Know Your Agent: Five Trust Protocols, No Standard, and Money20/20 Opens With the Payment Industry's Hardest Identity Problem

TL;DR: Money20/20 USA opens in Las Vegas today with a pointed question: how should banks and merchants verify an AI agent acting for a person? The emerging answer, Know Your Agent (KYA), links agent requests to an identifiable operator and an authorised user. But the industry has no single standard. Visa, Mastercard, Skyfire and Google are advancing distinct approaches, while an open KYA stack is also taking shape. Cryptographic proof is stronger than trusting a bearer token alone; the challenge now is making verification work across providers, payment networks and checkout systems.

The identity problem is bigger than checking whether an agent has a token

The central question in agentic commerce is not simply whether an AI agent can present a credential. It is whether the agent is authorised to take this action, for this user, under these conditions.

That distinction is at the heart of today’s Money20/20 USA panel, “Know Your Agent: Here’s How Banks Are Updating Identity Verification.” At The Venetian in Las Vegas, Skyfire CEO Amir Sarhangi, Firmly CEO Kumar Senthil, PayOS co-founder Johnathan McGowan, VGS CEO Chuck Yu and JPMorgan’s Frank Medrano will discuss identity verification for agents in payments.

The timing is notable. Authenticate 2026, hosted by the FIDO Alliance, opens tomorrow in Carlsbad with a dedicated Non-human Authentication track covering agentic AI, MCP and API protection. The events arrive amid a run of ten trust-through-defaults identity incidents in 21 days. Identity-based attacks have doubled in 2026, and 78 per cent of organisations reported identity-related breaches in the past year.

KYA aims to move beyond the traditional “do you have a token?” test. Instead, each request should be cryptographically connected to a registered agent, its operator and the user whose authority it relies on.

Five approaches are emerging, but they do not yet form one standard

The protocols below address overlapping trust questions, but they are not identical products or interchangeable payment rails. Their differences matter: an agent may need to present one form of identity proof, another form of delegated authorisation and a separate payment credential.

Player	Approach	Where it stands	Notable backers
Visa Trusted Agent Protocol (TAP)	Uses RFC 9421 HTTP Message Signatures and Ed25519 keys. Signed request headers help a merchant verify an agent against a directory of public keys. Separate signature tags distinguish browsing from payment intent.	Launched in October 2025 with Cloudflare. Merchant and agent verification includes KYB/KYC vetting, published agent identity and annual recertification.	Stripe, Shopify, Adyen, Worldpay, Microsoft and Coinbase. Specification and code.
Mastercard Verifiable Intent	Builds a cryptographic delegation chain using SD-JWT credentials to bind issuer, user and agent. Eight constraint types include amount bounds, merchant allowlists, budget caps and recurrence terms.	Open-sourced in March 2026. Protocol-agnostic, with integration mappings for AP2, ACP and other commerce protocols. Mastercard Agentic Tokens, announced in April 2025, are 16-digit network tokens scoped to an agent, merchant and consent policy.	Co-developed with Google; Worldpay, Fiserv, Checkout.com and Adyen have signed on. Specification.
Skyfire KYAPay	Uses JWT-based identity tokens to represent the human principal, agent platform and agent. Supports stablecoin settlement and tokenised card payments.	An open-standards route, with an IETF draft in progress: draft-skyfire-kyapayprofile-01.	F5, Fastly, Experian and Akamai. KYAPay.
Google Agent Payments Protocol (AP2)	Uses signed Intent, Cart and Payment mandates as tamper-evident evidence of user authorisation. Supports card networks, ACH, real-time payments and stablecoins on Base.	Announced in September 2025 and donated to the FIDO Alliance in April 2026.	More than 60 partners, including Mastercard, PayPal and Coinbase. AP2 developer information.
KYA-OS Payments Profile	Part of an emerging open KYA operating-system stack.	Still emerging; its position alongside the more specifically documented approaches is not yet settled.	No backers specified here.

This is a crowded field, but the distinctions are useful. TAP focuses on verifying an agent’s identity and request at the merchant. Verifiable Intent emphasises delegated authority and constraints. KYAPay combines agent identity with payment credentials. AP2 uses signed mandates to preserve evidence of authorisation. The KYA-OS Payments Profile represents a broader emerging stack, rather than a mature protocol with equivalent details.

The fragmentation risk may outlast the identity problem

Cryptographic binding is structurally stronger than accepting a bearer token as proof that an agent can act. A signed request can be tied to a particular agent, user, merchant or scope, making it harder to reuse a credential outside its intended context.

But if each ecosystem has its own directory model, key management and verification flow, merchants, agents and issuers inherit a new integration burden. One agent may need to support several frameworks to reach customers across different payment networks. One merchant may face multiple verification processes before it can decide whether to accept an agent-initiated checkout.

That can create new seams in the systems intended to remove uncertainty. The strategic question is not only which protocol is strongest on paper; it is whether trust signals can be translated and verified across protocols without weakening their meaning.

This is the next phase of the issue explored when Amex and Forter built the missing trust layer for agent checkout. The conversation is now expanding from a checkout trust layer to industry-wide efforts to define agent identity and authority, without agreement yet on one common approach.

Banks and platforms are already choosing different levels of control

Banks are not waiting for a settled standard. JPMorgan is restricting access by outside AI agents and advocating transaction limits, whitelisting and audit trails to manage liability. Bank of America, Wells Fargo, Capital One and NatWest have backed voluntary principles for agent transparency, safety and interoperability in “Building Trust in Agentic Commerce”.

The commercial landscape is moving too. Sierra recently introduced Poppy, the Personal Agent Protocol, to standardise how agents sign in and act on a user’s behalf. Stripe Link powers more than 70 AI agents making purchases, including Muse, Instinct and Grok Bot. Stripe President John Collison said agentic commerce “basically started going vertical” in September.

Yet the permission to transact remains contested. Amazon banned Meta’s Muse agent from shopping on its site, saying it would breach the terms and conditions for customers shopping there. Mark Zuckerberg responded that businesses that bar AI assistants “will end up not being the right strategic thing for them”. This is more than a debate about whether automated traffic is welcome: it is a question of who controls access, how user authority is demonstrated and who carries the risk when something goes wrong.

POS, PayFac, ISO, remittance and issuer teams should plan for verification choices

For operators, KYA is an architectural decision, not just a protocol discussion. First, decide which protocols to support or monitor, and whether your role is to verify incoming agent requests or issue scoped credentials that agents can present.

Merchant-side platforms (including POS providers, PayFacs and ISOs) will need to consider where verification belongs in the transaction flow, how a signature or mandate affects acceptance decisions, and how agent identity should be recorded for support and disputes. Agent onboarding may also require KYB/KYC checks, published identity information and periodic recertification, depending on the protocol.

Issuer and payment teams should assess how delegated permissions could be expressed and limited: by amount, merchant, budget, recurrence or other stated conditions. Remittance providers should consider how an agent’s identity and authority would be established alongside the payment method and settlement flow.

None of this resolves liability. A cryptographic record may help establish what was authorised, but it does not by itself settle who bears a loss if an agent exceeds its mandate. A Fenwick legal analysis from April 2026 flags unresolved US regulatory and liability questions, including whether a Verifiable Intent credential constitutes legally binding authorisation. Until the legal position becomes clearer, firms should document their controls, escalation paths and dispute handling. This is practical planning, not regulatory advice.

Frequently asked questions about Know Your Agent in payments

What is Know Your Agent (KYA) in payments?

KYA is an approach to verifying an AI agent’s identity and its authority to act for a user. It aims to connect the agent’s payment request to a registered operator and an authorised person, rather than treating a token alone as sufficient proof.

Which companies are building agent payment protocols?

Visa, Mastercard, Skyfire and Google have announced approaches described here as TAP, Verifiable Intent, KYAPay and AP2. An emerging KYA-OS Payments Profile is also part of the wider discussion, though its details and status should not be assumed to match those of the named protocols.

Why are there multiple agentic payment trust protocols?

Different organisations are addressing different parts of the problem, including agent identity, delegated user intent, transaction limits and payment credentials. Without a shared standard, each approach may bring its own directories, keys and verification process.

Who is liable when an AI agent makes an unauthorised payment?

There is no settled answer in the material discussed here. Liability may depend on the circumstances, the parties’ agreements and applicable law. Cryptographic proof can help show what an agent presented, but does not automatically determine who bears the loss.

Key takeaway: agent identity needs interoperability as well as cryptography

KYA is an important response to a real gap in AI agent payments: authenticating a payment credential does not prove that an agent had permission to use it in a particular way. But with five approaches advancing and no shared standard, the industry risks exchanging one identity problem for a complex interoperability problem. The winners will be the systems that make identity, consent and limits verifiable across the payment journey, and clear enough for operators to act on.