Agentic payments explained: What Malaysia merchants need to know (2026 guide)

Key takeaways:

• When an AI agent makes a purchase, the consumer has already authorised the spend. The agent operates within pre-set limits and never handles raw card or wallet credentials.

• Agentic payments are already live in Malaysia: Mastercard Agent Pay completed its first authenticated local transaction in March 2026 with CIMB and RHB, and Visa Agentic Ready launched with Alliance Bank, CIMB, and Maybank in April 2026.

• Airwallex's payment infrastructure gives you local acquiring in Malaysia, MYR settlement, and a multi-currency checkout supporting 160+ payment methods. It handles both domestic and cross-border agent-initiated transactions without requiring infrastructure changes.

Agentic payments are transactions completed by an AI agent on behalf of a consumer. There is no human at the checkout, no finger on the "pay now" button. The agent browses, selects, and pays. Your payment infrastructure receives the transaction.

This is already happening in Malaysia. In March 2026, Mastercard completed its first authenticated agentic payment in the country: an AI agent booked a ride from Kuala Lumpur International Airport (KLIA) to KL Sentral through mobility provider hoppa, processed via CIMB and RHB on Mastercard Agent Pay.

Weeks later, AEON360 announced a multi-year agentic commerce deployment in Kuala Lumpur, powered by Google Cloud and the Universal Commerce Protocol (UCP).

For most merchants, the immediate question is an operational one. How does an agent-initiated transaction actually arrive? Who authorised it? And does your current setup handle it? That is what this article covers.

How agentic payments work

Agentic payments follow a different path from anything your checkout was originally designed for. The mechanics are straightforward once you understand the three steps involved:

The consumer authorises it before the agent acts

Before the agent reaches your checkout, the consumer has already set a spend mandate inside their agent environment. That could be an AI assistant, a shopping agent built into a browser, or a super-app.

The mandate defines exactly what the agent can do: which merchants it can buy from, in which currency, up to what amount, and for how long.

The consumer is in control. They exercised that control earlier in the process, not at the moment of purchase. For Malaysian consumers familiar with setting spending limits on their Touch 'n Go eWallet or GrabPay, the mental model is similar: define the boundaries, then let the system operate within them.

Your checkout receives a token, not account credentials

When the agent checks out on your site, it does not present raw card details or wallet credentials. It presents a scoped payment token, configured with restrictions tied to the original mandate: merchant, currency, spend limit, and expiry window.

Your system receiving a token rather than a card number is already standard practice. It is the same principle behind a contactless card tap or a GrabPay stored credential. The consumer's actual payment details never leave the issuing environment.

Your existing infrastructure processes it

The token arrives at your payment service provider as a card-not-present (CNP) transaction. Fraud screening, acquiring, and settlement follow existing CNP processes.

For domestic MYR transactions, card-based agentic payments settle through existing card acquiring infrastructure. Your existing FPX flows are not directly affected, as these are human-initiated by design.

For merchants who want a single infrastructure layer across all of this, Airwallex processes payments locally in Malaysia, supporting MYR collections, local card acquiring, and cross-border settlement, so domestic and agent-initiated cross-border transactions run through the same platform without forced currency conversions.

What's already live in Malaysia

Agentic payments are not a future scenario for Malaysia. Two of the world's largest card networks have active deployments here, and a major Malaysian retailer is already building agent commerce infrastructure in Kuala Lumpur.

Mastercard Agent Pay: KLIA to KL Sentral

In March 2026, Mastercard completed its first authenticated agentic transaction in Malaysia.¹ An AI agent, facilitated by CardInfoLink, booked a ride from KLIA to KL Sentral through mobility provider hoppa. The transaction ran on Mastercard Agent Pay with CIMB and RHB as the issuing partners.

Each transaction on the network uses a Mastercard Agentic Token issued uniquely per agent. Consumer consent is captured explicitly, and purchase confirmation is secured via Mastercard Payment Passkeys.

Commercial rollout is planned in phases, with issuing banks leading consumer education ahead of broader deployment.¹

Visa Agentic Ready: Alliance Bank, CIMB, and Maybank

In April 2026, Visa launched its Agentic Ready programme in Malaysia with three local issuers: Alliance Bank, CIMB, and Maybank.² The programme gives issuers a structured way to test, validate, and understand agent-initiated transactions in a production-grade environment before they scale.

Agentic Ready sits within Visa Intelligent Commerce, Visa's broader portfolio of AI-driven commerce initiatives. It is the clearest signal yet that agentic payments are moving from controlled pilots toward mainstream issuer infrastructure in Malaysia.²

AEON360 and UCP: agentic commerce in Kuala Lumpur

In April 2026, AEON360 announced a multi-year agentic commerce deployment in Kuala Lumpur, powered by Google Cloud and built on the Universal Commerce Protocol (UCP).³

The system processes voice, text, and image inputs to build shopping carts and complete authorised purchases. It is the first major Malaysian retail anchor for agent commerce infrastructure and a concrete signal that the shift has moved beyond financial services.

Malaysia was selected as one of only two ASEAN-first markets for Mastercard Agent Pay. Its mature digital payments ecosystem and mobile-first consumer base were cited as reasons for the early regional rollout.

Who authorised it? Liability and consent explained

When no human pressed "buy", the natural question is: who is responsible if something goes wrong? The answer depends on how the transaction was authorised and how that authorisation is recorded.

How consent is captured

In agent-driven commerce, the consumer delegates spending authority before any transaction takes place. That delegation is recorded in the wallet or agent environment as a spend mandate, creating an auditable trail of what the consumer permitted, when, and under what conditions.

Two industry frameworks exist to make these records verifiable across the payment ecosystem:

• Mastercard Verifiable Intent, co-developed with Google: creates a tamper-resistant authorisation record for every agent-initiated transaction, accessible to consumers, merchants, and issuers alike

• Visa Agentic Ready: validates that agent-initiated transactions carry verified consumer consent before they reach a merchant

How liability works in Malaysia

Today's card-based agentic transactions are generally processed as card-not-present (CNP) transactions. Existing CNP chargeback and dispute frameworks apply. The spend mandate record serves as evidence of consent if a transaction is later disputed.

There is no separate regulatory category for AI-initiated payments in Malaysia at this stage.

Existing consumer protection obligations, anti-money laundering and counter-financing of terrorism (AML/CFT) requirements, and e-money rules apply to agent-initiated transactions the same way they apply to any digital payment. The agent is treated as an extension of the account holder, not a separately regulated entity.

The practical question for merchants is one of detection. Knowing which transactions are agent-initiated helps you monitor fraud patterns, manage your CNP risk models, and prepare for the transaction volumes that are coming.

As support for identifying agent-initiated transactions evolves, separately tagging this traffic can help prevent it from being grouped with standard CNP transactions, improving fraud analysis, conversion reporting, and customer behaviour analytics over time.

Agentic payment protocols: what's live in Malaysia

Several protocols now govern how AI agents, wallets, and merchant checkouts communicate. Think of them as the agreed-upon languages that let an agent request a payment token, pass it to your checkout, and have it validated.

You do not need to implement all of them, but knowing which ones have Malaysian partners helps you prioritise.

The two that matter most right now for Malaysia merchants are Mastercard Agent Pay and Visa Agentic Ready: both have live deployments with local banks.

UCP is equally worth attention if your business uses Shopify or has retail exposure to Google's AI Mode shopping ecosystem: AEON360's KL deployment is the clearest local signal of where that is heading.

AMP is the protocol to watch for wallet-native agentic payments. Its launch event was held in Kuala Lumpur, and Touch 'n Go eWallet is a named partner — more on this in the next section.

Malaysia's e-wallet layer and agentic payments

Malaysia is a wallet-heavy market. Industry sources consistently contrast it with Singapore's card-heavy profile: Touch 'n Go eWallet, GrabPay, Boost, and ShopeePay are part of daily purchasing behaviour for millions of Malaysian consumers.⁴

That makes the question of wallet-based agent delegation one of the most relevant questions for Malaysian merchants right now.

Where wallets and agents currently meet

Card-based agentic payments are live today. When an agent transacts using a tokenised card credential via Mastercard Agent Pay or Visa Agentic Ready, the mechanics are the same whether that underlying credential is linked to a bank card or a card stored in a wallet app.

The next frontier is wallet-native delegation: a consumer authorising an AI agent to draw directly from their Touch 'n Go eWallet or GrabPay balance, without the transaction routing through a card credential at all.

This is not yet live at scale in Malaysia, but the infrastructure signals are clear.

AMP and Touch 'n Go eWallet

Ant International's Agentic Mobile Protocol (AMP) is an open-sourced protocol designed specifically for mobile wallet interfaces: digital wallets, banking apps, super-apps, and wearables.³

Touch 'n Go eWallet is a named Malaysian deployment partner. AMP was launched at MoMents 2026 in Kuala Lumpur: a deliberate choice that reflects Malaysia's position as a priority market for wallet-native agentic commerce.

For merchants, the practical implication is straightforward. Ask your payment provider now whether their infrastructure is prepared to handle agent-initiated wallet transactions, not just card tokens.

The answer will shape how much you need to do when wallet-native agentic payments go mainstream.

Before agents can pay, they need to find you

Agentic payments get most of the attention. But there is a step that happens before any payment: the agent has to find your product, evaluate it against the consumer's criteria, and select it. If your product data is not machine-readable, you are invisible to the agent before the payment question even arises.

This is the part of agentic commerce that Malaysian merchants are least prepared for, and the part competitors are already acting on, as AEON360's UCP deployment in Kuala Lumpur demonstrates.

How AI agents discover products

AI agents do not browse your storefront the way a human does. They query structured data feeds, product APIs, and protocol-indexed catalogues.

A consumer asking their AI assistant to find running shoes under RM300 that match a previous purchase will get results from merchants whose product data is structured and accessible, not from merchants with well-written product descriptions alone.

One of the most important structured data standards for AI shopping discovery is schema.org Product markup, which helps AI systems understand information such as price, availability, delivery conditions, return policies, and product attributes.

What to check now

Run through these four points with your commerce or engineering team:

• Schema.org Product markup: confirm price, availability, GTIN, delivery conditions, and return terms are present and machine-readable across your product catalogue

• Commerce platform compatibility: if you use Shopify, much of the groundwork for UCP is handled at the platform level. Merchants on other platforms should confirm UCP or ACP compatibility with their provider.

• Checkout protocol support: ask your payment provider whether your checkout can accept delegated payment tokens from Mastercard Agent Pay, Visa Agentic Ready, and AMP

• Agent-card.json capability file: some emerging frameworks propose publishing a /.well-known/agent-card.json file so compatible agents can discover your checkout capabilities directly

None of these require a full re-platforming. For most merchants on modern commerce platforms, they are configuration and verification questions — but they need to be answered before agent traffic arrives, not after.

The JB–Singapore corridor

For merchants operating on both sides of the Johor Bahru–Singapore corridor, discoverability is already a cross-border commercial question. Agents transacting on behalf of buyers in either market will query both Malaysian and Singaporean merchants.

Being discoverable in both ecosystems is a meaningful edge as agentic commerce scales across the corridor.

Does your current payment setup need to change?

For most Malaysian merchants, the honest answer is: not much, and not immediately. But there are a few things worth reviewing now rather than after agent traffic starts arriving.

Agent-initiated transactions arrive as card-not-present. If your checkout already handles online card payments and digital wallets, your acquiring infrastructure will process agent transactions without modification.

Settlement works much the same way: MYR card transactions settle through existing card acquiring rails, while domestic account-to-account payment methods continue to follow their existing payment flows.

That said, there are three areas worth a conversation with your payment provider:

1. Checkout friction built for humans

Many checkout flows are built around human behaviour: session timeouts, CAPTCHA, and SMS one-time password (OTP) prompts that expect a person to respond. Agents cannot complete these steps.

If your checkout relies heavily on them, agent transactions will drop off before completing: not because of a payment failure, but because the flow was never designed for a non-human buyer.

The fix is not to remove these checks entirely. It is to make them conditional: triggered for human sessions, bypassed or handled differently for agent sessions carrying verified credentials.

Your payment or engineering team should be able to assess this without a full re-platforming.

2. Analytics and tagging

Agent-initiated traffic looks different in your data. Without separate tagging, it blends into your CNP volume and distorts your fraud models, conversion metrics, and customer behaviour analytics over time. Setting up agent-traffic tagging before volume arrives is far easier than retrofitting it afterward.

3. Protocol compatibility

If you want your products reachable via specific agent ecosystems (such as Google's AI Mode shopping via UCP, or ChatGPT via ACP), confirm with your payment provider that your checkout supports the relevant protocol.

If you use Shopify, much of the groundwork for UCP is handled at the platform level. Merchants on other platforms should verify directly.

For smaller businesses on hosted platforms, many of these questions are handled at the platform level. Check with your platform provider before assuming manual implementation is needed.

Get ready for agentic payments with Airwallex

Agentic commerce will generate multi-currency, cross-border transaction volumes at a scale and speed that most payment infrastructure was not originally designed to handle. Airwallex was built for exactly this kind of complexity. Here’s what you get with Airwallex:

Local acquiring in Malaysia

Airwallex processes payments locally in Malaysia, supporting MYR collections and local acquiring. That translates into faster settlement, and helps reduce avoidable FX conversion costs.

Whether a purchase is made by a human or an AI agent, domestic payments are processed through the same local infrastructure, giving merchants a consistent checkout experience.

Built for cross-border agentic commerce

Agentic commerce won't stay domestic. As AI shopping agents expand their reach, Malaysian merchants will increasingly receive purchases from buyers across ASEAN and beyond.

Airwallex helps you accept those payments without adding unnecessary FX complexity. Our payment gateway supports 130+ currencies, 160+ local payment methods, and enables merchants to collect payments from customers in 180+ countries and regions.

Payment infrastructure built for programmatic transaction volumes

Agentic commerce is programmatic by nature: high-frequency, automated, and running across multiple markets simultaneously.

Airwallex's Payments API gives merchants and developers the infrastructure to build fully programmatic payment flows and manage multi-currency settlement within a single platform, which is the foundation businesses need as agentic commerce scales.

Optimize 360, Airwallex's AI-powered payment optimisation engine, uses machine learning to flag suspicious patterns in real time, including the kind of anomalous CNP behaviour that high-frequency, automated transactions can trigger in standard fraud models.

Frequently asked questions (FAQs)

What are agentic payments?

Agentic payments are transactions completed by an AI agent on behalf of a consumer, without the consumer manually approving each purchase. The consumer sets a spend mandate upfront (detailing which merchants the agent can buy from, how much it can spend, and in which currency) and the agent operates within those boundaries. The payment itself processes through standard card infrastructure, the same way any online transaction does.

Are agentic payments already happening in Malaysia?

Yes. Mastercard completed its first authenticated agentic transaction in Malaysia in March 2026 with CIMB and RHB, involving an AI agent booking a ride from KLIA to KL Sentral via hoppa.¹ Visa launched its Agentic Ready programme in Malaysia in April 2026 with Alliance Bank, CIMB, and Maybank.² AEON360 is also deploying agentic commerce infrastructure in Kuala Lumpur through a multi-year partnership with Google Cloud.³

Do I need to change my payment setup to accept agentic payments?

For most merchants, not immediately. Agent-initiated transactions arrive as card-not-present and process through your existing acquiring infrastructure. The areas worth reviewing are checkout flows that rely on human interaction to complete (session timeouts, CAPTCHA, and SMS OTP prompts) and analytics tagging, so you can identify agent-initiated traffic separately in your data. Airwallex Payments gives you the infrastructure to handle both domestic MYR and cross-border agent transactions from a single platform.

Can my customers use their Touch 'n Go eWallet or GrabPay with an AI agent?

Not yet at a mainstream level, but it is coming. Card-based agentic payments are live in Malaysia today via Mastercard Agent Pay and Visa Agentic Ready. Wallet-native agent delegation — where an AI agent draws directly from a Touch 'n Go or GrabPay balance — is the next frontier. TNG eWallet's CEO has publicly confirmed the company is actively exploring agentic payments, and Ant International's Agentic Mobile Protocol (AMP) already names Touch 'n Go eWallet as a partner.⁵

Who is liable if an AI agent makes an incorrect or unauthorised purchase?

Agent-initiated transactions are treated as card-not-present, so existing chargeback and dispute rules apply. The spend mandate, created when the consumer set their authorisation, serves as evidence of consent. Mastercard's Verifiable Intent framework and Visa's Agentic Ready programme both create verifiable records of what the consumer authorised, which merchants and issuers can rely on in a dispute.

What is the difference between agentic payments and regular automated payments?

Regular automated payments follow fixed rules: pay this vendor this amount on this date. Agentic payments involve an AI agent making contextual decisions: evaluating options, choosing a merchant, and completing a transaction based on a consumer's preferences and constraints. The agent exercises judgment. Traditional automation does not.

What protocols do Malaysian merchants need to support?

The two most immediately relevant are Mastercard Agent Pay, live with CIMB and RHB, and Visa Agentic Ready, live with Alliance Bank, CIMB, and Maybank. UCP is worth attention if your business runs on Shopify or has retail exposure to Google's AI Mode ecosystem — AEON360's KL deployment runs on UCP. You do not need to implement all protocols yourself; your payment provider should handle compatibility on your behalf.

Sources

1. fintechnews.my/57123/ai/mastercard-agentic-payments-malaysia/

2. fintechnews.my/58246/payments-remittance-malaysia/visa-agentic-ready-malaysia/

3. businesswire.com/news/home/20260428720823/en/Expanding-Infrastructure-for-the-Age-of-AI-Commerce-Ant-International-Connects-Over-150-Million-Merchants-With-More-Than-2-Billion-Consumers

4. theedgemalaysia.com/node/805870

5. techwireasia.com/2026/06/tng-ewallet-agentic-payments-alan-ni-malaysia/