The Deutsche Bundesbank describes the transaction execution layer as fragmented but concentrating. Where other layers have largely complementary protocols, it says, two similar protocols, the Agentic Commerce Protocol and the Universal Commerce Protocol, have become de facto standards here. An alternative execution model built exclusively on DLT infrastructure is offered by the x402 protocol. Three protocols, two shapes.
For each I give who published it, what the order object is, how the payment credential moves, what confirmation returns to the agent at step 9, and where the mandate from Module 1 lives. I do not say which will win, and the Bundesbank's "de facto standards" assessment is reported as theirs.
ACP: a checkout session and a scoped token
OpenAI and Stripe published the Agentic Commerce Protocol in September 2025 to power Instant Checkout in ChatGPT. The Agentic Checkout specification asks a merchant to implement endpoints to create, update, complete, cancel and read a checkout session. A session carries line items, totals, fulfillment options and a status that moves through not_ready_for_payment, ready_for_payment, completed and canceled.
The payment credential is the interesting part. Under the Delegated Payment specification, the agent platform does not hand the merchant a card. It hands the merchant's payment service provider a token with an allowance: a max_amount, a currency, a merchant_id, a checkout_session_id and an expires_at. The reason field currently takes one value, one_time. The merchant and its provider then process the payment in the same manner as any other order they collect; settlement, refunds, chargebacks and compliance stay with them. Stripe's implementation is the Shared Payment Token, which its documentation describes as a scoped grant to use the customer's payment method, with usage limits on amount and expiry, that the seller spends by creating a payment on its own account.
What returns at step 9 is the completed session with an order object: an order identifier and a permalink the customer can open. After that the merchant publishes order events whose statuses run created, manual_review, confirmed, canceled, shipped and fulfilled. Steps 9 and 10 are both visible in that list, which is more than the Bundesbank's chart draws.
Where the mandate lives: in the allowance. Scope is one merchant and one session; limits are the ceiling and the expiry; lifecycle is single use. It is a narrow mandate, created after the agent has already decided. The principal's wider authority, if there is one, sits outside the protocol.
The product built on ACP did not survive in its first form. On March 24, 2026 OpenAI pivoted away from the first version of Instant Checkout, saying in its own post that the initial version lacked the level of flexibility it aspired to provide, so merchants would use their own checkout while ChatGPT focused on product discovery, as TechCrunch reported that day. I covered what that settled about step 4 in OpenAI Abandoned Instant Checkout. The Merchants Won. For this module the point is narrower: the specification is still published, and its delegated payment pattern, a single-use token with a ceiling and an expiry, is the shape card-rail approaches have converged on.
UCP: capabilities, handlers and the merchant of record
Google announced the Universal Commerce Protocol on January 11, 2026, co-developed with Shopify, Etsy, Wayfair, Target and Walmart and endorsed by more than 20 further companies, to power checkout in AI Mode and the Gemini app for eligible US retailers (Google). The engineering description calls it neutral and vendor agnostic. Shopify's announcement the same day says it works with any payment processor (Shopify).
The order object is a checkout session again, but the protocol is organized as capabilities a business advertises in a profile: checkout, cart, order, identity linking, with extensions such as fulfillment and discount. The specification binds each capability to a transport, and there are three, REST, MCP and A2A, which is why UCP is the protocol Module 2's readiness scan can detect as a published profile.
The payment credential moves through what UCP calls a payment handler, a design that separates the instrument the consumer pays with from the processor that handles it. Google Pay is one handler; Stripe lists one of its own and describes UCP's payment token exchange as letting platforms, businesses and credential providers exchange payment tokens and credentials (Stripe). For the autonomous case, Google says UCP is compatible with AP2, and the specification lists an AP2 mandates extension. That is the link back to Module 1: UCP does not define a mandate of its own; it carries AP2's.
What returns at step 9 is the completed checkout. Then the order capability takes over, which Stripe summarizes as monitoring shipping, delivery and returns with webhook-based lifecycle updates. Steps 9 and 10 again, plus the return path the Bundesbank's chart does not draw.
Where the mandate lives: in the AP2 credential the handler carries when the flow is autonomous, and in the signed wallet authorization, backed by what Google calls cryptographic proof of user consent, when a person is present. The one constant across Google's descriptions and Shopify's Agentic Storefronts announcement is that the business remains the merchant of record, with every order flowing into the merchant's own admin. The platform sells the discovery and the checkout surface; the merchant owns the sale.
x402: the payment inside the request
Coinbase published x402 on May 6, 2025, with a whitepaper that opens from a different problem. Not how an agent buys a product from a merchant, but how an agent pays for an API call, a page or a unit of compute without an account, a key or an invoice. The mechanism is HTTP status code 402, Payment Required, long reserved in the standard and unused.
There is no checkout session. The flow in the protocol repository is: the client requests a resource; the server answers 402 with the payment options it accepts; the client builds a signed payment payload for one of them and retries with it in a header; the server verifies, locally or through a facilitator; the server does the work; the server or the facilitator settles on chain; the server returns the resource with the settlement details in a response header. Three payment schemes are specified: exact, a fixed amount; upto, a maximum the seller settles against actual usage; and batch settlement, which redeems many small charges on chain at once.
The payment credential is a signed authorization to move a stablecoin, usually USDC, from the agent's wallet. The whitepaper's own claims for the Base network are settlement in about 200 milliseconds, nominal gas fees, and no reversibility. It lists "no chargebacks" as a feature. The Bundesbank's regulatory box lists the absence of a route back as a liability question. The next lesson holds the two side by side.
What returns at step 9 is the resource itself, with a settlement result attached. In x402 the order confirmation and the delivery are the same HTTP response. Steps 8, 9 and 10 collapse into one message, which is why the protocol sits in the settlement box of the Bundesbank's chart as well as the execution box.
Where the mandate lives: in the wallet. The protocol defines what one payment looks like; it does not define who authorized the agent to hold the key. I wrote about the spend limits Coinbase later shipped around agent wallets in Coinbase Just Shipped Spend Limits for AI Agents. Those Are Mandates, and that is the honest description: the mandate is a wallet policy, outside the protocol.
Governance has moved since the Bundesbank wrote. The Linux Foundation announced the operational launch of the x402 Foundation on July 14, 2026, with 40 member organizations and Coinbase's contribution of the protocol complete; its release describes payment types ranging from traditional cards to stablecoins (Linux Foundation). The Bundesbank's "exclusively on DLT infrastructure" is accurate for what is deployed; Stripe, for example, accepts x402 only for USDC on Base (Stripe). The stated scope is now wider than the running implementations. I keep a record of who has joined and what has shipped on the x402 adoption tracker.
The shape the Bundesbank saw
Look at the table's mandate row. Two of the three protocols carry the mandate inside the execution object, as a scoped token or an AP2 credential. The third carries none and relies on the wallet. That is the Bundesbank's subtitle for the layer, "can also extend beyond authorisation and identity," made concrete. ACP and UCP extend into it. x402 does not.
Now look at the native rail row. The two de facto standards run on the merchant's existing processor, which in practice means cards and whatever account-to-account methods that processor offers. The alternative model runs on a rail that did not exist as a retail settlement option until this decade. That is the sorting the Bundesbank makes between the execution box and the settlement box, and the next lesson follows it into the rails themselves.
One observation of my own. ACP and UCP arrived with partner lists; x402 arrived with a whitepaper and was handed to a foundation the following year. The Bundesbank's remark that broad partner alliances can establish standards at an early stage describes the first two. The protocol it calls the alternative took the other route, and the premier members the foundation named in July include Stripe, which co-published ACP, and Google and Shopify, which co-developed UCP. The protocols are not as separate as the chart's boxes make them look.
Next lesson: the three rails. When the instruction reaches a card network, an instant payment system or a blockchain, what does "paid" mean, and can it be undone?
Charlie Major is a Product Development Manager at Mastercard. The views and opinions expressed in Major Matters are his own and do not represent those of Mastercard.