Mastercard's Netherlands Agent Payment Ran on PSD2 Rails the US Doesn't Have

On April 30, 2026, Mastercard and Rabobank completed the Netherlands' first live AI agent payment in Amsterdam, two months after Santander ran Europe's first in Spain on March 2. The agent booked a coffee tasting on Priceless.com using a Rabobank Mastercard, with no card credentials shared and no website visit. Both pilots ran on PSD2 strong customer authentication rails, which US issuers don't have an equivalent for.

Two pilots, two countries, zero US banks

The pattern is starting to look intentional. Santander processed the Spain transaction through its live payments infrastructure on March 2. Rabobank's Tribe Lead Payments Suzan van Eeten and Mastercard Netherlands country manager Jan-Willem van der Schoot ran the Amsterdam demo on April 30. Both use Mastercard Agent Pay, both use Payment Passkeys, both produce a clean PSD2 audit trail.

Citi and US Bank cardholders were the first US issuers to enable Agent Pay back in November 2025. Mastercard then completed its full US issuer rollout before pivoting to Europe. So the technology was live in the US first. The actual on-stage live transactions, the ones with bank executives and press releases, keep happening on EU soil.

I don't think that's a marketing choice. It's a regulatory one.

PSD2 SCA is the moat (and most US marketers haven't noticed)

PSD2's strong customer authentication rule forces every electronic payment in the EU and UK to verify the consumer with two of three factors at the moment of authorization. That sounds like friction. For agent commerce it turns into the opposite: a built-in compliance framework where the bank, the network, and the merchant already know how to log a cryptographic consent step.

Payment Passkeys slot into that audit trail directly. The agent never sees the card. The user authenticates once. The token is scoped to a specific agent, a specific merchant, a specific spend cap. If the agent goes off-script, the network blocks the auth at the Mastercard layer, not at the issuer or merchant.

The US has no SCA equivalent. CFPB's 1033 open-banking rules are inching toward something similar, but not before 2027. So when Mastercard wants to demo a live agent payment to regulators and the press, the cleanest legal perimeter it has access to is European. The Netherlands and Spain aren't the cool-kid markets. They're the markets where the compliance team will sign off.

What the Amsterdam demo actually did

Strip it of marketing language and the pilot is small. A consumer told an AI assistant to book a coffee tasting experience. The agent searched, found an offer on Priceless.com (Mastercard's experiences platform), and paid using the consumer's Rabobank Mastercard. The full handling went through PayOS. The agent had no access to card data and operated only inside the consumer's pre-approved permissions.

What's worth pausing on isn't the transaction. It's what the consumer never did. They didn't visit Priceless.com. They didn't see a checkout page. They didn't tap or click any of the dozen Mastercard touchpoints brands typically pay to appear on. The brand selection happened entirely inside the agent's recommendation logic.

That's the actual change. Not "AI can pay." It's "the entire purchase consideration set just collapsed into one prompt."

Why this should change your EU test plan, not your US plan

If you're a US-based brand team waiting for the US version of these pilots to mature, you're looking the wrong direction. The US infrastructure is already there. What's not there is the live data. The pilots in NL and ES are where you can actually watch how an agent surfaces brands inside a regulated checkout, with measurable transactions on the other end.

If your company has an EU subsidiary or distributor, route a small test budget through any merchant on Mastercard's Agent Pay-enabled list in the Netherlands or Spain. Mastercard's Agent Pay page lists the participating partners and the Agentic Consulting Services team that handles onboarding.

A reasonable starter pilot looks like this: €5,000 to €15,000 across a four-week window. Don't measure it on traditional ROAS. The data points you actually want are agent citation share (does ChatGPT recommend you when prompted?), agent conversion rate inside the recommendation, and offer-side selection rate on whatever experience or SKU platform you list on. Aiso-style prompt batches give you the citation-share half. The transaction-side data is what only the EU pilot exposes.

Three things that won't show up in your analytics anymore

This is the bit most attribution teams haven't priced in.

First: no GA4 page_view fires when the agent buys for the user. There's no website visit. No cookie. No pixel. The Meta CAPI server-to-server feed will show the conversion if Mastercard's transaction record reaches your CRM, but the entire upper-funnel measurement chain is gone.

Second: the brand decision happens one layer up from search or paid. It happens at the model layer, where the agent decides which products to surface from which sources. Mastercard's Verifiable Intent standard, announced March 5, 2026 with Google, is essentially trying to make brand identity a cryptographic primitive at that layer. If your brand isn't a verifiable signal, you're invisible to the agent.

Third: conversion data is in the issuer's transaction record, not yours. Your only direct visibility is offer-side. So the metric that matters in the agent-commerce world is "did my SKU get selected from the recommendation set," and most US marketers don't have a clean way to measure that without working with the platform Mastercard is piloting on.

A weirdly specific 18-month bet

From what I've seen, the next year and a half of agent-commerce data will come almost entirely from EU pilots. That's not because EU consumers want this more. It's because the regulatory rails make the experiment legible. Lawyers can sign off. Compliance teams can audit. Bank board members can read a one-page summary that doesn't end with "and we'll figure out the consent framework later."

Which means the playbooks for surfacing brands inside an agent's recommendation set will be written by marketers working with Spanish, Dutch, and German bank-merchant partnerships. US-only teams will be reading translated case studies in 2027, kind of like CMOs reading EU-only GDPR best practices in 2018 and 2019.

I'm hedging on the McKinsey $3 to $5 trillion-by-2030 number that everyone is repeating. The headline figure is almost certainly too round. The directional point holds: the routing of consumer purchase decisions through agents is real, the pilots are accelerating, and they're not happening where most US marketing teams are looking.

What to put on the EU test-market line item

If you have any kind of EU presence, three concrete moves this quarter:

One, ask your media planner to carve out a small EU agent-commerce test budget separate from your normal performance line. €10K is enough to learn something.

Two, identify which of your products or experiences could be listed on a Mastercard Agent Pay-eligible platform in NL or ES. Priceless.com is the obvious one for experiential brands. For DTC consumer brands, ask Mastercard's Agentic Consulting Services about merchant pilots in your category.

Three, set up a parallel measurement framework that doesn't depend on website pixels. Aiso-style prompt-batch citation tracking on the agent side. Issuer or platform-supplied transaction reporting on the conversion side. They won't reconcile cleanly. That's fine. The point is to learn what's measurable at all.

For US-only teams: Citi and US Bank cardholders already have Agent Pay enabled. The infrastructure works. What you don't have is a regulated, scoped test environment where the lawyers will let you actually run a multi-merchant experiment. That's probably coming, but not this year. Plan accordingly.

Mastercard didn't pick Amsterdam by accident. It picked the cleanest legal perimeter on earth for testing what consumer payment looks like when a model spends the money. The brands that figure out how to be present inside that perimeter, not after it, will probably have a lot less to retrofit when the US version finally arrives.

Notice Me Senpai Editorial