Mastercard Agent Pay: How It Works

Mastercard Agent Pay is Mastercard's answer to the central trust question in agentic commerce: how does the network know an AI-initiated transaction is legitimate and authorized by the cardholder? Agent Pay layers tokenization, authentication and agent-specific fraud prevention on top of standard Mastercard authorization.

Mastercard announced Agent Pay in 2025 and has been rolling it out by market through 2026. Fiserv was the first major processor to integrate it (announced January 2, 2026), wiring it into its tokenization, authentication and fraud-prevention pipelines so merchants on Fiserv processing inherit support. Check Mastercard's current announcements for rollout status in your markets.

Mastercard has also said it works across the major agentic commerce protocols, including UCP, AP2 and ACP, alongside Agent Pay. The expectation is that the network, and the shopper's agent, pick the protocol. The network adapts to whichever one the shopper's agent is using.

Agent Pay sits at the network and processor layers, not the merchant layer. The flow:

1. Agent registration. Agent vendors (ChatGPT, Google AI Mode, custom enterprise agents) register with Mastercard's agent registry. Each registered agent gets verifiable credentials.

2. Consumer authorization. The cardholder authorizes the agent's transaction scope (amount, merchant, time window) through their issuing bank or wallet. The authorization is tokenized so the network alone holds the raw card credentials.

3. Transaction-time verification. When the agent initiates a payment, Mastercard's network checks the agent's registered credentials, the consumer's authorization scope, and runs agent-specific fraud rules (velocity, mandate-vs-transaction matching, anomaly detection on agent behavior patterns).

4. Standard authorization. If the checks pass, the transaction enters the normal Mastercard authorization flow with agent signals included in the response. The merchant's integration is unchanged from a card-not-present transaction.

From the merchant's side, Agent Pay is invisible at integration time once the processor supports it. The network handles agent verification. The merchant submits a normal authorization request.

The three payment-layer protocols differ in scope and ownership:

In practice, Visa transactions clear through Visa TAP, Mastercard transactions through Agent Pay, and AP2 is an authorization layer either can work with. The network behind the shopper's card determines the path.

Retailers don't directly integrate Agent Pay. The integration work happens at the processor layer (Fiserv first, others following through 2026). What matters at the retailer level:

1. Chargeback defense. Agent Pay transactions carry verifiable consumer authorization. Disputes that previously fell into "my agent did this" gray areas now have audit-trail-grade evidence at the network level.
2. Reduced manual review. Agent Pay transactions get scored by network-level agent-fraud rules, so retailers don't need to manually flag every AI-initiated purchase. They clear the same way human transactions do.
3. Higher safe limits. Without strong agent verification, networks and processors throttle agent transactions to small amounts. Agent Pay unlocks recurring agent purchases (subscriptions, replenishment, restocking) at higher value bands without losing dispute defense.

The practical move is to confirm your processor supports Agent Pay and let the network handle agent verification. The part of agent commerce that does need your attention is earlier in the journey: whether the agent finds and understands your products. That depends on the product information behind each listing, which is the work Paz handles for ecommerce teams.