Agent payments have mostly been demos: an agent proposes, a human approves, a card is charged. On 20 October 2026, Visa, BILL and Billtrust said they are running the first live pilot in which a registered AI agent authenticates itself to a supplier’s portal and completes an approved invoice payment without a person logging in.
What happened
The announcement, issued from Money20/20 in Las Vegas, describes an end-to-end flow between a buyer’s accounts-payable platform and a supplier’s receivables portal:
- The agent is registered, not merely configured. BILL’s payment agent is enrolled through Visa’s Trusted Agent Protocol and the Visa Agentic Directory, giving the supplier portal something to check before granting access.
- It pays with tokenised credentials. The agent uses tokenised payment credentials and controls aligned with the buyer’s approved payment instructions, rather than a shared supplier-portal login.
- The supplier portal authenticates the agent. Billtrust uses the Trusted Agent Protocol to recognise the agent and grant access. Visa states this authentication can satisfy the site protections historically provided by CAPTCHA and bot blocking — so the agent gets in without a separate login, and the supplier keeps its acceptance policy.
- The payment is tied to a specific invoice. Controls are bound to the customer’s approved payment instruction and a purpose-built payment path for that invoice, with visibility into authorization and completion.
BILL says the pilot is live and processing end-to-end transactions with participating buyers and Billtrust suppliers. The companies frame the pilot as the first application of the Visa Intelligent Commerce portfolio to a B2B payment problem; Visa’s Mark Nelsen put the design goal as not forcing businesses “to choose between automation and control.”
No transaction volumes, error rates or fraud outcomes were disclosed.
Why it matters for KYA
For years the practical blocker in agentic commerce has been an authentication mismatch. A supplier portal is built to admit humans: it challenges a person, sets a session cookie, and trusts what follows. An agent has no face to check and no session to inherit. The industry’s workaround — give the agent the customer’s password — is precisely the failure mode KYA exists to prevent.
This pilot is interesting because it replaces that workaround with an identity claim the receiving system can evaluate:
- The relying party verifies the agent, not the buyer’s password. Billtrust does not need to trust BILL’s software in the abstract; it checks a registered agent against a directory and a protocol. That is the shape of a KYA check at a real trust boundary: an identifier, an issuer, a scope, and a decision.
- Authority is scoped to an invoice, with payment controls attached. Delegation that says “this agent may pay this approved invoice, on these terms” is auditable in a way that “this agent has the account’s card number” never is. It is also revocable in principle — the supplier can decline the agent class without locking out the human buyer.
- The CAPTCHA substitution is the quiet significance. CAPTCHAs were a proxy for “probably a human.” Replacing one with an agent-authentication check is a public admission that bot-defence and agent-verification are the same control, and that portals need to distinguish authorized agents from scripts rather than blocking both.
- It creates an audit trail on both sides. Buyer-side approval, agent authentication at the portal, and payment completion each produce a record. When an agent pays the wrong invoice, the question “who authorized this, and what exactly were they authorizing?” has an answer.
The caveats matter. This is a pilot run by the vendors involved, with no independent evaluation and no published metrics; “first live” is their characterization. The Trusted Agent Protocol and Agentic Directory are Visa’s own framework, not a neutral standard — suppliers outside Visa’s network, and buyers on other card rails, are not covered by it. And agent authentication at a portal says nothing about whether the invoice was legitimate; business-email-compromise-style fraud does not disappear because the payer is an agent.
The test for practitioners is whether the identity claim survives outside the founding consortium: can a supplier verify a BILL agent without BILL’s cooperation, and can a buyer’s controls be audited by someone who is not Visa? Those questions will decide whether this becomes infrastructure or a closed loop.
Sources
- Visa, “Visa, BILL and Billtrust Launch First Live Pilot for Trusted AI Agent Payments Between Buyer and Supplier Platforms”, 20 October 2026 — usa.visa.com.
- Visa, Trusted Agent Protocol — the agent-authentication framework referenced in the release — visa.com.
- BILL, BILL Payments product documentation — the buyer-side agent described in the pilot — bill.com.
Note: the flow, the “first live pilot” claim and the CAPTCHA-substitution description are as stated by Visa in its 20 October release. No independent verification or transaction data has been published.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.