Visa vs Mastercard: networks, tokens and APIs (2026)

Visa and Mastercard both run global card networks that pass authorisation, clearing and settlement messages between the bank that issued a card and the acquirer that serves the merchant, and a merchant normally reaches both through the same acquirer or PSP. The useful differences in 2026 sit in their token services, developer programmes, products for issuers and their separate approaches to AI agent payments and stablecoin settlement.

Side-by-side

Sources: Visa and Mastercard results releases (27 and 29 October 2026), developer portals and press releases listed below, all opened on 3 November 2026. The two scale metrics are different measures and should not be read against each other. For the roles of issuer, acquirer and scheme, see how card payments work.

Technology and architecture

VisaNet

Visa has published more about the physical side of its network than most payment companies. In an article dated 29 October 2025, its technology chief said VisaNet runs across seven independent data centres and can handle up to 83,000 transaction messages per second at peak. The same piece describes a 44-acre site in Ashburn, Virginia, around 500 petabytes of stored data used for analytics and fraud models, and cyber fusion centres in Virginia, London and Singapore. Visa's VisaNet page sets an availability target of six nines (99.9999%), which works out to under a second of downtime a day.

Risk scoring is built into the network layer. Visa names Visa Advanced Authorization, Visa Protect for A2A and Account Attack Intelligence as its main AI-driven risk tools, and says its AI systems stop more than $40bn of fraud a year (company figure, October 2025). In June 2026 it added a Large Transaction Model, an AI model trained on billions of transactions to sharpen fraud detection and authorisation decisions.

Mastercard

Mastercard did not publish a comparable data-centre breakdown on the pages we opened. Its technical messaging in 2025 and 2026 centres on the checkout layer: network tokens, Click to Pay, payment passkeys that use device biometrics, and Identity Check, its 3-D Secure programme, which it says helps issuers judge risk and raise approval rates. Its June 2026 release states that the network operates in more than 200 countries and territories. For how 3-D Secure fits into the flow, see our 3D Secure explainer.

Tokenisation

Both networks launched token services in 2014, and both now treat tokens as the default way to store and pass card credentials. A network token replaces the card number with a substitute that only works in a defined context, so a merchant or wallet never needs to hold the real number. Our network tokenisation guide covers the mechanics.

Mastercard's developer documentation shows how the token plumbing works for issuers. MDES Token Connect lets a bank push a card straight from its own app into a wallet or merchant account: the issuer calls the API, MDES returns a receipt and a redirect URL, and the token requestor redeems that receipt for a token. A pull flow runs the other way, starting in the wallet. On the merchant side, the Mastercard Gateway documentation separates gateway tokens, which a gateway issues and stores, from network tokens issued by MDES, which it says are often used for wallets and can lift approval rates.

Products for merchants and issuers

Visa

• Acceptance: Visa's own pages reference Authorize.net for business payment acceptance, and Cybersource appears among the APIs on Visa Developer.
• Visa Direct: push payments to cards (Original Credit Transactions) and pull funding from cards (Account Funding Transactions). Use cases listed include marketplace seller payouts, gig worker pay, insurance claims and person-to-person transfers. The originator must be a Visa acquirer or a third party sponsored by one.
• Unified Checkout and Visa Intelligent Authorization: announced on 10 June 2026 for acquirers and merchants, covering card and non-card checkout orchestration and recovery of declined payments.
• Pismo: a core banking platform for issuers, positioned as a phased route off legacy systems.
• Stablecoin settlement and stablecoin-linked cards: Visa said stablecoin settlement over VisaNet reached an annualised run rate of about $7bn as of March 2026, and that more than 160 stablecoin-linked card programmes were live or in development (June 2026).

Mastercard

• MDES and Secure Card on File: tokens for wallets, merchants and PSPs.
• Click to Pay: live in 32 European markets, with returning customers making up over 70% of Click to Pay checkouts (June 2026).
• Payment passkeys: biometric payment confirmation, with Netopia and xMoney named as early partners.
• Mastercard Gateway: a gateway product with both gateway and network tokenisation.
• Agent Pay and Agent Pay for Machines: Agent Pay was introduced in 2025. Agent Pay for Machines, launched on 10 June 2026, targets frequent low-value payments made by software, with agent credentialing, programmable spending rules and settlement across cards, bank accounts and stablecoins. More than 30 firms are named as early supporters, including Adyen, Checkout.com, Stripe and Coinbase.

Both networks are building for AI agents. Visa's equivalent, Visa Intelligent Commerce, added an Agent Score testing tool, a directory of verified agents and merchants, and a partnership with OpenAI in June 2026. Mastercard and Santander described a live agent-executed payment in Europe on 2 March 2026.

Developer experience

Visa's quick start guide walks through the whole path: create a project, check that each API shows as active in the sandbox, download Hello World code or use Postman, then complete onboarding tasks before moving to certification and production endpoints. Some APIs need a separate access request. The Visa Developer MCP server lets coding assistants search documentation and pull OpenAPI-derived schemas, but it cannot call live APIs.

Mastercard's documentation pages for MDES and Mastercard Gateway were readable, but its general authentication and onboarding pages did not load for us, so the Mastercard column is incomplete. It is worth checking those pages directly before planning an integration.

Pricing model

Neither network lists prices for merchants. A merchant signs with an acquirer or PSP, and the network and issuer costs reach it inside that acquirer's pricing. Visa's rules page sends merchants to their acquirer agreement for details, and Mastercard's rulebook has a chapter on acquirer obligations to merchants. Our guide to gateways, PSPs and acquirers explains who charges what.

For developers, Visa states that its sandbox is free and that fees apply when a project moves to certification or production. The networks' own income comes from issuers, acquirers and value-added services: Visa reported $45.9bn of net revenue for the year to 30 September 2026 (up 15%), and Mastercard reported $9.8bn for the third quarter of 2026.

Coverage

Regulation in brief

Both networks set rules for the banks that join them and publish public editions of those rulebooks. Visa's rules page says its rules govern how financial institution clients take part in the Visa system and notes that, as a US company, it must comply with US law including OFAC sanctions. Mastercard's published rules, dated 2 June 2026, cover licensing of participating customers, issuing, acquiring and settlement.

Frequently asked questions

What is the difference between Visa and Mastercard?

Both run global card networks that pass authorisation, clearing and settlement messages between the card issuer and the merchant's acquirer. The useful differences in 2026 sit in their token services, developer programmes, products for issuers and their approaches to AI agent payments and stablecoin settlement. Most merchants accept both networks, so the choice is rarely either-or.

Do merchants pay Visa or Mastercard directly?

No. Neither network lists prices for merchants: a merchant signs with an acquirer or PSP, and the network and issuer costs reach it inside that acquirer's pricing. Our guide to gateways, PSPs and acquirers explains who charges what.

What are Visa Token Service and MDES?

Visa Token Service and the Mastercard Digital Enablement Service (MDES) are the two networks' token services, and both launched in 2014. A network token replaces the card number with a substitute that only works in a defined context, so a merchant or wallet never needs to hold the real number. Our network tokenisation guide covers the mechanics.

Is Visa bigger than Mastercard?

The published figures do not answer that directly. Visa reported $45.9bn of net revenue for the fiscal year to 30 September 2026 and 281.3bn processed transactions in FY2026, while Mastercard reported $9.8bn of net revenue and $2.952tn of gross dollar volume for Q3 2026. These are different measures and periods, so they should not be read against each other.

What is Mastercard Identity Check?

Identity Check is Mastercard's 3-D Secure programme, which it says helps issuers judge risk and raise approval rates. It sits alongside network tokens, Click to Pay and payment passkeys in Mastercard's checkout work. For how 3-D Secure fits into the flow, see our 3D Secure explainer.

Do Visa and Mastercard support AI agent payments?

Yes, both networks are building for AI agents. Visa Intelligent Commerce added an Agent Score testing tool, a directory of verified agents and merchants, and a partnership with OpenAI in June 2026. Mastercard introduced Agent Pay in 2025 and launched Agent Pay for Machines on 10 June 2026.

Which is the better fit for what

Most merchants accept both networks, so the choice is rarely either-or. These scenarios show where each network's own products may matter.

• Merchant cutting card-on-file risk: ask your PSP whether it provisions network tokens through both Visa Token Service and MDES, and whether it supports Click to Pay.
• Fintech issuing cards: compare Visa's developer programme and Pismo core banking with Mastercard's MDES Token Connect for push provisioning into wallets.
• Platform paying out to cards: Visa Direct is documented in detail on Visa Developer. Mastercard's payout products were outside the pages we opened.
• Team building agent-led checkout: both Visa Intelligent Commerce and Mastercard Agent Pay are live with partners; check which one your PSP supports.
• Business testing stablecoin settlement: Visa runs stablecoin settlement pilots for issuers and acquirers; Mastercard's Agent Pay for Machines includes stablecoin settlement among its rails.

More on card infrastructure in our cards hub, and on the providers that connect merchants to both networks in the Adyen vs Stripe comparison.

Information only, not financial or investment advice. Product details change; check each network's own pages before planning an integration.