On April 16, Mastercard announced that AI agents can now make purchases using your existing credit card. Not a special card. Not a crypto wallet. Your actual Mastercard, the one in your pocket right now.
The partnership is between Mastercard and Lobster.cash, a payment platform built by Crossmint specifically for AI agents. It's called Mastercard Agent Pay, and it's already live.
If you run a community bank or credit union, this is the article to read this week. Not because agentic payments will replace your card business tomorrow. But because the infrastructure is being built right now, and the institutions that understand it early will be the ones that shape how it works in their markets.
First, What Are AI Agents and Why Do They Need a Credit Card?
The biggest shift in AI right now isn't smarter chatbots. It's agents: AI systems that don't just answer questions but actually do things. Book a flight. File a report. Reorder inventory. Compare vendors and place a purchase order.
This is already happening at scale. OpenClaw, an open-source agent framework, has over a million agents deployed across 20+ platforms. Anthropic's Claude Code, OpenAI's Codex, and tools like Devin and Hermes are all building toward the same vision: AI that works for you, not just with you.
But there's been a missing piece. These agents can research, draft, analyze, and automate. The one thing they couldn't do reliably was spend money. Not because the AI wasn't capable, but because the payments infrastructure didn't have a way to verify that a human actually authorized the transaction. How does a merchant know it's not a hallucinating bot on a shopping spree? How does a bank distinguish a legitimate agent purchase from fraud?
Mastercard's answer is a framework called Verifiable Intent. It was co-developed with Google and aligns with two emerging standards: the Agent Payments Protocol (AP2) and the Universal Commerce Protocol (UCP). Here's what it does:
- Cryptographic proof of authorization. Every agent-initiated transaction includes a tamper-resistant record proving the human explicitly approved it. Not a checkbox on a form. A cryptographic signature that can be independently verified by the issuer, the merchant, and the platform.
- Scoped permissions. You define exactly what the agent can spend, where it can spend it, when, and with which payment method. The agent can't exceed those bounds.
- Issuer controls. The bank retains control. Transactions are authenticated through Mastercard's network with the same security infrastructure that already processes your cards.
The credential layer, the part that handles sensitive card data, is managed by Basis Theory. The agent never sees your card number.
Who's Already In
This isn't a concept paper. It's live, with real institutions:
- Banks: Santander, Commonwealth Bank of Australia, DBS, and UOB have already adopted Mastercard Agent Pay.
- Platforms: The initial rollout supports agents on OpenClaw, Claude Code, Devin, Hermes, and Zo Computer.
- Scale: OpenClaw alone has over one million agents deployed across more than 20 messaging platforms.
That last number is worth sitting with. One million agents, on one platform, already capable of making card purchases with proper authorization. This isn't a pilot program. It's infrastructure at scale.
Why This Is a Bigger Deal Than It Looks
Payments is the last major bottleneck for agentic AI. An agent that can research, compare, negotiate, and recommend — but then has to hand off to a human to actually click "buy" — is only half an agent. Mastercard Agent Pay removes that handoff.
This matters because the trajectory of AI in business is moving from copilot (AI assists while you drive) to autopilot (AI handles entire workflows end-to-end). We've already seen this with coding agents that can write, test, and deploy code autonomously. With procurement agents that can source vendors, compare quotes, and generate purchase orders. The missing step was always the transaction itself.
Now that step exists. And it exists on top of existing card infrastructure, not some new payment rail that requires merchant adoption from scratch. That's what makes this different from every crypto-payments pitch of the last decade: it works with the cards people already have and the networks merchants already accept.
Why Community Banks Should Care
Here's where this gets specific to our region.
The banks that adopted Mastercard Agent Pay first are global institutions. Santander. DBS. These are organizations with dedicated fintech teams and partnerships with payments innovators. They move fast because they have the resources to evaluate new technology quickly.
Community banks and credit unions don't have that luxury. But they have something else: relationships and trust. And in agentic payments, trust is the entire product.
Think about what's happening from the customer's perspective. They're being asked to let software make purchases on their behalf. That requires a level of confidence in the institution backing the transaction. When a customer at a community bank sees an agent-initiated charge on their statement, they're going to call their banker. Not a 1-800 number. Their actual banker.
That's an advantage, but only if the banker understands what happened and can explain it.
Here's the risk of waiting: if community banks don't engage with agentic payment standards now, they'll be forced to adopt whatever framework the big banks and card networks design without their input. The issuer controls in Mastercard Agent Pay are customizable. Banks can set policies on which agents are authorized, what spending limits apply, and which merchant categories are allowed. But you have to be at the table to shape those policies for your customer base.
What This Doesn't Mean
Let's be clear about what's not happening.
AI agents are not going to replace online shopping next month. Most consumers aren't delegating purchases to AI today. The early use cases are commercial: business procurement, automated reordering, subscription management, developers buying API credits and cloud resources.
But here's the pattern to watch. AI capabilities consistently move from enterprise to consumer faster than people expect. ChatGPT went from "interesting research tool" to "my kid uses it for homework" in about six months. Coding agents went from experimental to standard developer workflow in under a year. Agentic commerce will follow the same arc. Once business users normalize the idea of AI making purchases within approved bounds, consumer adoption follows.
And payment infrastructure has a long lead time. ACH took years to roll out. Chip cards took years. Contactless took years. The institutions that understood those transitions early were the ones that managed them well. The ones that waited scrambled.
What This Means for Your Business
Whether you're a community bank, a local business, or a financial services firm in Central New York, there are three things to do right now:
- Learn the framework. Understand what Verifiable Intent means and how issuer controls work in agentic payments. This doesn't require a technology investment. It requires reading and conversation. Mastercard has published documentation on Agent Pay, and the AP2 and UCP standards are open. Start with your payments team.
- Talk to your processor. If you're a community bank, ask your payment processor where they are on agentic transaction support. You won't be building this yourself. But you need to know whether your processor is ready, and what timeline they're on.
- Think about your policies. What would your bank's rules be for agent-initiated transactions? Which merchant categories would you allow? What spending limits? Which agent platforms would you authorize? You don't need to implement anything yet. But having a draft framework means you're ready when the capability arrives at your processor level.
The advantage community banks have always had is that they know their customers. In a world where AI agents are spending money on behalf of those customers, that knowledge becomes a competitive asset. But only if you're prepared to use it.
AI agents are coming whether banks are ready or not. The question isn't whether your customers will use them. It's whether your institution will be prepared when they do.