AI agents are already spending money on behalf of banks, businesses and consumers across Asia Pacific, and the region’s payments industry just admitted there is no shared rulebook for what happens when one of them gets it wrong.
A Working Group for a Problem That Already Exists
The Emerging Payments Association Asia (EPAA) launched its AI & Agentic Payments Working Group in Kuala Lumpur on July 20, with HSBC as founding member. The group brings together banks, payment networks, fintechs and technology platforms with a single mandate: define the standards that let autonomous agents transact safely at scale before a crisis forces the issue.
“AI agents are transacting across Asia Pacific right now, at scale, at machine speed, and without the regulatory architecture to protect businesses and consumers from real risks around liability, identity and fraud,” said Camilla Bullock, EPAA’s chief executive. The framing is deliberate: this is not a working group anticipating a future technology, it is one trying to catch up with a live one.
Why Liability, Not Adoption, Is the Real Bottleneck
The scale is already substantial. Alipay’s AI Pay exceeded 120 million autonomous transactions in a single week in February. Mastercard completed its first live consumer authenticated agentic payment in APAC in March. HSBC, together with Mastercard, piloted end to end B2B agentic commerce transactions for two Singapore based clients in May. Each of those events happened inside existing card and wallet rails, without a common regional standard for who is accountable when an agent exceeds its mandate, misreads an instruction, or is impersonated by a bad actor.
“Our ambition is to be the most trusted bank globally, and nowhere is this more true than in payments,” said Nicholas Soo, HSBC’s managing director and Asia head of payment products for global payments solutions. “The same level of customer trust must carry through to the new business models that are being developed as automation and agentic AI reshape commerce.” That statement doubles as an admission: trust infrastructure for agentic payments does not yet match the trust infrastructure banks have spent decades building for human-initiated transactions.
What the Working Group Will Actually Decide
EPAA’s mandate for the group covers five concrete outputs: common standards for agent identity, authentication and authorization; trust and liability frameworks that define responsibility when an agent’s actions exceed its mandate; business models that make agentic commerce commercially viable at scale; coordinated engagement with regulators across ASEAN and APEC; and practical toolkits member organizations can put into production rather than treat as theory.
Membership is structured in two tiers, a committee of 10 to 12 organizations setting direction and a working group of up to 30 organizations contributing to the standards themselves, with applications from EPAA members closing in November 2026. The group’s recommendations will move through an 18 month engagement process with ASEAN and APEC governments and central banks, culminating in formal policy proposals delivered at the 51st ASEAN Summit and APEC Economic Leaders’ Week in November 2027.
A Regional Race Against a Parallel Global One
The APAC effort is not happening in isolation. Card networks and infrastructure providers elsewhere have spent 2026 building their own pieces of agentic payment plumbing: 40 companies including the Linux Foundation, Coinbase, Visa and Mastercard formalized the x402 protocol as an open internet-native payment standard for AI agents, Mastercard opened a dedicated agentic commerce sandbox in the UK, and 1Password and Anthropic built a credential model that treats AI agents as untrusted by default. What distinguishes EPAA’s push is its target: not a technical protocol or a credential standard, but the liability and regulatory framework that determines who pays when those protocols fail. Asia Pacific is projected to be the fastest growing market for agentic commerce globally, expanding at a compound annual growth rate of nearly 45% through 2031, which gives the region’s regulators and banks a direct incentive to write the liability rules themselves rather than inherit them from Washington or Brussels.
The two tier membership structure is itself a signal of intent. A 10 to 12 organization committee is small enough to move fast on drafting standards, while a working group of up to 30 keeps the exercise from becoming a closed club that regulators can dismiss as one bank’s preferences dressed up as an industry position. That balance matters because the group’s credibility with ASEAN and APEC governments over an 18 month engagement depends on being able to point to broad industry buy in, not just HSBC’s name on the founding announcement.
What This Means for the Finance Leader
For banks and payment companies operating in or serving Asia Pacific, the practical signal is timing. The working group’s formal recommendations will not land until November 2027, but its positions will shape how regulators across ASEAN and APEC think about agent authentication and liability well before that date, and organizations that help write the standard get more influence over its shape than those who simply comply with it later. HSBC and Mastercard’s willingness to disclose their own pilot volumes and failure modes to a shared working group, rather than keep that data proprietary, suggests the industry has concluded that fragmented, bank by bank liability standards would slow agentic commerce more than a shared framework would.
The immediate action item is procurement, not policy. Finance leaders evaluating any vendor, wallet, or card platform that supports agentic transactions should be asking now whether that vendor can point to an identity, authentication and liability model, or whether it is waiting for a working group like EPAA’s to hand one down. The APAC application window for EPAA membership closes in November 2026, giving institutions with an APAC footprint a narrow window to help set terms that will otherwise be set for them.
