The payment stack is about to be rewritten. Not because the old one is broken - but because the buyer changed.
For fifty years, every layer of financial infrastructure assumed a human at the point of sale. Card networks, fraud models, checkout flows, KYC - all built around the assumption that a person initiates, approves, and completes a transaction.
That assumption is collapsing. In 2026, AI agents are booking travel, procuring supplies, subscribing to SaaS, paying invoices, and managing vendor relationships. Autonomously. At machine speed. Without a human in the loop.
The market is moving fast. Visa launched AI-initiated payments. Mastercard announced agent commerce APIs. Google and OpenAI are investing in agent commerce infrastructure. The agentic payments market is projected to reach $3–5 trillion globally by 2030.
But here's the thing nobody is saying out loud: none of the current infrastructure actually solves the core problem.
The problem is trust, not rails
Agents can already pay. You can give an agent a card number, a Stripe API key, or a crypto wallet. It will make purchases. The problem isn't capability - it's control.
When an autonomous agent has unrestricted access to payment credentials, you have a security liability masquerading as a feature. One prompt injection, one hallucination, one runaway loop - and your card is drained, your vendor contracts are violated, your compliance is blown.
The real infrastructure challenge is: how do you let agents transact autonomously while maintaining human-grade control over what they can spend, where, when, and how much?
This is not a UX problem. It's a systems-and-trust-layer problem.
What agentic payment infrastructure actually requires
We've spent the last months building Ovra and talking to teams deploying AI agents in production. The requirements are consistent:
1. Attestation before access. The agent must declare intent before receiving any payment credential. No credential should exist until a policy engine has evaluated and approved the specific transaction. This is the opposite of how traditional card-on-file works.
2. Scoped, ephemeral credentials. Each payment should get its own credential - a virtual card number locked to one merchant, one amount, one time window. After use, it self-destructs. No reuse, no leakage surface.
3. Policy enforcement at the infrastructure level. Spending limits, merchant allowlists, velocity caps, and approval workflows should be enforced by the payment layer - not by the agent's own code. An agent should never be trusted to enforce its own constraints.
4. Real-time observability. Every transaction decision, every policy evaluation, every credential issuance needs to be logged and queryable. When an agent overspends or buys something unexpected, you need the audit trail to understand exactly what happened and why.
5. EU-native compliance. For European companies, this means PSD2, GDPR, and AML/KYC built into the infrastructure - not bolted on after the fact.
Why we're building Ovra
Ovra is payment infrastructure for AI agents. Not a wallet, not a checkout widget, not a billing platform. Infrastructure.
Our stack: virtual Visa cards issued per agent through a licensed EU card issuer. An intent-based state machine where every payment moves through a strict sequence. A policy engine that evaluates spending rules before any credential is created. Full audit trails. An MCP server so agents can request payments through the standard Model Context Protocol.
We're EU-native. Berlin-based. A regulated EMI partner handles card issuing. We handle the intelligence layer - the part that decides whether an agent should be allowed to pay, and the part that gives operators visibility into what happened.
Our bet: the company that owns the trust layer between AI agents and the financial system will be one of the most important infrastructure companies of the next decade. Not because payments are hard - but because trust at machine speed is hard.
The market structure
The agentic payments space is splitting into three categories:
Consumer-facing agent commerce - Visa, Mastercard, PayPal building agent checkout for consumer shopping. Big TAM, crowded, commoditizing fast.
Crypto-native agent payments - stablecoin wallets and on-chain settlement. Interesting for agent-to-agent flows, but regulatory complexity and merchant adoption are barriers for B2B use cases.
B2B agent payment infrastructure - a small but growing group of companies building the middleware layer. This is where the defensibility is. B2B payments are messy, high-trust, compliance-heavy - exactly the kind of problem that rewards infrastructure depth over surface area.
We believe the B2B infrastructure layer is the right bet. Consumer checkout is a race to the bottom. Crypto settlement is a solution looking for mass adoption. But B2B agent payments - procurement, vendor management, SaaS subscriptions, invoice processing - that's where agents are already deployed and where the pain is acute.
How we solve risk and fraud
Traditional fraud detection watches for anomalous human behavior - unusual locations, spending spikes, new devices. None of that applies to AI agents. An agent doesn't have a device fingerprint. It doesn't have a "usual" location. It can make 50 purchases in 60 seconds and that might be completely normal.
Agent fraud is a different threat model. The attack vectors are:
- Prompt injection. A malicious website or API response manipulates the agent into making unauthorized purchases. The agent thinks it's following instructions. The operator has no idea.
- Hallucination-driven spending. The model confidently decides to buy something that was never requested - wrong merchant, wrong amount, wrong product. No adversary needed.
- Credential exfiltration. If the agent has access to raw card data, that data can leak through logs, error messages, context windows, or tool outputs. One exposed PAN and the card is compromised.
- Runaway loops. A bug in the agent's logic causes it to retry a purchase indefinitely, or scale up spending without a termination condition.
Ovra's risk architecture treats the agent as untrusted by default. The agent never receives raw payment credentials - it gets opaque tokens that resolve to card data only at the payment boundary. This eliminates credential exfiltration entirely. There is no card number to leak.
Every transaction runs through a real-time risk scoring pipeline before any credential is issued:
Velocity detection. If an agent suddenly starts making more transactions than its historical baseline, the system flags it before the next payment goes through. Configurable thresholds determine whether to auto-deny, hold for review, or alert the operator.
Amount anomaly scoring. Each intent is compared against the agent's spending history. A procurement agent that normally buys $50 SaaS subscriptions requesting a $5,000 purchase triggers immediate escalation.
Merchant trust scoring. Ovra maintains a merchant reputation layer. New merchants, merchants with high chargeback rates, or merchants in unusual categories for the agent's profile get flagged. The operator can configure allowlists and blocklists per agent.
Geo-consistency checks. If an agent operating in the EU suddenly attempts a purchase from a high-risk jurisdiction, the risk score spikes. This catches both compromised agents and misconfigured workflows.
Policy-as-code enforcement. All of this runs at the infrastructure level, not inside the agent's code. The agent cannot bypass, modify, or even see the rules it's being evaluated against. This is the critical difference from approaches where the agent self-enforces spending limits - you can't trust the entity you're trying to constrain to enforce its own constraints.
When something does go wrong - and with autonomous agents, something always eventually goes wrong - the full audit trail makes the post-mortem straightforward. Every intent, every policy evaluation, every risk score, every credential lifecycle event is logged and queryable. For regulated industries, this is the compliance artifact. For operators, it's the debugging tool. For investors, it's the proof that autonomous spending can be governed.
The net result: agents transact at machine speed, but within provable, auditable constraints. That's what makes the difference between a demo and infrastructure you'd trust with real money.
What's next
The next 18 months will define the agentic payments stack. The winners will be the companies that solve trust, compliance, and observability at the infrastructure level - not the ones with the flashiest agent demos.
We're heads down building. If you're deploying AI agents that need to make payments in the EU, we'd love to talk.