Hook
Forty-two percent of consumers will not let an AI agent spend more than $25 on their behalf. Only fourteen percent trust an agent at all when there is no cryptographic proof of who โ or what โ is transacting. And AI-driven retail traffic is up 4,700%.
Place those three numbers on the same ledger and the shape of the problem is immediate. Supply is sprinting. Demand is crawling. On September 10, in Sรฃo Paulo, three payment networks announced a framework they say will close the gap. Visa shipped its Trusted Agent Protocol. Mastercard shipped Verifiable Intent. Ant International brought a wallet ecosystem that touches $13 trillion in annual spending.
The framework is called Know Your Agent. On paper, it is an interoperability layer that lets a single agent identity be recognized across all three networks. Register once, transact everywhere.
Now read the announcement again and search for the word "registry." You will not find an owner. You will find "high-level intent," "ongoing work," and "cross-network recognition."
That absence is the entire article. A shared, cross-network agent identity registry is a single point of trust. Whoever operates it issues the credentials that let machines transact. Whoever issues the credentials writes the rules. Whoever writes the rules collects the rent. We trade the protocol, not the promise โ and right now, the promise is doing all the talking.
Context: a standard built in a room where no regulator sat
To understand why the missing registry matters, you have to be precise about what KYA is and what it is not.
KYA is not a payment rail. It settles nothing. It sits one layer above settlement, in what I would call the identity-and-authorization tier โ the layer that answers two questions before a transaction clears. First: is this agent who it claims to be? Second: did a human actually authorize this specific action?
Both questions sound trivial. Neither is. The first is a cryptography problem. The second is a semantics problem. And the three networks are attacking them with three different proprietary stacks that now have to talk to one another.
Visa's Trusted Agent Protocol already lists twelve partners, among them Adyen, Shopify and Stripe. Mastercard's Verifiable Intent is open-source and was co-developed with Google. Ant International's AMP is tied to its wallet distribution across emerging markets. The framework's job is to bridge these three into one trust chain โ an agent registered under any one of them should be recognized by the others.
The launch location tells you something. Sรฃo Paulo โ not New York, not Beijing. Latin America is the lowest-friction test bed: low legacy card penetration, high digital wallet adoption, and consumers who never developed a strong attachment to the incumbents now being disrupted. It is also, conveniently, a jurisdiction where none of the three networks carry their home-market regulatory baggage. That is not an accident. That is site selection as strategy.
What KYA genuinely is, at this stage, is a fact standard ahead of a regulator. There is no sanctions-screening body in the announcement. There is no central bank in the room. There is no named data-protection authority. The three networks are deliberately defining identity rules before any AI-agent regulatory regime exists โ the same way PCI DSS became the de facto card-security law years before legislators drafted anything comparable.
That is the play. Define the standard, ship it, then make it too expensive for regulators to replace. It is efficient. It is also a bet that regulators will ratify rather than rewrite. Silence on regulators is not neutrality. Silence is a wager that nobody will force the question of who governs the root of trust.
Core: the architecture, decomposed
Let me do what I do with yield protocols โ take the mechanism apart until the risk is visible on the surface.
The translation layer is not the hard part. Bridging three identity protocols is engineering, not mystery. The three networks can agree on message formats, credential schemas, and revocation lists. This is the W3C Verifiable Credentials and Decentralized Identifier paradigm wearing a payments suit. It is solved work. Anyone who tells you the interoperability itself is the innovation is selling you the easy half โ the half that photographs well in a press release and generates zero durable margin.
The hard part is the trust root. "Register once, recognized across all networks" is a load-bearing claim. It requires either a single unified registry or a federation of registries that mutually recognize each other's issuance. The launch material never stated which. That is not an oversight. It is an unresolved negotiation, and the negotiation is the point. The entity that owns the registry performs a function identical to a certificate authority on the web. It decides which agents exist, under what conditions, and at what price. That is a perpetual annuity dressed as infrastructure โ and the three parties have not yet agreed who holds the pen.
The second unsolved problem is intent verification. Cryptography can prove which agent is transacting. It cannot easily prove that the human behind the agent actually meant to buy this thing, at this price, right now. Mastercard's decision to open-source Verifiable Intent and co-build it with Google is a land grab for the semantic layer โ the layer where the word "authorized" is defined. This is a deeper moat than identity itself. Identity tells you who; intent tells you whether to allow. Whoever standardizes intent controls the risk decision, not merely the login. A network that owns intent owns the default. Everything downstream โ routing, fees, dispute handling โ bends toward whoever owns the default.
The third gap is the bank account. Nowhere in the framework does an issuing bank or account system appear. Agent payments eventually have to land in a bank account. If the identity layer never reaches the account-authorization tier, "interoperability" stops at the front door and never becomes an end-to-end clearable loop. When a Visa executive mentions issuing banks, that is a signal, not a courtesy. The next phase requires pulling banks into the standard, and banks โ institutions that have spent decades resisting disintermediation โ will have their own opinions about who controls identity.
Now the threat model. Visa's $2.4 billion acquisition of BioCatch tells you exactly where the danger points. BioCatch is behavioral biometrics: the analysis of how a human moves, types, hesitates, and holds a device. Embedding behavioral biometrics into an agent identity chain means using a person's physical behavior as the trust anchor for that person's machines. Under GDPR and analogous regimes, behavioral biometrics is sensitive personal data requiring explicit consent and a high compliance bar. The privacy cost of KYA is not disclosed anywhere. Code executes what lawyers cannot enforce โ but consent frameworks execute what code cannot defend. The moment a behavioral template leaks, the anchor of trust becomes the vector of compromise.
Let me put numbers to the operating assumptions, because the entire framework rests on them.
McKinsey's $3โ5 trillion agentic-commerce forecast for 2030 is the anchor. It is also a projection built on a single assumption: that autonomous agents transact at scale within four years. Strip the forecast and the framework has no valuation logic. KYA is not exposed to interest rates, FX, or classic credit. It is exposed to one narrative. That is a concentration bet on one analyst's model, and concentration bets revert. When the model slips โ and models modeled on AI capital-expenditure momentum always slip eventually โ the whole value clock resets.
And the demand side does not yet confirm the forecast. The $25 threshold is not random. It is the chargeback economics cliff. Below roughly $25, the cost of disputing a fraudulent transaction exceeds the value of the dispute, so the system absorbs the loss as a cost of doing business. Above it, disputes spike, and someone has to own the liability โ and nobody has defined who. The 42% of consumers who refuse high-value agent purchases are not irrational. They are pricing a missing liability clause. The consumer trust gap is not a marketing problem waiting for better UX. It is a legal-design problem that has not been solved.
Now the unit economics, because this is where the enthusiasm quietly dies. KYA sharply reduces the marginal cost of onboarding an agent โ register once, recognized everywhere โ so it improves customer-acquisition cost on the business side. Developers and merchants get cheaper. But it does almost nothing for the cost of building consumer trust. That cost stays high, and arguably rises once behavioral biometrics, consent management, and dispute exposure are priced in.
So the equation reads: acquisition cost falls on the B2B side, while trust cost holds or climbs on the consumer side. If the consumer side does not break, then "low onboarding cost" converts only into more experimental traffic โ not into paid volume. The 4,700% traffic growth is real, but the trust metric is 14%. That spread is a scissors gap between supply-pushed and demand-pulled growth, and a scissors gap that does not converge produces bubble-volume, not a market. Lifetime value over acquisition cost does not improve if the ceiling on transaction value stays pinned at $25.
There is a network-effects paradox hiding here too. The framework tries to manufacture cross-side network effects โ agents, merchants, wallets, and issuing banks all recognizing one another โ layered on top of data network effects, where richer agent behavior data sharpens risk scoring. All three parties are betting on a network-effects tipping point. But the tipping point may be exclusive rather than open. If three dominant networks own the registry, then non-participating agents and networks are excluded, and the network effect converts from open dividend into a wall. The critical mass, once locked by three players, squeezes out the latecomers โ regional wallets, independent identity vendors, and any Big Tech player that did not get invited early. The open-narrative and the exclusion-mechanism are the same object viewed from two sides.
Then there is the money-laundering hole that press releases never mention. KYA extends know-your-customer from humans to non-human agents: register, authenticate, monitor continuously. That is a genuine AML upgrade. But it opens a liability vacuum. When a hijacked agent โ a zombie agent โ launders funds across three networks, whose reporting obligation is it? The originating network? The registry? The agent's issuing party? The framework's very interoperability creates the space to point fingers. A three-network system with no named liability holder is a regulatory-arbitrage window by construction. The structure that makes agents portable is the same structure that makes responsibility deniable.
Worse, interoperability amplifies the blast radius of a single compromise. If an agent's identity key leaks, the attacker transacts as a "legitimate" identity across all three networks at once โ and no defined mechanism exists to freeze a hijacked agent network-wide. Interoperability takes trust risk that used to be distributed across separate networks and concentrates it into one component with undefined governance and undefined disaster recovery. That is efficiency traded for resilience, and nobody signed the trade knowingly. The registry, if single, becomes a single point of trust-infrastructure failure. Concentrating the trust that used to be spread across three networks into one ungoverned component is a classic bet: speed now, fragility later.
I have watched this pattern before. In the 2017 ICO cycle I audited more than fifty ERC-20 contracts, and the exploitable ones were never the contracts with missing functions. They were the contracts where a single admin key could rewrite state. The vulnerability was not the code โ it was the concentration of authority the code quietly permitted. KYA has the same shape at the trust layer. The registry is the admin key. And an admin key with no named holder is not resilience. It is an unaudited backdoor with a governance committee that has not met yet.
Contrarian: this is a defensive cartel, and the real enemy is upstream
Here is the angle the trade press missed entirely.
Three networks that compete ferociously in settlement chose to align on identity. That is not natural market evolution. That is a cartel response to an external threat. When rivals cooperate, it is because a third party is eating their lunch. The only question worth asking is: who?
The answer is upstream โ the platforms that own the agent entry point. If OpenAI, Google, or Apple build identity and payment directly into the agent runtime, then the agent never reaches the card network's identity layer at all. KYA becomes a backend query a platform optionally calls โ or skips. Visa and Mastercard inviting Google to co-build Verifiable Intent looks like partnership. Read it as appeasement. They are trying to convert a potential disintermediator into a co-owner before it routes around them. Standardization is the silent killer of alpha โ and the incumbents are standardizing precisely because they fear the alternative.
This reframes the entire competitive map. The fight is not Visa versus Mastercard. The fight is the card-network alliance versus the agent platforms that sit at the point of intent. The alliance is playing defense dressed as leadership.
Which brings us to Ant International โ the challenger in the room and the most exposed party in the framework. Ant arrives with the strongest distribution and the weakest position in cryptography. Its wallet network is genuinely differentiated in emerging markets, where card rails are weak and wallets are strong. But distribution without standards authority is leverage that decays. If Ant settles into being the protocol translator โ the party that bridges its wallets into a card-led identity standard โ it becomes a subordinate node on someone else's rail. It trades the chance to own the identity layer for the right to plug into the incumbents'. That is how a challenger gets co-opted. Ant is voluntarily walking into the standard, and the standard was written before it arrived.
There is a second, harder risk no press release will name: geography. An identity registry that requires cross-border sharing of agent identity and transaction data runs straight into conflicting data-sovereignty regimes. Ant's cross-market footprint โ with a Chinese lineage and Western network partners โ makes it the party most likely to be forced to choose. The compliance passport it gains from joining a Western standard is real. So is the geopolitical squeeze attached to it. Ant's benefit from KYA is asymmetric and asymmetrically uncertain. The framework gives it reach; it may extract autonomy in return.
Takeaway: watch the registry, not the rollout
Ignore the interoperability announcements. They are the easy, photogenic half. The half that decides who wins is the registry โ and the liability clause bolted to it.
Three signals will tell you the truth about KYA before its own marketing does. First, who is named as the registry operator, and under what governance โ a single network or single vendor means capture, not interoperability. Second, whether intent verification stays open or becomes a toll road; Mastercard open-sourced Verifiable Intent for a reason, and the tell is whether it stays open once volume arrives. Third, whether an issuing-bank or account-tier interface appears; without it, "end-to-end" is a slide, not a system.
Volatility is the tax on emotional discipline, and the agentic-commerce narrative is running hot on a $25 trust ceiling and an unwritten liability clause. The framework is real. The governance is not. Until someone signs their name to the registry, the most honest thing anyone can say about Know Your Agent is that it knows exactly which agents exist โ and nobody yet knows who gets to decide.