How AI agents pay — and why it matters.
PSD3 and the Payment Services Regulation reached provisional agreement on November 27, 2025. Official Journal publication is expected mid-2026, with PSR application around Q1 2028. Here's what changes — and how it shapes AI agent payments in the EU.
Five competing protocols define how AI agents pay merchants in 2026: Google's AP2, Stripe/OpenAI's ACP, Stripe/Tempo's MPP, Google's UCP, and Visa's Trusted Agent Protocol. Side-by-side comparison of governance, cryptography, scope, and merchant adoption.
Agentic commerce will move $1.5T–$5T globally by 2030. Visa, Mastercard, Stripe, OpenAI, and Google have all shipped agent payment rails in the last 12 months. Here's why agents need dedicated infrastructure — and what we're building at Ovra.
We started Ovra because we watched AI agents fail at the simplest thing: paying for something. Late 2025, every alternative meant hardcoding a card into agent context. We decided to build the infrastructure layer that wasn't there — EU-native, API-first, agent-aware from day one.
How Ovra prevents AI agents from overspending — a six-state machine (Intent → Policy Check → Grant → Issue → Redeem → Settle), AES-256-GCM encrypted card data, and an immutable audit trail that maps cleanly to PSD3/PSR's authentication framework.
Sharing a card with an AI agent exposes your entire credit line to retry storms, prompt injection, and scope drift. Dedicated virtual cards make blast radius a design parameter, not an accident — enforced at the Visa network token layer, not in application code.
Every Ovra payment follows a strict state machine — declare intent, get authorization, receive a tokenized credential. The agent never bypasses policy because credentials don't exist before approval. This is the same attestation-before-access pattern AP2 standardized at the network level.
Five real failure modes that cause AI agents to overspend — retry loops, stale authorizations, race conditions, scope creep, merchant mismatches — and the layered architectural defenses that stop them before money moves.
AI agents are booking flights, ordering supplies, and subscribing to SaaS at machine speed. By 2030, agentic commerce will move $1.5T–$5T globally. Here's how Ovra makes agent payments safe — virtual Visa cards, pre-authorization mandates, zero credential exposure.
How to set up programmatic spending policies that give AI agents the freedom to transact while enforcing strict budget limits, MCC restrictions, time windows, and approval workflows. EU-native, GDPR-compliant, enforced before money moves.
