April 14, 2026
Managing Partner
Agentic commerce will not commoditize payments; it will re-price them by shifting value toward the payment networks and issuers that can underwrite identity, liability, and fraud when AI agents, rather than humans, initiate purchases.
The retail debate about agentic commerce has centered on the wrong party. Our own March article asked how retailers should position themselves as AI agents begin to shop on consumers' behalf, and the framing there remains the right one for merchants. But the debate misses a more consequential shift happening one layer down the stack. When agents, not humans, initiate purchases, the decision authority that previously sat with the consumer shifts to the payment rail. The retailer is already choosing which rail to wire into its agent checkout. That choice is about to re-price an industry.
American Express's April 2026 launch of Agentic Commerce Experiences (ACE) is the first clean data point in that repricing. The developer kit ships with something no other network has publicly committed to: explicit purchase protection for transactions initiated by a "Registered Agent." On its own, that is a product announcement. In context, a $72 billion revenue base, 10% growth, 30 consecutive quarters of double-digit net card fee growth, and a record $10 billion in net card fees signal where the value is moving. CEO Steve Squeri's 2026 letter to shareholders described agentic commerce as "one of the biggest changes in shopping since the advent of eCommerce" and argued the winners would be firms that go "well beyond basic payment functionality by offering differentiated value, service, and security." Read literally, Squeri is describing a bet that the payment's premium, which twenty years of e-commerce have compressed, will return when humans stop clicking 'buy'.
Agentic commerce will not make payments all the same as e-commerce did for stores. Instead, it will make some more valuable. But only for the few payment networks that can truly cover agent identity, legal responsibility, and fraud at the moment of purchase. The main limit isn’t technology. It’s the ability to handle risk, which shows up in companies’ revenue models. Most card providers and regional banks are not investing yet to catch up.
Every authorization framework in use today assumes a human is present at the moment of transaction. Card-present EMV assumes a chip and a PIN or signature. Card-not-present 3-D Secure (and its European cousin, Strong Customer Authentication under PSD2) assumes a step-up challenge delivered to the cardholder's device. Subscription and recurring billing assume that the cardholder has given prior consent to the merchant of record. Each framework has, over two decades, produced a reasonably clean answer to the question that matters most to the participants: who bears the fraud loss when something goes wrong?
Agent-initiated transactions break every one of those assumptions. When an AI agent, not the cardholder, decides the item, the quantity, the merchant, and the moment of purchase, the cardholder was not "present" at transaction time in any sense those frameworks recognize. The step-up challenge cannot be delivered to someone who has never touched a keyboard. The merchant of record has no prior consent record for the specific item the agent selected. The network's rulebooks, which allocate liability based on who authenticated and who authorized, remain silent on what an agent is, whom it represents, and whose risk it carries.
The gap is not a loose end that will be tidied up through minor rulebook amendments. It is structural because the underlying authentication model, "proves the human is present," has no analog for agents. Someone will have to underwrite this gap before merchant-side agent checkout scales. The consequential question is not whether the gap will be filled, but who will fill it, and on whose economic terms.
Technical parity across agent APIs is achievable by every major network and large issuer within 12 to 18 months. Tokenization, step-up authentication, identity attestation, and protocol integration are hard engineering, but not distinctive engineering. What is not achievable at parity is the capacity to absorb the incremental fraud losses that agent-era transactions will produce before the rulebooks settle. That capacity is a function of revenue composition.
Pull three disclosures side by side: American Express, a large money-center issuer's card services subsegment, and a regional bank's FFIEC Call Report, and the asymmetry is structural. American Express earns the majority of its card revenue from discount revenue and card fees; in 2025, net card fees alone reached $10 billion, the thirtieth consecutive quarter of double-digit growth on that line. A dollar of AMEX card fee revenue carries almost none of the credit cost that sits against a dollar of interest income. Visa and Mastercard earn roughly 7.5 cents per transaction on interchange and assessments, a model built for volume, not for absorbing per-transaction underwriting losses. A regional bank's card book is a different beast entirely. We tested this against a fourteen-institution panel drawn entirely from direct disclosure: SEC 10-K segment reporting for the networks, AMEX, Capital One, and the card-services sub-segments of JPMorgan, Bank of America, and Citigroup; and FFIEC Call Report Schedule RC-C Item 6.a for seven regional banks (PNC, Truist, Fifth Third, Regions, KeyCorp, Huntington, M&T). Regional bank archetypes derive 67 percent of card revenue from net interest income on loan balances, compared with AMEX's 40 percent fee-weighted mix, a 10.8× fee-share gap that is significant at p=0.028 under a Mann-Whitney U test. Regional card outstandings average approximately 25 times smaller than those of the top five issuers, translating directly into a fraud-data scale gap that compounds the economic one. Regional provision costs run 24 percent higher than those of money-center peers, at 51 basis points versus 41.
The point is not that Amex runs its payments best. Is a business based on fees and spending able to handle the new fraud risks that come with agentic commerce, since those risks are already built into the card? By contrast, a business that relies mainly on small fees, like Visa and Mastercard, must squeeze these new costs out of just 7.5 cents per sale. Companies focused on lending either have to raise rates for shoppers, who are sensitive to higher costs, or accept lower profits. This isn’t hidden; it’s in their revenue reports. Visa and Mastercard’s main decision in 2026 is whether to treat this as a firm limit or a choice: chase more purchases and software connections, or stand out by covering risk. Both can be defended, but only by covering risk can AI agents receive a premium payment option.
Commerce protocols are being written right now. OpenAI and Stripe published the Agentic Commerce Protocol in late 2025. In the same cycle, Google's Universal Commerce Protocol drew endorsements from AMEX, Visa, Mastercard, Adyen, Stripe, and more than twenty merchant partners, including Best Buy, Macy's, Home Depot, Flipkart, and Zalando. Shortly after, Mastercard launched Agent Pay, which it later revised eleven months later to align with UCP. AMEX's ACE developer kit shipped in April. The cadence matters: protocols are not written once, but the window in which default behaviors crystallize and merchant routing preferences begin to lock in is narrow, and it is now.
Two features of the current landscape deserve explicit calibration. First, "industry-first protection for registered agent purchases" is AMEX's public commitment language, but the operating definition of a "registered agent" has not yet been disclosed. The developer kit terms go live in the balance of the second quarter. If the definition is narrow (a small whitelist of AI platforms with which AMEX has bilateral agreements), the commitment is meaningful but bounded. If it is broad (any agent that meets specified identity and attestation standards), it resets the category. Either way, as of this writing, AMEX is the only network to have publicly committed to indemnification. Visa, Mastercard, Stripe, and Google are at protocol parity but not at liability parity. That gap is what the next two quarters of announcements will test.
Second, the consequences of the window are unevenly distributed. A merchant wiring its agent checkout in Q2 or Q3 2026 will pick the rail that answers the "who eats the chargeback" question most cleanly. Once that default is wired, switching costs rise. Merchant routing preferences for agent-initiated transactions will form during 2026 and harden thereafter. This is a present-tense claim about platform construction, not a prediction. Whether merchants actually weigh liability over cost in that routing decision is the testable question and one that the H2 2026 earnings cycle from Shopify, Stripe, and the platform economy will answer.
Pulling the fact base together points to four strategic positions defined by two dimensions: the share of revenue that comes from card-related fees rather than interest or interchange, and the willingness to invest in agent-era liability products. The two-by-two is a Santiago & Company construct we built to force the decision onto a single page, but the archetypes on it are drawn from 2025 financial disclosures, not from modeling.
The Premium Agent Rail position is where AMEX sits today. Fee-and-spend-weighted revenue underwrites the incremental liability cost of agent transactions as a native product feature. Merchant acceptance expansion remains the ceiling problem AMEX has been attacking for a decade, but the agent-era product itself is economically self-consistent.
The Utility Operator position is where the open-loop networks will land if they choose not to match ACE's indemnification. Visa and Mastercard still win the decade on volume economics, but the premium layer of agent transactions, where indemnification matters, where the merchant prefers the rail that takes the chargeback, migrates elsewhere. This is not a failure state. It is a conscious bifurcation, and the boards of V and MA will treat it as such.
The Vulnerable Premium position is where non-adapting premium issuers drift. Card-fee revenue without agent-era investment is the weakest strategic combination: the firm has collected the fees, built customer expectation of protection, but has not built the underwriting product that protection now requires. A premium issuer that does not offer agent-era guarantees is priced for a customer experience it no longer provides.
The Disintermediated position is where most regional banks' card books sit today. Regional card P&Ls depend on net interest margin and interchange together (we measured 68 percent NII dependency in primary filings), which do not finance agent-era underwriting.
Fraud data scale is twenty-five times smaller than at the top issuers, compounding the capacity gap. This is a present-tense description of economic exposure, validated against 2024–2025 disclosures. Whether exposure converts into realized market-share loss is forward-looking: it depends on how quickly merchants route agent volume to indemnified rails and how visibly regional issuers' share of new card originations compresses. The H2 2026 earnings cycle will put numbers on that.
The point of the framework is not that only one position is viable; the Utility Operator position has won most of the payment history on exactly those terms. The point is that the choice between positions must now be made deliberately, with the balance-sheet math on the table. Drifting into Vulnerable Premium or Disintermediated through inaction is no longer an option that preserves the current P&L.
The decisions that matter in 2026 are specific enough to test. They are not aspirations.
For the open-loop networks, the choice is whether to match AMEX's indemnification or to cede the premium agent rail to the closed-loop incumbent. Matching is expensive in a 7.5-cent-per-transaction economy, but it is the only path to contesting the premium layer. Ceding is defensible on utility-operator economics, but makes the premium agent segment AMEX's to lose. The decision does not need to be made by year-end, but the public language network CEOs use about liability at 2026 earnings calls will be read as the answer.
For large diversified issuers, the choice is whether to build agent-era liability products on their own rails or route agent volume through a network that indemnifies them. A JPMorgan or Capital One has enough fraud-data scale to build; whether it has the fee-revenue mix to finance the build without compressing net interest margin is the diagnostic question. The answer, in most cases, is no, which means partnership decisions that network to default agent volume are 2026 decisions, not 2027 ones.
For regional banks, the math is harsher. The card P&L is being repriced from the bottom up. The structural conclusions from 10-K data are not hypothetical; what remains forward-looking is how quickly the repricing shows up in card origination share. Regional CFOs should model two scenarios: agent volume stays within the branded card rails they currently operate, or agent volume migrates to indemnified rails they do not operate, and present the delta on the card line to their boards this year. The answer in either scenario sets the tone for the partnership conversation.
For merchants, agent checkout procurement logic is inverted. The relevant ranking is no longer "which rail costs me the least interchange." It is "which rail indemnifies the agent-initiated transaction, on what terms, with what dispute SLA." Merchants that default their agent checkout to whichever rail looked cheapest will discover they bought a chargeback liability they cannot offset.
The payments premium that e-commerce spent two decades compressing returns when humans stop clicking buy. The firms that publicly price the liability first, with disclosed terms and underwriting capacity to back them, will set the decade's price. Ask your head of payments what percentage of 2026 agent volume your firm will route through indemnified rails. If the answer is "we haven't chosen yet," you have until the protocol window closes to make a choice.
Agentic commerce is poised to restore a payments premium that e-commerce spent two decades compressing, but only for firms that can underwrite the liability created when AI agents make purchases on behalf of consumers. American Express has made the first serious move, while much of the rest of financial services still risks being priced into a lower-value, utility-like role.
AI is not making services cheaper in any simple sense; it is forcing firms and clients to distinguish between work that can be industrialized and work that still requires accountable human judgment.
America’s shipbuilding debate is aimed at the wrong target. The real strategic opening is not rebuilding conventional yards but using US nuclear propulsion to define the next era of maritime power.
The companies achieving the strongest returns on technology investments are those that have fundamentally changed how their technology organizations operate, not simply by increasing spending.
