Visa

1. The same pattern, in finance

This is the same pattern as Walmart Connect and Tesco Clubcard / dunnhumby — operational data productized as external revenue. The shape is invariant. What varies is the substrate (transaction flow vs. shopper basket), the AI capability that scores it (fraud models vs. propensity models), and the buyer (issuers and AI platforms vs. CPG brands).

The retail variant sells who shopped what, where, with whom. The finance variant sells whether this transaction is real, whether this counterparty is legitimate, and increasingly — whether this AI agent is trustworthy enough to be allowed to spend money on someone's behalf. Different output; identical architecture. The data was always there. The AI capability is what lets Visa price it as a product line rather than as a free goodie bundled with interchange.

It is worth saying explicitly that Visa borrows the vocabulary of cloud computing — Ryan McInerney has used the word "hyperscaler" on three consecutive earnings calls — and the vocabulary is doing rhetorical work that should not be confused with technical truth. Visa does not run a hyperscaler. AWS runs a hyperscaler. Schwarz Gruppe is trying to run one — that's a separate case. What Visa runs is a network whose moat is the same thing that makes the AI products sellable: a trust franchise no other player can replicate at this scale. The hyperscaler analogy gets at the point that intelligence is becoming a separate product line; it does not get at why Visa specifically can charge for it. The "why" is the franchise, not the compute.

The retail and finance variants diverge most sharply on substrate origin. Walmart's data set is everything Walmart shoppers do in Walmart stores. Tesco's data set is everything Clubcard members do at Tesco. The substrate is the company's own commerce. Visa's substrate is everyone else's commerce — every issuer's cardholders, every merchant's transactions, every cross-border flow that touches a Visa rail. That breadth is what makes the product saleable to issuers, because no individual issuer sees the full picture. It is also what creates the regulatory exposure that retailers don't have: Visa is selling intelligence about transactions Visa did not originate, on a network whose pricing power is itself the subject of an active DOJ monopolization suit. The retail variant has supplier pushback as its main commercial risk; the finance variant has antitrust. Same pattern; different load-bearing failure mode.

2. The strategy in one picture

What the picture shows is that Visa now sells at three different layers. Card interchange — the historical product — is the bottom. Substrate-extension products like tokenization, Pismo, and Visa Direct are the middle. The intelligence layer on top is the new revenue line. Each layer is monetized separately, and each layer is increasingly sold to buyers who never used the lower layers — the fintech using Pismo without issuing a Visa card, the AI platform using Trusted Agent Protocol without ever touching the card rails directly.

3. How it actually works — three closed loops

Loop 1 — The substrate loop.

More processed transactions feed more labeled fraud outcomes. More labeled outcomes train better AI models. Better AI models produce higher authorization rates and lower fraud, which causes issuers and merchants to route more volume through Visa, which generates more processed transactions. The visible output is the headline number Visa repeats every March: roughly $40 billion in attempted fraud blocked per year, 80 million fraudulent transactions stopped. Tokenization accelerates the loop because tokens carry richer signals than card numbers — Visa Token Service has gone from 1 billion tokens in 2020 to 17.5 billion by Q1 FY2026, growing 44% year-over-year, and the tokens now cover more than half of global e-commerce volume.

Loop 2 — The intelligence loop.

Visa builds an AI product. Visa sells it to issuers as a Value-Added Services line item. Adoption generates use data; the model improves; the improved model gets sold to the next tier of clients. On the Q4 FY2025 call, Visa reported its largest 265 clients now use an average of 22 VAS products each, up sharply over three years. The Featurespace acquisition is the clearest recent signal here — Visa announced ~$935M for it in September 2024, closed by year-end, and within 90 days had folded the ARIC Risk Hub into a relaunched Visa A2A Protect. By Q4 FY2025 Visa had closed more than 100 deals on Featurespace-powered products since January 2025 alone. The pivotal architectural choice was making the scoring network-agnostic: Visa Advanced Authorization and Visa Risk Manager now score non-Visa transactions, which means the intelligence loop extends off Visa's own rails. Pix in Brazil — which by every disintermediation thesis was supposed to displace cards — has become a distribution channel for Visa fraud-as-a-service, scoring nearly $500B in partner-bank Pix volume and detecting $90M+ in fraud at 80%+ accuracy in 2025.

Loop 3 — The distribution loop.

This is the new one, the one that did not exist 18 months ago. Visa Intelligent Commerce, launched April 30, 2025, gives AI agents tokenized "AI-Ready Cards," cryptographic identity, and consumer-set spend controls. The launch partners read like a who's-who of the model layer — Anthropic, IBM, Microsoft, Mistral, OpenAI, Perplexity, Samsung, Stripe. Trusted Agent Protocol, launched October 2025 with Cloudflare, addresses an industry data point that explains why this matters: AI traffic to U.S. retail sites grew 4,700% year-over-year in 2025. Most merchant fraud systems treat that traffic as bot traffic; Trusted Agent Protocol gives legitimate agents a cryptographic signature so merchants can distinguish them. Akamai joined in December. AWS integration via Bedrock AgentCore came at the same time. By December 2025, Visa Intelligent Commerce had 100+ named partners and 20+ AI agents wired in directly. Each agent transaction generates new training data on a fraud category that did not exist in 2023, which feeds the intelligence loop, which feeds the substrate loop. Three loops, all closed.

4. The numbers

Visa reported FY2025 net revenue of $40.0 billion, up 11% (12% constant-currency), with non-GAAP net income of $22.5 billion, up 11%. Q1 FY2026 (the quarter ending December 31, 2025) came in at $10.9 billion, up 15%.

Inside that headline, the relevant line is Value-Added Services. VAS revenue grew from $7.2B (FY2023) to $8.8B (FY2024) to $10.9B in FY2025 — a 51% two-year ramp, with FY2025 growth of 24% year-over-year accelerating to 28% constant-currency in fiscal Q1 2026. VAS is now approximately 27% of total net revenue. CFO Chris Suh told the Q1 FY2026 call that VAS was responsible for roughly half of incremental revenue growth in the quarter. Visa breaks VAS into four sub-categories — Issuing Solutions, Acceptance Solutions, Risk and Identity Solutions (Visa Protect), and Advisory & Other Services — but does not publish dollar figures by sub-line.

The 27% headline deserves a caveat. The figure is flattering precisely because VAS includes high-margin but mostly-incumbent services like co-brand marketing, brand licensing, and Issuing Solutions tied to existing card volume. The number worth tracking is the Risk and Identity Solutions sub-line — Visa Protect, VAAI Score, Visa Deep Authorization, A2A Protect, the Featurespace/ARIC products. That sub-line is where the genuinely AI-driven, network-effect-compounding product lives. Visa does not break it out in its 10-K, and the cleanest proxy is the unit-level evidence: Visa A2A Protect scoring $500B+ in partner-bank Pix transactions and detecting $90M+ in fraud at 80%+ accuracy with one Brazilian bank network alone in 2025; Visa Account Attack Intelligence Score evaluating up to 182 risk attributes per millisecond on a model trained on 15B+ VisaNet transactions, with 85% reduction in false positives versus its predecessor. Until Visa breaks the sub-line out — which the antitrust environment makes unlikely — the headline 27% is a directional indicator, not a clean read.

Substrate metrics tell the same story. Network tokens crossed 17.5 billion in Q1 FY2026, up 44% year-over-year, covering more than 50% of global e-commerce. Visa Direct hit 12.6 billion transactions in FY2025 (+27%), with 3.7 billion in Q1 FY2026 alone (+23%) and new corridor partnerships including KCB (East Africa), Touch 'n Go (Malaysia), and Al Rajhi (Saudi Arabia). Cross-border volume excluding Europe grew 13%.

The acquisition spend tells its own story. Featurespace — announced September 2024, closed late 2024 — was reported by Sky News at approximately $935M; Visa never publicly disclosed the figure, and the FY2025 10-K's "Acquisitions, net of cash and restricted cash acquired" line shows $887M, which is consistent but not identical. Pismo closed in January 2024 at $1B in cash, bringing cloud-native issuer processing into the substrate layer. The two acquisitions back-to-back are the clearest signal that this is institutional doctrine, not a quarter's marketing campaign.

Internal AI investment numbers are reported in ranges rather than line items. Visa cites $3B+ in cumulative AI and data-infrastructure spend over ten years, $10–13B in total tech investment over five, and a $100M GenAI Ventures fund (launched October 2023). Most striking, from the Q4 FY2025 call: over half of the next-generation VisaNet codebase was written with the assistance of generative AI.

The named program owners. Ryan McInerney, CEO since February 2023, is the framer-in-chief and the source of the "hyperscaler" framing. Andrew Torre took over as President of Value-Added Services in June 2025, running the $10.9B P&L; he replaced Antony Cahill, who moved to Regional President & CEO of Visa Europe in May 2025 after scaling VAS to its current size. Jack Forestell, Chief Product and Strategy Officer, is the architect of Visa Intelligent Commerce and Trusted Agent Protocol. James Mirfin runs Risk and Identity Solutions globally. Jason Blackhurst runs Featurespace and Acceptance Risk Solutions from Cambridge after Featurespace founder-CEO Martina King retired post-close. Paul Fabara is Chief Risk and Client Services Officer; Michael Jabbara runs Visa Scam Disruption (which uncovered $1B+ in scams since its 2024 launch). Chris Suh has been CFO since 2023.

5. Is this an organizational norm?

The succession test for any AI strategy is whether it survives the executive who launched it. Visa is a different test case from prior pieces in this series: it is not a founder-led company. Dee Hock left in 1984; CEOs have rotated on five-to-seven year arcs ever since, governed by a board accountable to public shareholders. The question is not whether the strategy survives Dieter-Schwarz-style stewardship. It is whether the organizational structure under McInerney has been built to outlast McInerney himself.

The early evidence is yes. McInerney inherited the CEO role from Al Kelly and within 18 months had reorganized the segment story into Consumer Payments, Commercial & Money Movement Solutions, and Value-Added Services — three pillars rather than one. He elevated Antony Cahill to run VAS in 2023 and gave him a meaningful P&L. Pismo closed January 2024 ($1B); Featurespace closed December 2024 ($935M); the acquisitions look incoherent unless read as substrate-deepening, in which case they are obvious. Visa Scam Disruption was institutionalized as a named practice in March 2025; the Cybersecurity Advisory Practice was formalized under Carl Rutstein and Jeremiah Dewey.

The cleanest succession signal came in May/June 2025, when Cahill moved to Visa Europe and Visa promoted internally — Andrew Torre, a 24-year company veteran from CEMEA — rather than recruiting a glamorous outsider. The same pattern played out at Featurespace: post-close, founder-CEO Martina King retired, and Visa parachuted in Jason Blackhurst, a 30-year payments veteran, rather than running an external search. Internal promotability of P&L owners is the structural marker that this is now organizational doctrine rather than a single executive's pet thesis.

The AI norm itself is broader than any single product. Over half of new VisaNet code is being written with generative AI assistance. The $100M GenAI Ventures fund predates McInerney's restructuring; the Visa AI Advisory Council assembled outside experts; more than 100 AI-driven products are in production today. Visa's first AI patent dates to 1993. None of this is a 2024 marketing exercise; it is a 30-year technical commitment now being merchandised as a product line.

Succession in a board-governed company looks different from succession in a founder-led one. The pattern Schwarz Gruppe relies on — a foundation owner that removes quarterly P&L pressure entirely — is not available to Visa. What Visa relies on instead is the structural commitment of having put named executives against the new lines, given them P&L, and replaced them internally when they moved. The board cannot guarantee a 30-year horizon the way a foundation can. What it can do is make the AI strategy expensive to reverse: $1B for Pismo, ~$935M for Featurespace, hundreds of millions in standing organizational investment, partnerships with eight of the largest AI platforms in the world. The next CEO, whenever McInerney leaves, will inherit it as a fact rather than a choice.

6. Why this answer fits Visa specifically

Visa has three preconditions almost no other player has, and they compound.

The first is substrate breadth. 4.9 billion credentials. 150 million-plus merchant locations. 257.5 billion processed transactions in FY2025. Thirty-plus years of labeled fraud outcomes. No single issuer sees this; no single merchant sees this; even a competitor like Mastercard, running the same playbook, sees roughly half of it. The substrate is what makes the AI products valuable to buyers — an issuer pays for Visa Protect not because the underlying ML is more sophisticated than what JPMorgan could build internally (it isn't, particularly) but because Visa sees JPMorgan's cardholders everywhere JPMorgan can't.

The second is regulatory standing as a payment system. Visa sits on EMVCo, FIDO, NIST post-quantum working groups, central-bank consultations, and EU/UK regulatory tables that AI platforms simply cannot get to. The standing is decades-old, predates the AI strategy, and is the thing that makes Trusted Agent Protocol credible to issuers and merchants. When Cloudflare and Visa co-author a protocol for AI-agent commerce, the standards body that adopts it does so because Visa is at the table. When OpenAI proposes its own protocol, the same body asks it to come back through a payment system. This is not a meritocratic statement; it is a structural one.

The third — and this is the one that really matters — is the trust franchise. Visa's brand on a transaction means a merchant accepts the transaction without manual review. The brand has been built over 60 years against a payment-card category that punishes any single fraud incident. The brand is itself the product Visa is selling in the agentic-commerce loop: when an OpenAI agent makes a purchase and the payload carries a Trusted Agent signature, the merchant accepts because Visa is asserting trust. Without Visa's name on it, the same agent's transaction is a chargeback risk. That is the bet, anyway. Whether merchants will actually treat a Trusted Agent signature as accept-without-review at scale is a 2026 question; today the volume is still in the hundreds-of-transactions range. Activation energy for trust runs in years, not quarters; Visa has it, and the AI capability is what lets it package and sell it.

Mastercard is running the same pattern with measurable differences worth noting. On mix, Mastercard's Value-Added Services and Solutions hit roughly 40% of net revenue in 2025, with services revenue growing 23% — meaningfully ahead of Visa's 27%. Mastercard has been at this longer and is further down the curve on revenue composition. On acquisition strategy, Mastercard bought Recorded Future for $2.65B (closed Q1 2025; Recorded Future runs roughly $300–400M ARR with 1,900+ clients, including 45 governments) and built Mastercard Threat Intelligence as a stand-alone cyber business — a broader buyer set, but with shallower fusion to the network. Visa's equivalents — Featurespace, Visa Scam Disruption, the Cybersecurity Advisory Practice — are smaller individually but more deeply fused with the payment substrate. Mastercard is ahead on mix; Visa is ahead on substrate-fusion. Both will work. The race to watch through 2026 is who ships the more credible AI-agent identity layer at scale.

The inflection is regulatory and commercial at once. The October 2024 Section 1033 open-banking rule under the Biden CFPB has been challenged, stayed, and is in re-write under the Trump CFPB. Whatever the rule eventually says, the underlying directionality — that consumers can, in some form, port their account data — creates demand for an identity layer that travels with the consumer rather than with the bank. That is the layer Trusted Agent Protocol is positioning to be. Separately, the EU AI Act, in force since 2024, makes "high-risk" AI systems including financial decisioning subject to heightened compliance burdens that incumbents with audited model lineages can carry more easily than startups can. Both shifts argue for Visa rather than against it.

7. Where it goes next

Three things to watch over the next 24 months.

First, disclosure on the AI-revenue sub-line. When (or if) Visa starts breaking out Risk and Identity Solutions revenue separately from Issuing, Acceptance, and Advisory, the AI thesis becomes auditable in public filings. The reason it isn't currently disclosed is some mix of antitrust caution (do not preempt structural-remedy arguments by visibly separating the lines) and competitive opacity. Watch the FY2026 10-K segmentation when it lands in November 2026.

Second, Trusted Agent Protocol volume, as distinct from Trusted Agent Protocol partners. The partner count is impressive — 100+ named, 20+ AI agents wired in, eight of the world's largest AI platforms publicly committed. The transaction count is genuinely small: McInerney and Forestell have both told investors that hundreds of agent-initiated purchases were completed by December 2025, against a holiday-2026 ambition of "millions." The partner roster is the easy part. The volume is the part the agentic-commerce thesis is ultimately measured on. If by holiday 2026 Trusted Agent Protocol is still measured in tens of thousands of transactions rather than tens of millions, Loop 3 has stalled.

Third, the DOJ debit case. Filed September 24, 2024 in SDNY, alleging Visa handles more than 60% of US debit transactions and collects more than $7 billion annually in processing fees on debit alone. Visa's motion to dismiss was denied by Judge John Koeltl on June 23, 2025; the Trump administration's DOJ confirmed in late 2025 it is pressing the case forward; fact discovery is just opening. A consent decree or structural remedy in 2027 or 2028 is not the base case but is no longer remote. Any structural separation of the network from the services business would be the single biggest threat to the substrate that Loop 1 depends on.

The pattern only works if all three loops keep closing. Loop 1 depends on the network's growth and is the most secure. Loop 2 depends on AI products continuing to differentiate, and on Featurespace integration delivering at scale. Loop 3 depends on agentic-commerce actually materializing as a transaction category, not just a partner roster. Two of three is enough; one of three is not.

8. The four conditions this pattern requires

The pattern works only when four conditions are met. They map to the EAST diagnostic spine.

Substrate (Easy). The operating company's data must be broad enough that no single participant in the industry can replicate it. Visa's substrate is everyone else's commerce, and that breadth is what makes the AI products saleable to issuers. Most companies fail this test in five seconds — single-vertical companies (one bank, one retailer, one fintech) have only one side of the market.

Margin (Attractive). External customers must pay a premium for what the operator has already built internally to keep its own operations running. Visa's $40 billion-blocked-fraud number was an internal operating metric long before it was a marketing one. The premium exists because the buyers cannot replicate the substrate. Where buyers can replicate it, the AI capability is just a cost center.

Doctrine (Social). The organization must have institutionalized AI as a product line — named P&L, internal succession, capital deployment that survives a CEO transition — rather than treating it as a CEO pet project. The Pismo and Featurespace acquisitions, together with the Cahill-to-Torre internal succession, are the visible evidence at Visa. The pattern that fails is the one where one charismatic executive announces the strategy and leaves before it institutionalizes.

Inflection (Timely). A regulatory or technological shift must be creating a new buyer for what the substrate produces. Visa's new buyer is the AI platform, a category that did not exist in 2022. The EU AI Act, the 1033 re-write, and the agentic-commerce surge are simultaneous. Without the inflection, the data product is still saleable, but the new buyer set is missing, and the growth math gets harder.

Companies that meet all four conditions can run the pattern. Failing on Substrate makes the data product replicable — sellable but not priceable. Failing on Doctrine means the strategy dies with a CEO transition. Failing on Inflection means selling to the same buyers as before, where growth has to come from share gains rather than new categories. Most companies fail two of four. Visa, in this 18-month window, meets all four — which is why it is the case study and not the cautionary tale.