September 2026 – VERY VERY LONG Tech Blog on EMVCo’s new Spec

On September 1, 2026, EMVCo published a draft framework that quietly changes the architecture of agentic commerce. The “EMV Agentic Payments — Framework for Specifications” establishes a neutral, interoperable conceptual foundation for managing consumer intent across the entire payment ecosystem. After more than a year of watching proprietary platforms race to own and orchestrate “everything” in agentic, this is the most significant structural move the industry has seen.

I have written about this problem extensively, from Agentic — Intent and the New Data Games to Carts and Mandates: Decoupling Discovery, Authentication, and Liability to Agentic Data Battle: Intent. The core argument has always been the same: without a structure for managing intent, there will be no trust in agentic transactions. EMVCo just read that memo.

Executive Summary

• EMVCo’s Sept 1 draft “Agentic Payments Framework” creates a neutral, interoperable layer for managing consumer intent, the first standards body move in a space dominated by proprietary platforms.
• Intent is the fourth pillar of agentic trust (after user, instrument, and agent). Without it, banks cannot answer “is this what my customer wanted to buy.”
• Delta Network found 29% of Shopify agentic transactions returned the wrong product without intent enforcement.
• Google and Mastercard’s Verifiable Intent is structurally flawed: the platform constructs, holds, and signs the mandate with no path for banks or merchants to independently validate it. Self attestation.
• Amex ACE is the only operable agentic structure live today because its three party model lets it backstop liability. V/MA frameworks need issuer buy in, and Mastercard’s “100+ bank” claims were lab exercises.
• EMVCo’s core construct is Intent Services: a shared coordination point (not a point of origin) where any authorized party can register, retrieve, and track intent across the full transaction lifecycle.
• Signing moves to the consumer. Layer 1 is a trust anchor (candidate: Card DPC), Layer 2 is signed by the consumer on their own device, Layer 3 is the agent’s fulfillment. The consumer’s key, not the platform’s, roots the chain.
• Device binding is the opportunity: anchoring Layer 1 to a DPAN in the Secure Enclave or Titan M2 would deliver assurance no platform signature can match. The framework allows it but does not yet require it.
• Still a V1 framework, not a spec. Open questions: hardware assurance levels, who operates Intent Service Providers (networks are the natural fit), KYA liability rules, and 3DS/SRC integration.
• Governance matters more in agentic than CP or CNP because a new party acts on the consumer’s behalf. Google’s model is “I signed it, trust me.” EMVCo pulls intent into the neutral party where accountability can actually be enforced.

Why Intent Is the Whole Game

Let me start from first principles, because the word “intent” is becoming industry wallpaper. Card payments operate on a tight coupling: the consumer is present, they choose a product, they authorize a payment, and execution happens immediately. Every party in the chain, the merchant, the issuer, the network, can look at the transaction and say with confidence: this is what the customer wanted to buy.

Agentic commerce breaks that coupling. The consumer tells an AI agent to “find me cotton joggers, navy blue, size medium, under sixty dollars, machine washable” and then steps away. The agent discovers, compares, selects, and pays, potentially hours or days later, across multiple merchants, drawing down on a delegated budget. The consumer was not present at execution. Nobody in the payment chain has direct access to what the consumer originally said.

As I argued in Agentic Data Battle: Intent, this introduces a fourth pillar that existing frameworks were never designed to answer. Authentication tells you who the consumer is. Actor certification tells you whether the agent is legitimate. Neither tells you whether this specific purchase falls within what the consumer actually authorized. That is the role of Intent.

Without a structure to manage that fourth pillar, banks are flying blind. And as Delta Network’s data shows, agents are already failing at scale. Delta ran one hundred single-product purchase intents through two agents, spanning easy lookups to hard multi-constraint combinations. Without intent enforcement, 29% of Shopify-based agentic transactions returned the wrong product. Twenty-nine percent!! That is not a rounding error. That is a structural failure waiting to turn into a consumer trust crisis.

What Mastercard and Google Got Wrong

Earlier in 2026, Mastercard and Google introduced “Verifiable Intent,” a specification that draws on W3C Verifiable Credentials to encode consumer spending mandates as cryptographic tokens. The goal was right. The architecture was not. My view is that MA was just carrying Google’s water to EMVCo. I dissected this in detail in Carts and Mandates and Agentic Data Battle: Intent. The fundamental problem is structural, not technical. The Google and Mastercard framework allows the agentic platform (Google, acting as orchestrator through its Universal Cart and AP2) to construct, hold, and sign the intent. The platform is grading its own homework.

When the merchant or the issuing bank receives that signed mandate, they cannot independently validate whether the agent actually executed what the consumer wanted. They are forced to trust an attestation from a party that has a direct financial interest in the transaction completing. As I put it at the time: the platform says “I signed it, just trust me.” That is not cryptographic assurance. That is a press release dressed up in W3C credentials. This is the problem Delta Networks solves today and EMVCo’s new framework solve in the future – an independent third party.

The “intent problem” is compounded by the commercial reality I described in Agentic — Intent and the New Data Games: Google has no desire to share consumer intent mandates with banks or networks. Banks have no desire to process transactions where the risk allocation is undefined. This bilateral standoff is why Mastercard’s 100-plus bank announcements on “live agentic transactions” were conducted in bank innovation labs, not at operational scale with risk-carrying issuers.

The only exception today is American Express. As I covered in American Express Breaks the Agentic Commerce Deadlock, Amex’s closed-loop three-party structure gives it a unique advantage: as both issuer and network, Amex controls the credential, the message, and the participant rules simultaneously. Their Agentic Commerce Experiences (ACE) developer kit and Agent Purchase Protection represent the only operable agentic payment structure live today with a real liability backstop. But it is also dependent on intent data. While Visa and Mastercard have very solid frameworks too, they require issuer buy-in at scale (which requires intent data flows that are currently blocked).

What EMVCo Is Proposing

The EMVCo draft, published in August 2026, takes a different architectural position from the ground up. The framework introduces a conceptual layer called Intent Services. The spec defines it precisely: “Intent Services provide a function to register, reference, retrieve, and manage purchase Intent, including Intent artifacts where available, across agentic commerce flows.” Critically, “Intent Services act as a coordination point, not a point of origin for Intent within the broader ecosystem.”

That phrase, “coordination point, not a point of origin,” is doing a lot of work. It means no single platform originates, owns, or controls the intent record. The intent is registered into a shared, interoperable infrastructure that any authorized participant in the payment chain can access. This will NOT SIT WELL with OpenAI and Google. The last thing they want is for the raw consumer directive to leave anywhere, but it must work this way. Intent Services fulfills six primary functions:

1. registration (recording intent with a stable identifier),
2. retrieval (providing lifecycle state and mandate information),
3. lifecycle coordination (maintaining state across the full arc of an agentic task),
4. interoperability reference (providing stable cross-ecosystem references),
5. pre-transaction support (risk assessment, mandate validation, fraud prevention), and
6. post-transaction support (disputes, audit, reconciliation).

That last two are particularly important. With Google’s Verifiable Intent, handling a dispute or revoking a mandate after the fact requires going back to the platform that holds the intent. With EMVCo’s Intent Services, the liability-holding parties, namely the bank and the merchant, have continuous, independent visibility into the state of the intent throughout its lifecycle.

The spec also introduces a structured lifecycle model with states including REGISTERED, APPROVED, COMPLETED, COMPLETED_WITH_EXCEPTIONS, PARTIALLY_COMPLETED, REVOKED, SUSPENDED, and FAILED. That last category, COMPLETED_WITH_EXCEPTIONS, reflects the messy reality of agentic commerce: partial execution against a budget-based mandate, mixed outcomes across multiple fulfillment events, agents that satisfy four out of five constraints. The framework is designed for the actual complexity of the problem, not an idealized version of it.

The Delegation Chain and Where Signing Happens

This is where I want to go deeper than most coverage of this spec, because the authentication architecture matters enormously. EMVCo’s Verifiable Intent uses a three-layer credential chain, each layer a Verifiable Credential signed by a key delegated from the layer above.

Layer 1 is the trust anchor. It is constructed and signed by the Payment Credential Provider (the issuer, network, or token service provider) and provisioned into the consumer’s wallet. The spec is explicit: “A potential candidate for the Layer 1 VC is the Card DPC Card credential (com.emvco.dpc.card).” This is the long-lived, card-level credential anchored in the payment system’s trust hierarchy.

Layer 2 is where the consumer signs. The agent proposes the mandate content based on the consumer’s shopping task. The wallet presents this to the consumer for review. “Upon the Consumer’s consent, the Wallet signs the VC using the Consumer’s private key, the one corresponding to the public key in Layer 1. The Consumer’s signature is the act of consent.” The consumer is signing on their device, using a key bound to their payment credential.

Layer 3 exists only in autonomous mode. The agent constructs and signs the final payment and checkout mandates using its own private key, the one the consumer embedded in Layer 2. These VCs contain the concrete values the agent selected when executing the purchase. They are short-lived and transaction-scoped.

The implication for device binding is significant. Because Layer 2 is signed by the consumer using a key that corresponds to the public key in a Card DPC credential, and the DPC Card is itself an application of Verifiable Digital Credentials designed to operate alongside (and potentially replace) the DPAN model, the signing ceremony is anchored to the consumer’s payment credential infrastructure. As I explored in EMVCo and DPCs, a DPAN on the phone provides substantially greater assurance because it is hard-bound to device security silicon (Apple’s Secure Enclave or Google’s Titan M2) through a rigorous ID&V process that banks have invested in for over a decade.

The spec does not mandate DPAN or hardware binding at this stage. It defines Layer 1 as an “external dependency.” But the architecture is deliberately designed so that payment systems or other payment ecosystem participants may act as trust anchors, meaning the networks can bring their existing DPAN provisioning infrastructure into Layer 1 without redesigning the framework. A DPAN-anchored Layer 1, where the consumer’s Secure Enclave key is the root of the delegation chain, would provide a level of assurance that no platform self-attestation can match. This makes sense, if you want their governance they must control authentication of every actor and authorization of every service.

This is the “repurposing the vault” thesis from our DPCs and Governance research “The most successful path for banks is to repurpose DPAN-verified hardware as a sovereign identity anchor to sign the ‘loose’ mandates of AI agents, preserving the link between identity, instrument, and action.”

How This Differs From Google and Mastercard’s Approach

Let me make the architectural contrast explicit.

Custody of the mandate. In Google’s Universal Cart and AP2 model, Google holds and signs the intent. Other parties must trust Google’s attestation. In EMVCo’s Intent Services model, the mandate is registered in a neutral, shared infrastructure. Any authorized participant can retrieve and independently verify the lifecycle state of the intent.

Who validates. In Mastercard’s Verifiable Intent, the agentic platform presents a cryptographic signature that other parties must accept or reject as a binary. The spec does not provide a mechanism for merchants or issuers to continuously validate the ongoing state of the mandate. In EMVCo’s framework, the bank, the merchant, the acquirer, and the network can all independently retrieve current intent state from Intent Services at any point in the transaction lifecycle.

Where signing happens. In Google’s architecture, the platform orchestrates and signs. In EMVCo’s VI, the consumer signs on their device using a key bound to their payment credential (Layer 2), and the agent signs only the fulfillment layer (Layer 3) using a key that the consumer explicitly embedded in their consent credential. The consumer’s key, not the platform’s key, is the root of the authorization chain.

Selective disclosure. EMVCo’s framework enforces visibility boundaries as a structural property of the credential format: “The checkout mandate VC is disclosed to the merchant. The Payment Mandate VC is disclosed to the payment system. Neither party can reconstruct disclosures it was not given.” Merchants see what was purchased but not how it was paid. Issuers see payment details but not the specific cart items. This is not an access control policy enforced by a platform, it is a cryptographic property of the credential structure.

Decoupling discovery from transaction. As I argued in Carts and Mandates, the existential problem with Google’s model is that it conflates the discovery layer (Gemini, Universal Cart) with the transaction layer (AP2, mandate custody). When the platform that benefits from the transaction also holds the mandate, you have created an un-auditable conflict of interest. EMVCo’s framework sits beneath individual network and vendor products. It does not prescribe which entity acts as the Intent Service Provider. Payment systems, token service providers, or independent parties can all play that role, none of which has the same conflict that Google does.

Know Your Agent and Transaction Indicators

Two other elements of the framework deserve attention because they signal where EMVCo is heading.

Know Your Agent (KYA) is explicitly included as a framework section. EMVCo acknowledges that “payment ecosystem participants may require interoperable mechanisms to identify, reference, and evaluate the agent involved in a payment interaction.” The spec outlines a future agenda for stable agent identifiers, agent version and model identification, registry references, baseline registration criteria, and ecosystem participant visibility requirements. KYA is flagged throughout as still being developed. But its inclusion in a Version 1 draft is an architectural commitment: agent accountability is a first-class concern, not an afterthought.

Agentic Transaction Indicators would provide interoperable signals that an agent was involved in a transaction. The spec notes these indicators “may support risk assessment, fraud prevention, dispute resolution, operational transparency, auditability, reporting, and ecosystem accountability.” Critically, they would also “help participants consistently interpret payment interactions where Consumer authentication has been delegated to an agent operating within previously established bounds.” This is the signaling layer that allows 3DS, network routing, and issuer authorization systems to treat agentic transactions differently from standard ecommerce without requiring individual bilateral integrations.

Where This Framework Will Evolve

I want to be honest about what this is and what it is not. This is a Version 1 draft. It is a framework, not a specification. It establishes shared terminology, participant responsibilities, scope boundaries, and lifecycle concepts. The spec repeatedly notes that future specifications will define the actual message structures, state machines, and technical schemas. Italicized review notes are visible throughout the document, asking reviewers whether specific sections should be included, modified, or omitted.

Several areas are ripe for evolution:

Hardware binding. The framework leaves Layer 1 as an external dependency and does not require device-bound credentials. The most natural evolution would be to define Token Assurance Levels for intent artefacts, analogous to the TAL system for DPANs. A consumer signing with a Secure Enclave-backed key should carry materially higher assurance than a software wallet key, and that distinction should be visible to the issuer at authorization time.

Intent Service Provider governance. The framework does not prescribe who can operate an Intent Service Provider. This is intentional flexibility at a conceptual level, but it will require resolution before specifications can be written. The networks (Visa, Mastercard, and Amex) are the natural candidates; they have the commercial relationships, operating rules, and governance structures. An independent SWIFT-like utility is another option. This governance question is probably the most commercially sensitive decision the industry will make in the next 18 months.

KYA operationalization. The framework sketches agent identification but does not define a registry, a qualification process, or liability allocation rules. The question of who bears the risk when a certified agent makes a wrong purchase is left open. Without resolution, KYA will remain conceptual.

Integration with 3DS and SRC. The framework explicitly notes that intent information “may be referenced during 3DS authentication, risk evaluation or other payment processing interactions” and that future enhancements to SRC, 3-D Secure, Payment Tokenization, and Digital Payment Credentials are anticipated. Getting those integrations right, specifically the ability for 3DS to incorporate intent state in its risk scoring, would eliminate the current scenario where 3DS challenges disrupt autonomous agentic flows.

The Governance Argument

Let me close with the argument that I think matters most, and that the industry is only beginning to internalize. Governance is more important in agentic commerce than in card-not-present or card-present payments. That sounds counterintuitive, but here is why.

In CNP transactions, the human is present. If something goes wrong, there is a clear actor: the merchant misrepresented the product, or the card was fraudulently used. The liability framework, the chargeback rules, the dispute process, all of it was designed around human-initiated transactions with a known authorization event.

In agentic commerce, there is a new party acting on behalf of the consumer, and they are not always acting correctly. Delta Network’s 29% error rate is not the result of fraud. It is the result of agents that misinterpret constraints, hallucinate inventory states, or optimize for a metric (price) while failing another (material). The consumer gets the wrong product, returns it, and the merchant absorbs the loss. No one in that chain was malicious. Everyone was technically compliant with whatever rules existed. The problem is the rules were inadequate for delegated commerce.

The Google and Mastercard framework answers this with: “I signed the mandate, trust my signature.” That is a platform saying: I am accountable to myself. The bank gets no meaningful information about whether the agent executed correctly. The merchant has no neutral arbitration layer when disputes arise. The network cannot see whether the agent operated within the consumer’s authorized bounds.

EMVCo’s Intent Services answers differently. By pulling intent into a neutral coordination layer that every authorized participant can access, and by structuring the delegation chain so that the consumer’s own signature (not the platform’s) is the root of authorization, the framework creates the conditions for genuine accountability. Banks can see what was authorized. Merchants can verify that fulfillment matched the mandate. Networks can build dispute resolution processes around intent state rather than platform assertions.

That accountability infrastructure is MUCH MORE THAN a nice-to-have. As agentic commerce scales from innovation labs to real consumer wallets, the first wave of failures will not be obvious fraud. They will be subtle wrongness, the wrong shade, the wrong size, the wrong subscription tier. The consumer will not know whether to blame the agent, the platform, or the merchant. Without a neutral record of what was authorized and what was fulfilled, there is no way to answer that question.

EMVCo is proposing that the industry build that record, governed by no single platform, accessible to all authorized parties, anchored to the consumer’s own credential. It is early. The specs are not written. The governance model is not resolved. The device binding story is not complete.

But the architectural direction is right. And after eighteen months of watching platforms race to own the agentic layer while banks and networks waited on the sidelines, it is good to see the neutral party finally show up.

Related reading: Agentic — Intent and the New Data Games | Carts and Mandates: Decoupling Discovery, Authentication, and Liability | Agentic Data Battle: Intent | American Express Breaks the Agentic Commerce Deadlock | EMVCo and DPCs | Agentic Apocalypse — How to Stop It