CBiLink Secures EMVCo 3-D Secure Approval to Advance AI-Driven Agentic Payments

CBiLink has secured official EMV 3-D Secure Approval from EMVCo for its Access Control Server, a critical milestone for the fintech as it seeks to scale its authentication technology. Beyond standard compliance, the firm is now actively shaping the future of agentic commerce by contributing to the industry’s emerging framework for AI-driven cardholder authentication.

What was announced

CBiLink’s Access Control Server (ACS) has officially received approval based on the EMV 3-D Secure 2.2.0 Specifications. This technical validation confirms that the solution meets the global standards for online cardholder authentication, which are designed to verify identities during e-commerce transactions. The product has now been added to EMVCo’s official list of Approved 3-D Secure Products, providing financial institutions with a verified tool to manage risk and reduce fraud.

The solution is designed for issuers and offers a suite of capabilities beyond basic compliance, including:

• Advanced cardholder authentication and risk-based decisioning.
• Frictionless authentication to improve transaction approval rates.
• Fraud prevention and transaction risk management tools.
• Operational monitoring, reporting, and regulatory compliance support.
• Scalable APIs for integration with existing issuer systems.

Furthermore, CBiLink is engaging with the next phase of payment evolution: agentic commerce. The company has submitted formal comments to EMVCo regarding the draft "EMV Agentic Payments – Framework for Specifications." This contribution focuses on refining how cardholders are authenticated when an AI agent, rather than a human, initiates a purchase. By proposing refinements to this framework, the company is positioning its authentication expertise at the center of the industry's transition toward automated, machine-led transactions.

"CBiLink confirmed that its EMV® 3-D Secure (3DS) solution has officially received EMV® 3-D Secure Approval from EMVCo, and that the company is now applying that same authentication expertise to the question the industry is confronting next: how a cardholder is authenticated when an AI agent makes the purchase."

A statement from CBiLink.

The companies involved

CBiLink is a financial technology company that specializes in enterprise AI, digital banking, and cloud infrastructure. The firm provides high-performance, compliant AI applications tailored for the global financial sector, covering areas such as risk control, credit analysis, data governance, and workflow automation. Its focus is on modernizing financial infrastructure while meeting the stringent regulatory requirements of global institutions. To date, CBiLink has not been the subject of prior reporting by FF News, marking this approval as its first major appearance in our coverage of the authentication market.

EMVCo is the global technical body that facilitates the worldwide interoperability and acceptance of secure payment transactions. It is responsible for managing and evolving the EMV Specifications, including the 3-D Secure protocol. EMVCo is a prominent fixture in the fintech landscape, with FF News having reported on their activities 16 times previously. The organization plays a pivotal role in setting the standards that issuers, acquirers, and merchants must follow to ensure secure digital and physical card payments.

What FF News has reported before

FF News has closely followed EMVCo’s efforts to modernize payment standards for the digital age. In September 2026, we reported that EMVCo Releases Draft Framework to Standardize Card-Based Agentic Payments, which opened the door for industry feedback on how AI agents should be handled within the payment ecosystem. This followed our June 2026 coverage when EMVCo Unveils Draft Framework for Verifiable Digital Credentials in Card Payments, highlighting the organization's move toward secure, decentralized identity solutions. These developments underscore a broader industry shift toward more sophisticated, automated authentication methods that move beyond traditional human-interfaced e-commerce.

What this means

The approval of CBiLink’s ACS solution is a standard but necessary step for any fintech aiming to serve global issuers, but the real story lies in the move toward "Agentic Payments." As AI agents begin to handle autonomous purchasing, the traditional 3DS "frictionless" flow faces a paradox: how do you perform Strong Customer Authentication (SCA) when the "customer" is a piece of software? This announcement signals that the industry is moving past the era of human-centric verification. Legacy authentication providers are now under pressure to adapt their risk engines for non-human actors, or risk becoming obsolete as agentic commerce moves from a theoretical framework to a functional market reality.