Agentic commerce Malaysia: 2026 guide for merchants

Key takeaways:

• Malaysia is one of ASEAN's two launch markets for authenticated agentic commerce: Mastercard Agent Pay went live with CIMB, Maybank, and RHB in March 2026, and Visa Agentic Ready launched with three Malaysian issuers in April 2026.

• Malaysia's wallet-heavy payment ecosystem gives merchants a structural head start, but most existing checkout flows are not navigable by AI agents without changes.

• Airwallex's multi-currency Business Accounts and programmable payment APIs provide the infrastructure that agentic commerce requires: automated, cross-border transaction flows managed across multiple currencies from a single platform.

Agentic commerce in Malaysia is no longer something to watch from the sidelines. AI agents are executing real purchases on live payment rails, and Malaysia is one of only two ASEAN markets where this is already happening.

For Malaysian merchants, the question is no longer whether AI agents will become buyers. It is whether your business is visible and ready when they arrive.

This guide covers what is already live in Malaysia, the regulatory environment merchants need to understand, and the practical steps to take now.

What is agentic commerce?

Agentic commerce is a model where AI agents act on behalf of buyers to research, compare, and complete purchases autonomously, within rules and spending limits the user sets in advance.

It is different from a shopping bot. A shopping bot helps with discovery: it surfaces options and presents them to you. An agentic commerce system goes further. It selects, authorises, and pays, without a human clicking "confirm" at the end.

The shift matters for merchants because it changes who (or what) is making the buying decision.

An AI agent choosing between two suppliers does not respond to homepage design or brand recall. It reads structured data: price, availability, delivery terms, return policy. If your product data is incomplete or your checkout requires human navigation, the agent moves on.

Agentic commerce also covers business-to-business (B2B) use cases. An agent can reorder office supplies when stock drops below a threshold, renew a SaaS subscription, or book a corporate airport transfer, all without a procurement officer logging in. The KLIA pilot is a real example of exactly this kind of workflow.

Want to make sure your business is ready to receive agent-initiated transactions? Airwallex Payments gives you the infrastructure you need, including local acquiring, 160+ payment methods, and like-for-like settlement in up to 12 currencies.

What's already live in Malaysia: the first agentic transactions

Malaysia is one of only two ASEAN markets where authenticated agentic transactions are already live. The deployments span consumer payments, issuer infrastructure, and retail commerce. Here’s a quick overview:

• In March 2026, Mastercard completed Malaysia's first authenticated agentic transaction with CIMB, Maybank, and RHB on Mastercard Agent Pay: an AI agent booking a ride from KLIA to KL Sentral via hoppa.

• In April 2026, Visa launched its Agentic Ready programme in Malaysia with Alliance Bank, CIMB, and Maybank, giving issuers a production-grade environment to test agent-initiated transactions before broader rollout.

• That same month, AEON360 announced a RM50 million¹ multi-year agentic commerce deployment in Kuala Lumpur with Google Cloud, built on the Universal Commerce Protocol (UCP): the first major Malaysian retail anchor for agent commerce infrastructure.

For a full breakdown of how each deployment works, the banks involved, and what the rollout timeline looks like, see our guide to agentic payments in Malaysia.

The rest of this guide focuses on what these deployments mean for your business: the regulatory environment, the payment infrastructure gap, and the steps to take now.

Why Malaysia is one of ASEAN's first agentic commerce markets

Malaysia and Singapore are the only two ASEAN markets where authenticated agentic transactions are live. Four structural factors put Malaysia in this position:

1. Real-time payment infrastructure managed by PayNet

Malaysia has mature real-time payment infrastructure alongside widely adopted online banking and digital wallet payment methods. Together, these form a significant part of the country's digital payments ecosystem.

DuitNow already has cross-border connectivity to Singapore's PayNow, which is the same corridor that Mastercard's ASEAN rollout runs on.

2. One of the highest e-wallet penetration rates in ASEAN

Malaysia is a wallet-heavy market. Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay are mainstream across demographics and transaction types.

Stored wallet credentials are easier to delegate to an AI agent than a card number, which lowers the barrier to agentic payment adoption compared to card-first markets.

3. A proactive digital payments roadmap

The central bank's cashless economy blueprint and e-payments roadmap have driven consistent infrastructure investment over the past decade.

The Technology Requirements for Payment Services Regulatees policy document, issued in March 2026, sets clear technology risk and cybersecurity standards for payment providers, creating a stable operating environment for agentic payment deployments.

4. The Johor Bahru–Singapore economic corridor

Cross-border commerce between Malaysia and Singapore is already high-volume and high-frequency. As agentic commerce scales, the JB–SG corridor will be one of the first places where cross-border agent transactions become routine.

The Regional Payment Connectivity (RPC) initiative (now with nine central bank signatories) gives Malaysia instant cross-border settlement links to Singapore, Thailand, Indonesia, and beyond.² This is the rail that cross-border agentic transactions will run on.

The regulatory environment for agentic commerce in Malaysia

Malaysia does not yet have a dedicated regulatory framework for AI-initiated payments. For merchants, three things are worth knowing:

1. Existing rules apply by default

AML/KYC requirements, consumer protection obligations, and e-money rules all apply to agent-initiated transactions the same way they apply to any digital payment. The agent is treated as an extension of the account holder. No separate compliance category exists yet.

2. Your records are your defence

Under the Electronic Commerce Act 2006 and the Contracts Act 1950, AI-agent purchases may be treated as legally enforceable electronic transactions, although there is no Malaysian case law yet specifically addressing agentic commerce disputes.

Until there is, mandate context, authorisation records, and agent identity captured at the point of sale are your primary protection if a transaction is disputed.

3. Islamic finance is an open question

If your business operates with Islamic banking relationships or Shariah-compliant products, autonomous AI transactions raise unresolved questions around contractual consent under the Islamic Financial Services Act 2013.

No formal guidance has been issued. Seek specialist advice before deploying agentic payment flows in this context.

How agentic payments work

The mechanics of agentic payments, including how consumer consent is captured, how payment tokens replace raw credentials, how mandates travel with a transaction, and which protocols are live in Malaysia, are covered in detail in our guide to agentic payments in Malaysia.

What matters for this guide is the layer above the payment mechanics: identity, authorisation, and what merchants are responsible for when no human is present at checkout.

The core principle is that consumer control happens before the transaction, not during it. A buyer sets a spend mandate, and the agent operates within those boundaries.

When a transaction arrives at your checkout, the consumer has already authorised it. Your job is to receive it correctly, record it accurately, and handle disputes if the mandate was exceeded.

This is where Know Your Agent (KYA) comes in. KYA is the emerging standard for verifying that a transaction originated from a legitimately authorised AI agent rather than a malicious bot.

That distinction is particularly important in Malaysia's wallet-heavy, high-frequency payments environment. Fraud controls designed for traditional card transactions may incorrectly flag legitimate wallet-based agent payments unless they are calibrated for agentic traffic.

What Malaysian merchants need to do: a readiness checklist

Operational readiness, including checkout friction, analytics tagging, protocol compatibility, is covered in our guide to agentic payments in Malaysia.

This section focuses on the strategic layer: the decisions that determine whether your business is discoverable, competitive, and protected as agentic commerce scales.

1. Make your inventory machine-readable

Agents do not browse your storefront. They query structured data feeds. If your product catalogue is not machine-readable, you are invisible before the transaction even starts.

One of the most important structured data standards for AI shopping discovery is schema.org Product markup, which helps AI systems understand product information such as price, availability, delivery conditions, and return policies.

Here are the fields that matter most to agents evaluating a purchase:

• Name, brand, GTIN or MPN: unique product identifiers for cross-platform matching

• Offer block: price in RM, availability, return policy, and delivery conditions

• AggregateRating: agents weight social proof in product evaluation

• ProductGroup with hasVariantL for catalogues with size or colour variants

Beyond schema.org, add Model Context Protocol (MCP) server endpoints so agents can query your inventory directly, and ensure your feed infrastructure can handle the higher volumes of automated requests that agentic traffic generates.

One angle specific to Malaysian merchants: Answer Engine Optimisation (AEO) is becoming relevant as B2B decision-makers shift to AI search tools like ChatGPT and Perplexity.

2. Resolve the FPX compatibility gap

FPX is Malaysia's dominant online payment method, and it has a direct compatibility problem with agentic commerce. FPX works by redirecting customers to their bank portal for manual authentication. That redirect is inherently human-navigated. An AI agent cannot complete it.

If FPX is your primary online checkout method, agent transactions will drop before completing, because the flow was never designed for a non-human buyer.

The fix is not to remove FPX. It is to ensure your checkout also supports payment methods and APIs that are compatible with automated transaction flows. For example:

• Card payments using stored credentials (Credential on File), where supported

• Digital wallets using stored credentials, where supported

• Multi-currency support for RM and cross-border transactions, allowing agents to transact in the buyer's preferred currency

For card and wallet payments using stored credentials, Airwallex supports merchant-initiated transactions (recurring or unscheduled charges processed without the shopper being present) via its Credential on File (CoF) API.

3. Build post-checkout accountability

When an agent acts outside a user's expectations, disputes follow. Under Malaysia's current framework — ECA 2006, Contracts Act 1950, no dedicated agentic case law yet — your transaction records are your primary defence.

Capture at the point of sale: mandate context, authorisation records, agent identity, and KYA credentials. The TR PD audit trail requirements that apply to payment service providers flow through to the records you as a merchant should be holding. Incomplete records make chargeback disputes significantly harder to resolve.

This is also where the absence of a formal Malaysian agentic AI governance framework has practical consequences. Singapore's IMDA framework prescribes human checkpoint requirements at high-value transaction thresholds. Malaysia has no equivalent yet.

Until it does, defining your own agent controls (spending ceilings, category restrictions, and human review triggers) and documenting them is how you demonstrate reasonable care in a dispute.

4. Establish category authority before your competitors

When an agent selects a merchant on a buyer's behalf, the decision is based on data quality, catalogue completeness, and established preference signals, not brand recall or paid search position.

AEON360's Google Cloud deployment is the local model: building a direct, data-rich relationship with AI agents at the category level via UCP before competitors are present. An API-accessible catalogue and UCP-compatible product feed established now puts you in the agent's default consideration set early, before that set hardens around incumbents.

For B2B merchants specifically: Malaysia's Government Procurement Act 2025, passed in August 2025 and coming into force in 2026, raises audit trail and transparency standards for procurement workflows.⁹

Agentic B2B tools that produce compliant, timestamped records will have a structural advantage in procurement processes that require documentation under the Act.

Get ready for agentic commerce with Airwallex

Airwallex is built around programmable, API-first payment infrastructure, which is exactly what agent-initiated transaction flows require. Here’s what you can do with Airwallex:

Reach customers worldwide

As AI shopping agents begin making purchases on behalf of buyers, they'll use the buyer's preferred payment methods and currencies where supported.

Airwallex helps you reach customers across 180+ countries with support for 160+ local payment methods, so you're ready to serve a global customer base as AI-powered commerce evolves.

Programmable APIs built for automated transaction volumes

Agentic commerce is programmatic by nature: high-frequency, automated, and running across multiple markets simultaneously.

Airwallex's payment APIs are designed to support automated, programmatic payment flows and reduce reliance on human navigation where compatible payment methods and checkout integrations are used.

Frequently asked questions (FAQs)

What is the difference between agentic commerce and agentic payments?

Agentic payments refer specifically to the payment transaction: the moment an AI agent authorises and settles a purchase. Agentic commerce is the broader shift: it covers how agents discover products, evaluate options, make decisions, and complete the full purchase lifecycle from search to checkout. Getting ready for agentic commerce means more than updating your payment stack. It means making your products findable and evaluable by machines in the first place.

Is agentic commerce already happening in Malaysia?

Yes. Mastercard Agent Pay completed Malaysia's first authenticated agentic transaction in March 2026 with CIMB, Maybank, and RHB. Visa launched its Agentic Ready programme with three Malaysian issuers in April 2026. That same month, AEON360 announced a RM50 million multi-year agentic commerce deployment in Kuala Lumpur with Google Cloud. Malaysia is one of only two ASEAN markets where live deployments are underway.

What Malaysian law governs purchases made by an AI agent?

AI-agent purchases are legally binding in Malaysia under the Electronic Commerce Act 2006, which recognises contracts formed through electronic means. The Contracts Act 1950 governs formation and enforceability. Malaysia does not yet have dedicated legislation or case law for agentic transactions specifically — the Contract Laws Review and Reform Committee is actively working on how the law should accommodate AI agents. Until that framework matures, your mandate records and transaction audit trail are your primary protection in a dispute.

Will my products show up when an AI agent searches for them?

Only if your product data is structured and machine-readable. AI agents do not browse storefronts the way a human does — they query structured data feeds. Without schema.org Product markup covering price, availability, return policy, and product attributes, your products will not appear in agent-driven comparisons, regardless of how well your website ranks in traditional search.

Are there agentic commerce considerations specific to Islamic finance in Malaysia?

Yes, and this is currently unaddressed by any formal Malaysian authority. Autonomous AI transactions raise open questions around contractual consent and agency under Islamic law, particularly for businesses operating under the Islamic Financial Services Act 2013 or with Shariah-compliant banking relationships. No formal guidance has been issued. Merchants in this position should seek specialist advice before deploying agentic payment flows.

Does Airwallex hold a licence to operate in Malaysia?

Yes. Airwallex is licensed as a Major Payment Institution and registered as a merchant acquirer under the Financial Services Act 2013, regulated by Malaysia's central bank. Our platform supports MYR collections, local payment methods including FPX and DuitNow, and cross-border settlement across 130+ currencies.

Sources:

1. marketech-apac.com/aeon360-google-cloud-partner-on-ai-driven-commerce-ecosystem-in-southeast-asia/

2. theedgemalaysia.com/node/805870

3. flagright.com/post/bnms-e-money-exposure-draft-aml-cft-implications-for-fintechs-and-wallet-providers

4. fintechnews.my/57254/payments-remittance-malaysia/bnm-technology-requirements-payment-providers-regulatees-malaysia/

5. allenandgledhill.com/publication/articles/15066/my_restriction-of-movement-control-order-signing-contracts-electronically-during-trying-times

6. iclg.com/practice-areas/digital-business-laws-and-regulations/malaysia/

7. theedgemalaysia.com/node/752195

8. globallegalinsights.com/practice-areas/banking-and-finance-laws-and-regulations/malaysia/

9. zycus.com/blog/procurement-technology/malaysia-government-procurement-act