AI Weekly Malaysia

Grab has expanded its PayLater service to work with any physical merchant displaying a DuitNow QR code, letting users scan via the Grab app and split payments. The feature is currently rolling out to a limited group of users before potential wider availability.

Why: For Malaysian SaaS and commerce builders, this means Grab PayLater is now a viable BNPL payment option at virtually any offline DuitNow QR point-of-sale, not just Grab's own ecosystem. If you build POS, payments, or retail tooling, expect merchants and consumers to ask about DuitNow QR + PayLater integration and plan for how BNPL routing over national QR infrastructure affects settlement flows and fees.

Group-IB detailed a fraud campaign called WindRelay that combines a phone-based social engineering attack with two Android malware strains—SpyNote (a RAT leaked in 2016) and WindRelay (NFC relay malware discovered August 2025)—to clone contactless card transactions in as little as 13 minutes. The attacker poses as bank helpdesk, gets the victim to install SpyNote, which silently deploys WindRelay, then tricks the victim into tapping their card on their NFC phone and entering a PIN. WindRelay captures the live EMV APDU exchange and relays it to an attacker-controlled POS terminal or ATM, completing a genuine card-terminal handshake that authorizes fraudulent payments.

Why: If you build or operate payment, fintech, or banking apps in Malaysia—where contactless card and e-wallet usage is near-universal—this attack shows that contactless EMV is not a trust boundary you can rely on when the cardholder's own device is compromised. Fintech teams should evaluate whether their fraud detection can flag relay-style transactions characterized by unusual POS-to-cardholder geolocation or timing gaps, and whether customer-facing flows that instruct users to tap cards on phones create teachable moments for social engineering awareness.

Reserve Bank of India governor Sanjay Malhotra urged banks to use AI to approve loans for underbanked groups like gig workers and first-time borrowers by analyzing alternative data such as GST filings, utility payments, and digital footprints. He also advocated for AI voice interfaces in local languages to improve financial inclusion and early warning systems for default risk.

Why: Fintech and SaaS founders in Malaysia can anticipate similar regulatory pushes for AI-driven financial inclusion using alternative data, especially for vernacular language interfaces and gig economy underwriting.

Ryt Bank, backed by YTL Power International and Sea Limited, is the first Malaysian digital bank to allow account activation and initial funding via physical ATMs and bank branches through the Interbank GIRO (IBG) network. Users complete eKYC on the app, then fund at an ATM or over-the-counter; accounts activate within one working day, with no fixed minimum for offline transfers.

Why: For fintech and payments builders in Malaysia, this signals that digital banks are actively building hybrid onboarding flows that integrate legacy rails (IBG, ATM networks) rather than pure app-only journeys. If you're designing KYC or onboarding for underbanked segments, consider whether your flow assumes online banking access and whether partnering with physical cash-in channels materially widens your addressable user base.

Ant International's embedded finance unit Bettr has partnered with Muslim Pro to offer Shariah-compliant Umrah financing directly inside the app, letting eligible Malaysians split pilgrimage costs into 12-24 month instalments. The facility uses a Tawarruq (Commodity Murabahah) structure, with commodity transactions processed via Sedania As Salam Capital's AS-SIDQ platform and the structure endorsed by Masryef Advisory.

Why: For Malaysian fintech and SaaS founders, this is a concrete example of embedded finance being layered into a non-finance app with 190M+ downloads — the pattern of integrating credit assessment, Shariah-compliant structuring, and digital commodity trading into an existing lifestyle app is directly relevant if you're building BNPL or instalment products. Developers should note Bettr's credit models extend to gig workers and small business owners, which broadens the addressable user base for similar embedded lending plays.

The article title indicates the US federal government is attempting to override New York state gambling laws and has ordered prediction-market platform Kalshi to continue operating. However, the provided article text contains only cookie consent boilerplate and no substantive article content.

Why: No actionable detail can be extracted from the provided text. The headline alone suggests a federal-vs-state regulatory conflict over prediction markets, which could matter to founders building in regulated fintech or event-contract spaces, but without the article body there is nothing concrete to act on.

The CFTC invoked emergency authority to order prediction-market platform Kalshi to continue operating in New York, citing market stability concerns. The press release is a regulatory action by a US commodities regulator over a specific US-based trading venue.

Why: Minimal direct impact for Malaysian builders. The only practical angle is if you are building fintech, prediction-market, or derivatives-adjacent products and need to track how US regulators treat novel market venues—but no action is required by this audience based on this text alone.

This is a sponsored Grab post explaining how users can redeem accumulated GrabCoins balances for discounts on GrabCar, GrabFood, Grab PayLater, Grab Dine Out, and Jaya Grocer vouchers. It walks through checking your balance via the GrabCoins icon and redeeming offers from the in-app catalogue.

Why: This is sponsored marketing content with no actionable takeaway for builders, developers, or founders. There is no API, platform change, or partner program detail that would affect anyone shipping products in or around the Grab ecosystem.