Singapore’s AI payment push needs permission that travels

Original research record

We connect MAS’s latest work on AI agents in finance with the Singapore-backed effort to recognise agents across payment networks. The practical test is whether the user’s spending limits still hold when a recognised agent reaches a different service. Shared identity checks can help, but the proposed purchase must still fit the user’s permission.

What changed? In its 9 October speech, MAS says SAFR version 1.1 and an open-source reference implementation have been released. SAFR proposes checks on agent identity, authority and the user’s instructions before action, with an audit trail. These are MAS’s reported developments; we did not inspect the implementation or verify a live deployment. MAS and IMDA evidence here was read as indexed primary-source text because direct page access was incomplete. [MAS speech](https://www.mas.gov.sg/news/speeches/2026/building-trusted-foundations-for-digital-finance)

We link this to the September collaboration by Ant International, Mastercard and Visa through MAS’s BuildFin.ai platform. They aim to recognise agent trust signals across networks while keeping each network’s own verification and decision-making. That creates a specific question for Singapore payment pilots: what authority survives the hand-off? [Partner announcement](https://www.ant-intl.com/en/news/detail/?id=ant-international-mastercard-and-visa-initiate-collaboration-on-know-your-agent-interoperability-to-scale-agentic-commerce)

Behavioural fingerprint We would test a recognised agent against three deliberately changed instructions: a lower spending limit, a removed recipient and withdrawn permission before payment. Then repeat the test after the task passes to another service or agent. Record when the changed instruction was acknowledged, before the point at which payment can no longer be stopped. An earlier completed payment is not a failed withdrawal test. A successful checkout alone misses these cases. Our proposed evidence is a record showing what the user allowed, what action was attempted, which limit was checked and what happened. These are test cases, not observed failures at any named provider.

Historical comparables Our earlier OTR control work asked suppliers for version-matched proof. We extend that question to customer permission crossing payment networks. IMDA’s January framework recommends bounded agent powers, meaningful human checkpoints and lifecycle controls. Its later overview identifies a May update adding practices for multi-agent systems, third-party agents and automation bias. In September, MAS already described checks before an agent acts. The October speech adds a reported new SAFR version and implementation, but we have not established which controls changed between versions. [January framework](https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/press-releases/2026/new-model-ai-governance-framework-for-agentic-ai) [Updated overview](https://www.imda.gov.sg/About-IMDA/Emerging-Technologies-and-Research/Artificial-Intelligence) [September speech](https://www.mas.gov.sg/news/speeches/2026/building-the-financial-system-of-the-future---trusted-connected-and-resilient-by-md-for-gff-2026/)

Evidence graph The connection is concrete: the payment-network collaboration names BuildFin.ai and SAFR, while MAS describes the need to check an agent’s proposed action against the customer’s instructions. IMDA supplies the wider human-accountability layer. We see three linked jobs: identify the agent, decide whether this action is permitted, and keep evidence of the decision. Passing the first check cannot answer the other two by itself. [Singapore payment collaboration](https://www.ant-intl.com/en/news/detail/?id=ant-international-mastercard-and-visa-initiate-collaboration-on-know-your-agent-interoperability-to-scale-agentic-commerce)

MAS also warns that agents could move money faster in response to smaller benefits, affecting liquidity and collateral. Our inference is that control speed matters alongside payment speed. We have no measured flow, delay or loss data to quantify that risk. [MAS speech](https://www.mas.gov.sg/news/speeches/2026/building-trusted-foundations-for-digital-finance)

Opposing evidence The partner announcement already includes operator traceability, certification and ongoing transaction monitoring. It is therefore evidence that these risks are being addressed, not evidence that the firms ignored them. Separate network decisions may preserve useful local safeguards. Extra checks could also slow legitimate purchases or reject them by mistake. No public test sample reviewed here compares those costs with prevented errors. [Partner announcement](https://www.ant-intl.com/en/news/detail/?id=ant-international-mastercard-and-visa-initiate-collaboration-on-know-your-agent-interoperability-to-scale-agentic-commerce)

Invalidation We would narrow our concern for a specific pilot if it publishes repeatable evidence that changed limits and permission withdrawn before payment becomes irreversible are enforced across the actual hand-off, with a named person able to handle exceptions. If the pilot cannot act or move money and only offers suggestions, the payment-control concern has a smaller scope. A demonstration that only completes authorised purchases would leave the boundary tests unanswered.

Bottom line We would ask Singapore banks, wallets and merchants to demonstrate one purchase that should pass and one that must stop after the user changes permission. We see a useful implementation test for the next stage of AI payments. We do not infer compulsory adoption, a completed cross-network rollout, lower fraud losses or a share-price direction from these announcements.

Bayesian · what changed the estimate? The reported SAFR implementation gives teams a more concrete reference to test. It does not supply an observed failure rate. Evidence that a changed permission is enforced would strengthen our view of a particular pilot; an incorrectly executed action would weaken it. We have no fitted prior, likelihood ratio or numerical probability for deployment safety.

de Finetti · are the comparisons fair? Ant, Mastercard and Visa describe one joint collaboration, not three independent successful trials. MAS’s speech and SAFR work share an origin. An ordinary purchase, an automated treasury transfer and an agent-to-agent hand-off face different consequences and permissions. We would compare like-for-like tests rather than combine them into a single pass rate.

Kolmogorov · do the numbers agree? Agent identity, user permission and completed payment are different facts, not competing outcomes whose percentages should add to 100. For a future test, correctly completed, correctly blocked, wrongly blocked and wrongly executed actions would need precise definitions and a known denominator; timeouts and missing records would remain visible. No market-direction probability or scored price call applies here.