EMVCo wants one place to store what you told your agent, and most merchants cannot see the agent at all

EMVCo published a draft framework yesterday for card payments made by AI agents, and it wants comments on it by 30 September 2026 [1][2]. It is called the EMV Agentic Payments Framework for Specifications, and the part of it worth your afternoon is a layer named Intent Services [1].

Intent Services is a shared, interoperable place to register, reference, retrieve and manage what a consumer actually authorised, before a transaction, during it, and afterwards [1]. The draft sets out the ecosystem roles and the data fields for registering intent, for keeping its lifecycle and state, and for letting an authorised party read it back [1]. Junya Tanaka, EMVCo’s executive committee chair, says in the release that “card-based agentic payments require a globally interoperable foundation that consumers, merchants and issuers can all trust” [1].

Where the $300 cap actually lives

A valid card credential tells an issuer that an AI agent can pay, and tells it nothing about whether that agent should be making this particular purchase [2]. The worked example in the coverage is a shopper who authorises an agent to spend up to $300 a month on groceries, against which a $70 order is compliant [2]. Nothing on the wire today carries the $300.

That is the bit I keep running into when I build this. The cap lives in your own application, so the merchant holds a copy, the agent vendor holds a copy, the issuer holds nothing, and the three of them drift apart quietly over a month of grocery orders. Whoever gets the dispute gets to reconstruct the authorisation from logs written by the party being disputed. EMVCo is proposing that the intent stop being a private variable and start being a record with a lifecycle, which is the sort of unglamorous plumbing that decides whether a chargeback is a five-minute lookup or a fortnight.

The framework also names, as possible later work, Know Your Agent capabilities and Agentic Transaction Indicators: mechanisms to identify the agent in a payment, communicate its attributes, and signal to the other participants that a machine acted for the person [1][2]. So the authority half is being specified now and the identity half is deferred.

Most merchants cannot see the thing they are being asked to price

PYMNTS Intelligence published merchant research today, commissioned by Visa Acceptance Solutions. Twenty-three per cent of merchants can clearly identify both AI-driven traffic and AI-driven purchases [3]. Another 21 per cent can see the agent traffic arrive and cannot connect it to anything that completed [3]. Large merchants sit at 27 per cent, small and medium ones at 19 [3]. The same research has 38 per cent of merchants expecting agent purchases to pass 15 per cent of their sales inside two years [3]. It is a vendor-commissioned survey and the article publishes neither its sample size nor its fielding dates, so weigh it accordingly.

A registry of consumer intent only becomes enforceable at the point where somebody can tell an agent apart from a scraper. On these figures, roughly three quarters of merchants cannot do that yet, which puts the standard a fair distance ahead of the instrumentation it will be enforced with.

Spreedly’s case for letting some of the bots through

Spreedly’s executive vice president of product strategy, Adam Hiatt, told PYMNTS that “the biggest evolution is that not all the bots are bad now” [4]. He described one ticketing customer whose sessions originating inside LLM chat interfaces convert at roughly two to three times the rate of sessions that began with a traditional search [4]. That is one customer at one vendor with no methodology published alongside it, so take it as his account of a client rather than a measured figure.

His argument is the interesting part regardless of the ratio. When an agent has already compared the options before it lands on your site, the intent arrives pre-qualified, and, in his words, “when the bot hits the site, the decision’s pretty much ready to go” [4]. Which turns a decade of bot policy inside out. Blanket blocking was cheap and roughly correct for years; now it is a revenue decision taken by a WAF rule that nobody has revisited since it was written.

Comments on the EMVCo draft close on 30 September 2026 [1]. If you run an agent that spends money, or a checkout that takes money from one, that is four weeks to say what your side of the intent record needs to carry, before the data fields are settled by the people who did file.