Visa, Mastercard and Ant create KYA, the passport that lets AI agents pay without friction

By Zendoric · September 15, 2026.

Visa, Mastercard and Ant International announced on September 10 a joint standard called KYA (Know Your Agent), designed to solve a very specific problem: when an artificial intelligence agent makes a purchase on someone's behalf, there is currently no common language allowing the various payment networks to recognize it without repeating the verification on each one. With KYA, an agent registered with Ant, Visa or Mastercard is automatically identified by the other two, with no redundant paperwork.

The protocol answers three questions per transaction: who the agent is, who authorized it and what it has permission to do. It rests on three components: operator traceability (each agent is linked to a validated person or company), a security certification shared across networks, and continuous monitoring of risk signals. Implementation will begin at BuildFin.ai, the platform the Monetary Authority of Singapore (MAS) is promoting to pilot AI applications in financial services, according to the joint statement reported by TMCnet.

None of the three companies was starting from scratch. Visa already had the Trusted Agent Protocol (TAP), launched in October 2025 and counting 12 partners —among them Adyen, Shopify and Stripe—, according to Yahoo Finance. Mastercard unveiled Verifiable Intent in March 2026, open source and co-developed with Google. Ant International launched the Agentic Mobile Protocol (AMP) in April, integrated into Alipay+, a network that connects —according to Ant's own figures cited by TMCnet— more than 150 million merchants and 2 billion consumer accounts. KYA does not replace these three protocols: it connects them under a common identity layer, so that each network keeps its own verification process but shares the result with the others. "If an agent registers with Ant, it doesn't need to register again with Visa or Mastercard," summed up Jiang-Ming Yang, Chief Innovation Officer of Ant International. Pablo Fourez, CDO of Mastercard, framed it as a condition for scale: interoperability is needed "for agentic commerce to work at scale, giving merchants, platforms, wallets and issuers a consistent way to recognize trusted agents."

The size of the opportunity explains the hurry. McKinsey, cited by iProUP, estimates that AI agents will handle between $3 trillion and $5 trillion in retail transactions by 2030. Juniper Research, cited by American Banker, puts the value of agentic commerce at $8 billion in 2026 and projects $3.5 trillion in 2031. These are different methodologies that should not be compared line by line, but they agree on the slope: for scale, all of global e-commerce moved some $13 trillion in 2025, according to the Worldpay Global Payments Report 2026 cited by TMCnet. These projections —made before the market exists in real volume— deserve the same caution with which we at Zendoric read any capability benchmark: they are the bet of whoever publishes them, not a done deal.

What does already exist is internal adoption inside companies. According to a Salesforce study cited by iProUP, the average time to build an agent fell to two days, 53% less than in the previous period, and in retail agents went from performing two tasks in 2025 to nine in 2026. Companies with customer service agents resolve seven out of ten conversations without human intervention. "We are moving from passive chatbots and predictive models to execution-oriented agents that really get down to work and generate value," said Joe Inzerillo, President of Enterprise AI and Technology at Salesforce. These are Salesforce's own figures about its customer base: they should be read as evidence of a trend, not as an independent measurement.

Here is what really matters about the announcement: it is not a product, it is a trust layer, and whoever controls it decides which agents can buy and which are left out. The fight over AI has shifted from the smartest model to the plumbing that connects it to the real world. KYA is exactly that kind of infrastructure —invisible, boring and decisive— and the fact that it is being set jointly by the three players that already control the vast majority of the world's payment rails (cards plus Alipay+) closes the door from the outset to a fourth player imposing its own identity rules.

In the short term, this is defense before service: an AI agent with access to a card and a budget is a new fraud vector if no one can verify who authorized it. It is no coincidence that the ecosystem itself is already recommending per-task authorization —the user sets the budget, the conditions and the ability to revoke— before an incident forces its adoption. Nor does interoperability solve local regulatory compliance: it reduces technical friction, it does not eliminate each market's regulation. And for startups selling through wallets or marketplaces, being left out of this standard over the next two years could mean losing sales without knowing why, because the buyer is no longer a person clicking but an agent that needs to authenticate.

Over the longer term, however, this agreement is precisely the kind of boring plumbing that makes the underlying promise possible: agents that manage routine purchases, compare prices and renew subscriptions, freeing up human time for decisions that do require judgment. The abundance we defend at Zendoric does not arrive through a leap in model capability, but through thousands of agreements like this one —protocols, identities, trust layers— that reduce the friction of delegating tasks to software acting on our behalf. Agentic commerce only scales if there is first a reliable way to know who the agent is and who answers for it; KYA is a first serious attempt to build that foundation, not a guarantee that it will work.