The global technical organization EMVCo has officially released a draft framework aimed at establishing a secure, interoperable, and scalable foundation for agentic payments, marking a major milestone in the evolution of artificial intelligence-driven commerce. As autonomous software agents increasingly execute purchases, manage budgets, and handle financial transactions on behalf of human consumers, the financial services ecosystem faces unprecedented challenges regarding liability, authorization tracking, and real-time state management. EMVCo’s newly introduced draft addresses these complex vulnerabilities by proposing a standardized architecture designed to govern how AI agents interact with traditional card-based payment rails.
The rapid rise of autonomous commerce has shifted technological discourse away from simple chatbot interfaces toward true agentic execution—systems capable of negotiating, purchasing, and managing subscriptions without direct human intervention at the exact moment of checkout. While this shift promises immense efficiency for consumers and enterprises alike, it introduces profound questions regarding accountability and security. When an algorithm commits funds, traditional security checkpoints designed for human users frequently fail to capture the nuances of delegated authority. EMVCo’s proactive initiative seeks to bridge this gap, establishing a universally trusted protocol that safeguards merchants, financial institutions, and everyday users.
Understanding the Challenges of Agentic Commerce
At the heart of the current debate surrounding agentic commerce is the complex issue of liability. When an artificial intelligence agent makes an unauthorized purchase, exceeds a designated financial threshold, or falls victim to a sophisticated cyberattack, determining fault becomes an intricate legal and technical puzzle. Traditional payment verification methods assume a direct, synchronous line of sight between the cardholder and the point of sale. Agentic payments, however, operate asynchronously. An agent might be granted permission to monitor prices over weeks, automatically completing a transaction when optimal conditions are met.
Through extensive technical exploration, EMVCo identified a critical vulnerability in how these asynchronous scenarios are handled. In agentic payment flows where intent must be managed dynamically over extended periods—such as recurring monthly subscriptions, cumulative spending budgets, and post-transaction dispute resolution—users require a reliable mechanism to manage a shared intent “state.” Without a unified framework, multiple participants in a single transaction lifecycle lack a consistent, standardized method to verify what the consumer originally authorized, whether that authorization remains valid, and precisely how much of the allocated budget has already been expended.
To solve this systemic friction, EMVCo’s proposed framework introduces a dedicated layer known as “Intent Services.” This shared architectural layer allows all authorized payment participants—including issuers, acquirers, merchants, and agent providers—to register, retrieve, reference, and update consumer-authorized intent before, during, and after a transaction occurs.
The Architecture of Intent Services
EMVCo’s proposed framework is meticulously designed to complement, rather than completely replace, existing cryptographic methodologies aimed at proving consumer intent. While advanced cryptographic solutions such as Verifiable Intent provide robust mathematical assurance that a consumer initially authorized a specific software agent to act on their behalf, they often struggle with the dynamic, evolving nature of multi-step or recurring commercial agreements.
This is where Intent Services step in to fill the operational void. By acting as a common coordination point, the framework allows ecosystem participants to accurately interpret and manage consumer authorization as it adapts over time. The comprehensive draft specification outlines specific ecosystem roles, standardized data fields for registering intent, protocols for maintaining accurate lifecycle and state information, and secure channels allowing authorized parties to query intent-related data in real time.
Junya Tanaka, Chair of the EMVCo Executive Committee, emphasized the critical necessity of this infrastructure during the announcement of the draft release. “Card-based agentic payments require a globally interoperable foundation that consumers, merchants and issuers can all trust,” Tanaka stated. “This publication marks an important step forward by outlining a consistent approach for establishing and communicating intent alongside payment-related information, and we encourage participants from across the industry to share their feedback to shape its ongoing development.”
Collaborative Industry Engagement and Chronology
The release of the draft framework is the culmination of extensive internal research and cross-industry collaboration. EMVCo has maintained a dedicated Agentic Payments Task Force tasked with analyzing the intersection of artificial intelligence, consumer authorization, and global payment standards. This specialized task force has been actively engaging with EMVCo Associates, Subscribers, and prominent technology consortia to ensure the proposed framework addresses the multifaceted needs of the modern digital economy.
In developing the architecture, EMVCo has actively collaborated with several key industry partners, including the FIDO Alliance, the OpenID Foundation, the OpenWallet Foundation, and the World Wide Web Consortium (W3C). This multi-stakeholder approach ensures that the payment-specific framework harmonizes seamlessly with broader digital identity, credential management, and web-standard technologies currently being deployed across the global internet ecosystem.
The timeline for the initiative moves rapidly. Following the release of the specification document, EMVCo opened a formal public comment period, inviting fintech innovators, banking institutions, merchant associations, and technology developers to review the draft and submit constructive feedback. Interested stakeholders have until Wednesday, September 30, to provide their formal comments on the proposed specifications via the official EMVCo submission portal.
Broader Impact and Future Technological Roadmaps
The establishment of a common foundation for card-based agentic payments is expected to yield ripple effects across the entire suite of existing EMV specifications. EMVCo anticipates that the foundational insights gained through the agentic payments framework will directly inform potential future enhancements to established technologies, including EMV 3-D Secure (3DS), EMV Payment Tokenization, EMV Secure Remote Commerce (SRC), and the EMV Digital Payment Credential (DPC). By integrating agent-awareness into these proven security layers, the global payments industry can preemptively mitigate emerging fraud vectors tailored to automated systems.
Looking beyond the immediate draft framework, EMVCo is already evaluating advanced capabilities for subsequent publications. Among the most anticipated are capabilities related to “Know Your Agent” (KYA) verification protocols and standardized Agentic Transaction Indicators. Similar to how Know Your Customer (KYC) regulations prevent financial crime at human onboarding, KYA could empower payment participants to securely identify the specific software agent operating within a transaction, communicate vital trust attributes regarding the agent’s developer and security posture, and instantly signal when a transaction is being executed by an autonomous entity rather than a human cardholder.
These future enhancements aim to provide merchants and issuers with granular visibility into automated traffic, allowing them to optimize risk-scoring models, reduce false-positive decline rates for legitimate AI-driven purchases, and maintain absolute transparency within the digital commerce ecosystem.
Implications for Financial Institutions and Merchants
As autonomous agents transition from experimental novelties to mainstream commercial actors, the financial sector faces an imperative to adapt its infrastructure. For legacy issuers, the shift requires rethinking authorization engines to process machine-speed transactions without compromising compliance mandates or consumer protection laws. For merchants, integrating with EMVCo’s proposed Intent Services could unlock frictionless conversion rates, allowing high-intent AI shoppers to navigate complex checkout funnels securely and efficiently.
Ultimately, EMVCo’s draft framework represents a foundational bridge between the rigid, security-first architecture of traditional card payments and the fluid, autonomous capabilities of modern artificial intelligence. By establishing clear rules of engagement, standardized intent tracking, and collaborative governance, the organization is laying the groundwork for a secure and scalable future where humans and machines can transact with mutual confidence. Stakeholders across the global payments landscape are now tasked with reviewing the blueprint and contributing their expertise before the September deadline, ensuring the final standard robustly supports the next generation of global commerce.
