The Card Network Alliance That Reveals the Real AI Payment War

The same two card networks that have spent twenty years battling over interchange fees just agreed on something. Visa and Mastercard, alongside Ant International, are jointly building a cross-network identity standard for AI agents called KYA—Know Your Agent. The announcement is buried in industry newsletters, accompanied by vague press statements about "interoperability" and "frictionless commerce." The data shows something else entirely: this is a defensive coalition formed out of mutual fear, not opportunity. Context: What is KYA and Why Now? KYA is a proposed verification layer that answers two questions about an AI agent: who is it, and who does it represent? The idea is simple—once an agent is verified in one network (say VisaNet), it can initiate payments across Mastercard or Alipay+ without repeated registration. The three parties are building a federated trust framework, akin to W3C Verifiable Credentials or FIDO, but applied to the specific problem of autonomous payment authorization. The timing is no accident. By late 2025, the first wave of agentic commerce—AI assistants booking flights, negotiating subscriptions, and executing B2B procurement—is hitting the fringes of mainstream adoption. Google launched AP2 (Agent Payment Protocol). OpenAI partnered with Stripe on ACP (Agent Commerce Protocol). These are not experimental sandboxes; they are live experiments in how machines pay for services. And they all bypass the traditional card networks’ authorization flow. The card networks see their centuries-old role—trust intermediary—being replaced by a stack where the agent’s identity is managed by the platform that hosts it. Core: The Architecture of a Defensive Play Let me be precise about what this coalition reveals. It is not a product. It is a standards body in embryonic form, competing with at least two other developing standards. The technical architecture is federated: each network retains its own identity registry, but they agree on a shared protocol for exchanging trust assertions. This mirrors the architecture of early decentralized identity projects like Sovrin or the more pragmatic OAuth 2.0 token exchange pattern. During my 2017 smart contract audit sprint, I learned that federated trust is only as strong as the weakest link in the assertion chain. When I audited the 0x Protocol v1 exchange contract, I found reentrancy vulnerabilities that propagated through the mesh of relayer contracts. KYA faces a similar risk: if a single network’s verification method is compromised—say, a malicious agent forges its identity credentials on Ant’s side—the mutual recognition clause instantly propagates that fraud across Visa and Mastercard networks. The code does not lie, but it does leave traces. The trace here is a single point of trust propagation. The real technical debate is unstated in the press releases: who holds the root of trust? Is it a shared ledger? A multi-party computation that requires a quorum of all three? Or a simple bilateral memorandum that each party stores independently? The latter is the most likely for speed, but it is the least resilient. If the three parties cannot agree on a shared root-of-trust model, they will default to bilateral agreements—effectively replicating the problem they claim to solve. But the deeper story is not technical; it is economic. The business model behind KYA is classic “infrastructure land grab”: zero direct revenue, all upside depends on total transaction volume flowing through agent-initiated payments. The three networks are placing a bet that the share of payments automated by agents will grow from near-zero to double-digit percentages within three to five years. They are paying upfront to own the identity middleware layer, because they fear being reduced to a dumb settlement rail—a commodity pipe that loses pricing power and consumer relationships. Contrarian: The Alliance That May Not Survive Its Own Success The conventional take is that this is a smart, preemptive move by established players to define a standard before Big Tech does. I disagree. This alliance has three critical blind spots that will likely kill it or render it irrelevant. First, the cold start problem. KYA has zero value until enough agent developers and merchants integrate it. The three parties control large merchant networks, but those merchants are not yet deploying AI agents at scale. Without a critical mass of agents on the other side, the identity layer remains an empty shell. Visa and Mastercard have tried before to launch new payment protocols—look at the adoption curve of 3-D Secure 2.0, which took nearly a decade to reach meaningful penetration. Agent commerce moves faster. By the time KYA gains traction, platforms like OpenAI or Google will have already defined de facto standards through sheer developer adoption. Second, the responsibility vacuum. KYA verifies identity, but it does not verify the legitimacy of the instruction. If an agent unauthorized by its principal makes a payment, who bears the loss? The networks will push the liability to the merchant; the merchant will push it to the platform that hosted the agent; the platform has no contract with the payment networks. The result is a wave of chargeback disputes that undermine the entire premise of trustless automation. Yield is a symptom, not the cure. The yield here is the transaction volume—but the hidden cost is the fraud liability that no one has modeled yet. Third, the alliance’s fragility. Visa and Mastercard are direct competitors in every other business line. Ant International is a Chinese entity that faces geopolitical headwinds in both the US and EU markets. The moment any one of them believes they can capture more value by going solo—say, by acquiring a startup that builds a more elegant identity protocol—the coalition dissolves. Governance is the art of managing disagreement. This agreement has no governance mechanism other than a press release. When disagreements surface over technical standards or revenue sharing, there is no arbitration layer. I have seen similar alliances (the Enterprise Ethereum Alliance, the blockchain consortia from 2018) that died precisely because the incentives to cooperate never matched the incentives to defect. Takeaway: The Real Battleground Is Not the Standard—It Is the Developer Ecosystem The question investors and builders should be asking is not whether KYA is technically sound, but whether it can integrate into the workflows of the developers who are building the next generation of AI commerce agents. The card networks are not competing against each other; they are competing against an alternative paradigm where trust is managed by the agent’s hosting platform through cryptographic signatures and on-chain attestations. My experience designing governance for a mid-sized DAO in 2024 taught me that network effects can be synthetic—if you align incentives properly, you can bootstrap adoption even without a product. But that requires a long-term vision that runs counter to quarterly earnings. I am not optimistic. The most likely outcome is that KYA becomes a regional standard—adopted in markets where card networks remain dominant and where Big Tech is less entrenched (Southeast Asia through Ant, parts of Europe through Mastercard). But in the US and China, the platforms will develop their own identity layers, and the cross-network vision will be reduced to a handful of bilateral integrations. In the red, we find the structural truth. The red here is the 0.5% of fraudulent agent transactions that will eventually surface, causing a regulatory backlash that forces every player to retreat into walled gardens. The irony is that the card networks’ biggest advantage—their established compliance infrastructure—will become their biggest liability, because regulators will hold them accountable for every agent transaction they clear. The coalition does not yet understand that they are not building a moat; they are building a target. And in the new world of agent commerce, the safest path may be to not own the identity layer at all.