Visa Expands Tokenization and Agentic Payment Capabilities Across B2B and Digital Wallet Platforms

Key facts

Topic: Visa payment network and tokenization developments
Generated: 2026-08-28
Evidence window: last month
Sources analysed: 5 (0 regulator/official, 2 company primary)

Executive Summary

Visa published developer release notes covering new B2B payment control APIs, digital wallet enabler tokenization endpoints (TR HCE API), and Visa Direct Connect SDK updates ^S1.
Visa completed a live agentic-commerce proof of concept with Nuvei, Arvato Systems, and fashion brand Kings and Priests, in which a merchant's AI agent initiated and paid for a purchase without handoff to a separate payment flow, settled on live Visa rails ^S3.
Visa is extending existing tokenization and network-level controls under "Visa Agentic Ready" to support agent-initiated payments ^S3.
Visa's tokenized transaction data shows a 4.6% lift in card-not-present authorization rates for tokenized versus non-tokenized credentials ^S5.
Both Visa and Mastercard are building stablecoin-to-card bridging capabilities, with Visa's work described as covering programmatic stablecoin-to-card conversion ^S4.

What Happened

Visa's developer release notes (dated within the evidence window) detail additions to Visa B2B Payment Controls, including a Client Outbound Events capability that lets Visa Commercial's Virtual Card Authentication service push authentication requests and biometric results to fintechs for OTP or biometric verification workflows ^S1. Separately, a new TR HCE API was introduced under Visa Digital Wallet Enabler, allowing token requestors to fetch keys and provisioning data from the token service provider (TSP), with public availability ^S1. Visa Direct Connect SDK also gained an "Update Preferred Payment Credential" API, with restricted availability ^S1.

On the commerce side, Visa participated in a live agentic-commerce proof of concept with Nuvei, Arvato Systems, and merchant Kings and Priests, in which an AI agent completed a purchase inside the agent flow with no separate payment hand-off, using multiple European issuers on live Visa rails ^S3. Visa Europe described this as an extension of "Visa Agentic Ready," building on existing tokenization and network-level controls ^S3. A third-party support article states Visa has been building stablecoin settlement capability, initially for issuer-acquirer USDC settlement, now expanded toward programmatic stablecoin-to-card conversion, paralleling Mastercard's Multi-Token Network ^S4. Industry commentary also references Visa's "Intelligent Commerce" framework as a parallel initiative to Mastercard's Agent Pay/Agentic Tokens program, both aimed at enabling verified AI-agent-initiated payments ^S5.

Why It Matters

Tokenization is being repositioned from a card-not-present fraud-reduction tool into core infrastructure for agentic and programmatic commerce. FACT: tokenized credentials show a 4.6% authorization rate lift over non-tokenized ones in card-not-present transactions ^S5. ANALYSIS: this suggests network economics increasingly reward merchants and PSPs who adopt network tokens, not just for security but for approval-rate performance — a direct P&L lever, not merely a compliance cost.

The agentic commerce proof of concept ^S3 signals that Visa views existing tokenization and network controls as sufficient scaffolding for AI-agent payments, rather than requiring a wholly new rail. ANALYSIS: this likely reduces near-term technical disruption risk for issuers and acquirers, since agentic payments can ride existing tokenized-card infrastructure rather than a parallel settlement system.

Strategic Implications

Merchants

The live PoC with Kings and Priests indicates merchants can integrate agent-initiated checkout without building a separate payment flow, using existing Visa tokenized rails ^S3.
Merchant advisory input reportedly prioritizes first-party agentic capabilities before third-party/public agent support ^S3.

Banks/Issuers

Multiple European issuers participated in the live agentic settlement PoC, indicating issuer-side readiness is already being tested in production-adjacent conditions, not just sandboxes ^S3.
New Virtual Card Authentication push events give issuers/ACS providers a more direct role in OTP/biometric authentication workflows for commercial virtual cards ^S1.

PSPs

Nuvei's direct involvement as a PoC partner positions it early in agentic-commerce tokenization plumbing ^S3.
Vendor-token models (PSP-provisioned tokens) are described as one of several token custody models merchants can choose, alongside acquirer and merchant tokens ^S5.

Acquirers

Insufficient evidence in the retrieved sources.

Card Networks

Visa is expanding stablecoin settlement from issuer-acquirer USDC flows toward programmatic stablecoin-to-card conversion, mirroring Mastercard's Multi-Token Network strategy ^S4.
Visa's "Intelligent Commerce" and Mastercard's "Agent Pay" are described as parallel, competing frameworks built on the same tokenization premise for agent identity verification ^S5.

Fintechs

New Client Outbound Events APIs give fintechs a defined mechanism to receive and act on authentication requests/biometric results from Visa Commercial's virtual card authentication service ^S1.

Competitive Impact

FACT: Visa and Mastercard are pursuing structurally similar strategies — tokenization-based agent authentication (Visa Intelligent Commerce vs. Mastercard Agentic Tokens) and stablecoin-to-card bridging (Visa's programmatic conversion work vs. Mastercard's Multi-Token Network) ^S4^S5. ANALYSIS: this suggests neither network is achieving clear technical differentiation yet; competitive advantage will likely hinge on issuer/merchant adoption speed and partner ecosystem breadth rather than architecture novelty.

Nuvei, Arvato Systems, and Kings and Priests gained early-mover visibility as named participants in a live Visa-rails agentic PoC ^S3, which ANALYSIS suggests could translate into reference-customer advantage when marketing agentic-commerce readiness to other merchants and PSPs.

Technology Impact

Token Service Provider (TSP) architecture: new TR HCE API enables token requestors to retrieve keys and provisioning data directly from the TSP ^S1.
Client Outbound Events: push-based authentication request/biometric result messaging between Visa Commercial's Virtual Card Authentication service, fintechs, and ACS providers ^S1.
Visa Direct Connect SDK: preferred payment credential update capability ^S1.
Network-level tokenization and controls extended to agent-initiated transactions under Visa Agentic Ready ^S3.
Stablecoin settlement infrastructure (USDC) expanding toward programmatic stablecoin-to-card conversion ^S4.
Token typology in the broader market includes acquirer tokens, merchant tokens, and vendor (PSP-provisioned) tokens, each with different PCI liability and portability trade-offs ^S5.

Regulatory Impact

Insufficient evidence in the retrieved sources. No source in this evidence set references PSD2, PSD3, PSR, SCA rules, instant payments regulation, or AML requirements in connection with these developments.

Opportunities

PSPs and vendor-token providers can capture margin by managing tokenization on merchants' behalf, shifting PCI compliance burden away from merchants ^S5.
Merchants processing high card-not-present volume have a quantifiable authorization-rate case for migrating to network tokens ^S5.
Early integration with Visa Agentic Ready and equivalent Mastercard frameworks may position fintechs and PSPs as preferred agentic-commerce infrastructure partners ahead of broader market adoption ^S3^S4.

Risks

ANALYSIS: Parallel, non-interoperable agentic-commerce frameworks from Visa and Mastercard ^S4^S5 risk fragmenting merchant/PSP integration effort, similar to historical card-network API fragmentation.
Restricted availability of some new APIs (e.g., Visa Direct Connect SDK preferred-credential update) ^S1 indicates uneven rollout, which ANALYSIS suggests could slow ecosystem-wide adoption timelines.
ANALYSIS: authentication for agent-initiated payments is explicitly described as "continuing to evolve as the model scales" ^S3, indicating current agentic authentication controls may not yet be mature or final.

Outlook — What to Monitor Next

Whether Visa Agentic Ready and Visa Intelligent Commerce move from PoC/framework stage to general merchant availability ^S3^S5.
Expansion of TR HCE API and Client Outbound Events from "Public"/"Restricted" pilot status to broader availability ^S1.
Progress of Visa's programmatic stablecoin-to-card conversion relative to Mastercard's Multi-Token Network ^S4.
Additional named merchant/issuer participants in live agentic-commerce transactions beyond the Kings and Priests PoC ^S3.
Publication of updated card-not-present authorization-rate data as tokenization adoption scales ^S5.

Confidence Assessment

Source count: 5. Primary/operator sources: 1 (Visa developer documentation, ^S1); vendor/industry commentary: 4 (^S2,^S3,^S4,^S5), none from a regulator. Overall confidence: Medium. The Visa release notes are authoritative on API specifics, and the Nuvei PoC description is a named, dated primary account, but broader competitive and stablecoin claims rely on tier-4 secondary commentary without independent verification.

Sources

^S1 Release Notes — developer.visa.com — https://developer.visa.com/release_notes

^S2 What are alternative payment methods (APMs)? | Checkout.com — checkout.com — https://www.checkout.com/blog/what-are-alternative-payment-methods

^S3 Securing agentic commerce through advanced tokenization — nuvei.com — https://www.nuvei.com/posts/the-role-of-tokenization-in-securing-agentic-payments-and-autonomous-commerce

^S4 Visa Mastercard Agentic AI Commerce | Support — eco.com — https://eco.com/support/en/articles/14730449-visa-mastercard-agentic-ai-commerce

^S5 How Does Payment Tokenization Work? — spreedly.com — https://www.spreedly.com/blog/how-does-payment-tokenization-work

*Generated automatically. All factual claims carry [S#] markers referring to the numbered sources above. Analytical judgements are the model's interpretation and are not sourced.*