All reports
Daily Brief · AI · FinTech · Crypto

Malaysian Banks Rewire Cyber Defence Around AI Agents, Singapore's 1exchange Joins Canton as a Tokenization Validator, and GCash's Parent Posts Record Revenue but a Shrinking Profit Ahead of Its IPO

Malaysian bank CISOs say scam losses hit RM2.8 billion in 2025 as non-human digital identities now outnumber human ones roughly 144 to 1, forcing a shift from firewall-based security to monitoring the behaviour of customers, partners and AI agents themselves. Singapore's MAS-regulated 1exchange became a validator on Canton, the privacy-enabled blockchain built for institutional tokenization, alongside payments firm FOMO Pay. And Mynt, GCash's parent, posted record second-quarter revenue even as its earnings contribution to Globe Telecom fell 12% year-on-year on the delinking of mobile casino apps — a split top-line-versus-profit story landing weeks before a planned IPO that could raise up to $1.5 billion.

August 10, 20264 min readMalaysia · Singapore · Philippines · AI · Cybersecurity · Tokenization · E-Wallets
Wide editorial photograph of a bank security operations centre at night in Kuala Lumpur, rows of dark monitors glowing blue-white with data dashboards, a single analyst seen from behind and in silhouette reviewing the screens, the illuminated Petronas Towers skyline visible through floor-to-ceiling windows.
Malaysian banks are extending cyber defence past the firewall to the behaviour of every human and AI agent moving through their systems.

Malaysian Banks Are Rewiring Cyber Defence Around AI Agents as Non-Human Identities Outnumber Humans 144 to 1

Malaysian bank security chiefs say the security perimeter has moved past the firewall as real-time payments leave less time to catch fraud. Scam losses in Malaysia reached RM2.8 billion in 2025, and non-human digital identities — service accounts, bots and AI agents — now outnumber human ones inside bank systems by roughly 144 to 1, up from about 80 to 1 a year earlier. "We are moving from protecting or monitoring the wall towards monitoring the behaviour of the user or client," said Tahrizi Tahreb, chief information security officer at Bank Kerjasama Rakyat Malaysia (Bank Rakyat), adding that "identity is no longer one element of security. It is the security."

Goh Ser Yoong, CISO at Ryt Bank (YTL Digital Bank), said identity verification now has to start at onboarding rather than login, with document and consent checks built in from the first interaction rather than layered on afterward. Shankar Krishnan, chief technology officer at Boost Bank, framed the shift in blunter terms: "the perimeter now extends into our parents' pockets." Banks are also preparing for a future in which their own AI agents exchange data directly with partner organisations' agents — a scenario that complicates authentication in ways traditional network security wasn't built for. Bank Negara Malaysia and the National Scam Response Centre's 997 hotline were cited as the regulatory and reporting backstop for the current wave of real-time-payment fraud.

Singapore's 1exchange Becomes a Validator on Canton, Betting Institutional Tokenization Needs Privacy Rails

1exchange, a Recognized Market Operator regulated by the Monetary Authority of Singapore, said on August 4 it had been approved as a validator on Canton, a privacy-enabled public blockchain built for institutional capital markets that the network says processes more than 600,000 transactions daily. Singapore payments institution FOMO Pay, which operates across Singapore, Hong Kong and the Middle East, joined alongside it, running a dedicated node to explore business-to-business payment and settlement use cases. Canton's selective-disclosure design lets participants share transaction data only with authorised counterparties while still transacting on a shared network, and supports compliance controls such as transfer restrictions and investor-eligibility checks.

1exchange chief executive Sheena Lim said "the future of tokenization will be defined not only by the assets brought on-chain, but also by the quality of the market infrastructure" supporting them, while Canton co-founder and Digital Asset chief executive Yuval Rooz said the addition helps the network "expand our presence in Asia" to meet regional demand. 1exchange intends to use the validator role to support its existing tokenization, listing and secondary-trading business for real-world assets, protecting investor identities and ownership records that would otherwise be exposed on a fully public chain.

GCash's Parent Posts Record Quarterly Revenue but a Shrinking Profit Contribution Ahead of Its October IPO

Mynt, the parent of Philippine e-wallet GCash, posted record second-quarter revenue of P22.4 billion, but Globe Telecom's equity share of Mynt's net income came to P3.7 billion, down from P3.8 billion a year earlier — a decline of 12% year-on-year and 8% quarter-on-quarter that one analyst note called "the key disappointment" in an otherwise strong Globe earnings report. The drag traces to the delinking of mobile casino apps from e-wallets in late 2025. Following board approval on June 17, Mynt submitted its registration statement to the Securities and Exchange Commission and its listing application to the Philippine Stock Exchange for a planned initial public offering targeted for the fourth quarter, which could raise as much as $1.5 billion. Globe holds roughly 33.8% of Mynt, alongside Ayala Corp. and Ant Group.

The split shows up in Globe's own numbers too: first-half 2026 net income fell 11% year-on-year to P11.0 billion despite record first-half service revenue, with Globe's core telecom segments — wireless and wireline — outperforming while Mynt underperformed against expectations. Globe's management has continued to describe the IPO as an open option with the registration process now formally underway rather than a certainty on any fixed date.

Eyes on the Day Ahead

Malaysia's Ministry of Digital and MyDIGITAL Corporation co-host AI Malaysia Takeover 2026 (AIMTO_26) in Kuala Lumpur on August 11-12, a direct venue to watch for any government signal on AI governance standards for the financial sector following today's reporting on bank-level AI-agent security practices.

Layer 7 Ventures is a research-driven firm focused on AI and cryptocurrency in Southeast Asia. Views expressed are those of the firm and do not constitute investment advice.

More Research

Photorealistic photograph of a digital-asset compliance and transaction-monitoring floor in a Bangkok office at pre-dawn blue hour, an anonymous analyst reviewing multi-monitor data screens in the foreground while a second anonymous figure stands silhouetted at the window overlooking the skyline.
Weekly Signal · Crypto · FinTech7 min

SEA Signal: Thailand Locks In a Crypto Travel Rule, BitGo Plants Its APAC Flag in Singapore, and the Philippines Wires QR Ph to the World

Thailand's SEC finalized a Travel Rule that forces digital-asset operators to identify counterparties on every transfer, including self-custodial wallets, from February 2027. BitGo opened a Singapore office after tripling its APAC client base, a vote of confidence in the city-state's licensing regime from a major institutional custodian. And the Philippines connected its QR Ph network to Alipay+, giving 2.5 million local merchants a route into cross-border commerce without touching their existing infrastructure.

Photorealistic exterior photograph of a central bank headquarters building in Kuala Lumpur at golden hour, an anonymous security guard standing at the entrance and two office workers crossing the forecourt, with the city skyline visible in the background.
Daily Brief · FinTech · AI4 min

SEA Daily Brief: BNM's Sanctions-Screening Fines, Qualcomm's Vietnam AI Bet, and CIMB's Biometric Mandate

Bank Negara Malaysia fined Petronas' Setel and two Standard Chartered units a combined RM901,500 over sanctions-screening lapses. Qualcomm's CEO told Vietnam's top leader he wants the country to become the chipmaker's third-largest AI R&D hub globally. And CIMB will require biometric or passcode approval for all online banking transactions from September 19, ending password-only authorization.

A regulator addresses a conference audience from a lectern, a large digital screen behind them, seen from the back of the room.
Daily Brief · Crypto · AI4 min

SEA Daily Brief: Indonesia's OJK Maps a Crypto Roadmap, Singapore's Scam Data, and Alibaba's Malaysia AI Push

Indonesia's OJK laid out a 2026-2031 roadmap covering stablecoin regulation, real-world asset tokenization, and a single investor ID for crypto. Singapore's H1 2026 scam losses fell 17.9% to S$410.6 million, with crypto-linked losses down 43% but still 16% of the total. And Alibaba Cloud joined Malaysia's AI Untuk Rakyat programme, offering two free AI tools to 100,000 young Malaysians.

Stay Informed

Get the next report in your inbox.