Agents are live on European card rails, and the rulebook is five days late to the party.

Three threads to pull on today. Agent-initiated card payments have gone from demo to production in Europe. Mastercard is quietly building for a different customer than the one everyone is designing for. And the stablecoin rulebook is now five days from its statutory deadline.

Visa has agents buying real things at real merchants

At its Payments Forum in Paris on 2 July, Visa said AI agents are now completing live purchases at independent merchants across Europe, with more than thirty issuing banks having settled agent-executed transactions [1]. The list is not a pilot roster of fintechs. It includes Barclays, BBVA, CaixaBank, Commerzbank, HSBC UK, ING, Lloyds, NatWest, Nordea, Revolut and PKO Bank Polski, with merchants including lastminute.com, Frasers, Cleverbridge and BrickDepot [1].

The interesting part is the plumbing, not the launch. Every transaction was secured with Visa Payment Passkeys, which is how the scheme gets agent-initiated spend to sit inside European Strong Customer Authentication rather than fighting it, and merchant participation runs through Visa's Trusted Agent Protocol and Agent Directory so a merchant can tell a verified agent from anything else knocking on the door [1]. A human still authorises the purchase [2]. That is the whole trick: they solved the identity problem before they solved the autonomy problem.

Mastercard is not building for shoppers

Agent Pay for Machines, launched in June, is aimed at high-frequency, low-latency, low-value payments executed by agents and machines rather than by people with a basket [3]. Read that against Visa's consumer launch and you can see the market splitting into two problems that have been sharing a name. One is a person delegating a purchase. The other is software paying software, continuously, for compute and data and API calls, in amounts too small for a card auth to make economic sense.

Five days on the stablecoin clock

Six federal agencies, the OCC, FDIC, NCUA, Treasury, FinCEN and OFAC, must finalise their GENIUS Act frameworks by 18 July, one year after enactment [4]. Each has published proposed rules covering who qualifies as a permitted issuer and how reserves, redemption, custody and supervision work [4]. Treasury's proposal would pull permitted issuers under the Bank Secrecy Act, which brings the full AML and sanctions apparatus with it [4]. The parties most exposed if the date passes without a coherent framework are the ones still trying to get in: new federal applicants, foreign issuers, and state-qualified issuers relying on equivalence.

Read from the rails

The Visa launch answers the question everyone building agent checkout has been dodging. You do not get to invent your own trust model. Agents get onto card rails by fitting inside an authentication scheme the issuer already accepts, which in Europe means passkeys and SCA. If your agent design assumes you can bypass that with a stored credential and a promise, an issuer will decline you and you will never learn why.

Ten years in payments operations taught me to watch who carries the liability, not who ships the feature. The named issuer, the passkey, the merchant-side directory that can verify an agent: those exist because someone has to be answerable when an agent buys the wrong thing. Machine-to-machine settlement has none of that yet, which is exactly why it is running on stablecoins and exactly why the 18 July deadline matters more to it than to Visa.

Agents did not get onto the card rails by being clever. They got on by submitting to the authentication the issuer already trusted.