Who Holds the Money — Custody Models Across the Five Protocols, and Why It Names the Defendant

Four protocols, four different answers to "where does the money actually sit while an agent is authorizing a spend." AP2 never touches funds at all; AP4M and Visa route custody to a card issuer or to Coinbase depending on the settlement rail chosen; Coinbase Agentic Wallets split custody cryptographically between Coinbase and the operator. This matters beyond architecture diagrams: Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki is downstream of custody — whoever holds the key or the balance is the first-line defendant when an agent overspends.

AP2: no custody, mandate layer only

AP2 is a mandate/signaling layer, not a fund custodian — Google does not hold funds, stablecoins, or card balances. The official announcement states AP2 "supports different payment types – from credit and debit cards to stablecoins and real-time bank transfers," delegating actual fund movement to whichever existing infrastructure the Payment Mandate designates: the card network, a bank rail (ACH, FedNow), or a blockchain network — FONTE: cloud.google.com/blog (AP2 announcement).

AP2's own role is producing cryptographically signed proof — the Intent Mandate, Cart Mandate, and Payment Mandate, encoded as W3C Verifiable Credentials (JSON-LD, signed ECDSA) — that the user authorized a specific transaction. The actual custodian is whichever rail the mandate names, not AP2 itself — FONTE: github.com/google-agentic-commerce/AP2. The spec is public at ap2-protocol.org (Apache-2.0, 54+ commits on main as of the note's check) — FONTE: ap2-protocol.org.

AP4M (Mastercard)

credentialing and permissioning are recorded on public blockchains (Polygon, Solana, Base), not inside Mastercard's own infrastructure — FONTE: blockhead.co (2026-06-11). Who holds the *funds* on the stablecoin branch is less settled than a single custodian name: blockhead.co reports Coinbase as one of more than 30 early partners in the Mastercard integration announced around June 2026, without confirming that Coinbase's Custody division specifically holds the funds — FONTE: blockhead.co. The primary Mastercard press release describing the partnership returns HTTP 403, so the specific attribution to Coinbase Custody cannot be verified against the primary source — FONTE: mastercard.com press release (inaccessible, HTTP 403). When the rail is a card network (Visa, Mastercard), the card issuer holds the funds and Mastercard merely networks the settlement, same as any traditional card payment — FONTE: blockhead.co. The full AP4M spec is not public; only the launch-partner list and a high-level four-function architecture (credentialing, permissioning, transacting, settling) are disclosed, and the announcement URL itself was reported broken as of June 2026 by multiple secondary sources — FONTE: mastercard.com. (unverified) some sources describe AP4M custody as an "agent-held stablecoin wallet on Base/Solana," but the primary Mastercard source does not confirm agent-level key custody; the Coinbase partnership points to Coinbase-managed custody instead — FONTE: blockhead.co.

Visa Intelligent Commerce

the agent receives a tokenized, scoped credential bound to a specific agent, merchant, and spend limit — the agent never custodies the token or the underlying funds. Visa's own developer docs describe it as a "tokenized payment credential…for use at Visa-accepting merchant locations" — FONTE: developer.visa.com. The user's underlying funding source (card, bank account, stablecoin) stays in issuer/wallet custody; the agent gets a time-bound, transaction-scoped authorization, and the user keeps dispute rights — FONTE: eco.com/14845484. Settlement runs through Visa's card network for card-rail payments and through Visa's stablecoin settlement infrastructure for blockchain rails; the card-issuer custody model in general requires a "bank-grade, fully custodial fund pool" bridging on-chain assets and traditional rails — FONTE: cobo.com. Visa's stablecoin settlement reached a $7 billion annualized run-rate by April 2026, across nine blockchains — the note flags "annualized run-rate" as a short-window extrapolation, not a measured full-year figure — FONTE: eco.com/14845484. Visa's treasury holds positions on multiple blockchains simultaneously for cross-chain USDC flows and clears the difference internally rather than bridging — FONTE: coindesk.com.

Coinbase Agentic Wallets: MPC custody split between Coinbase and the operator

The private key is split with threshold-ECDSA Multi-Party Computation (MPC) into two shares — one held by Coinbase, one by the operator's CDP project — and below the configured threshold neither share alone can produce a valid signature — FONTE: eco.com/14845485 (documentation quote). Coinbase's own MPC library, cb-mpc, is open source and implements "Elliptic Curve Distributed Key Generation (EC-DKG) and threshold ECDSA over secp256k1" — FONTE: eco.com/14845485. Signing itself happens inside an AWS Nitro Enclave, an isolated VM where "the raw key material is never reconstituted in plaintext on a normal host"; Coinbase leadership calls this "several orders of magnitude safer than just having a private key on disk" — FONTE: eco.com/14845485.

This is a hybrid custodial model: the operator keeps cryptographic control via its keyshare, but Coinbase controls the signing infrastructure. It is neither pure self-custody (operator alone) nor traditional custody (a single provider with no operator key material) — a taxonomy that contrasts "custodial MPC" (Coinbase) against "self-custodial MPC" where shares sit entirely on operator-controlled devices — FONTE: vultisig.com. Settlement on Base is gasless for the operator — Coinbase absorbs the gas cost as part of the service — FONTE: eco.com/14845485. x402 — the protocol underlying Coinbase Agentic Wallets, and also supported by other wallet implementations such as Circle and Crossmint — crossed 165 million transactions total protocol-wide by April 21, 2026; the source does not break out how many of these ran specifically on Coinbase Agentic Wallets, and the note flags that this count includes testnet activity unless stated otherwise — FONTE: eco.com/14845485.

Why custody model determines the defendant

Under agency law, when an agent is prompt-injected and overspends under a facially valid mandate, liability follows the custody boundary first: the party holding the key or signing authority bears operational liability, then it can shift to the mandate issuer (the human principal) if that principal authorized excessively broad permissions — FONTE: law.justia.com (Georgia agency-law code, general principle, not agent-payments-specific). Applied per protocol:

- AP2 (no custody): liability attaches to whichever rail settled — the card issuer/bank for card/ACH, the blockchain network for stablecoin. AP2 itself produces the audit trail but is not the custodian and so is not the natural defendant — FONTE: eco.com/15192002. - AP4M, stablecoin rail: Coinbase is the custodian and first-line defendant; Mastercard may carry secondary liability if the permissioning logic was scoped incorrectly — FONTE: blockhead.co. - Visa Intelligent Commerce: the issuing bank (not Visa) is the custodian and first-line defendant for card-rail settlements; for the stablecoin rail, Visa's own treasury position makes Visa a co-defendant if settlement fails — FONTE: coindesk.com. - Coinbase Agentic Wallets: liability splits along the same line as custody — Coinbase for signing-infrastructure security, the operator for wallet-policy enforcement, since neither party alone controls the key — FONTE: vultisig.com.

(unverified) No published CFPB guidance or court ruling yet addresses who bears liability when a prompt-injected agent overspends under a cryptographically valid mandate; existing principal/agent liability law may not map cleanly onto a scenario where the "agent" is software rather than a human actor with intent or negligence — FONTE: notes, general assessment. This is exactly the open question Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki exists to run to ground.

Comparison summary

| Aspect | AP2 | AP4M (stablecoin) | Visa Intelligent Commerce | Coinbase Agentic Wallets | |---|---|---|---|---| | Who holds funds | Neither (mandate layer) | Likely Coinbase (unverified — primary source inaccessible) | Card issuer (issuer rail) / Visa (stablecoin rail) | Split: Coinbase infrastructure + operator key share | | Custody mechanism | N/A — delegates to payment rail | MPC + HSM + Coinbase partnership | Tokenized credential; issuer holds balance | MPC threshold ECDSA (2-of-2 shares) in AWS Nitro | | Agent access to funds | None (sees mandates only) | Via Coinbase API/signing | Via scoped token (not direct account access) | Via MPC wallet; operator initiates, Coinbase co-signs | | Settlement latency | Depends on rail (card 1-3 days; stablecoin block time; ACH 1 day) | Stablecoin on-chain (Base ~12 sec finality) | Card 1-3 days; stablecoin block time | Stablecoin on Base ~12 sec, gasless |

FONTE for the table: same sources cited per row above, consolidated from the notes' own comparison table.

Why this page serves the wiki's objective

The objective demands telling "shipped and measurable" apart from "announcement," and custody is one of the sharpest tests: AP2 makes no custody claim at all (so there is nothing to overclaim), AP4M's stablecoin custody rests on a named partner (Coinbase) with a broken announcement URL and no public spec, and Coinbase's own MPC design is the most concretely documented of the four. Custody is also the load-bearing fact for Who Is Liable When a Prompt-Injected Agent Spends Money — the unresolved question behind every mandate protocol in this wiki and for Mastercard AP4M — an announced authorization layer, not yet a published spec or a shipped integration and Visa Intelligent Commerce: Tokenized Agent Credentials — the spec-vs-announcement test applied to Visa's own numbers, which need this page's issuer/Coinbase split to reason about settlement economics and disputes.