Agentic Commerce 2026: The AI Shopping Revolution and What It Means for Payment Service Providers

Research Report | June 2026 | Focus: Europe & Global Trends

Executive Summary

Agentic commerce has moved beyond concept. In the past six months, concrete breakthroughs have occurred: the first regulated AI-initiated transactions in Europe, the launch of competing protocols by Google, Stripe, and Mastercard, the first agentic transaction in Poland – and simultaneously, OpenAI’s retreat from Instant Checkout exposed a hard truth: the market’s infrastructure is not yet keeping pace with ambition.

For payment service providers, this is no longer a topic for future strategy decks. The architectural decisions that will define competitive positioning are being made right now.

1. What Is Agentic Commerce – A Working Definition for the Payments Industry

Agentic commerce is a model in which an autonomous AI agent – such as ChatGPT, Google Gemini, or a purpose-built tool – independently searches, compares, negotiates, and completes a purchase on behalf of the user, based on a goal expressed in natural language^[1].

The key distinctions from earlier forms of automation:

• A chatbot or copilot stops at a recommendation or a list of links.
• An agent executes the transaction – at the end of the conversation, money moves and an order is confirmed^[2].
• A standing order runs a predefined script. An agent interprets a goal, optimises the decision, and acts within user-defined constraints^[3].

The full agentic transaction cycle unfolds across four stages: discovery (the agent locates products matching the goal), authorisation (verifying that the user has delegated the purchase and establishing spending limits), payment (transferring funds via a payment token or card), and fulfillment (triggering order execution on the merchant’s side)^[2].

For PSPs, one change is fundamental: the payment is initiated by software, not by a human at a screen.

2. Market Scale – Numbers from Authoritative Sources

Projections vary by scope, but the direction is unambiguous:

Source	Projection	Target Year
McKinsey	$3-5 trillion globally[4]	2030
Morgan Stanley	$190-385 billion (US, B2C)[5]	2030
Bain & Company	$300-500 billion (US, 15-25% of e-commerce)[5]	2030
Gartner	$15 trillion B2B via agentic exchanges[6]	2028
Mordor Intelligence	$60.4 billion (AI in retail market, 2026)[7]	2026
Mordor Intelligence	$218.4 billion (AI in retail)[7]	2031 (CAGR 29%)
EuroCommerce + McKinsey	EUR 240-320 billion value for European retail[8]	2030

What is working today? Agentic commerce has reached over $180 billion in annual volume according to Digital Commerce 360^[4]. On Black Friday 2025, AI-driven traffic to retail sites rose 805% year-over-year^[5]. Amazon Rufus drove approximately 66% of purchases during sessions in which it was active, converting at 3.5x the rate of non-Rufus sessions^[9].

At the same time, the data is sobering: fewer than 0.2% of e-commerce sessions originate from ChatGPT referrals, and conversion from those referrals is 86% worse than from affiliate links^[5]. Consumer demand is real; commercial infrastructure does not yet serve it.

3. Key Events of the Past Six Months

September 2025

OpenAI and Stripe launch Instant Checkout inside ChatGPT and open-source the Agentic Commerce Protocol (ACP)^[10]. Etsy, Shopify (over 1 million merchants), Walmart, and Glossier join as launch partners. This marks the first mass production implementation of AI-initiated purchases.

October 2025

OpenAI introduces dedicated retail apps within ChatGPT: Instacart, Target, and travel companies build “ChatGPT Apps” – merchants control the purchase experience inside the AI interface^[11].

October and November 2025

McKinsey, Morgan Stanley, Bain, and Gartner publish landmark reports with real market numbers. Gartner announces its forecast: 90% of B2B purchases executed by AI agents by 2028^[6].

November 2025

Visa announces Intelligent Commerce pilots in Asia Pacific with Ant International, Grab, and Tencent, and in the US with OpenAI, Perplexity, and Anthropic^[12]. The platform combines APIs and a partner programme enabling secure agent-initiated transactions.

December 2025

Stripe launches its Agentic Commerce Suite: merchants can connect their product catalogue to Stripe and choose which AI platforms they want to sell through^[13]. That same month, Adyen publishes its Model Context Protocol (MCP) server – an alpha release enabling developers to build Adyen payment integrations through agentic LLMs^[14].

January 2026

Google announces the Universal Commerce Protocol (UCP) – an open standard for agentic commerce spanning the full purchase journey^[15]. Alongside UCP, Google launches a “Business Agent” for Google Search and tests Direct Offers in AI Mode.

February 2026

Stripe launches Machine Payments on the Base network (stablecoins)^[16], entering a new category of agentic settlements. Simultaneously, law firm Taylor Wessing publishes a detailed analysis: PSD2 is technically neutral and does cover AI agents, but SCA compliance presents a structural challenge^[17].

March 2026

1 March 2026: Santander and Mastercard announce Europe’s first live, end-to-end payments executed by an AI agent within a regulated banking system, using Mastercard Agent Pay^[18][19].

Almost simultaneously, OpenAI withdraws Instant Checkout^[11]. The reason: low conversion and poor performance. ChatGPT evolves toward “ChatGPT Apps” – merchant-owned experiences embedded within the AI interface^[20]. Shopify confirms the new model: products discoverable in ChatGPT, but checkout on the merchant’s own site^[11].

April 2026

22 April 2026: The International Monetary Fund publishes official note “How Agentic AI Will Reshape Payments” (IMF Note No. 2026/004)^[21][22]. The IMF sketches a three-layer architectural model: probabilistic AI operates at the “intent and orchestration” layer, sitting above deterministic authorisation and settlement systems. The Fund warns: probabilistic AI and deterministic payment rails are a dangerous mix unless properly separated^[23].

FIDO Alliance announces the Agentic Authentication Technical Working Group with contributions from Google (AP2) and Mastercard (Verifiable Intent)^[24]. Goal: interoperable standards for agent authentication.

May 2026

19 May 2026, Google I/O: Google unveils the Universal Cart – an intelligent shopping basket aggregating Search, Gemini, YouTube, and Gmail^[25][26]. The Agent Payments Protocol (AP2) is set to roll out starting with Gemini Spark. UCP expands to Canada and Australia, with the UK next.

24 May 2026: Mastercard announces Poland’s first authenticated agentic transactions in collaboration with mBank, Bank Pekao S.A., and UniCredit^[27][28][29]. The pilot demonstrates how an AI agent can initiate and complete purchases using the Verifiable Intent model.

15 June 2026: Adyen announces Adyen Agentic – a three-layer API for agentic commerce: Agentic Feed (discovery), Agentic Cart (agent-side basket building), Agentic Payments (transaction initiation)^[30]. Adyen shares rise 4% on the announcement.

June 2026

2 June 2026: Mastercard announces that all European Mastercard-issuing institutions are technically ready for Agent Pay at the network level^[31]. The list of banks that have completed pilot transactions includes 37 European institutions, among them CSOB, OTP Bank, Raiffeisen, UniCredit Poland, mBank, Pekao, N26, and Bunq^[31].

Worldline, ING, and Mastercard complete the first end-to-end production agentic payment transaction in Europe (ING cardholder to merchant in the Netherlands)^[32][33].

9 June 2026: Mastercard launches Agent Pay for Machines – a protocol enabling payments between AI agents. User permissions are stored on blockchain (Polygon, Solana, Base)^[34].

11 June 2026: Visa and OpenAI announce a partnership – integrating Visa’s payment capabilities directly into “OpenAI experiences”^[35].

15 June: EuroCommerce and McKinsey publish “Rewiring Retail in Europe”^[8]: 61% of European consumers already use AI in discovery, with a EUR 240-320 billion opportunity for European retail.

4. Protocol Map – Understanding the Architecture

The market is consolidating around several competing standards. For PSPs, understanding the architecture of each is essential.

Agentic Commerce Protocol (ACP) – OpenAI + Stripe

Open standard announced September 2025^[10]. Enables AI agents to access product catalogues and initiate transactions via existing Stripe infrastructure. Following OpenAI’s pivot, ACP lives on as the infrastructure connecting merchants to agents through the ChatGPT Apps ecosystem^[20].

Universal Commerce Protocol (UCP) + AP2 – Google

UCP (January 2026) is an open standard covering the full journey from discovery to post-purchase support^[15]. AP2 (Agent Payments Protocol) is the payment layer of UCP, built on cryptographically signed “mandates” – expressions of user intent that the agent executes^[36][24]. At Google I/O 2026, the Universal Cart was presented as the culmination of UCP, AP2, and Gemini convergence^[25].

Mastercard Agent Pay

Framework announced 29 April 2025^[37]. Extends existing MDES tokenisation (the same infrastructure as Apple Pay and Google Pay) with additional fields: agent identifier, consent policy, and merchant scope. The Agentic Token is cryptographically bound to the specific agent – not to the card itself^[37]. The policy is validated on the network side at every authorisation, and the token can be revoked in real time from a banking app^[37].

Visa Intelligent Commerce

A platform combining APIs and a partner programme^[12]. Focuses on tokenisation, agent identity verification, purchase history (opt-in), and personalisation for LLMs. Being tested with OpenAI, Perplexity, and Anthropic in the US; with Ant International and Grab in Asia Pacific^[38].

Machine Payments Protocol (MPP) – Stripe + Tempo (Visa as design partner)

Protocol for agent-to-agent payments^[36]. Supports B2B transactions between purchasing agents and supplier agents.

x402 – Coinbase

Revitalises the obsolete HTTP 402 status code (“Payment Required”) to embed stablecoin payments (USDC) directly into web requests^[16]. Designed for fully autonomous agents operating on crypto rails, without the need for accounts or API keys.

Model Context Protocol (MCP) – Anthropic (the integration standard)

Open standard (November 2024) standardising LLM integration with external tools and data^[39]. By 2026, most major PSPs (Adyen, Stripe, PayPal) have launched their own MCP servers, enabling payment integration through AI developer tooling^[14].

5. Key Players – Who Is Building Agentic Payment Infrastructure?

Card Networks

Mastercard has established itself as the European leader. Agent Pay is scaling to production, all European issuing institutions are ready at the network level, pilots have been completed in Poland, the Netherlands, Belgium, and 37 European banks have executed test transactions^[31][32]. Mastercard is also opening a Lisbon Centre of Excellence for Innovation^[31].

Visa has chosen a more platform-oriented model: Intelligent Commerce as infrastructure, AI ecosystem partnerships, and sandbox testing. The partnership with OpenAI announced in June 2026 signals an acceleration^[35].

Enterprise PSPs

Stripe has built its position as the “connector” for the entire agentic ecosystem. Suite, MCP server, Machine Payments – Stripe wants to be the platform through which merchants connect to all agentic channels via a single API^[13][40]. Stripe’s leadership describes today’s state as “level 1-2” out of five levels of agentic commerce maturity^[41].

Adyen has adopted a “merchant-first” strategy: merchants retain control of tokenisation, routing, and the customer relationship; the agent is embedded within the existing ecosystem^[42]. Adyen Agentic (June 2026) – three layers: Feed, Cart, Payments^[30]. Adyen has joined the Agentic AI Foundation^[43]. Goldman Sachs and Morgan Stanley rate Adyen a “Conviction Buy” with a EUR 2,200 target^[44].

Worldline has demonstrated European operational capability with the ING production transaction in the Netherlands^[32][45]. As Europe’s leading acquirer, Worldline is a natural bridge between card networks and merchants.

PayPal launched an Agent Toolkit and MCP server for developers^[46], while “PayPal Beyond” (April 2026) positions PayPal as the infrastructure for the full agentic journey – from identity to checkout^[47][48]. Notably, PayPal’s branded checkout (the button) recorded only 1% online growth in Q4 2025; unbranded is growing faster^[49].

Big Tech AI Platforms

OpenAI (ChatGPT): 900 million weekly active users (February 2026)^[36]. Following the Instant Checkout pivot, the focus is on product discovery and ChatGPT Apps as a commerce channel. The strategic partnership with Amazon ($50 billion investment, February 2026) may make ChatGPT + Amazon the dominant B2C agentic commerce pairing^[50].

Google: Owns Shopping Graph with 60 billion product listings and one billion shopping queries per day^[25]. Universal Cart + UCP + AP2 + Gemini = Google’s complete agentic stack.

Amazon: Rufus (formerly Alexa for Shopping) generated nearly $12 billion in additional sales in 2025 and converted 3.5x better than other sessions^[9][51]. In May 2026, Amazon opened its AWS Agentic Shopping Assistant to external retailers with a deployment time of approximately 60 days^[51].

6. Europe: Between Pioneering and Regulatory Caution

What Has Been Proven

Europe is not behind. The past six months delivered real breakthroughs:

• March 2026: Santander + Mastercard: the first regulated agentic transaction on the continent^[19].
• May 2026: mBank + Pekao + UniCredit: Poland joins the Mastercard Agent Pay pilot^[29]. The first step verifying the Polish financial sector’s readiness.
• June 2026: Worldline + ING + Mastercard: the first production, end-to-end agentic payment in Europe, spanning the Netherlands and Belgium^[32].
• All European Mastercard-issuing institutions are technically ready at the network level^[31].

The European Specificity: Where Autonomy Hits Regulation

Consulting firm Diconium states clearly: “Autonomous checkout is not currently available in Europe”^[52]. Fully autonomous purchases – without any human confirmation – encounter three regulatory barriers in Europe:

1. PSD2 / SCA: Strong Customer Authentication requires interaction with a specific individual (biometrics, device, knowledge). An AI agent is not the “payer” under current definitions^[17]. The PSD3/PSR proposal (currently in trilogue, implementation 2026-2028) does not explicitly address payments initiated by AI agents – a significant blind spot^[53].
2. EU AI Act: Full compliance for high-risk AI systems from 2 August 2026 (Annex III systems covering credit assessment, biometrics, employment – delayed to 2 December 2027)^[54]. For PSPs: classifying an AI agent within a payment system as “high-risk” may require a full compliance package^[17].
3. GDPR: Processing consumer data by an AI agent to execute purchases raises questions about legal basis, data minimisation, and automated decision-making (Art. 22 GDPR)^[52].

The practical consequence: Perplexity’s Buy with Pro is not available in Europe^[52]. ChatGPT’s Instant Checkout never crossed the Atlantic.

The European Opportunity: B2B and Internal Agents

Autonomous B2C purchases face barriers, but B2B has a completely different risk profile^[52]. B2B procurement is more repetitive, automation is already embedded (EDI, PunchOut), and SCA does not apply to merchant-initiated transactions in certain scenarios. Gartner projects 90% of B2B purchases executed by AI agents by 2028^[6] – a trend that in Europe may outpace B2C.

Internal agents are equally significant: AI managing catalogues, dynamic pricing, returns handling, and fraud detection. McKinsey confirms: 84% of European consumers use AI in daily life, 63% during shopping – but only 30% would trust an agent to place an order without their confirmation^[52]. Organisational and technical preparedness is growing faster than B2C consumer trust.

7. Fraud and Risk – A New Threat Landscape

Jeff Weinstein at Stripe identifies four new attack vectors^[55]:

1. Agent Takeover (ATO): An attacker steals login credentials, hijacks a legitimate agent, and completes purchases using another person’s funds.
2. Trojan Horse Agents: An apparently helpful shopping agent that secretly siphons payment data.
3. Compromised Agent Networks: Armies of fake “legitimate” agents sold on dark web marketplaces.
4. The Authentication Gap: No reliable way to prove that an agent is acting on behalf of a specific user rather than behind their back.

The scale of the threat is real: 75% of respondents in the Darwinium survey (500 fraud, risk, and security leaders) estimate that more than 25% of current fraud attempts are AI-assisted^[56]. 78% of financial institutions expect fraud to increase following the deployment of AI shopping agents^[5].

Industry responses:

• FIDO Alliance has created the Agentic Authentication Technical Working Group with Google and Mastercard input – developing “Verifiable User Instructions” and “Agent Authentication” standards^[24].
• Cloudflare advocates cryptographic agent verification via Signature-Input and Signature-Agent HTTP headers^[5].
• Mastercard embeds Verifiable Intent into Agent Pay – every transaction carries a cryptographically bound user consent policy^[31][37].
• The concept of “Know Your Agent” (KYA) – a direct analogy to KYC for agent certification – is gaining traction across the industry^[57].

8. Implications for PSPs – A Strategic Window

Where the Risk of Being Bypassed Comes From

PSPs have traditionally occupied the space between merchant and card network on the acquiring side. In the agentic model, a new upstream entry point appears: the AI platform (ChatGPT, Gemini, Amazon Rufus) that initiates the transaction before the user ever visits a merchant’s website.

As Worldline and Valantic state directly: PSPs that do not integrate with the LLM layer risk being excluded from the purchase journey^[57][58]. An AI agent will naturally prefer providers with agentic APIs, rich product metadata, and transparent consent mechanisms.

The Technical Layer: What PSPs Must Actually Do

1. Integrate with agentic protocols: ACP (OpenAI/Stripe), UCP/AP2 (Google), Agent Pay (Mastercard). PSPs cannot require merchants to maintain five separate integrations – their role is to abstract that complexity^[57].
2. Support Agentic Tokens: The new token types (Mastercard MDES with agentic fields) require changes to the intake layer – formatting, routing, and consent policy validation at the network level^[57].
3. Carry agent metadata: A transaction initiated by an agent carries additional data (agent identifier, permission scope, consent policy). PSPs must be able to process, store, and present this data in the event of a dispute^[57].
4. Next-generation fraud detection: Models built for “human clicks” cannot distinguish a legitimate agent from a bot. What is needed are foundational payment models (Mastercard Payment Optimisation Platform is one example^[59]) and autonomous risk engines that analyse agentic behavioural patterns^[59].
5. MCP Server and API-first architecture: Deploying an MCP server (following the example of Adyen and PayPal) enables developers to build agentic integrations without deep knowledge of the PSP’s native API^[14][39].

The Regulatory Layer: Key Open Questions

Consent and SCA: PSD2 requires “payer consent” for each transaction, and SCA requires interaction with a specific individual. A “framework consent” (the user sets limits once, the agent acts within them) is technically possible, but ensuring ongoing SCA compliance presents a structural challenge^[17]. PSPs need to design new authentication flows – for example, payment passkeys as used in Mastercard Agent Pay^[60].

Liability and chargebacks: If an agent purchases the wrong product due to AI hallucination or misinterpretation of user intent – who bears responsibility? Without “proof of intent,” PSPs are exposed by default^[17][57]. Cryptographically signed “mandates” (AP2) or “Verifiable Intent” (Mastercard) are intended to serve as that proof.

PSP licensing: An AI company offering an end-to-end purchase flow without a PSP licence may be in violation of PSD2 – unless it operates purely as technical infrastructure without “possessing” funds^[17][61]. PSPs may therefore be indispensable compliance partners for AI companies seeking to enter the EU market.

EU AI Act (2 August 2026 – delay to 2 December 2027 for Annex III): Agentic AI in payments may qualify as high-risk (credit assessment systems). PSPs acting as “users of AI systems” carry a lighter compliance burden than “providers”^[17]. Despite the deadline delays^[54], preparing governance documentation and risk management frameworks should begin now.

DORA: PSPs relying on external AI systems (ICT third-party risk) must ensure DORA compliance – AI vendor due diligence, minimum contractual requirements, and ICT risk management frameworks^[17].

Three Strategic Positioning Options for PSPs

Strategy	Description	Risk
Connector (Stripe/Adyen model)	Be the abstraction layer between merchants and all agentic protocols	Need to integrate rapidly with every new protocol
Trust Anchor	Specialise in compliance, SCA-equivalent for agents, Verifiable Intent, KYA certification	Slower growth; requires close collaboration with networks
Infrastructure Layer	Offer PSP-as-a-service for AI companies seeking EU market entry without their own licence	Depends on the pace of AI firm market entry

Forrester notes that the leading PSPs (Adyen, PayPal, Stripe, Worldpay) are converging on two priorities: building MCP servers for agent access and pursuing certification across competing protocols^[36].

9. B2B: The Unexpected Front of Advantage

While B2C agentic commerce dominates headlines, B2B is closer to mass adoption^[52]. The reasons:

• B2B procurement is more repetitive (ordering raw materials, licences, services) – ideal for agents with well-defined mandates.
• SCA does not apply to merchant-initiated transactions (MIT) under established mandates – fewer regulatory barriers.
• Existing ERP and ProcureTech systems are already structured for agentic automation via MCP.
• Gartner projects $15 trillion in B2B value flowing through agentic exchanges by 2028^[6].

PSPs serving B2B customers – SaaS platforms, B2B marketplaces, wholesalers – should treat agentic B2B commerce as an operational priority for 2026-2027, not a future-state planning exercise.

10. Stablecoins and Crypto-Native Agentic Rails

In parallel to the card-network world, a separate narrative is developing: AI agents + stablecoins. The technical argument is coherent – an AI agent cannot hold the identity document required by a bank, but it can hold a crypto wallet^[16].

Coinbase x402 (May 2025), Stripe Machine Payments on Base (February 2026), MoonPay Agents (February 2026) – all settle in USDC^[16]. The primary use case: agent-to-agent microtransactions (payment for API data access) or one agent purchasing a service from another without any human in the loop.

For European PSPs: this terrain is harder to navigate (MiCA, absence of PSD2-compatible stablecoin rails). However, it is worth monitoring whether Mastercard’s “Agent Pay for Machines” on blockchain (Polygon, Solana, Base)^[34] marks the direction for agent-to-agent microtransactions over the medium term.

11. What Remains Unknown – Gaps and Open Questions

No dominant protocol has emerged. Forrester explicitly writes about a “battle of protocols” – ACP vs. UCP/AP2^[36]. The market resembles 2010 in mobile payments: too many standards, too little interoperability. PSPs need a clear internal position on this uncertainty.

European conversion data is absent. The figure of 805% AI traffic growth (Black Friday 2025) relates to the US. European consumer data indicates that only 30% of consumers would trust an agent to place an order without their confirmation^[52] – a trust barrier, not a technology one.

PSD3/PSR ignores agents. The current PSD3 draft contains no provisions on payments initiated by AI agents^[53]. Until its implementation (2026-2028), PSPs will operate in the interpretive grey zone of PSD2.

The IMF is sceptical of full autonomy. The IMF note envisions an architecture in which AI is “smart” but payments remain “dumb” (deterministic)^[23]. This is a significant signal – global regulators are not yet prepared for fully probabilistic payment initiation.

12. What to Do Now – A Priority List for PSPs

A pragmatic set of actions, ordered from shortest to longest time horizon:

Immediately (Q3 2026):

• Audit your architecture for handling “agent-originated transactions” – how are they formatted, routed, and recorded in the audit log?
• Classify internal AI systems under the EU AI Act (Annex III vs. transparency obligations).
• Perform DORA risk assessment for AI vendors.

Short-term (Q4 2026):

• Deploy an MCP Server (following Adyen and PayPal) – enabling merchants to build agentic integrations without additional development overhead.
• Complete a pilot integration with at least one agentic protocol (ACP/Stripe, UCP/Google, or Agent Pay/Mastercard).
• Open dialogue with Mastercard and Visa regarding Agent Pay / Intelligent Commerce certification.

Medium-term (2027):

• Build or acquire a next-generation fraud detection solution with a behavioural model for agentic traffic.
• Create a “Verifiable Intent” layer capturing and encapsulating user intent as evidence in dispute resolution.
• Develop a “PSP-as-Compliance-Layer” offer for AI companies planning EU market entry.

Glossary

Term	Definition
Agentic commerce	A commerce model in which an AI agent autonomously executes a purchase based on a user-defined goal
ACP	Agentic Commerce Protocol – open standard by OpenAI and Stripe
UCP	Universal Commerce Protocol – open standard by Google
AP2	Agent Payments Protocol – the payment layer of Google’s UCP
Agent Pay	Mastercard’s framework for tokenised, agent-initiated payments
Agentic Token	Mastercard MDES token with additional fields binding it to a specific agent and consent policy
MCP	Model Context Protocol – Anthropic’s open standard for integrating LLMs with external tools
MPP	Machine Payments Protocol – Stripe/Tempo standard for agent-to-agent payments
Verifiable Intent	A cryptographically signed declaration of user intent executed by an agent
KYA	Know Your Agent – the KYC analogy for verifying AI agent identity and permissions
x402	Coinbase protocol embedding USDC payments within HTTP requests
DORA	Digital Operational Resilience Act – EU regulation for ICT risk management in financial services
MIT	Merchant-Initiated Transaction – a payment category allowing recurring, agent-executed charges under a pre-established mandate

This report is based on data and analysis from the following institutions and publications: Mastercard, Visa, Stripe, Adyen, Worldline, OpenAI, Google, Amazon, International Monetary Fund, McKinsey & Company, EuroCommerce, Forrester Research, Morgan Stanley, Bain & Company, Gartner, Taylor Wessing, Fenwick & West, FIDO Alliance, Diconium, Valantic, FintechPoland, Cashless.pl, Electronic Payments International, Digital Commerce 360, and others.