Agentic Payments Landscape — protocols, sources and status, 2026-07-21

menu<br>dark

Agentic Payments<br>Landscape

Layers

01The stack

Four contested layers over one uncontested substrate. Discovery does not get its own band —<br>UCP treats discovery through post-purchase as a single protocol, which is the industry's own answer<br>to where that boundary sits. Click any protocol to jump to its entry.

02Protocol catalog

Every protocol, rulebook and rail in scope, grouped by the layer it operates at.<br>Status separates what ships today from what was only announced. Expand any card<br>for mechanics, known gaps and named adopters.

03What moved

Status transitions, new capabilities and corrections to the record, newest first. Longer-run<br>history lives in the timeline below; this is only what has changed recently.

Movement history appears once the pipeline has run.

04Who governs what

Standards-body cover is thinner than the press releases suggest. No binding rule requiring agent<br>identity in payments exists in the US, UK, EU, Singapore or India.

BodyOwnsStateSinceReality check

05By jurisdiction

Ordered by how far each regulator has actually gone. The gap between rhetoric and rule is wide<br>everywhere — and the only binding text governing agent payments anywhere in the world is a card<br>scheme's private rulebook.

JurisdictionPostureWhat existsBinding?

06Regulatory clock

The binding constraints over the next 24 months are not new AI rules — they are old rules with 2026<br>and 2027 dates. Three comment windows are open right now — two US, one Indian — and all three are places to put<br>a position on the record before the frameworks harden.

Nobody has allocated prompt-injection loss. Not Visa, not Mastercard, not Reg E, not<br>Reg Z, not PSD2, not PSD3/PSR. Amex's Agent Purchase Protection is the sole exception and covers only<br>registered-agent error against certified intent. Price it as an uninsured operating cost.

07How it happened

Six years from LSAT — the first HTTP-402 revival, five years before x402 — to a landscape with<br>five competing checkout and settlement standards, one binding rulebook, and an unresolved federal<br>appeal over whether agents may act inside a logged-in session at all. Most of it happened in the<br>last fourteen months.

08Watchlist

Names that keep coming up but are not in the catalog above, with how often they<br>have appeared. Being mentioned is not the same as being real — this is a reason to look, not a<br>claim that any of it matters yet.

Nothing on the watchlist.

close