Agentic Commerce: The Protocols Are Free, the Liability Isn't

TL;DR

On July 14th, 2026 the x402 Foundation went live under the Linux Foundation with 40 member organizations. Its 17 premier members include Visa, Mastercard, American Express, Stripe, Google, Coinbase and Circle. The protocol they steward has zero fees built in. In the week to September 26th it settled about USD 240,000 on x402stats' public daily data, 98% below its busiest week in November 2025. TRM Labs puts what looks like AI agents buying things at about USD 5,000 to 11,000 a month.

The biggest names in payments joined a protocol that charges nothing and barely moves money.

My read: they aren't there to collect a fee. They're there to make sure nobody else can.

My base case: through 2028 the agent-payment protocols earn nothing, and wash-filtered x402 plus MPP volume grows from about USD 11M a year in 2026 to approx USD 100M a year. At least 90% of the USD 0.6B to 1.3B of payment fees on agent purchases in 2028 goes to the networks, issuers and processors that already hold the credentials and the dispute rights. That's my model, which puts agent checkout on cards; Section IV tests how far that can move.

So the return sits with whoever issues the agent's credential and writes the rule for who eats a bad payment, and with whoever owns the shopper's attention. Both are owned today. Public-markets investors get at most a small option inside incumbents. Venture investors get one narrow wedge: evidence for agent errors that aren't fraud.

What would change my mind, fastest first: wash-filtered x402 plus MPP volume above USD 10M a month for two consecutive months before the end of 2027, on a method-disclosed series (it's about USD 0.9M a month now). Structurally: above USD 25M a month for two quarters before the end of 2028, or an independent identity or dispute company disclosing USD 50M of annualized agent-payment revenue.

In March I wrote about Conrad, my startup's go-to-market agent. Every line of his running cost is a monthly bill against an account. In August I argued that the rent accrues to the conversion layer, not the fuel. Agent payments have the same shape: the protocol is abundant, and the scarce thing is whoever stands behind the payment.

Where I sit: I lead capital formation at PL Capital, which has backed three companies in this piece: t54 Labs¹, an x402 Foundation member, World² and Privy³, which Stripe acquired in 2025. The one opening I find, the evidence layer for agent errors, is where t54 Labs sells. My thesis implies that independents there end up selling to a network or processor, an outcome that would suit PL Capital. So weigh my read of that seam accordingly; every company claim here links to a public, dated source, and the strongest case against the seam is in Section VIII.

How to read this

---

I. The protocols compose, and the incumbents wrote them

The protocols are layers, not rivals, and every one of them is free to use. They overlap in two places, and the incumbents are erasing both.

x402 and the Machine Payments Protocol (MPP) put a price on an HTTP request. The server answers with status 402, Payment Required, and its terms; the client pays; the server serves. AP2, UCP and ACP handle authority and checkout, and the card networks bolt agent identity onto rails they already run.

The overlaps are x402 against MPP at the 402 layer, and ACP against UCP at checkout. Visa's Intelligent Commerce Connect takes its Trusted Agent Protocol (TAP), MPP, ACP and UCP through one integration. MPP's core draft leaves settlement to whatever payment method a rail defines.

Coinbase built x402; Tempo and Stripe wrote MPP; Google wrote AP2 and led UCP; OpenAI and Stripe wrote ACP.

Each sponsor gives away a protocol that routes to something it owns.

Coinbase completed its contribution of x402 to the Linux Foundation on July 14th. Sixteen days later its Q2 2026 results said 97%+ of onchain agentic transactions used "Coinbase's x402 protocol", 90%+ of agentic stablecoin volume ran on Base, and 99%+ of onchain agentic commerce settled in USDC (all company-reported). MPP routes to Tempo and Stripe acceptance, UCP and AP2 to Google Pay, and the networks' agent programs to network tokens.

Joel Spolsky named this in 2002: smart companies commoditize their products' complements.

In 2021 I wrote that the web's open protocols were outpaced by the companies that built services on top of them, and that decentralized architecture was the way to reverse it. That argument hasn't aged well here.

The open architecture arrived, and the incumbents wrote it, in under eighteen months.

---

II. Measured money is a rounding error

Very little money moves. The headline counts overstate what agents spend by one to two orders of magnitude.

x402stats publishes every day of x402 settlement since launch. Summed by month:

++++

[ FIG. 01 ]

Oct 20254.01

Nov 202528.79

Dec 20258.41

Jan 20261.80

Feb 20262.24

Mar 20262.42

Apr 20262.05

May 20261.15

Jun 20261.00

Jul 20260.73

Aug 20261.45

Source: x402stats daily data (accessed 2026-09-27), summed by month. Author's calculation.

TRM Labs says that in late 2025 "the volume was speculation, much of it consistent with meme-token minting". Coinbase's own head of AI product estimates that 25% to 30% of x402 transactions may have come from people climbing public leaderboards.

Since January, raw volume has run at about USD 19M a year.

By "wash-filtered" I mean volume after a published wash-and-test filter, before any test for agents.

++++

[ FIG. 02 ]

Gross x402 settlements52.7

After TRM's anomaly screens25.62

Looks agentic, permissive test (7.5%)1.9

Looks agentic, strict test (0.6%)0.15

Source: TRM Labs, 'Who's Actually Paying? Measuring AI Agent Payments Onchain' (2026-09-09). Dollar values of the agentic shares are the author's calculation.

A Visa and Artemis report, commissioned and funded by Visa, threw out 89% of x402's raw dollar volume as wash and test activity. That left about USD 15.0M adjusted across 109.6M transactions to April 21st, about 14 cents each. A preprint covering 280 days of x402 on Base could prove that only USD 187,861 reached a nameable service, against USD 44.1M gross.

Every serious count shrinks the number.

The trackers can't even agree on the raw total (Artemis USD 135.7M to April, TRM USD 52.7M to September, x402stats and Coinbase about USD 55M), so I never mix them. The x402stats organic filter, the loosest of the three, puts the latest 30 days at about USD 0.87M. That's where my USD 11M a year comes from; MPP adds about USD 25,000 from its first weeks.

One signal points the other way: Chainalysis finds that payments of USD 1 or more rose from 49% of x402 volume in early 2025 to 95% by early 2026. Real use is forming, at a scale that doesn't yet cover anyone's payroll.

The card side can't be measured at all, because no listed incumbent reports agent-payment volume. Visa said partners had completed "hundreds" of controlled, real-world agent transactions by December 18th, 2025. Mastercard's 10-K says all US cardholders were enabled for Agent Pay in 2025, which is eligibility, not use. OpenAI promised Instant Checkout to over a million Shopify merchants; about a dozen to about 30 went live before it pulled back in March to focus on product discovery.

Announcements are plentiful. Money is not.

---

III. One purchase, two answers

Who gets paid, and who is liable, depends on which of two markets the purchase sits in.

Walk A is a consumer's agent buying a USD 90 order in Google's AI Mode. It runs on the card stack as the specs describe it: UCP for the session, AP2 mandates for authority, a Google Pay token for payment.

Walk B is an agent buying one Exa search over x402, the same search Conrad buys through an account. Exa charges USD 0.007 a call in USDC on Base, with no account, API key or subscription.

Much of the gap between the walks is what it costs to have someone stand behind the payment: fraud liability, chargeback rights and, on a credit card, the loan.

On cards, the incumbents collect nearly all the fees and write the loss rules. Issuers carry fraud on properly authenticated tokens. Merchants still carry most card-not-present fraud losses, on the Kansas City Fed's debit data, and they fight the disputes. On the stablecoin rail the fee is a tenth of a cent and the payer eats everything.

Coinbase's launch post on Hacker News pitched x402 to sellers as "micropayments without fraud".

From the buyer's side, every mistake is final.

Where the micro rail pays, and why it stays small

++++

[ FIG. 03 ]

Cost as % of ticket	USD 0.10	USD 1	USD 10	USD 100
Card, Stripe list (2.9% + 30c)	302.9%	32.9%	5.9%	3.2%
Debit, Regulation II interchange cap	220.05%	22.05%	2.25%	0.27%
FedNow (USD 0.045 a transfer)	45.0%	4.5%	0.45%	0.045%
x402 via Coinbase facilitator (USD 0.001)	1.0%	0.1%	0.01%	0.001%
Tempo transfer at fee cap (USD 0.0006)	0.6%	0.06%	0.006%	0.0006%

deeper shade = higher value

Sources: Stripe pricing; Regulation II (12 CFR 235); FedNow 2026 fee schedule; Coinbase CDP facilitator pricing; Tempo fee specification (all accessed 2026-09-27). Debit row is issuer interchange only. Author's calculation.

Stripe's list price of 2.9% plus 30 cents takes more than 10% of any ticket under USD 4.23, and never less than 2.9%.

Only stablecoin or batched rails serve tickets of about 14 cents.

But the real substitute for an agent's API spend isn't a card swipe. It's an account with a key and a monthly bill. Conrad calls the same handful of services every day, and for that pattern a spend-capped account beats a signature on every call.

The incumbents are buying that position: Stripe bought Metronome, a usage-billing company, and agreed to buy OpenRouter, a router for model spend. Even Frames, a catalog built for per-call payments, sells prepaid credit plans.

The per-request rail wins where no account exists: a one-off purchase from a seller the agent has never met. That's a real market, just not most of the spend. Pricing on it is a fixed fee per call, with upto and batch schemes in the spec and no negotiated one. MPP adds sessions and subscriptions, which is the account model again.

---

IV. The size of the prize

On my numbers, fees on agent-initiated payments come to roughly USD 0.6B to 1.3B in 2028 and USD 2.3B to 5.1B in 2030.

Nearly all of it is fees that already exist.

I built it two ways, counting fees only. The band is wide because nobody discloses agent GMV.

++++

[ FIG. 04 ]

Card and processor acceptance fees4825

Incremental agent-layer fees290

Machine-to-machine fees18

Protocol fees0

Model: author's calculation from Morgan Stanley (2025-12-08), Stripe pricing, Circle and x402 data. Forecast, not measured.

What's new is small: agent-layer fees (payment tokens, agent verification) of USD 0.13B to 0.29B in 2030, and machine-to-machine fees of about USD 3M to 18M. The agent-layer input rests on Stripe's listed USD 0.15 per Shared Payment Token; halving it moves the total by about 3%.

The 90% is partly an input, because my model puts agent checkout on cards. Say 20% of route A's 2030 agent GMV moved to open stablecoin rails at an all-in 0.5%, and independents kept every cent. Their share of the fee pool would be under 5%. The 90% breaks only if roughly 37% of agent GMV moves to open rails with independents keeping all of it, or about 57% if they keep half (my arithmetic on the model's inputs).

Cheap rails also shrink the pool as they take share. And on Riskified's Q4 2025 call, its CEO said he expects cards "to remain dominant in most categories".

The open rail barely registers. Grow 2026's roughly USD 11M of wash-filtered x402 plus MPP volume at 40% to 250% a year. You get about USD 21M to 133M by the end of 2028, with USD 52M in the middle. The band is a judgment call: Token Terminal counted transfers doubling in the week of August 17th, while value sat 96% below its November peak. At a 1% take, generous for a rail that charges a tenth of a cent a call, even USD 133M is about USD 1.3M of fees. That's a tenth to a fifth of a percent of the pool.

Anyone pricing an agentic-commerce story off the 2030 GMV forecasts (Morgan Stanley's USD 190B to 385B; Bain's USD 300B to 500B, which counts agent-influenced purchases) should turn GMV into fees first. The fee on USD 193B is about USD 5B.

---

V. Liability is where the return is held

On cards, fraud has an answer, and the networks write it. The seam is the agent error that isn't fraud. The loss itself is small next to the fee. What matters is who writes the rule, because the rule-writer also issues the credential that collects the fee.

Mastercard's Agent Pay page says "Only registered agents can transact", on its network tokens, and its machine-payments service promises "guaranteed settlement" across cards, accounts and stablecoins. Visa onboards agents to Intelligent Commerce, issues agent-specific tokens and collects "commerce signals", the user's original instruction and each authorized purchase. It says those signals will allow for "the quick resolution of most disputes".

That's the dispute-evidence layer, and the network is building it itself. Visa describes the product as in development, and Worldpay says Intelligent Commerce Connect is in pilot. Visa lists the service as free in its sandbox, with production fees on request.

According to FBT Gibbons, the public Visa Core Rules have carried express agentic provisions since April 2026, requiring identity verification under Intelligent Commerce specifications and use of the provisioned token. The same firm reads Mastercard's operating rules as still silent on agents.

When the agent authenticates and the token is valid, Worldpay's head of agentic commerce says liability "generally follows" existing tokenized-transaction rules: the issuer carries fraud, and the cardholder keeps chargeback rights. No agent-specific liability shift exists yet, and EMVCo has set up a task force.

So the networks are building a registration moat, not a liability shift.

Register your agent and you inherit the rules. Skip it and you carry the risk yourself.

The hole is the dispute that isn't fraud: the agent misread an instruction, bought the wrong thing or went past its brief. Worldpay, which sells dispute tooling, says current frameworks have no clean answer for who absorbs that. It concedes that "only the card networks can close the liability gap at scale." The usual evidence is a human clicking "buy". Here there isn't one.

The law narrows the seam. Under Regulation E, a consumer who hands an access device to someone who exceeds the authority given is liable until they tell the bank. Applying that to AI agents is my inference, untested by the CFPB or the courts. On credit cards, Regulation Z's claims-and-defenses right tends to push the loss back to the merchant. American Express backs cardholders on purchases by registered agents. As Worldpay notes, that leaves the merchant's side of a non-fraud dispute open.

That side is where an evidence vendor sells.

On the stablecoin rail the payer eats every loss. The GENIUS Act gives holders no chargeback right. In May 2025 the CFPB withdrew a proposal that could have extended Regulation E to some of these payments.

What the liability is worth

Card-not-present fraud on US debit cards ran above 19 basis points of transaction value in 2023, on the Kansas City Fed's count. At that rate, my 2028 agent GMV of USD 22.7B to 49.5B would carry at least USD 44M to 95M of fraud. That floor alone is about 8% of the acceptance fee: 19 basis points against 250.

The non-fraud slice, the one an independent could own, is unsized, because nobody publishes a dispute rate for agent errors.

Agent-error disputes in 2026 look like counterfeit card fraud before October 2015. Everyone can see the loss coming, and the question is which rule the networks write.

The analogue points both ways. The rule-writer sets the price of liability. But card-not-present fraud, which the 2015 rule didn't cover, stayed with merchants, and merchant-side guarantors such as Riskified built businesses there.

If agent rules follow the same path, the non-fraud seam is where an independent lives.

---

VI. Float pays the distributor, and attention pays the surface

The settlement asset is a rate trade

USDC carries 99.6% of x402's settled value on TRM's count. But an issuer earns on balances and interest rates, not on flow. In Q2 2026 Circle's USDC onchain volume grew 151% year over year while its reserve income grew 5%, because a 66 basis-point fall in the reserve return rate ate most of the balance growth.

On my float model, USD 1B a year of agent payments held 30 days on average keeps about USD 82M in balances. At the 3.48% reserve return rate Circle reported for Q2, that earns about USD 2.9M a year. The same flow at 10-cent tickets would pay about USD 10M in facilitator fees, more than three times the float.

++++

[ FIG. 05 ]

USD 54M

All x402 volume ever, May 2025 to Sep 2026 (company-reported)

USD 324.6M

Circle's payments to Coinbase, Q2 2026 alone

Sources: Circle Form 10-Q for Q2 2026; Coinbase, 'Coinbase for Agents adds equities and x402 payments' (2026-09-22). Author's calculation.

The issuer doesn't keep most of the float. Circle's distribution and transaction costs were 58.5% of its USD 701.3M of revenue and reserve income in Q2 2026, and USD 324.6M of it went to Coinbase. Coinbase says it has captured about half of all USDC economics over the past year. On the open rail it takes the largest share, about half, of what little money there is.

Even the chains are incumbent-sponsored. Tempo, incubated by Stripe and Paradigm, raised USD 500M at a reported USD 5B valuation, and Circle's Arc counts Visa and Mastercard among its founding validators.

Discovery is an ad market inside the surfaces

Google attached a paid Direct Offers pilot to AI Mode on the day it launched UCP, and OpenAI started showing ads in ChatGPT in February. For machine buyers the catalogs are thin and unpriced: the Bazaar indexes what Coinbase's own facilitator settles, and the official MCP Registry has no price or ranking fields.

Placement still matters, because agent choice can be steered. Rewriting a tool's description lifted agents' selection of it from about 20% to as high as 81% in one preprint. Microsoft Research's Magentic Marketplace found severe first-proposal bias in every frontier model it tested.

The value is the default slot, and the runtime owner controls it.

I can't size this leg from disclosed data, so my 90% covers the payment-fee pool only. The watch-list thresholds give a bound. On route A's USD 193B of 2030 agent GMV, a 0.10% toll on issuers would be about USD 190M. A 2% take from merchants would be about USD 3.9B, or 80% of the USD 4.8B card-acceptance pool.

For now I expect the low end, because Direct Offers is a pilot and ChatGPT's ads are a test.

---

VII. The opportunity map

Four tests, set before any company appears. A winner:

1. owns a complement the others can't give away: credentials, acceptance, balances or the default slot;
2. holds or prices the liability for a bad agent payment;
3. sits where the purchase decision is made;
4. survives at today's volume, without needing agent flow to pay its bills.

By incumbent I mean a company that held one of those complements at scale before x402 launched in May 2025: a payment credential, an acceptance contract, a stablecoin balance or a consumer surface.

I picked the companies below because each shows a mechanism, and I've included two failures. Three of them, t54 Labs, World and Privy, are PL Capital portfolio companies (see the footnotes above).

For a public-markets investor there is no pure play and no disclosed agent revenue. The exposure is an option inside the incumbents, and it's small: a modeled agent-layer pool of USD 0.13B to 0.29B in 2030 would be immaterial to any of them. On the defensive reading in Section VIII, it's worth nothing.

I'd treat it as free, on businesses owned for other reasons.

On the venture side, the funding ledger behind this piece counts USD 1.53B of disclosed venture money across 22 rounds since the start of 2025, a third of it Tempo's. Trust, identity and liability drew six rounds worth USD 113.3M, among them Baselayer's USD 35M and Catena Labs' USD 30M.

Capital is far ahead of volume, and the exits so far go to incumbents.

There's no clean base rate for open payment standards against bundled networks. The nearest precedents in this piece, the 2015 EMV shift, 3-D Secure and Apple Pay's issuer fee, each left the economics with the network or the surface.

The one wedge that still looks open is evidence for non-fraud agent errors, sold into network and processor programs. It's unsized. The nearest pricing comparable is Riskified, which books revenue on the orders it approves: USD 344.6M of FY2025 revenue, up 5%, on USD 155.1B of GMV reviewed, or about 0.22%. At that rate, a vendor screening every agent order in 2028 would book USD 50M to 110M.

That's a ceiling on revenue, not a size for the seam.

New channels price higher at first. Riskified's CEO said the general-purpose LLM channel carries higher risk, so the "average take rate there would likely be higher right now", though it could shift over time. At twice the blended rate, the ceiling is USD 100M to 220M.

My USD 50M falsifier sits somewhere between a quarter of that ceiling and all of it.

What I would not back:

• protocol tokens, because nothing in the mechanism needs one;
• a protocol itself, because Apache-2.0 and zero fees leave no toll;
• standalone agent wallets without distribution;
• independent API catalogs, because nobody pays for placement;
• new chains as a bet on agent flows, which carry USD 3M to 18M of machine-to-machine fees in 2030 on my base cases.

---

VIII. The case against all of this

Two of those falsifiers are regime detectors, not trend tests. Reaching USD 25M a month for two quarters needs roughly 4.5x to 6x growth a year from here. That's above the top of my own growth band. USD 50M of independent revenue would be two-thirds to one and a half times the whole modeled 2028 agent-layer pool of USD 34M to 74M. They fire only on a structural change, which is why the TL;DR and the watch-list lead with a faster test.

The machine economy is real, and x402 is just the wrong meter. AI inference and API spend is large, and it flows through prepaid credits and API keys. If per-request settlement became the norm for that spend, open-rail volume could jump by orders of magnitude with no new demand. That's the best case against my volume number. It points at an incumbent again: Stripe owns the usage-billing meter and has agreed to buy the router.

A steward, or a surface, can turn default status into a toll. Coinbase runs the leading facilitator, and the Bazaar lists what that facilitator settles. The precedent exists: card issuers pay Apple 0.15% on credit and half a cent on debit for Apple Pay. An issuer class claims that totals up to USD 1B a year. If an agent runtime does the same, "incumbents capture" splits into winners and losers among incumbents. For a public-markets reader, that matters more than my line between independents and incumbents.

Independents can own the trust layer. a16z's Noah Levine argues that processors can't underwrite a tool with no website, entity or track record. If networks buy attestation rather than build it, independents capture real value. My reply: Mastercard open-sourced Verifiable Intent and gave it to FIDO. AP2 routes its mandates into existing network representation, and Visa is building its own dispute signals. The evidence layer may become a free standard. At its strongest, this argument supports an exit thesis.

Consumers may not delegate checkout at all. Walmart said purchases made inside ChatGPT converted at a third of the rate of click-outs to its own site. If that holds, even the incumbents' agent pool stays near zero through 2028. The honest answer to "what is investable" is then "nothing yet".

Incumbents may earn nothing incremental. About 94% of the modeled pool is fees on orders a human might have placed anyway. The costs arrive first: issuers carry fraud on agent tokens, and Amex funds purchase protection. Shopify says agentic orders carry exactly the same economics as its online-store orders.

This argument weakens my own public-market case: on this reading the option is worth close to nothing, and the incumbents are spending to defend fees they already had.

One caution on all of it: the numbers this market runs on come from interested parties. The counter on x402.org appears frozen since about March, and the main adjusted study was funded by Visa. I've used method-disclosed counts only, with their boundaries next to each.

---

IX. What I'm watching

1. Raw x402 settlement, weekly. The seven-day average on x402stats was about USD 34,200 a day in the week to September 26th. Still below USD 100,000 a day at the end of March 2027, after Cloudflare's Monetization Gateway and Coinbase Business acceptance have had time to work, and the recovery case is dead.
2. Wash-filtered volume, monthly. About USD 0.9M a month now. Above USD 10M a month for two consecutive months before the end of 2027, on a method-disclosed series with no counterparty above 25% of the month, breaks the open-rail half of my base case.
3. The rail mix, by the end of 2027. If disclosed volumes show less than about 63% of agent GMV settling on card and processor rails, where the 90% breaks if independents keep every cent (Section IV), the base case is wrong. At 90% or more, my model becomes a measurement. If nobody discloses by then, the 90% stays a model, and I'll say so.
4. The agent-error rule, by the end of 2027. If the networks fold non-fraud agent errors into existing chargeback categories and nobody sells a paid guarantee, the one open seam closes. A rule that gives third-party evidence a paid role opens it.
5. Know-your-agent consolidation, by mid-2028. If two or more of Persona, Baselayer, Vouched, Skyfire, t54 Labs and Prove's agent unit are acquired or pivot while neither network prices a third-party attestation path, identity is a feature.
6. A surface toll, by mid-2028. An agent surface charging issuers or processors at least 0.10% per agent checkout, or merchants at least 2%, moves the pool from the networks to the surface owners.
7. Rules with dates. Treasury expects the GENIUS Act to take effect on January 18th, 2027. If the EU's final Payment Services Regulation text still requires strong customer authentication for agent-initiated stablecoin transfers, with no delegated-authority exemption, by mid-2027, EU agent spending tilts further toward cards.

---

X. Threads I keep pulling

The meter. Whether per-request settlement replaces prepaid credits for inference and API spend. The obvious experiment is moving one of Conrad's services from an account to x402. I plan to run that test and publish what breaks.

A number nobody publishes. There is no method-disclosed monthly series of wash-filtered agent payments. The daily data is public; the filter is the work. That's the piece I want to build next.

---

Coda

Forty organizations sit in the foundation behind a payment protocol that charges nothing and carries, on TRM's count, five to eleven thousand dollars a month of agents buying things. At the top of this piece that looked like an anomaly. On my reading, they're there to keep it free.

Everything that makes a payment worth accepting still costs money: a credential someone vouches for, a rule that says who eats the loss, a surface where the decision gets made, a balance that earns a rate. Those are owned, mostly by the names on that membership list.

The protocols are free. The liability layer is not. The companies that already price it for a living wrote themselves into the agent era before the agents showed up with any money.

---

A note on the numbers

I calculated these from primary data: the x402 monthly and weekly figures, the dollar values behind TRM's agentic shares, the break-even table, the two-route sizing, the rail-mix stress test, the growth range, the liability table, the float model, the wedge's revenue ceiling and the cross-source ratios. Everything else is someone else's number, named and dated where it appears.

The data freeze is 2026-09-27, and no figure was updated after it. Mastercard's Agent Pay page, its Agent Pay for Machines release and Visa's Intelligent Commerce page were re-read on 2026-09-28 for quotes; no figure changed. Two limits are worth knowing. I did not read the card networks' rulebooks directly: the rule descriptions come from Visa's and Mastercard's own product pages, Worldpay and one law firm's reading, each named where it's used. And no one publishes a method-disclosed monthly series of wash-filtered agent payments, so every volume figure here is a snapshot with its boundary stated, never an average of snapshots. The companion data and scripts are available; just ask.

---

References

Primary data

• Linux Foundation, Operational Launch of x402 Foundation (2026-07-14): members, premier tier, Coinbase's completed contribution. x402.org
• x402 Foundation, docs and README (accessed 2026-09-27): license, fees, schemes. docs.x402.org; github.com
• IETF Datatracker, draft-httpauth-payment-01 (2026-09-09): MPP's draft status. datatracker.ietf.org
• x402stats, daily stats CSV (accessed 2026-09-27): Figure 1, weekly totals, organic 30-day volume. x402stats.io
• TRM Labs, Who's Actually Paying? (2026-09-09): Figure 2, agentic tests, USDC share. trmlabs.com
• Visa and Artemis, Agentic Payments from the Ground Up (2026-07-14), commissioned by Visa: adjusted volume. visa.com
• How Agentic Is Agentic Commerce? (preprint, arXiv 2607.12575, 2026-07-14): provable value on Base. arxiv.org
• Circle, Form 10-Q for Q2 2026 (2026-08-05): distribution and transaction costs, payments to Coinbase. sec.gov; Q2 2026 results (2026-08-05): onchain volume, reserve income. circle.com; Q2 2026 earnings call transcript (2026-08-05): reserve return rate. fool.com; Arc validators (2026-08-05). circle.com
• Coinbase, Q2 2026 results (2026-07-30): agentic shares, USDC economics. investor.coinbase.com; Coinbase for Agents adds equities and x402 payments (2026-09-22): cumulative x402 volume. coinbase.com
• Coinbase Developer Platform, CDP Facilitator and discovery API (accessed 2026-09-27): pricing, Bazaar, Exa's listing. docs.cdp.coinbase.com; api.cdp.coinbase.com
• Mastercard, Form 10-K for 2025 (2026-02-11): Agent Pay eligibility. sec.gov; Mastercard Agent Pay (accessed 2026-09-28): registered agents. mastercard.com; Agent Pay for Machines (2026-06-10): initial participants including t54 Labs, guaranteed settlement. mastercard.com; Verifiable Intent (2026-03-05). mastercard.com; BVNK completion (2026-08-03). investor.mastercard.com
• Visa, Visa Intelligent Commerce developer page (accessed 2026-09-28): agent onboarding, agent tokens, commerce signals, fees. developer.visa.com; Intelligent Commerce Connect (2026-04-08). usa.visa.com; partner transactions (2025-12-18). investor.visa.com
• Google, UCP and Direct Offers (2026-01-11). blog.google; AP2 to FIDO (2026-04-28). blog.google; AP2 specification (accessed 2026-09-27): representment. ap2-protocol.org
• FIDO Alliance, AP2 and Verifiable Intent (2026-05-26). fidoalliance.org; A2A Project, Joining the Agentic AI Foundation (2026-08-27). a2a-protocol.org
• OpenAI, Buy it in ChatGPT (2025-09-29) and Testing ads in ChatGPT (2026-02-09). openai.com; openai.com
• CFPB, Regulation E 1005.2 and Regulation Z commentary to 1026.12 (accessed 2026-09-27): consumer liability. consumerfinance.gov; consumerfinance.gov; withdrawal notice (2025-05-15). federalregister.gov
• Public Law 119-27, the GENIUS Act (2025-07-18): holder protections. govinfo.gov; US Treasury, sb0605 (2026-08-17): expected effective date. home.treasury.gov
• Federal Reserve Bank of Kansas City, The Initial Effects of EMV Migration on Chargebacks in the United States (2018-12-06): the 2015 liability shift. kansascityfed.org; New Data on Card-Present and Card-Not-Present Fraud Rates in the United States (2026-02-25): 2023 fraud rates. kansascityfed.org
• Riskified, Form 20-F for 2025 (2026-03-06): revenue and pricing on approved GMV. sec.gov; Q4 2025 earnings call transcript (2026-03-04): GMV reviewed, agentic take rates, card mix. fool.com
• World, AgentKit (2026-03-17). world.org; Stripe, AWS AgentCore payments on Privy (2026-05-07). stripe.com; Payman, Access over ownership (2025-05-13). paymanai.com

Analysis and market

• Worldpay, Agentic commerce liability is still being written (2026-07-30): liability reading. worldpay.com
• FBT Gibbons, The Payment Infrastructure Layer (2026-05-05): Visa and Mastercard rules on agents. fbtgibbons.com
• Chainalysis, Agentic Payments Cross the Threshold (2026-06-03): payment-size mix. chainalysis.com
• CoinDesk on leaderboard farming (2026-08-23) and on underwriting machine merchants (2026-03-11). coindesk.com; coindesk.com
• Forbes (2026-03-10) and CNBC (2026-03-20, 2026-03-24) on Instant Checkout. forbes.com; cnbc.com; cnbc.com
• Morgan Stanley, Here Come the Shopping Bots (2025-12-08): GMV forecast, survey. morganstanley.com
• Bain & Company, 2030 forecast: how agentic AI will reshape US retail (2025-12-17): GMV range including agent-influenced purchases. bain.com
• Shopify, Q2 2026 earnings call transcript (2026-08-05): agentic order economics. investing.com
• Stripe, Metronome (2026-01-14) and OpenRouter (2026-08-19). stripe.com; stripe.com
• Cointelegraph, Tempo's Series A (2025-10-17). cointelegraph.com
• MacRumors, Apple Pay issuer fees (2026-09-25). macrumors.com
• Search Engine Land, Walmart's in-ChatGPT conversion (2026-03-19). searchengineland.com
• Technext, Chimoney's shutdown (2026-05-16). technext24.com
• ToolTweak (arXiv 2510.02554) and Magentic Marketplace (arXiv 2510.25779), preprints on agent choice. arxiv.org; arxiv.org
• Crunchbase News on Baselayer (2026-09-22); The Block on Catena Labs (2026-05-20). news.crunchbase.com; theblock.co
• Hacker News, Show HN: x402 (2025-05-06): launch pitch. news.ycombinator.com
• Joel Spolsky, Strategy Letter V (2002-06-12). joelonsoftware.com
• Disclosure sources: The Block on t54 Labs' seed (2026-02-25). theblock.co; PL Capital (Lacey Wisdom and Kacey Fisher), Rethinking Identity (2025-09-23), my employer's publication listing World and Privy as portfolio investments. medium.com

Prices and current conditions

• Stripe, Pricing & Fees (accessed 2026-09-27): card, dispute and token prices. stripe.com
• Exa, Pay with x402 (accessed 2026-09-27): USD 0.007 a search. exa.ai
• FedNow 2026 fee schedule; Regulation II (12 CFR 235): Figure 3 rows. frbservices.org; ecfr.gov
• Tempo, fee specification; Tempo Mainnet is live (2026-03-18). tempo.xyz; tempo.xyz
• Frames (accessed 2026-09-27): prepaid credit plans. api.frames.ag

Prior work in this series

• How I Built A Custom GTM Agent, Second Breakfast, March 2026.
• The Conversion Layer, Second Breakfast, August 2026.
• Web 2 --> Web3, Second Breakfast, April 2021.

---

Disclosures: PL Capital, where I lead capital formation, co-led t54 Labs' seed round, so I have a reason to want it to do well. PL Capital, where I lead capital formation, lists World among its portfolio investments, so I have a reason to want it to do well. PL Capital, where I lead capital formation, lists Privy among its portfolio investments; Stripe acquired Privy in 2025. Views are my own and do not represent PL Capital or Protocol Labs. Nothing here is investment advice. Do your own diligence.

Footnotes

1. PL Capital, where I lead capital formation, co-led t54 Labs' seed round, so I have a reason to want it to do well. ↩

2. PL Capital, where I lead capital formation, lists World among its portfolio investments, so I have a reason to want it to do well. ↩

3. PL Capital, where I lead capital formation, lists Privy among its portfolio investments; Stripe acquired Privy in 2025. ↩