Understanding agentic commerce protocols: What merchants should know right now

The protocol layer will reshape eCommerce more than any AI demo, and most merchants haven't read a word of it.

The way people shop is changing faster than at any point since mobile. Instead of typing queries into a search bar and clicking through links, customers are asking AI assistants what to buy. ChatGPT tells them which running shoes fit their arch. Gemini surfaces the right dishwasher for a small kitchen. Perplexity compares wireless headphones across six brands in a single answer. The research and discovery layer is moving into the chat window.

That shift is already showing up in the numbers. ChatGPT now has more than 900 million weekly active users and US shoppers alone ask it more than 84 million shopping-related questions every week. Google's Gemini fields product queries from over two billion Search users. Perplexity, Copilot, and a growing roster of vertical agents are carving their own paths to purchase. And Gartner projects that by 2028, AI agents will intermediate 90% of B2B buying, funnelling more than $15 trillion in spend through automated exchanges.

All the conversations around agentic commerce have, understandably, focused on AI. What AI can find, how it reasons, and how convincingly it recommends your product over someone else's. But AI is only the interface. When an agent clicks ‘buy’ on behalf of a customer, a different layer takes over. Those rules dictate where the checkout happens, who processes the payment, who sees the customer's data, and who owns the relationship after the sale. That's the protocol layer. And most merchants haven't read a word of it.

Today, the companies writing those standards are the same companies competing to control the transaction.

How agentic demand shows up

As this shift plays out, merchants won’t just see ‘AI traffic’ in the abstract. AI traffic shows up as different types of demand:

• Customers who start and stay inside ChatGPT.

• Shoppers who discover you via Google’s AI Overviews and Gemini.

• Protocol‑native agents that speak ACP or UCP on behalf of buyers.

• Independent buyer agents that talk directly to your APIs.

• Emerging machine buyers that may use payment-native protocols such as MPP or x402 to transact directly with software, content, or services.

The type of demand changes, but every agent needs to do the same three things: find your products, prove it has permission to buy, and complete the payment. How it does each one depends on which protocol it speaks. Those rules are the protocol layer, and they’re being written right now.

The protocol land grab has already begun

Several players are converging on agentic commerce. There are horizontal aggregators like ChatGPT and Gemini that want to own the shopping conversation. There are OS-level assistants like Apple Intelligence and Microsoft Copilot that live on your customer's device. And there are vertical specialists built for travel, fashion, and B2B procurement that act as their own orchestrators.

Each one discovers products differently, authenticates payments differently, and hands transactions off to your payment processor differently. There is no unified standard, and that gap is exactly what every major platform is now racing to fill on its own terms.

The protocols trying to standardise all of this fall into two camps, and they represent different visions of how commerce should work inside AI surfaces.

ACP: The native checkout play

The Agentic Commerce Protocol (ACP) is a transaction standard built by OpenAI and Stripe and launched in September 2025. It defines how to structure a cart, generate a payment token, and complete checkout natively inside ChatGPT.

The thesis was that if people are already asking ChatGPT what to buy, keep them in the chat to finish the purchase. The entire transaction, from product discovery to payment confirmation, happens inside OpenAI's environment.

For ACP-style demand:

• Discovery: you expose a machine-readable catalogue so the agent can find what you sell.

• Security: the platform handles authorisation and permission within its own environment.

• Acceptance: checkout happens natively inside the chat, sitting in front of your payment processor.

The upside is speed to conversion. The trade-off is that the platform sits between you and your customer. You may never see full transaction data or be able to apply your own promotions and loyalty programmes. The agent becomes the primary interface, and your customer looks more like the platform’s customer than yours.

It's worth noting that ACP is already evolving. In March 2026, OpenAI pulled back its native Instant Checkout and shifted purchases to retailer apps within ChatGPT, giving merchants more control over the checkout experience. The protocol's direction is still being shaped, which is part of the point.

UCP: The open orchestration play

Google and Shopify took a different approach with the Universal Commerce Protocol (UCP), announced in January 2026. UCP does not centre on a single in-platform checkout. It gives merchants a way to publish their commerce capabilities so different AI agents can find them, understand what they offer, and coordinate the next step.

For UCP‑style demand:

• Discovery: you publish a product feed that multiple agents, across different platforms, can query.

• Security: the permission and intent data travels with the request, so your own risk systems can evaluate it.

• Acceptance: the transaction can still land in your existing checkout or PSP. The protocol acts as a shared language, not a destination.

Instead of one platform controlling the full flow, agents and merchants negotiate across a shared framework. That gives you more control over checkout, fulfilment, and customer experience. It also asks more of your team, because your catalogue, pricing, availability, and fulfilment logic need to be exposed in a machine-readable format.

Think of the two main protocols this way: ACP is like selling inside a shopping mall that owns the tills, the foot traffic, and the final checkout. UCP is closer to a common language that lets different buyers and sellers coordinate across many storefronts. One keeps the transaction inside the platform. The other helps agents and merchants find each other, then decide how the transaction should happen.

A third lane is emerging: machine-native payments

Alongside commerce protocols, a separate category is forming around agent-to-agent payments and paid access to digital resources.

Tempo and Stripe’s MPP is designed to let agents or applications pay each other across multiple rails, including cards, stablecoins, and Lightning. Coinbase and Cloudflare’s x402 takes a web-native approach: an agent requests a gated resource, receives a payment prompt, pays in stablecoins, and proceeds.

These systems are small today. But if software increasingly buys software, data, APIs, media, or compute on demand, protocols like MPP and x402 could eventually process a meaningful share of machine-originated transactions. In a decade, they may matter less as niche experiments and more as core transaction infrastructure.

For merchants, that expands the definition of commerce. Not every future payment will be a human checking out a basket. Some will be autonomous systems paying per request, per usage event, or per task completed.

The trust and payments layer is fragmenting too

The protocols don’t stop at discovery and checkout. The card networks are staking out their own territory with a different focus. Where ACP and UCP concentrate on validating the payment itself through cryptographically signed mandates, Visa and Mastercard are working to authenticate the agent. Visa's Intelligent Commerce protocol, built with partners like Cloudflare, creates agent-specific tokens and establishes KYA (Know Your Agent) standards for the Visa network. Mastercard's Agent Pay does the same for its rails. Both rely on card network tokenisation and payment passkeys under the hood, capabilities that Airwallex already support today.

Google's Agent Payments Protocol (AP2) adds a separate trust layer, using cryptographic mandates to verify that an agent has genuine permission from a real customer before it can spend their money.

These are different questions. ACP and UCP are asking "is this payment valid?" The card networks are asking "is this agent who it says it is?" This is not one standard settling the market. Stablecoins may also play a role here. They combine near card-like settlement assurances with programmability, making them attractive for escrow logic, conditional release of funds, recurring machine payments, and cross-border settlement. What they lack today is a universal acceptance and trust standard for agentic commerce. If one emerges, stablecoins could move from edge case to mainstream coordination layer.

Platforms, payment networks, crypto rails, and trust providers are all competing to shape how agent-led transactions get authorised, routed, and completed. That affects who controls the checkout, who owns the customer relationship, and where costs start to build.

Checkout is power, and every protocol embeds different incentives

The protocol decides where checkout happens. And whoever owns the checkout owns everything that comes with it. They control what the customer sees, decide whether your promotions apply, and keep the data about what the customer bought. Every protocol makes that commercial choice for you before you've had a chance to weigh in.

The incentives are not aligned. Platforms want to keep users inside their AI surface, monetising attention and capturing a share of the transaction. Merchants optimise for margin, repeat purchase data and owning the customer relationship after the sale. These objectives pull in opposite directions, and the protocol is where that tension gets encoded.

If you're selling across multiple markets, that tension compounds. Local payment methods, currency conversion, tax compliance, and settlement all vary by region. A protocol built for a single domestic market won't account for the operational weight of cross-border commerce, and that leaves you to bridge the gap alone.

Being agent‑ready at the protocol layer means understanding these incentives and not letting any single protocol’s worldview become your architecture.

Hard-coding is a strategic mistake

Standards will evolve. Some will consolidate and others will vanish.

OpenAI provided the clearest evidence of this recently when they pulled back Instant Checkout, the native in-chat purchasing experience that was supposed to turn ChatGPT into a destination for buying. People researched products inside ChatGPT in large numbers, but they didn't complete purchases there. Forrester's consumer data confirms the pattern. Among regular answer-engine users in the US, UK, and Canada, completing a purchase inside the AI surface ranks as the least-adopted use case.

Of the millions of merchants on Shopify's platform, roughly 30 had integrated with ChatGPT's checkout. Etsy had to cover merchant commissions to drive adoption. OpenAI had not built a system for collecting state sales taxes in the US. The promise of mass-market agentic shopping collided with the reality of merchant behaviour and consumer habits.

That applies equally to newer crypto rails. Whether stablecoins become dominant or remain one rail among many, merchants should avoid architectures that assume a single future winner.

Deep integrations to a single protocol inflate rebuild risk and erode your negotiating position. When OpenAI pivoted, merchants who had poured engineering resources into that specific checkout flow faced an immediate decision about what to do next. Infrastructure that abstracts payments, FX, routing and settlement keeps you portable across ecosystems. You can participate in ACP, UCP, or whatever emerges next without reconstructing your payment stack each time. If your payment stack is entangled with one protocol’s worldview, every change in that worldview becomes your problem.

What flexible infrastructure looks like

The protocol layer is being written in real time. The companies writing it are optimising for their own business models. Your job is to optimise for yours.

You don't need to pick a winning protocol today. You need to make sure the question doesn't matter. Keep your payment stack independent. Watch how ACP and UCP develop. Stay close to the conversation. And when you're ready to plug into a new agent surface, make sure you can do it without ripping out your existing setup.

That means staying flexible at the infrastructure level, where the actual movement of money happens, regardless of which AI surface is ascendant this quarter or which standard picks up momentum next year.

Airwallex operates at that infrastructure layer, powering global payment acceptance, FX management, and settlement across markets. However agents discover your products, verify permission, or complete the payment, the underlying rails stay the same. The protocols above will compete and evolve. Your ability to participate in any of them, without locking yourself to one or rebuilding your payment stack each time, is where the real advantage sits.