On September 10, 2026, in São Paulo, three payment networks shared a stage and a vocabulary. Visa brought TAP. Mastercard brought Verifiable Intent. Ant International brought AMP and a wallet footprint that reaches into roughly $13 trillion of annual spend. The problem they named: AI agents move money without a verifiable identity. The solution they announced: a Know Your Agent interoperability framework.
Not one press line said who owns the identity registry.
That silence is the story. Three protocols. Three clearing layers. One announced standard. Zero named holders of the root of trust. I have spent a career reading systems for the space between what they document and what they execute. Tracing the binary decay in 2x02 taught me the lesson in 2017: the flaw is never in the headline. It lives in the component the spec forgot to assign an owner.
This is not a report on a finished product. It is a reading of an architecture that does not yet exist, published as if it does.
The context you actually need
Agentic commerce is a real primitive with an unreal present. McKinsey's number floats around $3–5 trillion by 2030. The measured present is different. AI-driven retail referrals are up roughly 4,700% year over year — a growth rate that looks spectacular until you notice the base is thin. Consumer trust in unverified AI purchases sits near 14%. Forty-two percent of buyers say they will not trust an agent with a purchase above $25.
That $25 is not a rounding error. It is the chargeback break-even. Below that number, the cost of contesting a fraudulent charge exceeds its value. The economics absorb the loss silently. Above it, disputes become expensive, and the question of who pays becomes unavoidable. The entire agent payment story is currently a low-value story wearing a high-value future. The framework is a bet that the threshold moves. Nothing in the architecture moves it.
The technical scaffolding underneath is legitimate. KYA sits as a translation and federation layer above three proprietary protocols — Visa's TAP, Mastercard's Verifiable Intent, Ant's AMP. The likely substrate is W3C Verifiable Credentials and decentralized identifiers, not a single monolithic database. The stated promise is "register once, be recognized across networks."
That promise requires something the announcement did not describe: a unified registry, or a federation of registries, that all three networks agree to trust.
The hard part is the registry, and nobody named it
Protocol translation is solvable. Engineers do it every day. The unsolvable question is governance of the trust root.
Who operates the registry? Whoever answers that question controls the issuance of agent identity — a role with the same structural power as a root certificate authority. Every agent credential chains back to it. Every dispute resolves against it. Every network that accepts the standard inherits its decisions. Root access is just a permission slip, except this permission slip gets issued to machines acting on behalf of money.
The three parties left this blank on purpose. That is not an oversight. It is an unresolved negotiation. You do not publish a launch announcement about a standard whose most valuable component has no owner unless the ownership is exactly what you are still fighting over.
Governance is a myth; the bypass reveals the truth. I ran that experiment myself during DeFi Summer 2020. Compound v1's governance interface had a timestamp manipulation flaw. I replicated it locally in Hardhat, delaying block inclusion to shift a vote's outcome. The documentation described a voting mechanism. The bytecode described a miner-controllable variable. The gap between the two was the entire attack surface. Two weeks later it was patched.
I did a version of the same reading on CryptoPunks in 2021. The contract stored traits off-chain in mutable JSON. I wrote a Python script to track 48 hours of state changes and proved the "immutable" metadata moved. Ownership was a claim pointing at a file someone else could rewrite. Immutable metadata doesn't lie — but it also doesn't exist if nobody pins the pointer.
KYA's registry is the same shape of problem at a much larger scale. The document will describe interoperability. The registry will describe who actually decides. If the registry is mutable and unowned, the agent identity layer inherits the CryptoPunks flaw with money attached.
Interop threatens routing — that is why the card networks showed up
Here is the counterintuitive part. The framework is framed as a gift to the ecosystem. It is better understood as defensive architecture.
If a single agent identity is recognized across multiple networks, then a single agent transaction can be competitively routed across multiple clearing networks. Today, card network lock-in is enforced at the transaction level. Break the identity dependency and you decouple routing from the network that issued the credential. That decoupling is the real threat to the incumbent take rate.
So Visa and Mastercard are not at the table because interoperability is nice. They are at the table to be the default. The move is to make the card rail the path of least resistance for agents before agents define their own rails. Co-opt the challenger to delay the shock. I have watched this pattern inside protocol governance for years. The incumbent does not fight the standard. It chairs it.
Ant is the challenger in that framing. It arrives with the strongest distribution network of the three — wallet connections across emerging markets, $13 trillion in spend touching its ecosystem. It also arrives without cryptographic standing in the identity and intent layers. Its participation risks converting it from an alternative clearing channel into an endpoint that plugs into card-network standards. A very well-distributed endpoint. Still an endpoint.
The stack is honest, the operator is not. A federation that claims neutrality while three of its four members are incumbents defending take rate is not neutral. It is a cartel with a white paper.
The real moat is intent, not identity — and the code proves it
Here is where the layers separate cleanly, and where most coverage gets it wrong. Cryptography can prove which agent is transacting. It cannot prove that the human behind the agent intended this specific transaction.
That gap is the product. Mastercard's Verifiable Intent, open-sourced and built with Google, is not competing to prove identity. It is competing to prove intent — the semantic layer above identity. Whoever controls the meaning of "authorized" controls the dispute. Identity is the floor. Intent is the roof. Mastercard is buying the roof.
Visa answered on a different axis. The $2.4 billion BioCatch acquisition puts behavioral biometrics directly into the verification loop. BioCatch builds continuous authentication from how a user moves, types, and hesitates. Visa is not only asking whether the credential is valid. It is asking whether the human motion behind the credential looks right.
That is where privacy costs explode. Behavioral biometrics are sensitive personal data under GDPR and under China's PIPL. They demand a higher consent bar and carry a higher breach consequence. Embedding them as the trust anchor for agent authorization means the identity chain now terminates in human biology. That is a design decision with a long compliance tail. Compile the silence, let the logs speak — the framework says nothing about retention windows, collection scope, or the deletion path for biometric templates. Those omissions will cost more than the cryptography.
I reviewed EigenLayer's slasher contract in 2024 and found a race condition in the reward distribution logic that could leave penalties partially enforced. The bug was not in the math. It was in the ordering. The same discipline applies here. The identity check and the intent check execute in a sequence. If the sequence favors one party's signature over another's, the dispute resolves in that party's favor regardless of what the cryptography claims. The order of operations is the law.
Where interoperability actually breaks
Interoperability is sold as an efficiency gain. It is also a blast-radius multiplier.
Consider a compromised agent — a hijacked credential, a leaked key, an agent whose authorization was socially engineered out of its operator. On a single network, you freeze the account. In a three-network federation, you need a coordinated freeze mechanism that spans Visa, Mastercard, and Ant simultaneously. The framework does not define one.
So the single point of failure is no longer a single network. It is the shared trust root, and the shared revocation path, that do not yet exist. Interop assumes every operator is honest at the same moment. A registry owner can rewrite who is allowed to be in the registry at all. The freeze you need in a crisis is the freeze an unowned registry cannot guarantee.
I spent three months in 2022 reverse-engineering Anchor's yield mechanism after the Terra collapse. I traced the flows from LUNA seigniorage to USDT reserves and mapped the circular dependency that produced the death spiral. The lesson was not "someone was greedy." The lesson was that circular dependencies look stable right up until one leg is stressed. Agent identity interoperability has the same topology. Each network believes it holds a piece of the trust. The trust is actually held by the shared component none of them named.
The AML hole nobody is filling
Know Your Agent extends KYC and AML from people to non-persons. That is a capability upgrade on paper. In practice it is a liability vacuum.
When an agent is compromised and moves money across three networks, who files the suspicious activity report? The originating party, the network, or the registry? The framework's selling point — interoperability — is precisely the mechanism that lets responsibility diffuse across boundaries. That diffusion is a regulatory arbitrage window, and regulators eventually notice windows. When they do, the "harmonization" that follows will not be voluntary.
The same logic governs cross-border data. Ant carries a China-linked footprint. Visa and Mastercard are US card organizations. The framework launched in Brazil. Data crossing those jurisdictions runs straight into China's outbound data transfer rules and into US sanctions and export-control review. Ant's most valuable asset in this framework — its distribution — is also the thing most exposed to jurisdictional pressure. There is no arbitration layer for that in the spec, because it cannot be solved in the spec.
The traffic-trust scissors
I want to name the metric that should govern every decision here, and which the announcement buried: the ratio of supply-side adoption to demand-side trust.
4,700% traffic growth. 14% trust. 42% refusal above $25. Read those three numbers together. Growth is being pushed from the seller and developer side. It is not being pulled by consumer demand. Agent checkout experiments exist. Consumers do not yet grant agents authority over money they care about.
A framework that lowers the marginal cost of onboarding an agent improves seller-side economics. It does nothing for consumer trust, which is the actual constraint. Lower onboarding cost, without trust, converts into more experimental traffic — not more settled volume. The lifetime-value-to-acquisition-cost math does not improve. This is a technical solution aimed at the back end of a problem that lives entirely at the front.
The $25 threshold is where that math is decided. Break it and the market opens. Fail to break it and the framework is a well-engineered toll road with no traffic above the first exit. The missing bank-core integration makes this worse. The architecture stops at the front-end edge — identity and authorization. It does not reach the account layer where money actually settles. Until it does, "interoperability" terminates before settlement and never becomes an end-to-end, clearable loop. The reference to "issuing banks" in the launch language was not a detail. It was a confession that the next phase requires pulling banks into a system they have not yet joined.
Macro tailwinds are quietly doing the work
There is a reason three competitors aligned instead of fighting. The macro environment forced the decision.
A global rate-cut cycle compresses net interest margins at payment and clearing institutions. When spreads tighten, revenue has to migrate toward transaction volume and value-added services. Agent commerce is exactly the incremental revenue pool a margin-pressured incumbent wants to own. The alignment is not ideological. It is balance-sheet urgency dressed as technical cooperation.
The second tailwind is regulatory. KYA is, functionally, RegTech infrastructure. It hands regulators traceability and continuous monitoring of agent activity. Build the compliance capability first and the regulator adopts your standard rather than writing one against you — the route PCI DSS took. The goal is to convert an industry standard into a quasi-regulatory one. That is worth more than any take rate, because it is political capital that compounds. And silence in the room — no regulator, no sandbox, no endorsement — is the deliberate precondition of that strategy. You establish the facts before you invite the referee.
And there is a geography. Choosing São Paulo over New York or Beijing was not cosmetic. Emerging markets skipped credit cards and went straight to wallets and instant payment rails. They have weak card-network lock-in and high wallet penetration. That is the lowest-resistance ground for agent commerce. Ant's wallet depth in Southeast Asia and Latin America is its one genuine differentiator against the two card networks — a distribution fact that the identity battle is designed to neutralize.
The parts nobody is asking about
The framework is described as open. The economics point the other way.
Cross-sided network effects reward whoever reaches critical mass first. But critical mass in a three-party registry is not neutral openness. It is exclusion. Once the registry is controlled by Visa, Mastercard, Ant, and Google, any regional wallet, any BigTech outside the founding set, and any independent identity provider is on the outside of the definition. The network effect becomes a moat, not a commons. Forks are not disasters, they are diagnoses — and the absence of any credible fork path for the registry tells you exactly how centralized this "interoperability" layer intends to be.
Then there is the dependency risk underneath the structure. If Verifiable Intent becomes the de facto intent standard and BioCatch becomes the de facto behavioral standard, the entire agent commerce identity layer runs on two single commercial entities. Change their licensing, their pricing, or their uptime, and the whole industry feels it. A decentralized-sounding framework built on two centralized chokepoints is not decentralized. It is re-centralization wearing new vocabulary. Audit? More like hope, if the intent layer is one vendor's source tree.
The deepest signal is not who attended. It is who did not. The most likely competitor is the agent platform itself — the runtimes where agents are born. If identity and payment get built into the agent runtime, the agent never reaches the card network's identity layer. It calls it as a backend query, or not at all. The three networks know this. Pulling Google into Verifiable Intent is not just collaboration. It is bringing the potential disruptor inside the tent. Sometimes that works. Sometimes you hand the disruptor the keys and call it a partnership.
Takeaway
KYA will most likely be adopted first in emerging markets, ratified by regulators second, and monetized third. The sequencing matters, because the first mover does not win on technology — the three protocols are adequate, not exceptional. It wins on registry ownership and on intent verification, the two components still unassigned.
Watch four things over the next twelve to eighteen months. The first is any disclosure of the registry's operator. The second is whether the $25 trust ceiling moves. The third is whether a cross-network revocation mechanism is published. The fourth is whether an agent platform announces its own identity layer.
If the registry owner is never named, assume it is the three networks and Google, and price the exclusion accordingly. If the $25 ceiling holds through 2027, the $3–5 trillion forecast is a forecast about a market that has not started. If no revocation path emerges, the framework's first systemic failure will not be a hack. It will be a freeze that no one can execute in time.
Heads buried in the hex, eyes on the horizon. The hex here is thin — there is no deployed code to trace, only three signatories and one silent question. That is precisely why the silence is the finding.
Who owns the root?