EPAA and HSBC Launch APAC's First Working Group to Set Liability and Standards for Agentic AI Payments
EPAA and HSBC launched APAC's first agentic AI payments working group to define liability, identity and fraud standards. Here is what it covers and what it means for merchants.
EPAA and HSBC Launch APAC's First Working Group to Set Liability and Standards for Agentic AI Payments
Summary
Key Takeaways
- Industry body EPAA has launched APAC's first AI & Agentic Payments Working Group with HSBC as a founding member, to build standards for liability, identity and fraud in agentic payments
- AI agents are already transacting at scale, yet no agreed rule defines who is liable when an agent misfires, and this is the first industry-wide effort to close that gap
- Once the standards and liability frameworks take shape, merchants gain a basis for deciding how far to accept agent-initiated orders and where to draw the fraud line
A standards push for agentic payments begins in Asia Pacific
EPAA and HSBC have launched an APAC working group to develop standards for liability, identity and fraud in agentic payments.
fintechnews.sgOn 20 July 2026, the Emerging Payments Association Asia (EPAA), an industry body for the region's payments sector, launched an AI & Agentic Payments Working Group to set the standards for payments made by AI agents. HSBC joins as a founding member.
The group brings together banks, payment networks, fintechs and technology platforms. Its aim is to make agentic commerce, where AI agents transact on behalf of people and businesses, work safely and at scale across the region. EPAA frames this as the first industry-wide effort of its kind in Asia Pacific.
The announcement is not about a flashy new product. It is a problem statement: AI agents have started executing payments, and the industry still lacks a shared answer to the questions that raises. EPAA describes itself as a body with formal policy channels into ASEAN and APEC governments and central banks, and it intends to carry the group's output along those channels.
AI agents are already making payments
Why the urgency now? Because agentic payments have already moved past pilots and into commercial use.
EPAA cites several examples. In May 2026, HSBC worked with Mastercard to run end-to-end B2B agentic transactions for two Singapore-based clients. Ant Group's Alipay reported that its AI Pay exceeded 120 million autonomous transactions in a single week in February. Mastercard completed its first live consumer-authenticated agentic payment in Asia Pacific in March. The test scope and transaction values remain undisclosed, but the pattern is clear: several major players moved into live use around the same time.
Market growth is part of the backdrop. Asia Pacific is projected to be the world's fastest-growing market for agentic commerce, expanding at a compound annual growth rate of nearly 45% through 2031. That figure is an estimate from Mordor Intelligence rather than a settled result, and should be read with that caveat. Even so, this launch signals that the players involved are unwilling to let the rules arrive after the fact.
The unresolved question of who is liable
At the heart of the group's work is a legal gap. When an AI agent pays beyond its mandate, or a transaction goes wrong, who is liable? Across much of Asia Pacific, there is no agreed answer today.
The problem is not limited to liability. How are agents identified and authenticated across borders? How does fraud detection, built around human behaviour, tell a legitimate agent acting at machine speed from a compromised account? How are disputes resolved when software, not a person, initiated the transaction? EPAA lists all of these as open questions.
The same wall is felt internationally. The International Monetary Fund noted this year that current liability regimes assume human intent and direct causation. The moment an autonomous agent decides independently, that assumption becomes legally ambiguous. A flight booking, a B2B invoice settlement, or a subscription renewal executed by an agent are the typical cases.
Europe is further ahead. The EU is already grappling with this through PSD3, the EU AI Act, which classes certain AI financial systems as high-risk with strict accountability duties, and an emerging Know Your Agent framework for identity and transparency. The financial stakes are real. Applied to agentic AI, the UK's authorised push payment fraud reimbursement model, which splits liability 50/50 between sending and receiving providers, could leave payment service providers with exposure that legal analysis calls potentially significant, given the speed and scale at which agents approve payments. Fraud models built for humans could also flag legitimate agent patterns as suspicious, producing false positives at machine scale.
What the group will do, and on what timeline
So what does the group intend to produce? EPAA's scope is broad and falls into these pillars.
| Focus area | What it covers |
|---|---|
| Standards and infrastructure | Common specs and rails for agent identity, authentication and authorisation |
| Trust and liability frameworks | Defining responsibility when an agent exceeds its mandate or a payment fails |
| Business models | Commercial frameworks that are viable and scalable for every participant |
| Regulator engagement | Coordinated outreach to regulators across ASEAN and APEC |
| Practical toolkits | Toolkits, briefings and intelligence members can deploy into their operations |
The timeline is worth noting. The group's positions will be developed through an 18-month engagement process with ASEAN and APEC governments and central banks, with formal policy recommendations to be delivered at the 51st ASEAN Summit and APEC Economic Leaders' Week in November 2027. A real gap sits between agents transacting now and recommendations landing in late 2027. Readers should also note that the body produces policy recommendations, not binding regulation.
On structure, a committee of 10 to 12 organisations will steer the work, with a working group of up to 30 organisations. Places are open to EPAA members, and applications close in November 2026. Membership terms and fees are undisclosed.
What this means for merchants
This may read as a payments-industry story. But the substance of these standards feeds directly into a merchant's daily operations.
For anyone accepting agent-initiated orders, the first hurdle is identity and authentication. Without a shared way to tell whether the order came from a legitimate agent or a hijacked account, merchants may err on the side of caution and reject genuine transactions. EPAA's proposed standards for agent identity, authentication and authorisation are the foundation for that line. Once they exist, merchants can tune fraud controls to agent behaviour and cut the risk of losing sales to machine-speed false positives.
The liability framework matters just as much. When an agent buys the wrong item, or orders beyond its mandate, who absorbs the loss? Once the split between banks and payment providers is settled, refunds and chargebacks become more predictable, and merchants can size the risk they carry. Left unresolved while agent transactions keep rising, the burden of dispute handling could tilt toward the merchant side.
The practical move now is not to watch, but to check whether your checkout and order flows can withstand agent transactions. The standards will firm up toward 2027, but agent traffic will not wait. Even before common identity and authorisation specs arrive, cleaning up your order-path logs so agent-initiated transactions can be observed separately from human ones will make later adaptation lighter.
Conclusion
The launch of the EPAA and HSBC working group marks the point where the agentic commerce debate shifted from whether the technology works to who is liable and how trust is secured. Agents are already paying, but the law and rules behind them are not yet written.
The output will not take shape as policy recommendations until late 2027, and binding force will take longer still. Even so, EPAA's view that the organisations shaping these frameworks early will influence the next decade of rulemaking is hard to ignore, not only for the payments industry but for every merchant serving agent-driven customers. What to watch next is which payment networks and platforms join the committee, and which area the first common specifications emerge from.
