Visa Demonstrates Agentic Commerce Payments With 10 Indian Partners at GFF 2026: How Tokenisation and Payment Passkey Carry AI Agents to Checkout
Visa ran live AI agent payments with Razorpay, PayU, Pine Labs and seven other partners at Global Fintech Fest 2026. We unpack how the demo runs on existing tokenisation and Visa Payment Passkey rails, how it sits next to NPCI's UPI agent protocol, and what merchants need to connect their own agents to checkout.
Key Takeaways
- At Global Fintech Fest 2026 Visa demonstrated AI agent payments with ten partners including Razorpay and PayU, running on its existing tokenisation and Payment Passkey infrastructure
- Some of the seven payment aggregators involved also run their own agent platforms on UPI, so NPCI's protocol and Visa's card rails are advancing side by side
- With only 23% of consumers trusting AI to handle payments, merchant agents should connect to checkout while keeping the moment of authentication in place
What Visa Showed in Mumbai: From Asking to Paying in One Flow
Visa showcases AI agentic commerce at Global Fintech Fest 2026 in Mumbai. Experience secure, AI-driven payments from discovery to purchase.
www.storyboard18.comAt Global Fintech Fest (GFF) 2026, held in Mumbai from September 9 to 11, Visa ran live demonstrations of agentic commerce payments. According to Storyboard18, a consumer states a request in natural language, an AI agent narrows and compares the options, and the flow runs straight through to payment. Two entry points were shown: starting from a general-purpose large language model (LLM), or starting from a merchant's own AI agent.
The demos were built with ten partners: Federal Bank, IndusInd Bank, RBL Bank, Cashfree Payments, CCAvenue, Juspay, Paytm Payments Services, PayU, Pine Labs and Razorpay. Use cases covered food ordering, lifestyle purchases and online shopping, with travel bookings also included. Indian Television reports the showcase was designed to prove the model works not only for large brands but also for D2C brands and small businesses.
Suresh Sethi, Group Country Manager for India and South Asia at Visa, said trust becomes central as commerce turns agent-driven. In the same week Visa also published a whitepaper, "Frontier AI: A New Era of Cyber Resilience", covering its open-source vulnerability pipeline VVAH, but this article stays focused on the payments demo.
Not a New Protocol: Built on Tokenisation and Passkey
What stands out is not what Visa built but what it did not build. Visa brought no agent-specific payment rail. It layered the agent experience on tokenisation and Visa Payment Passkey (VPP) authentication, both already live in India.
Visa Payment Passkey only went live in India on July 2, 2026. According to Visa's announcement, it launched with IDFC FIRST Bank as the first issuer and became available to select users at merchants such as Myntra and Reliance Digital. Built on FIDO standards, it replaces the one-time password (OTP) with the device's own fingerprint, face recognition or PIN, in line with the Reserve Bank of India (RBI) framework on alternative authentication issued in September 2025.
What matters is that back in July, Sethi already described it as laying "the foundation for the next era of agentic commerce". Tokenisation keeps the actual card number away from the agent, and Passkey leaves a record on the device that this specific payment was approved by the account holder. With both in place, the AI can search and fill the cart while the final approval stays pinned to a human biometric. When the demo is described as keeping "human involvement where required", that is this design restated.
The July Passkey launch partners included Juspay, Razorpay, PayU, Pine Labs and Paytm Payments Services, overlapping heavily with the ten demo partners. Visa lifted the payment providers that had already integrated Passkey straight into the agentic payment showcase, which is how the live demos came together in two months.
Globally, Visa runs Trusted Agent Protocol, which proves an agent's legitimacy with cryptographic signatures, and Intelligent Commerce Connect, a single connection point for merchants, under the Visa Intelligent Commerce umbrella. Whether either was used in this demo is not disclosed, and the only components made public are tokenisation and Passkey.
What the Ten Partners Reveal About India's Three-Layer Payment Structure
Breaking down the participants gives three banks and seven payment aggregators (PAs) or payment gateways (PGs).
| Layer | Participants | Own agentic payment moves (public information) |
|---|---|---|
| Banks (card issuers) | Federal Bank, IndusInd Bank, RBL Bank | Issuers of Visa cards. They provision tokens and receive Passkey authentication |
| Payment aggregator | Razorpay | Agentic UPI payments on ChatGPT with NPCI and OpenAI since October 2025. Also runs Agent Studio for payment operations |
| Payment aggregator | PayU | Announced Agent HQ, an AI agent store for merchants, on September 11 during GFF |
| Payment aggregator | Pine Labs | Launched P3P, an autonomous payment protocol on UPI, in June 2026, with Grantex handling delegated authorisation |
| Payment aggregator | Cashfree Payments, Juspay | Building in-chat payments and agent connectivity products for merchants (Business Standard) |
| Payment aggregator | Paytm Payments Services | Visa Payment Passkey rollout partner in India. Developing agent products for merchants (Business Standard) |
| Payment gateway | CCAvenue | No agent-specific payment product disclosed |
The three banks are the card issuers, provisioning tokens and receiving Passkey authentication. The counterparty for approval is ultimately the issuer, so without them the demo does not exist.
The depth is on the aggregator side. Razorpay has offered agentic UPI payments on ChatGPT since October 2025 with NPCI, the operator of UPI, and OpenAI. In June 2026 Pine Labs launched P3P, an autonomous payment protocol combining UPI's Reserve Pay, HTTP 402 and the delegated authorisation framework Grantex. On September 11, during the same event, PayU announced Agent HQ, a no-code agent store that lets merchants pick agents from the dashboard for everything from exposure to AI shopping agents to automating payment operations.
In other words, at least three of the seven already run their own agent platforms on UPI while also taking part in Visa's card-rail demo. The natural reading is that they are planting a foot on both rails so that consumers can pay whichever way they choose. Business Standard, however, noted in a September 6 report that monetisation remains nascent and most offerings are still being tested. The ten logos are best read as a list of declared entrants, not proof of production use.
The UPI Side and NPCI's Principle That "AI Does Not Approve"
UPI processed 24.51 billion transactions in August 2026, and according to MediaNama no AI-agent-specific framework governs those rails yet. The candidate reported to fill that gap is NPCI's Unified Agent Protocol (UAP). Per Reuters reporting relayed by Inc42, it would build on UPI Circle, which delegates payments to family members, and Reserve Pay, which blocks funds in advance, to let users hand payment authority to AI agents within a preset limit, initially for low-value, high-frequency transactions such as grocery orders.
It was not formally launched at GFF 2026, however. In a September 10 keynote, NPCI non-executive chairman Ajay Kumar Choudhary said only that NPCI is "examining" the protocols needed to identify and authorise agents, and instead set out a design boundary.
Decision making and execution must remain separate. AI may recommend, but authentication and final settlement must follow deterministic auditable rules.
The agent reads intent, while verifying identity, limits and consent sits with the authoriser, and interoperability "must remain non-negotiable". Regulators lean the same way: CERT-In, under India's IT ministry, has proposed in its Digital Threat Report 2025-26 that agentic AI actions above defined financial thresholds require human-in-the-loop controls and audit trails.
In this context, Visa's insistence on tokenisation and Passkey makes sense. Passkey inserts a human biometric right before payment, which maps directly onto NPCI's boundary that AI recommends and authorisation follows human-side rules. Visa showed first a form that the regulator and the domestic payments body can accept, assembled from existing infrastructure.
The Distance Between Demo and Production, and the 23% Figure
Reading only the promoters' announcements, adoption looks like a matter of waiting, but the numbers are less optimistic. The Visa Trust Index, published by Visa itself on September 9, found that 72% of U.S. consumers have used an AI assistant, yet only 23% trust GenAI to handle payment transactions on their behalf. Some 61% said they would trust Visa to handle agentic transactions, rising to 68% among 18-to-34-year-olds and 71% among frequent AI users. The survey was run by the Harris Poll in May 2026 among 2,065 U.S. adults; it is not an Indian consumer figure.
Visa frames this as brand trust accelerating adoption, but the flip side is that three in four consumers refuse to delegate payment to AI itself. It is consistent with Visa CEO Ryan McInerney's remark the same week that adoption is visible in shopping but not yet in autonomous payments, and the demo's emphasis on human involvement is also a response to this finding.
The demo itself carries caveats. The participating merchants, whether Passkey authentication is required per transaction or one delegation can cover several, the commercial launch timing, and the fees for merchants and payment providers are all not disclosed. The McKinsey estimate Visa cited, $3 trillion to $5 trillion globally by 2030, describes the overall market potential and does not underwrite an Indian rollout schedule. MediaNama reports that its questions to Visa about a session at the same event went unanswered.
What It Means for Merchants: Connecting Your Own Agent to Payment
Of the two entry points in Visa's demo, the one where a merchant keeps control is the path that starts from the merchant's own AI agent. In the general-LLM path, product exposure and comparison criteria belong to the platform; with your own agent you design the service, the range of recommendations and the route to payment. The problem is connecting that agent safely to payment, and breaking down the demo's structure, a merchant needs three things.
First, do not let the agent hold card details. In the demo the agent handles tokens, and payment processing is delegated to the aggregator's checkout. With your own agent, avoid any design in which customers type card numbers into the conversation, and hand off to the payment provider's tokenised checkout instead. PayU's Agent HQ and Razorpay's merchant-facing connectivity productise this hand-off destination.
Second, do not erase the moment of authentication. It is tempting to drop approval to reduce friction, but given the 23% trust figure and the direction set by NPCI and CERT-In, keeping a beat where the agent proposes and a human approves with a biometric will, for now, reduce both abandonment and chargebacks. Device authentication like Passkey compresses that beat to a few seconds, which makes the two goals compatible.
Third, keep both delegation and per-transaction approval in view. In India, the UPI Circle model of upfront delegation within a cap runs alongside the Visa model of Passkey approval per transaction. The split, low-value repeat purchases on the former and high-value or first-time purchases on the latter, applies just as well when Japanese merchants decide how much to delegate to an agent for consumables versus high-consideration items. Visa is running its Agentic Ready programme across ten Asia Pacific markets, and as the card-side foundations mature, the homework left to merchants narrows to how they design their own agent and which payment provider's checkout they hand it to.
Conclusion
Visa's Mumbai demo was not a splashy new technology announcement. It combined tokenisation and Payment Passkey, both already working, to show with ten partners that an AI agent can reach payment. That plainness is not a weakness; it reads as the choice most likely to be accepted in a market where the regulator and the domestic payments body draw the line at "AI recommends, humans approve".
Three things to watch next: whether NPCI's Unified Agent Protocol emerges as a formal specification, what merchant products the aggregators in the demo ship on both card and UPI rails, and whether consumer trust in delegating payment moves off 23%. Those three are the yardsticks for the distance between demo and production.
