Revolut and Visa have completed France's first Passkey-authenticated agentic card payment in a live checkout at Cleverbridge.
The transaction was initiated by an artificial intelligence agent rather than a cardholder using a browser or a point-of-sale terminal. Visa's test agent, My Agent, ran the purchase on a real French consumer Revolut card at software reseller Cleverbridge. Authentication relied on Visa Payment Passkey (VPP) instead of a PIN, one-time password, or a device-based challenge at the point of payment, while Revolut retained issuer authorisation over the transaction.
Testing within existing rails
According to the announcement, the payment used Visa’s existing Intelligent Commerce infrastructure, including card security, identity checks, and real-time fraud monitoring. Revolut said the agent acted only with prior customer authorisation and that users retain control over spending rules. The functionality has not been activated within the Revolut app, and the transaction formed part of a controlled pilot rather than a live consumer-facing feature.
The purpose of the pilot was to establish whether an agent-led debit could operate within existing Strong Customer Authentication (SCA), tokenisation, and issuer-control frameworks, rather than to introduce a separate payment rail.
Part of a wider Agentic Ready programme
The test forms part of Visa's Agentic Ready programme. Cleverbridge already supports Visa's Trusted Agent Protocol and Agentic Directory, allowing the acquiring side of the transaction to recognise a verified agent as a known actor rather than treat it as unverified bot traffic. Visa has been conducting live agent-initiated checkouts with more than thirty issuers across Europe since the spring. Revolut's role represents the first instance in France involving Visa and Passkey authentication specifically, rather than the first agent-initiated payment recorded in Europe.
That earlier milestone was reached by Santander and Mastercard in March of this year, when the two companies completed an end-to-end agent-executed transaction using Mastercard's Agent Pay infrastructure, a separate scheme stack. In addition, the two card networks are each developing methods to link agent-generated purchase intent to a tokenised credential that continues to meet PSD2 SCA requirements without requiring manual confirmation at the final step of a transaction.
Open questions for issuers and PSPs
The pilot leaves several operational questions unresolved. These include the scope of an agent's mandate, merchant allow-list management, spending caps, chargeback liability in cases where the cardholder is software rather than a person, and how Passkey binding applies to an agent session as opposed to a browser session.
