Visa's AI Readiness: Pioneering Agent Rules It Hasn't Set for Itself

Visa's AI Readiness: Pioneering Agent Rules It Hasn't Set for Itself

Visa wants the market to see a payments company that reached the AI frontier early, and the public record cooperates. In December 2025 the company reported hundreds of secure, agent-initiated transactions completed with ecosystem partners, framing 2025 as the last year consumers would check out alone.

It convened more than ten partners around a Trusted Agent Protocol for AI-driven checkout. It struck a strategic collaboration with OpenAI. Its chief technology officer described a $3.5 billion internal AI platform built with guardrails and observability. Net revenue grew 11 percent. It is a confident story. But what is the story behind the headlines?

That's the exercise here. This is a WAVE assessment of Visa, scored across the four pillars of the framework — Watch, Adapt, Verify, Empower — plus AGI readiness, built entirely from public material: the company's Form 10-K, investor press releases, the annual report CEO message, executive blog posts, Fortune reporting, and partner announcements. No interviews, no internal access, no proprietary data, just what any outsider could already assemble without being let inside.

WAVE is the methodology I first set out in my book Now What? How to Ride the Tsunami of Change, and it's the same framework underneath the Intelligence Age Scorecard, the diagnostic that scores an organization's readiness across exactly these dimensions.

I'm using Visa as the worked example, but the method is the point. The assessment surfaces how the company builds the authentication rules for everyone else's AI agents while disclosing no framework for how much authority its own AI may exercise over authorization and settlement. With Colorado SB 24-205 and California's automated-decision rules taking effect, the SEC naming AI in its 2026 examination priorities, and US fraud losses projected to reach $40 billion by 2027, that gap carries a regulatory price.

Here's the full assessment. The sharper question isn't whether Visa's total of 9.2/16 is exactly right. It's what a stranger reading only your own public record would conclude about your company, with this year's regulatory calendar open in their other hand.

WATCH: What Visa Sees Coming

Visa's sensors are genuine. Coordinating more than ten partners around the Trusted Agent Protocol, and completing hundreds of agent-initiated transactions ahead of mainstream agentic commerce, is early sensing few incumbents can claim. That is real capability, not theater.

Yet Watch lands at 2.0/4 because of two structural breaks. The company plans against roughly a 12-month window. And it shows no formal way to separate signal from noise. In a market where The Clearing House reports real-time payment value up 405 percent year over year and 94 percent of financial firms are piloting generative AI, a one-year horizon means you see the wave but misjudge when it lands.

The scarce skill is no longer detecting signals, it is filtering them. Without a disciplined filter, sensing depends on individual judgment that does not survive at network scale. Neobanks now serve 29 percent of US consumers; the gap between seeing those threats and deciding what to do about them is exactly where competitive position erodes.

ADAPT: Built to Ship, Slow to Stop

Adapt scores 2.4/4, and the evidence explains the strength. Visa ships on a single strategic thread at remarkable cadence: Visa Intelligent Commerce launched in April 2025, an MCP Server arrived that September, the Trusted Agent Protocol that October, and an Intelligent Commerce Connect pilot with named partners followed. For an institution processing some $17 trillion in volume, standing up initiatives without years of committee debate is a genuine advantage over slower rivals.

But one weakness drags the pillar down: the discipline of closing the loop; kill criteria and structured feedback. Visa can launch; it struggles to formally retire what has stalled. In a sector where only 61 percent of firms say AI is delivering on its promise, experiments without kill criteria become a portfolio of half-finished pilots that consume resources and obscure focus. Pair a short Watch horizon with strong Adapt machinery and you get fast execution against a near-term view, motion optimized for the next 12 months while settlement economics shift over a longer arc.

VERIFY: The Firmest Ground, and the Crack Beneath It

Verify is the strongest pillar at 2.6/4, and it tracks with what Visa is. The $3.5 billion AI platform codifies data-use principles and monitors models in production to stop them drifting, and the Form 10-K folds technology and third-party risk into an enterprise framework.

The crack is in provenance, the ability to trace where an output's inputs came from. Data lineage and the auditability layer beneath validation score lower than the governance and review processes above them. In plain terms: Visa can confirm an answer looks right without always tracing how it was produced.

In an agentic world targeting mainstream adoption in 2026, that asymmetry compounds. The Trusted Agent Protocol authenticates an agent at the door, but provenance is what lets you reconstruct a decision after the fact, when a regulator under Colorado SB 24-205 or California's automated-decision rules asks how an automated outcome was reached. Validation without lineage is a confident answer you cannot defend.

EMPOWER: Trained, Not Yet Empowered

Empower is the lowest pillar at 2.2/4, and it holds the single weakest answer in the whole assessment: the channel for frontline insight to travel upward. Visa does the literacy work well: all 32,000 employees have access to internal generative AI tools, and the company encourages peer-to-peer sharing of use cases.

But cross-functional development and distributed decision-making sit a notch lower, and the route for an idea to move from the edge of the network to the center is effectively absent. That is the difference between a workforce that is trained and one that is genuinely empowered.

The interaction with Verify matters here. You cannot fully cash in strong controls when people lack the authority to act on the outputs they have learned to trust. Visa built the trust layer; it has not yet built the authority layer. Neobanks compete on organizational agility, not superior technology, and Visa's roughly 12 billion network endpoints mean little if operators meeting agentic edge cases have nowhere to route what they learn.

What Isn't on the Agenda

AGI readiness scores 1.0/4 — Exposed — with all five dimensions at the floor: workforce displacement, decision authority, economic resilience, institutional speed, and governance beyond human oversight. This is the most consequential finding in the report, and it sits far below the WAVE total of 9.2/16.

Here the announced signals do not rescue the picture. There is no disclosed framework that defines how much authority Visa's own AI may exercise over consequential payment decisions, no stress-tested scenario for how stablecoin and tokenization pressure would reshape interchange economics, and no governance artifact scoped to systems that may operate beyond human comprehension.

The contradiction is stark: Visa pioneers agent authentication for the broader market through the Trusted Agent Protocol and its Large Transaction Model and Crypto Labs work, while governing its own autonomous decisions at the floor. Payments governance moves in quarters; agentic AI moves in weeks. That mismatch is structural, and every cycle the committees lag, a more agile competitor ships.

The Structural Exposure

Read the pillars together and a fault line appears that no single score reveals. Visa senses the frontier earlier than most (Watch), ships against it quickly (Adapt), and validates its outputs well (Verify), yet it cannot trace where those outputs came from, cannot route frontline learning upward (Empower), and has no framework governing its own AI's authority (AGI).

The company is building the trust infrastructure for everyone else's agents while leaving its own decision authority undefined. That is the sense-to-govern gap: the widest asymmetry in the assessment.

The executive team likely sees the deployment wins; what it may not yet see is that strong detection without provenance, and fast shipping without an authority layer, leave the network's largest revenue base, interchange economics, single-threaded against stablecoin, tokenization, and neobank pressure precisely as autonomy outpaces oversight across financial services.

What This Means For You

Now turn the lens. If a stranger scored your organization from your public record alone — your filings, your press releases, your executives' own words — with this year's regulatory calendar open in their other hand, what would they find? Most leadership teams are fluent at the announceable layer: the partnership, the platform spend, the training numbers that reach a board deck. Far fewer can show the evidence underneath, the data lineage that lets you reconstruct an automated decision, the framework that defines what your AI may decide without a human, the channel that carries an operator's hard-won insight to the people who set policy.

The uncomfortable truth Visa's assessment exposes is that the gap between those two layers is invisible from inside the company and obvious from outside it. A regulator, an analyst, or a litigator will find it before you brief them on it. The question is whether you find it first.

Visa sees the wave coming earlier than almost anyone, and governs its arrival at the floor. The work is closing the distance between the two before agentic commerce scales past the guardrails. Score your own readiness here.