Malaysia Needs Consent Rules Before AI Agents Pay for Us, Says Razorpay Curlec Chief
AI assistants in Malaysia are starting to move from suggesting what to buy to actually paying for it. In a column published in The Edge Malaysia this week, Kevin Lee, who heads payment gateway Razorpay Curlec in Malaysia, argues that the country’s payment systems need clear rules on consent, liability and user control before these “AI agents” are allowed to shop at scale.
His view: Malaysia already has much of the plumbing needed to test agent-led payments, but trust will depend on who is responsible when an AI makes a purchase the user did not expect.
Key facts
- Lee’s column ran in The Edge Malaysia Weekly issue dated 9–15 November 2026.
- In March 2026, Mastercard completed what was billed as Malaysia’s first agentic AI transaction: an AI agent booked and paid for a ride from KLIA to KL Sentral, with CIMB and RHB taking part.
- That pilot used tokenised card credentials and Mastercard Payment Passkeys, so the AI agent never saw the user’s real card number.
- The e-Conomy SEA 2025 report by Google, Temasek and Bain & Company found that 68% of Malaysian digital consumers have conversations with AI chatbots.
- PayNet, the national payments network, processed 8.44 billion transactions in 2025.
What is an “agentic” payment?
An AI agent is software that can act on your behalf, not just answer questions. In payments, that means an assistant that can compare options, pick one and complete the checkout within limits you have set, for example “book me the cheapest airport transfer under RM100”.
Instead of handing over a card number, the agent is given a token, a stand-in credential that only works for that agent and can be cancelled. The user confirms with a passkey, such as a fingerprint or face scan on their phone. This is the set-up Mastercard tested in the KLIA pilot.
Lee also describes a business case: a wholesaler in Johor could let an agent forecast demand, compare supplier prices across ASEAN, check credit and pay within preset limits. The owner sets the rules and reviews exceptions, rather than approving every single order.
The three gaps Lee wants closed
- Controlled trials with clear liability. Regulators and industry should test agents in real payment flows, with set rules on who pays when something goes wrong, how decisions are explained and how disputes are handled.
- Tamper-proof consent records. A shared standard should record exactly what the user allowed, including the agent’s scope and spending limits, so banks, merchants and consumers can refer to the same evidence in a dispute.
- Simple controls for users. People should be able to see what an agent can access, understand its limits, and pause, change or cancel its permissions easily.
What it means for Malaysians
For consumers, the promise is convenience: fewer forms, fewer app switches and automatic bookings or top-ups. The risk is losing track of what has been approved. Malaysians have already seen a wave of scams and unauthorised transactions, so clear consent records and an easy “off switch” would matter as much as speed.
For merchants and SMEs, being “agent-ready” means having product, price and stock data that machines can read, plus a payment provider with reliable APIs and fraud checks. Small sellers that rely only on social media chats and manual bank transfers may find it harder to be chosen by an AI shopper.
For banks and payment firms, the work is in tokens, authentication and dispute handling. Bank Negara Malaysia (BNM), the central bank, has not issued specific rules on AI agents making payments, so pilots like the one with CIMB and RHB, and industry columns like Lee’s, are shaping the early debate.
What to watch
- Whether BNM or PayNet sets up a sandbox or guidance for AI-initiated payments, including how liability is shared.
- More bank pilots with Mastercard, Visa or local players, especially ones that use DuitNow rather than cards.
- Whether merchants and gateways start offering “agent checkout” options for Malaysian shoppers.
Related: How Malaysia’s payment system works · Payment gateways in Malaysia
Sources: The Edge Malaysia (Nov 2026) · Fintech News Malaysia (Mar 2026) · Tech Wire Asia (Nov 2025) · The Star (Apr 2026)
