HSBC and EPAA Launch Asia’s First Rulebook for AI Agent Payments

Alipay’s AI agents completed more than 120 million autonomous payments in a single week this year, and Asia’s banks still cannot say who pays when one of those agents gets it wrong. That gap is why the Emerging Payments Association Asia (EPAA) and HSBC just launched the region’s first working group built to write common rules for AI agents that pay on people’s behalf.

Formal recommendations will not land until late 2027. The transactions are not waiting.

EPAA and HSBC Launch Asia’s First AI Payments Rulebook

The Emerging Payments Association Asia, a regional industry body for banks and payment companies, opened its AI & Agentic Payments Working Group on July 20 with HSBC as founding bank member. The group pulls in banks, payment networks, fintech firms and technology platforms to define the standards agentic commerce demands across Asia-Pacific (APAC), according to the launch announcement.

The mandate covers five specific areas:

• Agent identity – how an AI agent proves it is who it claims to be, across a merchant, a bank and a border
• Authentication and authorization – the limits on how much an agent can spend and on whose say-so
• Liability frameworks – who absorbs the loss when a transaction is disputed or an agent exceeds its authority
• Commercial models – how banks, networks and fintechs split the cost and the risk of running agentic rails
• Regulatory engagement – direct outreach to governments across the ASEAN and APEC blocs

The urgency behind that list came through in the group’s own framing of the problem.

AI agents are transacting across Asia Pacific right now, at scale, at machine speed, and without the regulatory architecture to protect businesses and consumers from real risks around liability, identity and fraud.

Camilla Bullock, Chief Executive of the Emerging Payments Association Asia, said that in the group’s launch statement. Her point is less a warning than a description of a market that has already moved.

The Numbers Behind the Rush

Every major payment brand in the region now has a live agentic milestone on the board. Alipay’s scale is the outlier, but it is not alone.

Alipay’s version runs on voice commands rather than typing. A user installs the service into an AI agent, verifies their identity once, then hands off routine purchases like subscription renewals with a single instruction, according to a Business Wire release on Alipay’s user growth. Ant Group, Alipay’s parent, says every payment still needs explicit authorization and runs through a 24-hour risk control system.

Who Pays When the Agent Gets It Wrong?

Right now, existing card network rules decide by default. Visa and Mastercard treat an agent-initiated purchase the same as an ordinary card-not-present transaction, so a cardholder who delegated authority to an agent is still on the hook if that agent overspends, under dispute frameworks written years before AI agents existed.

Visa’s answer so far is its Trusted Agent Protocol for verifying agent identity, a standard that lets a merchant tell a legitimate shopping agent apart from a malicious bot. The company also points to its existing consumer protections, telling merchants that Visa’s zero-liability guarantee already covers agent-driven purchases the same way it covers any other unauthorized charge.

Not everyone reads the fine print the same way.

Where the debate splits:

• EPAA says no common standard exists across Asia-Pacific for who is responsible when an agent exceeds its authority, and calls that a gap that needs new rules, not old ones.
• Visa argues its existing fraud systems and zero-liability guarantee already extend to agent transactions without requiring a new framework.
• Rivero, a payments industry consultancy, argues that liability is still judged by rules built for human intent, leaving genuine grey areas when an agent misfires.

All three can be true at once. That is the problem the working group exists to sort out.

Identity Verification Still Stops at the Border

An AI agent that books a hotel in Bangkok on behalf of a client in Mumbai has to prove its identity to systems in at least two jurisdictions, neither of which currently agrees on what that proof should look like. The EPAA’s mandate to engage ASEAN and APEC regulators exists precisely because no cross-border authentication standard for agents currently exists.

Indian banks are already confronting a version of this problem on their own turf, rewriting fraud and identity threat models around AI as real-time payments and machine-driven transactions multiply faster than verification systems can adapt. That kind of country-by-country patchwork is exactly what a regional standard would need to override.

Banks Are Staffing Up Before the Rules Exist

HSBC’s own pilots gave it a case study to lean on. Nicholas Soo, Managing Director and Asia Head of Payment Products at HSBC, said the bank’s recent projects showed agentic commerce could run with control, transparency, and risk management from the start. He added that industry-wide collaboration would be needed to build the trust that wider adoption requires.

That framing lines up with a broader pattern already playing out inside major banks, which have started paying seven-figure salaries for chief AI officer hires to own exactly this kind of risk before regulators force the issue. The instinct is the same in both cases: build internal guardrails now, rather than wait for an external rulebook that is still years from finished.

Adoption Is Moving Faster Than the Calendar

The scale problem is not going to slow down for the working group’s timeline. Roughly 29% of Asia-Pacific consumer businesses are using agentic AI today, and that share is projected to reach 76% within two years, according to a Deloitte report on agentic shopping in Asia-Pacific. Deloitte’s researchers found the region is set to drive around two-thirds of the world’s new retail sales over the next five years, powered by more than 4.3 billion shoppers across 18 megacities.

The EPAA’s own launch materials put the region’s agentic commerce growth at nearly 45% a year through 2031, the fastest of any market globally. That regional figure sits alongside separate global market sizing, not in conflict with it. Either way, the trajectory points the same direction: up, and fast.

Formal Rules Are Not Due Until Late 2027

The working group’s own calendar is the clearest number in the whole story. Formal recommendations on liability, identity and fraud are expected in late 2027, roughly a year and a half from now. Alipay alone will likely process billions more autonomous transactions before that document exists.

Soo’s point about trust is the connective thread. Nobody in the group disputes that agentic commerce works technically. What is missing is agreement on who answers for it when it does not.

Frequently Asked Questions

What exactly is agentic commerce, and how does an AI agent complete a payment?

Agentic commerce describes a purchase or payment that an AI agent initiates and finishes on a person’s or business’s behalf after receiving an instruction and a spending authorization. Alipay’s version, for example, works off a voice command: a user states a need, confirms the order, and authorizes payment, with the agent able to cancel or modify the order at any point before it settles.

Which AI agents can already make payments through Alipay?

Alipay’s AI Pay service is pre-installed on Alibaba Cloud’s JVS Claw and on DTClaw from Ant Group Digital Technologies, and it is also compatible with outside OpenClaw-type agents, including Claude Code and Hermes Agent. That interoperability is part of why the transaction volume climbed so quickly.

Is there a global standard for verifying AI payment agents?

Not yet, but Visa’s Trusted Agent Protocol is the furthest-along candidate. It is reportedly being built with partners including Cloudflare, Adyen, Shopify, Stripe and Microsoft, giving it reach across both the merchant and payments-infrastructure side of the market, even though no regulator has adopted it as a mandatory standard.

How big could Asia’s agentic commerce market become?

Big enough to reshape global retail. The global agentic commerce market was valued at 5.7 billion dollars in 2025 and is projected to reach 65.5 billion dollars by 2033, with Asia-Pacific identified as the fastest-growing region within that total.