Issue #1

The Protocol Stack

Six protocols are competing for the agent commerce layer, however the competition is not with eachother.

That framing has produced more confusion than clarity. These protocols occupy different layers of the same stack. Most production deployments combine three or four. The meaningful choices are about which layer to solve first.

The Protocol Stack

Six dominant protocols divide cleanly by function. ACP (Stripe + OpenAI) and UCP (Google) both occupy the commerce workflow layer: discovery, cart, checkout, order lifecycle. Neither is a payment rail. ACP uses SharedPaymentTokens, single-use and amount-restricted, issued once a human pre-authorizes a payment method. The agent receives a scoped credential that cannot exceed the authorization. Stripe settles underneath using existing fiat infrastructure.

x402 (Coinbase) operates at settlement. The client signs an EIP-3009 gasless authorization, proving it can spend a specific USDC amount to a specific address, without submitting a blockchain transaction. From there, the facilitator broadcasts to Base and the resource server serves the response immediately. Settlement happens asynchronously at near-zero gas cost. x402 requires no human in the loop at payment time. ACP does. That single difference determines the use case: ACP for human-delegated agent shopping, x402 for machine-to-machine micropayments.

AP2 (Google, with 60+ organizations including Adyen, Mastercard, PayPal, and Coinbase) sits at the authorization layer, using cryptographically signed "mandates" that encode who authorized the agent, for what purpose, maximum spend, and expiry. AP2 has integrated x402 as a settlement option. A2A handles agent-to-agent task coordination. MCP (Anthropic) is the upstream discovery layer: 97 million monthly SDK downloads, 10,000-plus public servers, now under the Linux Foundation. TAP (Visa) provides cryptographic agent identity verification at the trust layer.

A working production stack for an e-commerce agent chains four or five of these: MCP for tool discovery, A2A for sub-agent coordination, ACP or UCP for checkout, AP2 for authorization, x402 for data or API calls within the flow. Eco.com's protocol guide and Stellagent's protocol map document this composition pattern across production deployments. Single-protocol adoption is not how builders are actually shipping.

The Numbers Behind the Hype

x402 crossed 100 million cumulative transactions on Base, per Chainalysis from June 3, 2026. That figure gets cited often and deserves context.

Weekly volume peaked at approximately $15 million in April 2026, per Phemex and x402.org data. Allium Labs' on-chain analysis put verified volume for the same period at approximately $3 million after removing wash trades. The gap is not a rounding error. Analyst Onchain Lu at Artemis Analytics identified wallets engaged in self-transactions and fund cycling that inflated raw counts. Bloomberg cited $24 million over 30 days using x402.org data; Allium's filtered figure for the same period was $3 million.

The Q4 2025 spike compounds this. PING, a meme coin using a pay-to-mint loop, drove a 10,000%-plus week-over-week surge and processed 150,000-plus transactions in its first month. Chainalysis attributes that Q4 explosion largely to speculative activity. By Q1 2026, transaction sizes had shifted upward: 95% of volume came from transactions of $1 or more, versus 49% in Q3 2025. The tester-to-payer conversion rate improved 4x in six months. Behavioral data points toward genuine adoption replacing speculative noise.

The verified $3 million weekly figure is the number to work from. AWS Bedrock AgentCore Payments, launched May 7, 2026, brings native managed x402 to Bedrock with policy-based spending controls. Cloud-native enterprise adoption is a different signal than transaction counts.

The Compliance Clock

On April 8, 2026, FinCEN and OFAC issued a joint Notice of Proposed Rulemaking implementing the GENIUS Act's AML and sanctions provisions for Permitted Payment Stablecoin Issuers. Comments close June 9, 2026.

The rule treats PPSIs as financial institutions under the Bank Secrecy Act: AML programs, ongoing customer due diligence, independent testing, a US-based AML officer. SAR threshold set at $5,000.

One provision is specific to x402: secondary market on-chain transaction monitoring is explicitly excluded. USDC transfers between wallets, including those that settle x402 payments, are not directly monitored by the issuer under this rule. Circle is not required to file SARs on individual x402 transactions.

That exclusion does not resolve the exposure for x402 facilitators. Facilitators that verify EIP-712 signatures and broadcast transactions are not PPSIs. Whether they qualify as money transmitters under FinCEN guidance is unanswered. FinRegLab's September 2025 analysis identifies the structural problem: AML frameworks assume a human initiating a transaction who can be identified and screened. Agents transact at sub-second speed with no human counterparty, in patterns that can resemble layering. No existing framework classifies AI agents as a distinct entity type.

x402 facilitators remain in a gray zone. Builders operating facilitators carry undetermined compliance exposure until the rule finalizes, a process that typically runs at least 12 months after the comment period closes. June 9 is the last formal window to shape what that rule looks like.