Agentic commerce means AI agents acting for consumers or businesses to find, decide and pay. Two years ago that was a concept. Today every major card network and wallet has a protocol or programme for it, and Malaysia is one of the first ASEAN markets with authenticated transactions. For payments executives, merchants and founders, the question has moved from whether this happens to who controls the rails when it does.
The global protocols
Four layers are forming, and they overlap more than they compete.
- Google's AP2. Google announced the Agent Payments Protocol (AP2) on 16 September 2025, with more than 60 launch partners including Mastercard, PayPal, Coinbase and American Express. It uses three signed "mandates" (Intent, Cart and Payment) carried as W3C Verifiable Credentials, and treats stablecoins as first-class alongside cards and bank transfers. The principle is that the user's spending authority travels with the transaction.
- OpenAI and Stripe's Agentic Commerce Protocol (ACP). This is a checkout standard, launched with ChatGPT's in-chat purchasing. It lets merchants stay the merchant of record while an agent completes the purchase.
- Visa and Mastercard. Both build on tokenisation. Mastercard Agentic Tokens embed agent identity in network-level token metadata, while Visa's Trusted Agent Protocol uses HTTP request signatures to bind agent identity to a request. Visa Intelligent Commerce and Mastercard Agent Pay are the commercial programmes on top.
- PayPal. PayPal sits inside the ecosystem as an AP2 launch partner, so wallet balances and buyer protection can be part of agent checkout.
The shared design is a scoped credential. The consumer sets boundaries on merchants, amount and duration, the agent receives a payment token rather than card details, and the processor treats the result as a standard card-not-present transaction. That helps merchants, because existing acquiring, dispute and settlement flows still apply.
Early commercial signals
Evidence on conversion is thin and mostly from the US. One industry guide reports that by March 2026 AI-sourced visits to US retail sites converted 42% better than non-AI traffic, a reversal from 38% worse a year earlier. That is a vendor-published figure and we treat it as directional. Agent-led discovery is changing traffic quality faster than it is changing checkout volume.
ASEAN: live, but at pilot scale
The region moved in the first half of 2026. On 6 April 2026 Mastercard announced authenticated agentic transactions live across multiple ASEAN markets, plus a planned AI Centre of Excellence in Singapore. Singapore and Malaysia are described as the first two ASEAN markets with live agentic payment deployments. In Singapore, Mastercard Agentic Tokens underpin the DBS and UOB deployments, and Visa's Trusted Agent Protocol was used in the DBS Visa pilot.
Real-time rails add a second path beyond cards. The same guide lists FAST/PayNow in Singapore, DuitNow in Malaysia, PromptPay in Thailand, and InstaPay and PESONet in the Philippines, along with cross-border QR links between them. Account-to-account agent payments are plausible here in a way they are not in card-dominated markets. The obstacle is that payment methods that rely on customer redirects are hard for AI-initiated checkout.
Malaysia: what has actually shipped
Two bank-backed programmes stand out:
- Mastercard pilot. Mastercard completed an AI commerce pilot with CIMB, Maybank and RHB using Agent Pay. An agent booked a ride from KLIA to KL Sentral through hoppa, using tokenised credentials authenticated with Mastercard Payment Passkeys. The pilot was designed to prove feasibility, and commercial deployment is to be phased with issuers.
- Visa Agentic Ready. Visa launched Agentic Ready in Malaysia on 6 May 2026 with Alliance Bank, CIMB, Hong Leong Bank and Maybank, following its Asia Pacific regional announcement on 30 April 2026. It is a controlled environment for issuers to test AI-initiated payments.
One local analysis dates the first authenticated agent purchases in Malaysia to March 2026. Both programmes are issuer-led and controlled. Neither is yet open consumer commerce.
Bank Negara Malaysia and the regulatory gap
We did not find a Bank Negara Malaysia (BNM) policy document written specifically for agentic payments, and we will not imply one exists. What is visible is market sentiment. TNG Digital's CEO sees Bank Negara's progressive stance as a signal that the regulatory ground is shifting in the right direction. That is one executive's reading, not a regulatory position.
In practice, existing rules will apply to agents: payment-system and e-money oversight, authentication expectations, consumer protection, and BNM's guidance on technology risk and AI use in financial services. Firms should assume regulators will ask who authorised the transaction, who is liable when an agent errs, and how the audit trail works. Agentic payments are also where Malaysia's Consumer Credit Act and any agent-initiated buy-now-pay-later flows will eventually meet. We would watch BNM and MAS publications closely.
Trust is the bottleneck
The Edge Malaysia reported in June 2026 that stakeholders see agentic commerce as the next breakthrough after QR codes, and that trust remains a significant barrier. Three trust problems need answers:
- Authority. Can the issuer prove the customer gave this agent this mandate?
- Liability. Who bears the loss on a wrong purchase: the issuer, the agent provider or the merchant?
- Fraud. Existing bot defences block exactly the traffic merchants now want to admit.
What to do now
- Merchants: keep checkout machine-readable, support a broad mix of payment methods including DuitNow and e-wallets, and review bot-blocking rules.
- Issuers and acquirers: join a network sandbox, define mandate and dispute rules, and decide which protocols to support rather than backing one.
- Founders: build for interoperability across AP2, ACP and the network tokens. The standards are still moving, and lock-in is the main risk.
- Boards: treat agent authorisation as an AI governance and risk question, with clear ownership and limits.
Agentic commerce in Malaysia is real, controlled and early. The firms that settle the authority and liability questions first will set the terms for everyone else.