The OpenID Foundation has submitted comments to EMVCo on the EMV® Agentic Payments – Framework for Specifications v1.0 DRAFT.

As AI agents increasingly act on behalf of consumers, every payment raises an identity question: who is the agent, and what has the consumer authorized it to do? The line between payments and identity is beginning to blur.

This is where EMVCo, a global leader in payment standards, and the OpenID Foundation, a global leader in identity standards, have complementary roles to play. 

The two organizations have had a liaison relationship since 2025, and the organizations share common ground on approaches such as delegation lineage, verifiable intent, role-based disclosure and agent identification. 

The OpenID Foundation’s specifications could help deliver agentic payments at scale. In its response, the Foundation has offered EMVCo three things: support with due diligence on its specifications, a comparison of terminology, and, for use cases of mutual interest, joint interoperability events and conformance testing. 

The submission includes a cover letter and line item comments from OpenID Foundation experts. The detailed comments focus on three themes:

• Assign accountability, not just meaning. Define the Verifier role and its minimum checks, and make non-repudiation a cornerstone, with every actor signing its act.
• Separate agent identity from delegated authority. Every agent initiated payment should be identifiable as such, and relying parties should be able to confirm the Agent Provider behind an agent from signed, attested metadata.
• Design against adversaries, not just errors. Add a threat model covering compromised and manipulated agents, including prompt injection before consent, as well as malicious merchants, replay, and wallet or intent service provider compromise.

These are initial comments from OpenID Foundation experts. They do not represent the consensus view of the Foundation or any of its Working Groups or Community Groups.  

Ray Voss, JPMorganChase Executive Director and OpenID Foundation Board member, said: “An agentic payment needs to answer two questions together: what did the consumer authorize, and which accountable Agent acted within that authority? 

“Together, EMVCo's payment framework and OpenID's identity standards can make those facts verifiable across participants, enabling secure, interoperable standards that give consumers confidence to embrace new forms of commerce.”

 Juliana Cafik, Identity Standards & Solutions Architect and independent expert contributing to the OpenID Foundation, said: “Non-repudiation has always been the holy grail of payments. When a buyer hands a merchant cash, no one can deny what happened. Remote payments lost that certainty, and merchants have paid for it ever since through fraud, chargebacks and higher interchange. Agentic commerce could widen that gap or finally close it. 

“Most of us never think about EMV, yet it works quietly in the background as a global standard, so that people everywhere can pay with confidence. Pairing that foundation with verifiable identity means every action by an agent can leave proof that holds up long after the transaction is complete. 

“A few years ago, I asked whether we could bring non-repudiation into remote payments, and I believed we could. Built on these cornerstones, agentic commerce can be where we finally deliver it: liability fairly assigned, disputes settled on evidence, and trust that no single platform owns." 

The OpenID Foundation looks forward to working more closely with EMVCo in the months ahead, including on how the two organizations can refine the boundaries and handoffs between their standards work.

Read the full submission here, along with the cover letter here. 

The OpenID Foundation (THE OPENID FOUNDATION) is a global open standards body committed to building trusted identity ecosystems. Our mission is to lead the global community in identity standards that are secure, interoperable, and privacy respecting. Founded in 2007, we are a community of technical experts. The Foundation's OpenID Connect standard is now used by billions of people across millions of applications. More recently, the FAPI security profile - built on OAuth 2.0 - has become the standard of choice for interoperable Open Banking and Open Data implementations, while OpenID for Verifiable Credentials specifications are underpinning a new generation of digital wallets. Today, the OpenID Foundation's standards are the connective tissue that enable people to assert their identity and access their data at scale, the scale of the internet, enabling "networks of networks" to interoperate globally. Individuals, companies, governments and non-profits are encouraged to join or participate. Find out more at openid.net.