Mastercard Agent Pay, Visa TAP, and ACP: The Agentic Payments Protocol Map for Merchants (October 2026)

On October 1, 2026, Mastercard added two new capabilities to Agent Pay. A probability score, now in testing in the United States, estimates how likely it is that a given transaction was actually initiated by an AI agent rather than a human, which helps issuers decide whether to approve it without unnecessary friction. Alongside it, a set of trust and intelligence signals answers three narrower questions for an issuer in real time: does this activity match expected patterns, does anything here need a closer look, and should the transaction proceed or trigger an additional check. Mastercard built the identity side of this with Skyfire, a provider of what the industry calls KYA technology, know your agent, and is working with Cloudflare on the data side to keep the underlying activity analysis privacy preserving.

That announcement landed the same week trade coverage took stock of the full agentic payments landscape and counted eight live protocols: MCP and A2A for agent connectivity, ACP and UCP for discovery and checkout, AP2 for cryptographic consumer authorization, TAP and Agent Pay for agent identity and transaction trust, and MPP for machine to machine card payments. The framing that matters here, and the one the better coverage is converging on, is that this looks like the internet's own protocol stack: several specialized layers doing different jobs at the same time, not one standard beating the others into irrelevance.

Why this is not actually a standards war

It is tempting to read eight competing acronyms as chaos, but look at what each one actually does and the overlap mostly disappears. MCP and A2A sit at the connectivity layer, giving an agent the tools and coordination it needs before a purchase is even in view. ACP and UCP sit at the discovery and checkout layer, defining how a product gets surfaced to an agent and how a cart gets built and submitted. AP2 sits underneath both as an authorization layer, giving a consumer a cryptographically verifiable way to say yes to a specific purchase a specific agent is about to make. TAP and Agent Pay sit on the card network side, answering a different question entirely: not what was bought, but whether the entity buying it was actually an authorized agent and not fraud. MPP handles the narrowest case, a machine paying another machine with no consumer authorization step involved at all.

A merchant does not pick one of these the way they picked a payment gateway a decade ago. UCP already carries backing from Mastercard, Stripe, and Visa alongside Shopify and Google, which tells you plainly that the card networks expect to sit underneath whichever discovery and checkout protocol wins traffic, not to replace it. The real integration question is not which protocol to bet on. It is which layers your stack currently has no coverage for at all.

What a merchant not on Shopify actually has to do

If your storefront already handles ACP for OpenAI driven checkout, you have discovery and checkout covered for that specific agent ecosystem, but that says nothing about whether a transaction coming through it will clear cleanly on the card network side. Agent Pay and TAP operate independently of ACP and UCP, at the issuer and network level, which means a merchant can be fully compliant on the checkout protocol and still see legitimate agent driven transactions declined or flagged if the underlying card never gets the trust signals Mastercard and Visa are now building. Practically, that means confirming with your payment processor whether Agent Pay's probability score and trust signals, or Visa's TAP credential flow, are active on your merchant account, separately from whatever checkout protocol your storefront speaks. These are two different integration surfaces, and shipping one without the other leaves real transactions getting declined for looking exactly like what they are.

FAQ

Do I need to support all eight protocols? No single merchant needs all eight. Most storefronts need one discovery and checkout protocol relevant to where their customers shop, UCP or ACP depending on channel, plus whatever their card processor requires on the Agent Pay or TAP side. MCP, A2A, and MPP mostly operate below the merchant integration layer.

What does Mastercard's probability score actually change for a merchant? It changes approval behavior at the issuer, not at your storefront. A transaction correctly flagged as agent initiated with a high trust score is less likely to be declined as suspicious, which should reduce false positive declines on legitimate agent purchases over time.

Is TAP the same as UCP? No. TAP is Visa's agent identity and credential protocol, operating at the network and issuer level. UCP is a discovery and checkout standard that Visa also backs, operating at the storefront level. A merchant can need either, both, or neither depending on their stack.

Does backing UCP mean Mastercard and Visa are abandoning Agent Pay and TAP? No, and this is the core of why the eight protocol landscape is not a war. The same networks back the checkout layer protocol and run their own identity and trust layer underneath it, because those are different jobs.

Who is Skyfire and why does Mastercard's announcement mention them? Skyfire builds know your agent, or KYA, technology, the identity verification layer that lets a network confirm a specific AI agent is who it claims to be before trusting the transaction it initiates. Mastercard is using Skyfire as the identity backbone under Agent Pay's new trust signals.

When this applies to your stack

If your checkout already speaks one of the discovery protocols, confirm separately with your payment processor whether the identity and trust layer, Agent Pay, TAP, or both, is active on your merchant account, because that is the piece most teams are missing and the piece most likely to cause real declines. If you have not touched agentic checkout at all yet, start with whichever discovery protocol matches where your actual customers are shopping with agents today, not the one with the most press coverage. Contra Collective integrates agentic commerce protocols and the payment network layers underneath them for headless and Shopify Plus merchants who need both working together.