Who authorised the agent?

EMVCo published a draft framework for card-based agentic payments, introducing an Intent Services concept for managing consumer-authorised intent across participants. The announcement’s public feedback period ended on 30 September 2026. This is a draft framework, not a final specification or a merchant mandate.

For a risk team, the useful distinction is between identifying an agent and understanding the authority delegated to it. Our question: can your event model distinguish the purchaser, the agent and the limits of the instruction?

A question for your next team meeting

What would we need to verify before this changes our workflow?