EMVCo Drafts First Framework to Bring Consumer Authorisation Context to AI Agent Payments

A New Layer of Trust for the Age of AI Agents

When a consumer instructs an AI agent to book a flight, reorder household supplies or execute a standing grocery run, something important happens before any money moves: the consumer defines the limits of what that agent is permitted to do. Today's card payment infrastructure has no reliable way to carry that authorisation context through a transaction. EMVCo, the technical body jointly governed by American Express, Discover, JCB, Mastercard, UnionPay and Visa, is working to change that.

The organisation has published a draft framework — the EMV Agentic Payments: Framework for Specifications v1.0 — and opened it for public comment, with the feedback window closing 30 September 2026. The document sets out the conceptual architecture for how consumer intent and delegated authority could be communicated alongside card-based payments initiated by AI agents, rather than directly by a human at a point of sale or checkout page.

The Problem the Draft Is Trying to Solve

Traditional card payments are built around a simple two-party assumption: a cardholder decides to pay, and that decision is expressed immediately through a tap, dip or click. Agentic commerce breaks that model. An agent acting on a consumer's behalf may initiate a transaction minutes, hours or days after the original instruction was given, in a context the merchant and issuer cannot independently verify.

This creates at least three friction points the industry has not yet resolved at scale. First, issuers lack a standardised signal indicating whether a transaction was human-initiated or agent-initiated. Second, merchants have no common mechanism to confirm that the agent presenting a payment token is operating within the consumer's stated limits — on amount, merchant category, frequency or any other constraint. Third, dispute resolution becomes ambiguous when neither party in the clearing chain holds a record of what the consumer actually authorised the agent to do.

The card payment ecosystem was not designed to answer the question of who — or what — decided to spend. EMVCo's draft framework is, at its core, an attempt to make that question answerable in a standardised way.

What the Framework Addresses

Based on EMVCo's published announcements and the high-level descriptions made available during the comment period, the draft framework identifies a set of functional requirements rather than prescribing a finished technical specification. EMVCo has stated publicly that its goal is to ensure card-based agentic payments are secure, interoperable and scalable — language that mirrors the body's standard design principles for EMV chip and tokenisation work.

The framework is understood to address how authorisation scope — the boundaries a consumer sets on an agent's ability to transact — can be represented, conveyed and verified across the four-corner model involving issuers, acquirers, merchants and networks. It also engages with questions of liability allocation when a transaction falls outside a consumer's stated intent, a gap that existing chargeback frameworks are ill-equipped to handle cleanly.

EMVCo has separately noted it is examining how its existing global specifications, including those governing tokenisation and 3-D Secure, might be extended or adapted to support agentic use cases — suggesting the final output could be an overlay on existing infrastructure rather than a parallel system.

Industry Context

The draft lands at a moment of intensifying commercial activity around agentic payments. Card networks and large technology platforms are developing proprietary approaches to agent authentication and payment delegation. Without a shared interoperability layer, the risk is a fragmented landscape in which a consumer's AI agent can transact seamlessly with one merchant ecosystem but faces friction or outright rejection at another — an outcome that would replicate, at the application layer, the compatibility problems EMV chip standardisation was designed to eliminate at the hardware layer.

EMVCo's consultation process is designed to surface objections and refinements from across the payments industry before specifications are finalised. Historically, the gap between a framework draft and a ratified EMV specification has spanned multiple years, meaning commercial deployment at scale remains some distance away even if the comment period produces a workable consensus.

What Comes Next

The 30 September 2026 comment deadline is a milestone, not a finish line. EMVCo will review industry submissions before determining whether revisions to the framework are needed and when formal specification development work will begin. The organisation has not published a timeline for a final specification.

For issuers and merchants building agentic commerce capabilities now, the practical implication is that any proprietary implementation will eventually need to accommodate whatever interoperability requirements EMVCo ratifies. Designing those systems with flexibility for future standardisation — rather than treating today's bespoke approaches as permanent — is likely the more durable commercial strategy.