, but with a shared foundation the whole industry can build on.
EMVCo, the technical body jointly owned by Visa, Mastercard, American Express, Discover, JCB, and UnionPay that writes the specifications underlying most chip and contactless card payments, released a draft framework on September 1, 2026, called EMV Agentic Payments – Framework for Specifications. The document addresses card-based agentic payments: situations where a consumer authorizes an AI agent to make purchases on their behalf, sometimes without being present when the payment actually happens.
The framework’s central idea is something EMVCo calls “Intent Services.” In plain terms: when a person tells an AI agent “you can spend up to $200 a month on groceries” or “book this trip if the price stays under $500,” that instruction needs to be recorded somewhere that every party in the transaction chain, the agent, the merchant, and the bank, can check and trust. Intent Services is the shared layer that does this.
It lets participants register a consumer’s instructions, look them up later, and update them as circumstances change, for example if a subscription renews or a budget resets. This matters most for the trickier cases: recurring purchases, spending caps that build up over time, and anything that happens after the initial purchase, like a refund or a price adjustment. Rather than each bank or merchant keeping its own separate record of what was authorized, Intent Services aims to give everyone the same reference point.
How This Differs From Visa and Mastercard’s Agentic Programs
This is where it’s easy to get confused, because Visa and Mastercard already have agentic payment programs of their own. Visa’s Trusted Agent Protocol authenticates AI shopping agents at checkout and flags which ones are trustworthy. Mastercard Agent Pay uses its own “Agentic Tokens” and a feature called “Verifiable Intent” to prove an agent acted within the limits a consumer set. Both are products built and controlled by a single network.
EMVCo’s framework is not a competing product. It is a neutral coordination layer that sits above network-specific tools like these. In fact, EMVCo’s own materials describe Intent Services as designed to complement, not replace, “cryptographic assurance provided by existing industry solutions, such as Verifiable Intent.” The goal is that a consumer’s authorization can be understood consistently no matter which card network or bank is involved, instead of each network building its own incompatible version of the same idea.
It’s also a different layer from tools like Cloudflare’s Kitesurf browser and the x402 protocol, which focus on how an agent actually executes a payment at checkout, recognizing a paywall and completing a transaction without a human clicking “confirm.” EMVCo’s framework sits earlier in the process: it’s about establishing and tracking what a consumer authorized in the first place, not about the mechanics of moving the money. The two kinds of infrastructure are meant to work together rather than compete.
Who Can Weigh In, and Feedback Deadline
EMVCo has opened the draft framework for public review and is inviting feedback from anyone with a stake in card payments: banks, card networks, merchants, payment processors, technology vendors, and other industry participants. Comments can be submitted through EMVCo’s website, and the review period closes on Wednesday, September 30, 2026. EMVCo says the feedback will shape further specification work, including possible future additions such as “Know Your Agent” identity checks and indicators that flag when a transaction involved an AI agent rather than a person.
