AI agents now have payment instruments of their own. On August 11, 2026, business banking platform Mercury launched virtual cards that companies can assign to AI agents, and Coinbase Business, which has let merchants accept payments made by agents since late July, expanded that offering. An agent here is software that an organization hands a whole task to, including the decisions along the way. For the past year, card networks and protocol builders have worked out how such an agent can prove it acts on a human’s behalf. The two products move the question from protocol to instrument.
Mercury issues agent cards like employee cards
The agent cards are part of Mercury Spend, a spend management product in which a company issues cards to its employees and now to its agents too. Agent cards are virtual. A human creates the card and sets its controls. The agent then uses it end to end, with no approval needed for each transaction. The controls stay out of the agent’s reach: it can’t raise its own limit or get around a restriction.
- Budgets by spending category, such as travel, software, or procurement.
- Per-transaction limits enforced at authorization, so anything outside the rules is declined at the point of sale.
- Restrictions by specific merchant and by merchant category.
- Automatic card freeze when a receipt, memo, or accounting code is missing.
- An activity log kept separate from human cardholders’, and cancellation at any time.
Mercury co-founder and CEO Immad Akhund says the product formalizes something customers were already doing. “People have already been manually issuing our virtual cards,” he told Fast Company, referring to cards handed to agents. Mercury says more than 300,000 entrepreneurs use its platform. Rival Ramp issues scoped virtual cards to external agents through a partnership with Visa .
Coinbase bets on stablecoins instead
Since late July, Coinbase Business has let merchants take payments from AI agents through x402, an open standard for machine-to-machine payments. Funds settle in USDC directly into the merchant’s account. The same day as Mercury’s launch, Coinbase added new features to its payment links, checkout, and invoices, including USDT acceptance, with USDT converted to USDC at settlement. Coinbase Business says it serves more than 5,000 companies and that those three products have processed more than 100,000 payments.
| Feature | Agent virtual card | x402 payment settled in stablecoin |
|---|---|---|
| Spending controls | Limits and categories enforced at authorization | Controls built into the wallet’s application logic |
| Acceptance | Any merchant that accepts the card network | Merchants that have integrated the standard |
| Settlement | Deferred, on the network’s clearing cycle | Immediate, on chain, in USDC |
| Disputes | Chargebacks under network rules | None: Coinbase touts the absence of chargebacks |
| Revocation | Issuer cancels the card | Wallet permissions are withdrawn from the agent |
The dividing line is risk. Cards bring universal acceptance and a familiar safety net, the dispute process, at the cost of fees and deferred settlement. The stablecoin rail brings speed and low cost, with no dispute process at all. If an agent makes an unwanted purchase, a card payment can be charged back. A stablecoin payment has to be negotiated with the merchant.
The mandate moves into the instrument
Earlier announcements dealt with protocols: how a mandate travels from a human to an agent and on to a merchant. Mercury’s agent cards and Coinbase’s agent checkout deal with the instrument. The mandate now lives in the payment credential itself, either a card number dedicated to one agent or a wallet whose permissions are limited to a set budget. The shift is as much about accounting as technology, because it lets a company separate an agent’s spending from a human’s in the general ledger.
Regulators got there first
Supervisors started on oversight before these products shipped. On July 3, 2026, the Monetary Authority of Singapore published a framework called Safeguards for Agentic Finance at Runtime (SAFR), which checks an agent’s identity, permissions, and risk limits before a transaction runs rather than after. Ant International, Circle, HSBC, JPMorgan Chase, Manulife, Mastercard , OCBC, and Visa are among the organizations involved.
- An identity layer that establishes whom the agent acts for.
- A rulebook specific to each agent.
- An engine that checks each proposed action against those rules.
- An audit log that records every decision.
A proposed action can end one of four ways: it runs automatically, runs but is flagged for review, waits for human approval, or is denied. Other jurisdictions are taking different paths. The UK’s Financial Conduct Authority favors ongoing “stewardship” over fixed rules; its chief executive, Nikhil Rathi, has said that “legislation will never keep up with AI.” EU supervisors have called for “enhanced governance” without an operational framework of their own, and the US is leaving it to industry for now.
The issue is no longer theoretical. An agent holding a card number that works at the point of sale enters the same authorization, clearing, and dispute chains as a human cardholder, with the same consequences for the issuer and the merchant.