Insights
Payments, APIs and agentic commerce, with my take on what each story means.
Meta says 10 million people have set up Muse agents, and shopping is the top use
On its 21 Oct earnings call Meta said more than 10 million US and Canadian users set up Muse agents since 8 Sep, shopping is the most common use with an average purchase over $200, and Meta had to work with Stripe to raise credit limits in the first week. Meta plans to charge businesses a fee per completed sale and is building the Personal Agent Protocol with partners including Shopify and Walmart.
Agent checkout is now a volume story. Payment APIs should accept agent sessions arriving through platform protocols without bespoke integration work for every merchant.
Mastercard's Transaction Link Identifier mandate takes effect today
From 23 Oct Mastercard requires the TLID from the original customer initiated payment to be sent on related merchant initiated payments, recurring charges and refunds, alongside the existing trace ID. Worldpay's IPS documentation tells affected merchants to upgrade to IPS 3.2.0.
Every scheme mandate that adds a field is an argument for one lifecycle reference that the API returns on the first payment and attaches automatically to every later one.
Visa reported in talks to buy Fireblocks, which denies it, days before network earnings
Reports said Visa was in talks to acquire Fireblocks for around $2.5 billion; Fireblocks called the rumours news to it and not true, and Visa said it does not comment on rumours. Visa reports on Tuesday 27 Oct and Mastercard on Thursday 29 Oct, after Mastercard closed its $1.8 billion BVNK deal in August.
Whatever happens with Fireblocks, networks are investing in stablecoin plumbing to sell as value added services. Payment APIs should keep settlement and payout objects rail neutral so new rails slot in without new integrations.
PSR makes Confirmation of Payee permanent in the UK
On 22 Oct the Payment Systems Regulator removed the 1 Nov 2026 expiry date from Specific Direction 17, so CoP obligations stay in force. More than 320 organisations offer CoP and over two million checks run every day; the PSR will review the requirement in five years and keep talking about extending it to more PSPs.
Name checking is now permanent UK infrastructure. Payout and account to account APIs should return the CoP result as a standard field before money moves.
Plaid, Barclays, HSBC and Open Banking Limited: pay by bank needs reliability and richer data
At Open Banking Expo on 21 Oct the panel said inconsistent limits, standards and reliability hold back pay by bank, Barclays called for treating payments as a data product, and commercial VRP through the UK Payments Initiative was named the key test.
Pay by bank loses at checkout on consistency, not speed. Payment APIs should normalise limits, status codes and remittance data across banks so it can sit beside cards.
Affirm becomes the exclusive pay over time provider at Sam's Club
On 22 Oct Affirm announced a multi year exclusive deal with Sam's Club. It goes live on SamsClub.com in the coming weeks, with clubs planned for 2027, for eligible purchases of $500 or more.
BNPL is moving into exclusive enterprise deals and, from 2027, physical stores, so payment APIs should treat it as a standard payment method across online and in store flows.
HSBC launches its RedCoin HKD stablecoin on PayMe
HSBC's Hong Kong dollar stablecoin became available on PayMe on 23 Oct. Users will be able to activate a wallet in app in the coming days for peer to peer transfers and payments to more than 100,000 merchants, with wholesale, corporate and institutional uses planned next.
A major bank, not a crypto app, is bringing stablecoin payments to everyday merchants. Payment APIs should let a bank issued stablecoin act as just another tender with fiat settlement.
Revolut gets its first credit rating: BBB+ from S&P
On 22 Oct S&P assigned Revolut Ltd a BBB+ rating with a positive outlook and said it expects the holding company to issue senior unsecured bonds in 2027. S&P expects Revolut's loan book to more than double this year and again in 2027.
Neobanks are becoming rated, bond issuing banks, which makes them bigger and more demanding partners for acquirers and payment platforms.
Whop raises $200 million at a $5.1 billion valuation as its AI agent tools pass 350,000 calls a day
Whop announced a $200 million Series D led by Sequoia and Shopify Ventures on 21 Oct. It says its CLI and MCP connectors, which let operators run their businesses through AI agents, now get over 350,000 calls a day.
Developer experience now includes agents as API callers. Payment APIs should ship tooling that AI agents can call safely, not just SDKs for humans.
Fintech demo: linking repeat payments to the first payment
Run a first card payment, then a renewal, a top up and a refund. Compare sending each scheme identifier yourself with one lifecycle reference, and see what happens when the TLID was never stored. All values are mock.
Shows in two minutes why payment APIs should own transaction linking, so the next scheme mandate needs no merchant change.
Walmart gives AI agents their own profiles and spending limits
On 21 Oct Walmart launched Agent Profiles, an Agent Gateway built on MCP and new agent terms. Each agent gets its own profile under the customer's account with caps of $50, $100 or $200, or approval on every purchase, and agents never see card data.
Payment APIs now need to tell an agent's payment apart from a human's and carry per agent limits with it. Walmart has just shown customers what to expect as standard.
Mastercard opens early access to Agent Pay for Machines on x402
On 20 Oct Mastercard opened developer access to Agent Pay for Machines. Agents sign vouchers within a pre approved budget and providers aggregate and settle them later. Pilots include Cloudflare, Coinbase, BVNK and Ant International.
Budgets, mandates and deferred settlement are becoming core payment objects, not edge cases. Payment providers should model them from day one, or the card networks will own that relationship.
Visa, BILL and Billtrust run the first live B2B agent payment pilot
On 20 Oct the three firms launched a live pilot where agents registered through Visa's Trusted Agent Protocol pay supplier invoices with tokenised credentials. Agent authentication replaces CAPTCHA checks on supplier portals.
Checkout and B2B payment flows should verify trusted agents rather than block them as bots. I think the providers that get this right first will win agent driven B2B volume.
Stripe lets ChatGPT and Claude run business treasury
On 21 Oct Stripe launched Treasury for agents. Through Stripe's MCP server, agents can check balances, pay invoices, move funds between accounts and convert currency, with read and act permissions and human approval. Spend limits are coming in the following weeks.
Read and act permissions with human approval are the right pattern for giving agents access to money. I expect every business banking API to offer the same split within a year.
Mission Bound Authorization draft revised at the IETF
On 21 Oct an individual OAuth draft was revised: an agent states its task via PAR, the server derives RAR authorization details such as a USD 500 cap, the user approves, and tokens carry a revocable mission claim. It is not yet adopted, and OAuth 2.1 is itself still a draft.
This is the right direction: agent mandates built on PAR, RAR and a mission claim rather than proprietary schemes. Standard OAuth keeps integration simple for every partner.
BigCommerce and Cloudflare switch on WebMCP by default
On 21 Oct Commerce.com and Cloudflare turned on WebMCP for eligible BigCommerce stores, so browser based AI agents can search products and fill a cart while checkout stays on the merchant's storefront. Merchants can switch it off.
Agents will increasingly build the cart, so checkout and payment APIs should accept agent built carts without special handling.
OCC finalises its GENIUS Act stablecoin rule
On 21 Oct the OCC published its final rule implementing the GENIUS Act for payment stablecoin issuers and related custody. The rule and the Act take effect on 18 Jan 2027; AML and sanctions rules follow separately.
Stablecoin settlement is becoming a regulated option in the US. Payment APIs should keep settlement and funding models currency and rail neutral.
Google Cloud outage disrupts Revolut and UK banks
On 20 Oct a power event in Google Cloud's London region disrupted Revolut card payments, transfers, ATM withdrawals and sign in for hours, with issues also reported at Lloyds and HSBC. The FCA said it was engaging with Google and affected firms.
Cloud concentration is now a payments risk. Every payment API should be designed for regional failure, with idempotent retries, failover and an honest public status page.
CMA proposes opening iPhone contactless to UK rivals
On 20 Oct the CMA consulted on requiring Apple to give UK developers NFC access through both secure element and host card emulation, on fair terms with fees expected to be substantially lower. The consultation closes on 17 Nov 2026.
Opening iPhone NFC would give UK merchants more ways to take tap to pay. Payment APIs should treat wallets as just another payment method, in person and online.
EPC launches SCARLET for EU Digital Identity Wallets in SCA
On 19 Oct the European Payments Council launched SCARLET, a rulebook and liability framework for PSPs accepting EU Digital Identity Wallets for strong customer authentication. A consultation is planned for summer 2027 and the first rulebook for December 2027.
SCA keeps gaining new authentication methods. Payment APIs should model authentication as method neutral rather than hard wiring one flow.
KORT Payments to acquire real time payouts firm AptPay
On 19 Oct KORT Payments agreed to buy Toronto based AptPay, which offers a single integration for payouts and collections across Visa Direct OCT, Mastercard Send, Interac, EFT, ACH, RTP, FedNow and cross border. Terms were not disclosed and closing is expected in Q4 2026.
Acquirers are buying multi rail money movement behind a single API. I think payouts should be modelled as rail agnostic resources, not card only add ons.
Worldpay research: 59% of shoppers want to approve each agent purchase
The Global Payments and Worldpay Agentic Commerce Report 2026 surveyed more than 16,000 consumers and found 59% prefer to approve each purchase an AI agent makes.
Consumers clearly expect human approval by default. Standards like PAR and RAR make that approval part of the payment itself, which is where it belongs.
Nothing under this topic yet. Pick another tag or check back soon.