Questions about AI-driven payments have been buzzing in risk team chats since EMVCo released their draft framework for card-based agentic payments. This framework is open for public review until Wednesday, September 30, and the inquiries keep coming.
You're likely fielding these questions too. Your fraud team wonders about new detection rules. Your compliance lead is concerned about regulatory risks. Your product manager wants to understand the scope.
Here's what you need to know about the framework and its implications.
Do We Need to Change Our 3DS Implementation for AI Agents?
Not immediately, but it's important to understand the role of Intent Services.
EMV 3-D Secure handles authentication for card-not-present transactions. It typically involves a single transaction: consumer initiates, issuer challenges, consumer authenticates, payment proceeds.
Intent Services introduce a new model for scenarios where intent persists across multiple interactions, like recurring purchases or cumulative budgets. Examples include "buy coffee every morning, don't exceed $50/week" or "reorder supplies when inventory drops below a threshold."
The framework positions Intent Services as a coordination layer alongside 3DS, not a replacement. When an agent initiates a payment, 3DS authentication still occurs. Intent Services provide a reference to the registered intent authorizing the agent.
Your 3DS flow remains unchanged. The difference lies in verifying that the transaction aligns with delegated authority, which is a fraud prevention issue, not an authentication one.
How Do We Prove the Consumer Actually Authorized the Agent?
This is the main challenge the framework addresses.
Intent Services offer "a shared, interoperable layer" for registering, referencing, retrieving, and managing consumer-authorized intent before, during, and after a transaction. Essentially, it's a record of intent that multiple parties can verify.
When a consumer delegates authority to an agent, this delegation is registered with an Intent Service, including lifecycle and state information. When the agent initiates a payment, it references this registered intent. Issuers, acquirers, or merchants can verify that the transaction is within scope.
However, the framework doesn't specify how consumers prove their identity when registering intent. EMVCo is working with the FIDO Alliance and OpenID Foundation, indicating they might use existing authentication standards.
Your task is to determine what evidence you'll require. If an agent presents an intent reference, what do you need to see? Cryptographic proof of the original authorization? Multi-Factor Authentication logs? Biometric confirmation? The framework provides the structure; you define the threshold.
What Happens When Intent Changes Mid-Transaction?
The framework touches on "lifecycle and state information," but it's vague on enforcement.
Imagine a consumer authorizes an agent to book travel up to $2,000. The agent finds a flight for $1,800, initiates booking, but the price jumps to $2,100 by the time the transaction processes. Does the transaction proceed? Does the agent need fresh authorization? Who decides?
Intent Services are meant to maintain state across interactions, tracking cumulative spend, time windows, and transaction counts. But the framework doesn't specify whether Intent Services enforce limits or just report them.
You need to decide where enforcement happens. If you're an issuer, you might decline transactions that exceed registered intent parameters. If you're a merchant, you might require agent re-authorization before processing. If you're building the agent platform, you might block the request before it reaches the payment network.
The framework gives you the data structure, not the business rules.
Do We Need New Fraud Detection Models for Agentic Transactions?
Yes, and you need them before this goes live.
Current fraud models assume a human initiates each transaction, looking for patterns like velocity, geolocation mismatches, unusual merchant categories, and behavioral anomalies.
Agentic transactions disrupt these patterns. An agent might legitimately initiate 50 transactions in 10 minutes across multiple merchant categories in different countries. That's not fraud; it's an agent comparison-shopping or executing a complex purchase workflow.
The framework mentions potential future work on "Agentic Transaction Indicators" and "Know Your Agent (KYA)" capabilities. These would signal that a transaction involved an agent and provide identifying attributes about the agent.
You'll need those signals. Without them, you can't distinguish between direct consumer action and delegated agent activity, making it impossible to tune your models.
Start building a test dataset now. If your organization is participating in the EMVCo review process, push for clear transaction indicators in the next version. If you're not participating, consider joining.
What's Our Regulatory Exposure if an Agent Makes an Unauthorized Purchase?
This is a major concern for compliance teams, and the framework doesn't provide answers.
Under the Fair Credit Billing Act, consumers have dispute rights for unauthorized charges. But what counts as "unauthorized" when the consumer explicitly delegated authority to an agent? If the agent exceeds its mandate, is that fraud or a contract dispute?
The framework introduces the concept of registered, retrievable intent, which helps demonstrate authorization. But it doesn't define liability when things go wrong.
You need to align this with your existing dispute and chargeback processes. If a consumer claims they didn't authorize a purchase, and the agent provides an intent reference, what's your investigation procedure? What evidence do you require from the agent platform? What recourse does the consumer have if the agent malfunctioned?
Document your position before your first agentic dispute arrives. Work with your legal team to define what "consumer-authorized intent" means in your jurisdiction and how you'll verify it.
Should We Wait for the Final Spec or Start Planning Now?
Start planning now.
The framework is open for public review until Wednesday, September 30. This is your chance to influence the final specification. If you identify gaps or implementation challenges, submit feedback. EMVCo is engaging with Associates and Subscribers and collaborating with the FIDO Alliance, OpenID Foundation, OpenWallet Foundation, and W3C.
Don't wait for the final spec to start internal discussions. Map your current authentication flows. Identify where intent verification would fit. Talk to your fraud team about detection model changes. Review your dispute procedures.
Agentic payments are becoming a reality. The question isn't whether this will affect your operations, but whether you'll be ready when it does.
Where to Go for More
EMVCo's draft framework, EMV® Agentic Payments - Framework for Specifications, is available for public review through Wednesday, September 30. Even if you're not an EMVCo Associate or Subscriber, you can explore participation options and submit input.
For authentication standards likely to integrate with Intent Services, review FIDO Alliance specifications and NIST SP 800-63B for digital identity guidelines.
If you're responsible for fraud prevention, start tracking industry working groups on agentic transaction indicators. The signals you build into your models now will determine how effectively you can distinguish legitimate agent activity from fraud when this framework goes live.
