Agentic commerce is no longer a pilot concept in Malaysia. Airwallex reports that Mastercard completed the country's first authenticated agentic transaction in March 2026 with CIMB and RHB, in which an AI agent booked a ride from KLIA to KL Sentral. It also reports that Visa launched its Agentic Ready programme with three Malaysian issuers in April 2026. The cryptography and APIs work. What is unsettled is who said yes, who pays when it goes wrong, and which rulebook applies. We think those questions belong on the board agenda now.
Authorisation: what did the customer actually consent to?
Card and account rules assume a person approves each payment. An agent breaks that link. The customer instructs the agent once, and the agent then acts many times, interpreting the instruction as it goes. A mandate such as "reorder my usual groceries under RM300" is easy to state. It becomes ambiguous when the agent substitutes a product, picks a different merchant or buys at a surprising price.
Worldpay makes a related point. Fraud models built to ask whether a shopper is trustworthy do not fit an agent transaction, because the question has moved to authorisation and intent. We would go further and say the mandate itself is the control. It should be explicit and bounded by amount, merchant category, time and frequency. It should also be recorded and revocable, so that it can serve as evidence later.
Liability: existing rules, unresolved edges
The three major networks have each launched agent frameworks. Worldpay lists Visa Intelligent Commerce, Mastercard Agent Pay and American Express's ACE. It adds that EMVCo has set up a task force to consider how its global specifications can support agentic payments.
Worldpay's reading of liability is that rules have not changed specifically for agents. When an agent authenticates properly and a token is issued correctly, liability generally follows existing authenticated tokenised-transaction rules. The harder cases are not straightforward fraud. They are disputes such as "my agent bought the wrong thing", "the agent exceeded my instructions" or "the agent was manipulated by a malicious page". Worldpay says liability between merchant, issuer and agent platform remains largely unresolved once a dispute moves past straightforward fraud. Until the networks publish dispute rules, contracts will decide these cases. Banks, acquirers and merchants should not assume the default allocation will favour them.
Fraud and tokenisation: from "is this a bot?" to "is this agent authorised?"
Merchants have spent years blocking bots. Now they must admit some automated traffic and reject the rest. Network agent-token frameworks help by binding a credential to a specific agent, with limits attached. That moves the control point from the device and the person to the agent's identity and its mandate.
Three risks follow from this:
- Agent impersonation. A fraudster presents as a legitimate agent.
- Mandate abuse. A genuine agent is steered to spend outside what the customer intended.
- Friendly fraud. A customer disputes a purchase their agent made, and the evidence trail is thin.
Issuers and acquirers need to decide what signals they will accept as proof of agent identity and intent. Those signals need to be logged in a form that supports chargeback representment.
Malaysia: existing rules apply, and none was written for agents
Airwallex notes that Malaysia has no dedicated framework for AI-initiated payments yet. Existing payment, consumer protection and technology risk requirements continue to apply, which means the obligations are already live.
For payment providers, Bank Negara Malaysia issued its Policy Document on Technology Requirements for Payment Services Regulatees on 12 March 2026. Law firm Skrine reports that it takes effect on 12 March 2027. It sets tiered expectations by transaction value and volume. Fintech News Malaysia reports that it requires board oversight, dedicated CISOs and full accountability for third-party vendors. Regulated institutions remain under BNM's Risk Management in Technology policy document, which took effect on 28 November 2025 and was updated on 25 September 2026. An AI agent platform that sits in a payment flow is, in practice, a third party. It should be assessed, contracted and monitored as one.
Personal data: agents run on customer information
An agent that shops needs addresses, preferences, payment credentials and purchase history. That puts it within the Personal Data Protection Act 2010, as amended in 2024. The amendments, phased in from 2025, are widely summarised as adding direct obligations for data processors, mandatory breach notification, data protection officer requirements and higher penalties. Please confirm exact commencement dates and thresholds against the Personal Data Protection Commissioner's guidance, as we did not re-verify them for this article. The practical point is that agent platforms, model providers and merchants may each be processors or controllers. Each should know which role it holds, what it logs and where the data goes.
What boards should ask
- Where in our products can an agent already initiate or influence a payment?
- How is customer mandate captured, bounded, evidenced and revoked?
- What do our contracts with agent platforms say about loss in a disputed transaction?
- Can our fraud systems tell a legitimate agent from an impersonator?
- Have we mapped agent flows against BNM's technology risk requirements and the PDPA?
- Who owns the risk, and what is our fallback if the networks' dispute rules change?
Our view
Agentic commerce will grow faster than its rules. Institutions that define consent, evidence and accountability early will carry less loss and face less regulatory surprise. We found no independent adoption or fraud forecasts from McKinsey, Gartner or the networks that we could verify for this piece. We have therefore not quoted any, and we advise treating unsourced market-size claims with caution.