Twenty-six companies put their names on the same working coalition on Tuesday, August 18, and two of them were Visa and Mastercard — the two networks that spend the rest of the year shipping competing agentic products against each other. The convener was not a network, not a bank, not a standards body. It was Rain, a stablecoin card issuer that closed a $250 million Series C in January at a $1.95 billion valuation and holds Principal Member status at both networks.

At 09:00 ET, Rain announced the Agentic Payments Alliance (APA). There is no spec. There is no charter yet — members are expected to write one together. There is no product. What there is: a stated first agenda of three unresolved questions — how agents get authorized, how fraud gets caught when the buyer is software, and how loyalty and rewards travel with an agent — plus advocacy on the regulatory questions none of it has answers to. Those questions are being answered right now anyway, privately, inside individual company roadmaps. The stakes are whether the answers converge enough to interoperate, or whether merchants spend the next three years writing integration code against six mutually incompatible definitions of "authorized agent."

What the alliance is, and what layer it sits on

Rain's own language is unusually careful about ownership: "The Alliance itself is a working coalition, run collectively by its founding members rather than owned by any one company. Members will set its charter and mission together." Early work, per the announcement, "is expected to include shared research and frameworks, testing emerging standards for agent identity and authorization, and advocacy on the regulatory questions agentic commerce raises."

Read that as three verbs — research, test, advocate — and note the absence of a fourth: publish. Nothing has been standardized. Nothing has been ratified. The APA at launch is a room, and the news is who agreed to sit in it.

The layer distinction matters for anyone deciding whether this competes with what they already integrated. The x402 Foundation, housed under the Linux Foundation with roughly 40 members, is a protocol effort — machine-native payment over HTTP 402, a wire format for an agent to pay a resource. The APA is not that. It is the governance and policy layer above the wire: who is this agent, who delegated to it, what is it allowed to buy, how does a risk engine tell a legitimate one from a scripted attack, and what happens to the cardholder's points when a bot makes the booking. You can implement x402 and still have no shared answer to any of those. That gap is the entire premise.

Nor is APA a new card product. Visa Intelligent Commerce and the Trusted Agent Protocol exist. Mastercard Agent Pay exists. Visa went live on agent-initiated merchant transactions in the EU in July. American Banker's John Adams noted the obvious tension in his August 18 piece: many of these members, Visa and Mastercard included, have already built agentic tooling for banks and card issuers. They are bringing competing implementations to a table whose purpose is to make competing implementations talk to each other.

Sherri Haymond, EVP and global head of Digital Commercialization at Mastercard, framed the motive plainly: "The risk in a moment like this is not that the industry moves too slowly — it's that innovation outpaces alignment. For decades, Mastercard has helped shape the standards that enable commerce at scale, and our participation in the Agentic Payments Alliance is a natural extension of that work for the agentic era."

Rain co-founder and CEO Farooq Malik put the convening logic more bluntly: "No single company should get to decide how agents transact on someone's behalf. That has to come from the platforms building the rails, the regulators setting the rules, and the innovators closest to how agents are actually being used today. We initiated the Agentic Payments Alliance to put all of these parties in the same room, and to do it now, while the category is still taking shape."

The coalition math

The full 26: Avalanche, Basis Theory, Chainalysis, Circle, Coinflow, Crossmint, delta Network, Episode Six, Evertec, Fireblocks, Fiserv, Kala, Lithic, Mastercard, Monad, PayOS, Rain, Remitly, Rialo by Subzero Labs, Sardine, Shift4, Solana, Turnkey, Uniswap Labs, Visa, and Yuno. Rain headlined six: Visa, Mastercard, Fiserv, Circle, Solana, Remitly.

Sort them and you get four constituencies that do not usually share a working group. Card networks and processors: Visa, Mastercard, Fiserv, Shift4, Evertec, Episode Six, Lithic, Yuno, Coinflow, PayOS, delta Network. Crypto rails and custody: Solana, Avalanche, Monad, Rialo, Uniswap Labs, Circle, Fireblocks, Turnkey, Crossmint, Kala. Risk, data and compliance: Chainalysis, Sardine, Basis Theory. And one large remittance operator, Remitly, which is the member most likely to surface cross-border and licensing friction that the others can wave away.

Zil Bareisis, director at Celent, gave American Banker the comparison the organizers clearly want made: "In the credit card world, EMVCo — an entity that brought together all major networks: American Express, Discover, JCB, Mastercard, UnionPay and Visa — has been driving the development of security standards for card transactions for years." He also gave the structural argument for why a Rain-convened body might work where a network-run one would not: "While traditional payment networks will play a major role in agentic commerce, other players will do as well. A broad alliance, such as Agentic Payments Alliance announced here, that brings together companies from different domains, stands a better chance of becoming adopted than anything done by any of those companies individually."

His warning is the part operators should file: "It's natural for the forerunners to launch their own protocols and standards, and we've seen plenty of examples of that already around agentic commerce. But at some point, those standards must converge to achieve scale. Different approaches used by different providers is not viable in the long run, as it lacks interoperability and consistency, driving up costs for the industry and undermining confidence and trust."

Sophia Goldberg, head of payments at Rain, described the origin as pattern recognition across sales calls — the same protocol and risk questions surfacing in separate conversations with different clients and partners. "We're trying to be the unifying force in some of these conversations," she told American Banker. She was also the member of this launch most willing to say the quiet part: "Agentic commerce is very early. Everyone has the question of when the big volume will hit."

Rain cited McKinsey's $3 trillion to $5 trillion by 2030 estimate in its own materials. Treat it as the number the convener chose to anchor on, not as evidence of anything.

What is already running underneath

Rain did not arrive at this convening empty-handed, which is part of why it could convene at all. Its Agent Control Layer, released in June 2026 and still in beta, enforces spending policy at the moment of card issuance and transfer initiation rather than through after-the-fact monitoring. Rain's framing: "By the time an agent attempts to transact, the governing rules are already in place, and a transaction that falls outside them does not proceed."

Agent-level controls cover transaction amounts, merchant and category allowlists, spend intervals, and card expiry. Rain's own example — an agent issued a card for a single booking, limited to approved airlines or hotels, capped, and time-boxed. Outside those parameters, the card does not transact. Program-level controls cap the number of active cards and aggregate spend. On money movement — virtual accounts, onramps, offramps, fiat and stablecoin — counterparties, amounts, frequency and timing are constrained, and "changes to those terms require explicit action by a human administrator."

Scoped Cards are the delivery mechanism: virtual credentials funded from a user's stablecoin balance, usable anywhere Visa is accepted online across Rain's stated footprint of more than 175 million merchant locations in over 200 countries and territories. Sponge, a Y Combinator W26 company founded by Stripe alumni and building wallets, accounts and cards for autonomous agents, is issuing agent-usable cards on Rain in production today.

Rain says agents have been transacting on its infrastructure in production for months — booking travel, subscribing to software, running procurement workflows, moving money globally. That is a narrow but real production base, and it is the credential that lets a stablecoin issuer put two card networks in the same room.

For scale contrast: Visa's Agentic Ready Program has already pulled more than 85 partners into a formal certification process for agent-initiated transactions, as Forkast's Nolan Pratt noted in his August 20 analysis. Visa is working the issuer layer. The APA's claim is on the cross-industry layer above it.

Fraud is the part nobody has solved

The authorization question is tractable — it is policy plumbing, and Rain has shipped a version of it. Fraud is harder, because the detection systems banks run were trained to treat automation as an attack signal.

Michael Rodriguez, chief growth officer at Darwinium, told American Banker that banks are not doing a good job distinguishing good bots from bad ones. Darwinium's bank research puts numbers on the split: 48% of respondents allow AI transactions by default and rely on after-the-fact monitoring, while 31% proactively block transactions unless explicitly allowed. That is a market with no shared posture at all — half permissive, a third restrictive, and no common vocabulary for what a legitimate agent looks like at the authorization request. Visa's acquisition of BioCatch sits in the same problem area from the behavioral-signal direction.

If the APA produces one durable artifact in its first year, the useful one is a shared representation of agent identity and delegated authority that a risk engine can actually consume. Everything else is downstream of that.

Adjacent this week

Alibaba reported June-quarter results on August 20: revenue up 9%, reported in secondary coverage at $39.6 billion, with net income down roughly 75-76% as capex rose 75% to 67.7 billion yuan — about $10 billion. Cloud external revenue grew 45%; AI-related product revenue posted triple-digit growth for a twelfth consecutive quarter. CEO Eddie Wu said 250 million users have completed their first AI-driven shopping experience using the company's flagship Qwen model, and that "going forward, we'll also collaborate with Qwen Office to launch AI agents that are specifically tailored for eCommerce scenarios." Qwen models have been downloaded 3 billion times in the last six months. Read that as the demand-side proof the APA's supply side is being built for — and as a reminder that the largest agentic shopping funnel currently operating is not governed by any Western coalition.

Binance Agent OS shipped August 20, letting ChatGPT, Claude Code, Codex and Cursor connect to Binance for analysis and trading through subaccounts, with withdrawals blocked by default and reported daily limits of $50,000 for regular swaps, $100,000 for DeFi and $20 for x402 payments. TechCrunch's framing was that keeping agents in check is largely up to users. That is precisely the design default the APA exists to argue about.

What could break it

Divergent economics. Forkast identified the fault line directly: the interests of crypto-native protocols like Solana and Avalanche often diverge from those of traditional payment processors like Fiserv or Shift4. Interchange, settlement finality, chargeback liability and loyalty economics do not resolve the same way on both sides of that room. A charter written by consensus among 26 parties with opposed revenue models tends toward the vague.

No governing authority. Forkast calls the APA "not a product launch but a governance experiment," and compares the play to The Clearing House's approach with tokenized deposits. EMVCo works because six networks control the endpoints. The APA controls nothing. Its output is only as binding as its members choose to make it.

The legal and legislative vacuum. The CLARITY Act remains stuck, with a Senate procedural vote scheduled September 15 and passage odds Forkast puts at roughly 19-20 percent. The White House hosted a crypto summit on August 19 at the Eisenhower Executive Office Building focused on regulatory architecture. Separately, the Ninth Circuit's August 4 decision in Amazon v. Perplexity vacated a preliminary injunction, with Amazon filing for en banc rehearing around August 18 — meaning the door for user-directed browser agents is currently propped open by litigation while the permissioned-rail door is exactly what the APA is trying to write. Forkast's summary of the posture: "They are not waiting for permission; they are building the rails and inviting the regulators to watch."

Volume. Goldberg's own question — when the big volume hits — has no answer. A standards body convened ahead of demand is either prescient or premature, and nothing announced this week distinguishes the two.

What to do with this

Audit your agent stack against the three gaps the Alliance itself hasn't closed. Twenty-six members signed on and not one of them has published a specification. Authorization, fraud liability, and loyalty attribution are all named as priorities and all undefined. That means every agent you deploy between now and whenever the first draft lands is running on rules you wrote yourself, and those rules will need to be re-written. Write them anyway — but write them so they can be torn out. Hard-code nothing about how an agent proves it had permission to spend, because that is precisely the layer the coalition will standardize first and the one most likely to look nothing like your internal version.

Treat Visa and Mastercard's joint presence as a signal about timing, not novelty. The two networks already overlap on agentic work elsewhere — Visa's Agentic Ready program expanded globally this year, and Mastercard has its own agent credential track. What's new is that both chose to put people inside a 26-member coalition convened by a stablecoin card issuer rather than waiting to arbitrate the standard from above. Networks join committees when they think the committee will produce something they'd otherwise have to comply with. Plan for the output to have teeth.

Assume the regulatory floor stays where it is through at least the fall. The CLARITY Act faces a Senate procedural vote on September 15, 2026, and procedural votes are not passage. Congress moving slowly is the whole reason a private coalition is drafting the rules for agent-initiated payments, and it's why the drafting is happening in a Slack channel instead of a rulemaking docket. If your compliance posture is "wait for the statute," you are waiting behind a coalition that will have shipped by then.

Stop treating agentic demand as speculative. Alibaba CEO Eddie Wu said 250 million users have completed their first AI-driven shopping experience using Qwen. Binance shipped Agent OS and let AI agents trade, with the supervision burden landing largely on users. Those are not pilots. They are volume, on two continents, in two asset classes, with the safety layer unbuilt in both cases. The Alliance is a supply-side answer to a demand-side fact that already happened.

If you build in this space, get in front of the cohort before it's assembled. Rain is still recruiting members, the first cohort of five startups is unnamed, and the demo day has no date attached. Sponge is a production partner on the infrastructure side, not a cohort company — don't confuse the two when you're mapping who's inside. The address is [email protected] and the window for shaping a spec is always shorter than the window for complying with one.

Pull your agent authorization logic into a single module this week and find out how many places it leaks.

Sources