Machine-to-Machine Payments Are Live. Is Your Merchant Endpoint Ready?

Three deployments in ten days changed the shape of commerce.

On June 2, AWS launched its Agentic Shopping Assistant. On June 8, Amazon's Buy For Me feature reached 400,000+ merchants. On June 10, Mastercard launched AP4M — a machine-to-machine payment rail with 30 infrastructure partners, including Stripe and Coinbase.

The infrastructure is no longer a roadmap item. Agent-initiated transactions are running on production rails right now.

What none of these launches included: a standard for verifying merchant-side readiness.

What AP4M Actually Does

AP4M (Agentic Payments for Money Movement) is Mastercard's answer to a gap that has been widening for two years. As AI agents have become capable of completing purchasing workflows end-to-end — identifying products, comparing prices, verifying availability, initiating payment, confirming delivery — the payment rail underneath those flows remained designed for human-initiated transactions.

AP4M changes that. It is purpose-built for money movement initiated by software rather than humans. The 30 infrastructure partners include the platforms most merchants already use: Stripe for payment processing, Coinbase for crypto rails, and a range of payment orchestration providers across banking and fintech.

For merchants, this means agent-initiated purchases are no longer theoretical edge cases. They are incoming traffic, using the same payment infrastructure already connected to your checkout.

The Problem That Shipped Without a Solution

When Amazon expanded Buy For Me to 400,000 merchants, it created an enormous base of storefronts that must now handle AI agent buying behavior at scale. The agent researches, selects, and purchases on behalf of a human — but the merchant's systems were built assuming a human operates the browser.

The gap this creates is not in the payment rail. Mastercard, Stripe, and Coinbase have solved the money movement problem. The gap is in what happens after the payment intent is formed and before the transaction is confirmed.

Does your refund policy work when the buyer is software? A human buyer who initiates a return can navigate your refund flow. An agent buyer needs your refund logic to be structured, accessible via API, and consistent with the terms the agent was shown at purchase time.

Is your compliance posture written for automated buyers? Age verification, export controls, product restrictions — most of these flows assume a human who can interpret context. An AI buyer processes them literally. If your compliance check relies on judgment rather than structure, it will behave unpredictably.

Can you attribute intent when the buyer is not a person? Disputes, chargebacks, and fraud investigations all require establishing what the buyer intended. When the buyer is an AI agent acting on behalf of a human, the audit trail is different. The chain of attribution runs: human → agent → transaction. Most merchant systems only log the last step.

Why Verification Wasn't Included

The launches focused on the infrastructure problem because that is where the technical complexity lives. Building a machine-to-machine payment rail that satisfies the compliance requirements of 30+ financial infrastructure partners is a multi-year engineering project.

The merchant-side verification problem is different in character. It is not one problem — it is a configuration audit problem. Every merchant's checkout is slightly different. Every refund policy has different edge cases. Every compliance requirement is specific to the merchant's product category, jurisdiction, and customer base.

That is not a problem you solve at the infrastructure layer. It is a problem you solve at the merchant layer.

What Merchants Need to Do Before Agent Traffic Arrives

Agent-initiated transactions are not uniformly distributed. They will concentrate first in the categories where AI shopping assistants are most capable: electronics, software, subscriptions, and commodity goods with clear specifications.

If your business operates in any of those categories, the window between "this will be a problem eventually" and "this is a problem now" is shorter than the timeline for typical IT planning cycles.

The verification questions merchants need to answer before agent traffic arrives at scale:

Checkout flow: Does your checkout handle non-interactive sessions? Some checkout flows require JavaScript events, mouse movements, or browser-specific behaviors that assume human input.

Terms and conditions: Are your T&Cs structured in a way an agent can parse and confirm? Terms that rely on scroll-depth tracking or checkbox UI assume a human completing the form.

Dispute handling: Do you have a process for disputes where the buyer is documented as an AI agent acting for a named human? This is the audit trail question that most merchants have not yet had to answer.

Refund and cancellation logic: Is your cancellation API accessible and consistent with the terms shown at purchase? Machine-initiated purchases require machine-accessible cancellation paths.

The Verification Window

Mastercard, Amazon, and AWS have shipped the transport. The merchant-side verification standard does not yet exist as an industry norm — but it will emerge from the disputes, chargebacks, and compliance incidents that happen in the absence of one.

The merchants who document their endpoint state now — who run verification before agent traffic scales on their storefront — will not be the ones filing incident reports in six months.

Attest is the structured verification layer that tells a business whether their endpoint is agent-ready before traffic arrives that cannot be redirected. The readiness assessment maps your checkout, refund logic, compliance posture, and attribution chain against the specific behaviors of agent-initiated transactions.

The rails arrived faster than most merchants expected. The verification standard is still being written. Getting ahead of it is a decision you can make now, before the first agent dispute lands in your queue.

---

Attest by ECTD — The verification layer between your AI agents and the real world. Start your readiness assessment →