Agent-based commerce requires cloud-first infrastructure

By Thomas Benjaminsen Normann, Product Director (Digital Services), Paymentology

Following the launch of protocols for agents, the payments industry has increasingly recognised an oncoming shift like the internet, but many financial institutions, FinTechs and businesses haven’t fully grasped its implications. While banks focus on incremental improvements to digital services, Visa and Mastercard launched platforms enabling AI agents to handle transactions autonomously. With 99% of executives planning AI agent deployments and 65% already running pilots, this represents more than a technological advancement, but a completely new method of interacting with financial services.

The transition from manual commerce to agent-assisted transactions is accelerating beyond most predictions. Visa’s Intelligent Commerce and Mastercard’s Agent Pay have moved beyond experimental pilots to process real transactions. The payments industry is approaching a significant inflexion businesses must preparection point, and businesses must prepare for a new age of digital commerce.

Keeping pace with agentic demands

Financial infrastructure designed for the self-hosted era is unable to meet the demands of autonomous agents. While Visa and Mastercard have already deployed tokenised credentials and API-first architectures to support AI agents, legacy payments and banking systems built on monolithic, decades-old mainframe architectures cannot keep up. These platforms lock institutions into implementation cycles of months or even years, while their competitors are already processing agent transactions in real-time.

However, simply moving to cloud-first infrastructure isn’t enough. Many supposedly modern solutions are merely legacy architectures repackaged for cloud deployment, offering limited configurability and adaptability. The real competitive advantage lies in platforms that enable real-time configuration without code deployments, dynamic rule engines that adapt instantly to new use cases and truly composable services that can be recombined for emerging scenarios.

Network tokenisation has become the foundation that makes agent-driven payments possible. By replacing sensitive card credentials with dynamically generated tokens, network tokenisation enables AI agents to conduct transactions without exposing actual payment card numbers. This token-based approach is essential for autonomous systems that may store, transmit and process payment credentials across multiple touchpoints. Traditional PCI compliance frameworks, designed for human-mediated transactions, prove inadequate when AI agents need to manage hundreds of tokenized credentials simultaneously across diverse merchant environments.

Trouble in paradise

However, the tokenization landscape reveals a troubling reality. When Apple Pay launched, most tokenization implementations were rushed, hard-coded solutions built for very specific requirements. As the scope expanded to eCommerce tokenization and Click to Pay, vendors largely focused on mandate compliance rather than building flexible, adaptable platforms. Today, many issuers operate tokenization systems that automatically approve eCommerce token requests with minimal risk evaluation, a legacy of Visa and Mastercard’s original green path/red path limitation that offered no middle ground for risk assessment.

Adopting a truly cloud-first infrastructure stack isn’t an iterative upgrade, it’s the price of admission to participation in the agentic era. Institutions need tokenization platforms that offer real-time configurability and multi-dimensional control capabilities, and legacy systems repackaged for the cloud simply won’t do. Migrating core systems to platforms built from the ground up for the cloud enables rapid deployment and seamless integration of new agile workflows, reducing timelines for launching new capabilities from months to days. Cloud-first platforms excel at token lifecycle management, enabling real-time token provisioning, rotation and revocation that autonomous agents require for secure operations. This isn’t about moving existing systems to the cloud, it’s about rebuilding financial infrastructure with API-first architectures designed for machine-to-machine communication.

The institutions that remain reliant on legacy systems are betting against a shift in payments technology that is already underway. Their reluctance to embrace truly adaptable, configurable cloud-first infrastructure will severely degrade their ability to compete with modern competitors when autonomous agents bypass traditional banking channels entirely, seeking partners capable of interacting through agent-to-agent channels.

Personalisation drives survival

Generic financial products have a limited shelf life following the launch of agent-driven commerce platforms. Mastercard’s Agent Pay demonstrates the precision these systems demand, enabling an AI agent to curate birthday party outfits based on style preferences, venue ambience and weather forecasts, then execute purchases across multiple retailers. Network tokenization enables this cross-merchant functionality through sophisticated token controls that allow agents to operate within specific parameters, such as spend limits, time restrictions, merchant category limitations and geographic boundaries, while maintaining transaction security and merchant isolation.

This level of contextual decision-making makes traditional one-size-fits-all financial products appear primitive by comparison. It also requires a fundamental shift in risk management. Instead of evaluating individual transactions at the point of sale, financial institutions must now assess and manage risk at the moment of token provisioning for AI agents. Legacy tokenization platforms, many of which automatically approve eCommerce token requests with minimal evaluation, are completely unprepared for this paradigm shift.

The trust challenge in agentic commerce is unprecedented. We’re asking consumers to allow computer programmes to research products, make recommendations and use their money to pay for purchases autonomously. How can anyone trust something like that? The answer lies in sophisticated tokenization that moves risk management from the point of purchase to the point of token provisioning.

The gap between expectations and the reality of agents in commerce is stark. While 66% of shoppers express interest in AI agents securing high-demand items and 65% want agents that can buy products at target prices, only 47% feel comfortable with agents making recommended purchases on their behalf. This trust deficit is partially addressed through network tokenization’s enhanced security, which enables personalisation of transactions without exposing sensitive payment credentials to agents. Consumers can grant agents highly specific tokens with multi-dimensional controls including spending limits, time constraints, merchant category restrictions and geographic boundaries, creating granular control over autonomous purchasing decisions.

Of course, consumers will not instantly adopt the new behaviours brought about by agentic commerce, with automated purchasing and payments disrupting typical expectations for online purchases. As merchants, payment processors, banks and FinTechs educate consumers on secure adoption of agentic purchasing and refine their infrastructure to accommodate agents, trust among the public will build in the new model for online commerce.

Embedding levers for personalisation at every possible point of the payments value chain is essential for agent adoption in commerce. Financial institutions must build comprehensive systems that capture and respond to individual preferences, positioning themselves to support the hyper-personalised interactions that autonomous agents will demand. This means creating platforms capable of instant customisation and dynamic product configuration, utilising cloud-first infrastructure to unify data sources and enable access for agents. Tokenization platforms must evolve beyond simple approve/deny decisions to sophisticated risk engines capable of real-time evaluation of agent capabilities and spending patterns.

The institutions excelling at personalisation today will become the preferred partners for tomorrow’s autonomous agents. Those that fail to build these capabilities will watch as intelligent systems route around them in search of more responsive alternatives.

Leadership in the era of agents

Digital payment technology is the first point of integration for agentic AI adoption in eCommerce. Innovative banks and payments companies already support the programmable transitions that autonomous agents require, making it the natural entry point for institutional transformation. Network tokenization serves as the critical enabler, but only when implemented through platforms capable of real-time configuration and sophisticated risk management at the point of token provisioning rather than transaction processing.

The financial institutions best positioned to benefit from this transition are partnering with providers that offer truly configurable, adaptable tokenization platforms, not merely cloud-hosted versions of legacy systems. These partnerships must include robust tokenization capabilities that can scale to support millions of autonomous transactions while providing real-time fraud detection and sophisticated token provisioning risk engines. The payments infrastructure decisions made today will determine which institutions remain relevant as autonomous agents begin managing the majority of financial transactions. Visa and Mastercard’s partnerships with OpenAI and Agent Pay demonstrate the competitive advantage available to early adopters of agent-compatible payment technologies.

Customer hesitation remains significant, with only 24% of American consumers feeling comfortable sharing data with AI shopping assistants. However, this trust gap creates an opening for companies that can build robust and transparent systems that are capable of earning consumer confidence, gaining market share by better serving the AI-first consumers of the future. Tokenization addresses many consumer security concerns by ensuring that AI agents operate within predefined constraints through sophisticated token controls, providing granular protection that can help bridge the trust gap.