This article first appeared in Digital Edge, The Edge Malaysia Weekly on November 9, 2026 - November 15, 2026

Artificial intelligence (AI) agents are moving beyond recommending products to making purchases, requiring payment systems that can verify consent, enforce spending limits and handle disputes.

In a Kuala Lumpur pilot, an AI agent booked and paid for a ride from the Kuala Lumpur International Airport to KL Sentral using tokenised credentials and biometric passkeys to authenticate the user. The agent never accessed the user’s actual card details.

The pilot demonstrates how existing security tools can support agentic payments, in which AI finds options, selects one based on a user’s preferences and completes the transaction within agreed limits.

Malaysia already has widespread digital payment acceptance and growing familiarity with AI. According to a report by Google, Temasek and Bain & Co, 68% of Malaysians have conversations with AI agents to compare products, plan travel and troubleshoot problems, indicating the greatest appetite for AI-powered decision-making in Southeast Asia in 2025.

DuitNow QR has expanded from roughly 300,000 registered codes in 2019 to more than three million touchpoints in 2025, providing an extensive merchant acceptance network. The country’s digital economy is projected to reach up to US$70 billion in gross merchandise value by 2030, driven by e-commerce, online travel and digital financial services.

These developments provide a starting point, but enabling AI agents to initiate payments requires additional safeguards and technical capabilities.

Agentic payments allow customers to delegate three tasks — finding options that meet their requirements, selecting based on rules and preferences, and paying within defined limits.

The same approach could apply to business purchases. A wholesaler in Johor, for example, could use an AI agent to forecast demand, compare supplier prices across Asean, check credit and cash flow, and execute payments within preset thresholds. The owner could then focus on setting purchasing policies and reviewing exceptions, rather than processing each routine approval.

Merchants would also need to provide accurate, machine-readable information on products, prices and availability so agents can assess their offerings and complete purchases. Payment providers would need reliable application programming interfaces (APIs), robust risk controls and consistent transaction data.

Before these systems can operate at scale, regulators, banks, fintech companies and merchants need to address three areas.

First, controlled trials should test AI agents as participants in payment flows, with clear rules on liability, explainability, model validation and dispute handling. The ability to execute a payment does not, by itself, establish who is responsible if an agent acts incorrectly or outside its authority.

Second, participants need shared standards for recording what a user has authorised. A record protected against tampering would give consumers, banks and merchants a common reference when a transaction is disputed. That record should make clear the scope of the agent’s authority and the limits attached to it.

Third, consumers need to understand what agents can access, how spending limits work and how to pause, revoke or change permissions. These controls must be straightforward to use if customers are to retain meaningful oversight of payments made on their behalf.

Malaysia has much of the infrastructure needed to begin testing agentic payments, but broader adoption will depend on how well the industry establishes consent, accountability and consumer control.

Kevin Lee is country head and CEO of Razorpay Curlec Malaysia

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.