Mal7
Insights
Agentic commerceJuly 8, 20267 min read

Mastercard is funding the layer that sits above the UAE retail bank

Mastercard is backing AI agents that will choose banks, cards, and loans for customers. Banks now have to compete for the agent's attention.

By Mustafa Khider

Executive summary

  • Mastercard's UAE Lighthouse programme puts capital behind agentic commerce and MSME credit, two areas that touch the retail and SME banking relationship directly
  • Aani has already shifted the infrastructure baseline: 12.5 million users and three-second settlement make regulated real-time money a platform for autonomous agents
  • The competitive layer moves above the banking app, where customer agents compare offers, switch providers and execute without loyalty, inertia or cognitive load

So what

UAE banks should build for the agent-facing layer now: machine-readable APIs, consent flows, transparency controls and segment-specific endpoints that agents can discover and use

The signal is not another app feature. It is institutional backing for the interface layer where an agent can compare, choose and execute across regulated real-time payment rails.

21 May

Lighthouse UAE launch

Mastercard launched the programme with the UAE AI Office and Hub71

4

funded focus areas

Agentic commerce, personalisation, risk management and MSME credit

12.5m

Aani users

The Central Bank's instant payment platform is already at national scale

3 sec

settlement time

Transfers settle fast enough that the interface becomes the bottleneck

01 Launch signal

Mastercard has put capital behind the layer customers will touch next

On 21 May, Mastercard launched the Lighthouse programme in the United Arab Emirates, in partnership with the country's AI, Digital Economy and Remote Work Applications Office (the federal ministry coordinating UAE AI strategy) and the Abu Dhabi technology hub Hub71. The programme will fund and accelerate startups across four areas: agentic commerce, personalisation, risk management, and credit for micro, small, and medium enterprises. The two that matter most for the incumbent UAE retail bank are the first and the last. Both target the part of banking the customer actually touches.

Lighthouse focus

Four areas, two that hit the relationship directly

Agentic commerce and MSME credit matter most because both sit close to the part of banking the customer actually touches

01

Retail relationship

Agentic commerce

The layer where autonomous agents choose which provider, card or payment route to use

02

Experience layer

Personalisation

The data-driven surface around offers, timing and customer context

03

Control layer

Risk management

The controls and trust layer that decides what can be automated safely

04

SME banking

MSME credit

The financing relationship where agent-mediated comparison can move quickly

02 Infrastructure

Regulated real-time money has stopped being the bottleneck

The infrastructure precondition is already in place. The Central Bank of the UAE has reported that its Aani instant payment platform now has 12.5 million users, with transfers settling in three seconds. Twelve and a half million users is most of the country. Three seconds is faster than a card authorisation across most international networks. Programmable, regulated, real-time money has stopped being the bottleneck for what an autonomous agent can do on a customer's behalf. The bottleneck is now the interface that decides what to do with the money. That is the interface Mastercard has just put institutional capital into building, alongside one of the most engaged government bodies in the region's AI ecosystem.

03 New layer

The relationship the bank used to own now has to be won with the customer's agent

This lands on the heads of retail and SME banking at the regional banks. The pressure they have felt over the last three years has come from FinTech competitors with a sharper app, a faster onboarding flow, or a cheaper transfer corridor. The Mastercard move signals a competitor on a different layer. The new layer sits above the app itself, where the customer's autonomous agent decides which bank, which card, which financing offer, which utility provider, and which SME credit line to use, optimising continuously across the payment infrastructure Aani provides. The relationship the bank used to own with the customer becomes a relationship the bank has to win with the customer's agent. Different conversation. Different sales cycle. Different product economics.

Layer shift

The new competition is not inside the app. It sits above it.

Before

The app owns the moment

The customer compares providers, carries switching friction and forms a relationship with one bank

After

The agent owns the moment

The agent reads structured endpoints, compares offers continuously and executes on the customer's behalf

04 Comfortable reading

The conventional incumbent reading is logical, but incomplete

The conventional view inside the incumbents treats this kind of announcement with sober equanimity. The bank has the deposits, the licence, the balance sheet, the brand, the customer base of decades, and the regulatory relationships that take years to build. A challenger has a clever interface and limited funding. The history of FinTech disruption in the UAE supports the view. Most challengers that survived have partnered with the incumbents, used their payment infrastructure, or been absorbed by them. The incumbents kept the customer relationship and improved their digital channels by learning what the challengers taught. On this reading, agentic commerce is the next chapter of the same absorption cycle. Banks will update their APIs, the technical connection points other software uses to talk to the bank, partner with the agent providers, plug into the new interface layer, and continue to own the underlying account. Mastercard, on this reading, sits on the bank's side of the table. It is a network the incumbent already partners with, now investing in the next generation of founders. The right posture is engagement, not anxiety.

05 Autonomous interface

The interface becomes different when it is autonomous

The reading is comfortable, and it understates what changes when the interface is autonomous. Every previous wave of FinTech disruption assumed a human at the end of the chain who would form a relationship with one provider. The relationship was the barrier to entry. Brand affinity, switching cost, account inertia, the friction of changing direct debits, the cognitive load of comparing offers, all of these protected the incumbent. An autonomous agent has none of those frictions. It compares offers continuously. It switches without ceremony. It has no loyalty, no inertia, no cognitive load, and no patience for a five-step onboarding flow. And the agent will not visit the bank's website. The agent will read a structured endpoint, parse the offer, compare it against three others, and execute. The customer will see a notification telling them what the agent did. The bank's marketing budget, its branch network, and its app design all sit outside that decision loop. The customer's relationship is now with the agent. The bank's relationship is with whichever agent the customer is using this quarter. The barrier to entry has moved up a layer, to where the agent is built, trained, and integrated into the customer's life. That is the layer Mastercard has just put a flag on.

06 Value structure

The competitive structure shifts downward and upward at the same time

The competitive structure shifts in two directions at once. Downward, the incumbent bank becomes one of several interchangeable providers the agent considers, optimising on whatever criteria the customer or the agent itself has been trained on. Upward, the agent provider takes the data flow and the customer relationship the bank used to own. Mastercard's partnership choice tells the market where the value will sit. The AI, Digital Economy and Remote Work Applications Office is a coordinating body inside one of the most ambitious national AI agendas in the region, working alongside an experienced acceleration hub. The signal is that agentic commerce in the UAE will be built with serious institutional backing, on the payment infrastructure the Central Bank has already modernised, with founders the regulators are familiar with. And the regulator will read this layer too. The Central Bank of the UAE will scrutinise agent-mediated transactions the same way it scrutinises any other channel, with the same expectations on consent, transparency, and consumer protection. The bank that designs the consent flows and transparency requirements into the layer from the start will find the conversation with the supervisor easier, not harder.

Operating response

The clock is measured in agent roadmaps, not steering committee cycles

2

quarters of practical work

The source frames the near-term response as work over the next two quarters

6 months

agent-ready API window

A bank that ships in this window can become a counterparty in the new structure

18 months

deck-to-vendor risk

A bank waiting for an eighteen-month transformation deck risks becoming a vendor

2028

customer interface test

The customer of 2028 will not be looking at the app. The agent will

07 Response window

Transformation timelines now compete with founder roadmaps

The harder consequence sits inside the bank's transformation programme. Incumbents that respond to this by commissioning a multi-year strategy engagement with a global consultancy will run out of time. The agent layer is being built now, by founders who measure their roadmaps in months. A twenty-four-month transformation programme delivered by a partner-light, junior-heavy team, structured around milestones and steering committees, produces a finished deck around the same time the third generation of agentic commerce platforms arrives on the App Store. The seat-based pricing model and the partner-light, junior-heavy economics behind it cannot move at the speed of a regulator-cleared challenger with an engineering team in the same room as its founders. A founder making product decisions in the same room as the engineering team can ship in a week what a steering committee takes a quarter to approve. That asymmetry is the operational reality the incumbent now has to compete against. The bank that ships an agent-ready API in six months, with treasury, lending, and SME credit endpoints designed to be discoverable and consumable by an autonomous client, will be a counterparty in the new structure. The bank that ships a transformation deck in eighteen months will be a vendor.

08 Practical work

The practical work over the next two quarters is concrete

The practical work over the next two quarters is concrete. Build the APIs the agents will need, with documentation written for machine consumption first and human readers second. Decide which customer segments are most exposed to agent mediation, and design for that segment, not for the in-branch flow. Sit down with the Hub71 cohorts when they appear, and treat them as future counterparties. Reread the open banking framework the Central Bank of the UAE has put in place, the Saudi Central Bank's authorisations of open banking providers including Tatbiq Darahem, and the United Kingdom's variable recurring payments work, as instruction manuals for the new interface. And stop measuring the digital programme by how the app looks on a phone. The customer of 2028 will not be looking at the app. The agent will.

Agent-ready work

The work is concrete, and it starts above the app

01

Machine-readable APIs

Build documentation for machine consumption first and human readers second

02

Exposed segments

Decide which customer segments are most exposed to agent mediation

03

Founder counterparts

Treat Hub71 cohorts as future counterparties, not peripheral innovation theatre

04

Open-banking instruction manuals

Reread UAE, Saudi and UK open-banking work as guidance for the new interface

Interface test

The customer of 2028 will not be looking at the app. The agent will

09 Close

The retail bank's place in the customer relationship moved up a layer this month

The banks that notice will start building for the layer above. The banks that do not will discover what it feels like to be wholesaled

About the author

Mustafa Khider is a co-founder of Mal7, focused on enterprise AI and automation for financial institutions, FinTechs and regulators moving AI into production.

Agent-facing banking readiness

Build for the layer above the app before someone else owns it

Mal7 helps financial institutions turn AI ambition into agent-ready operating capability, with the APIs, controls and adoption path needed for production