Malaysian Payment Gateways Compared (2026): Stripe, Billplz, ToyyibPay, Curlec & HitPay

The Malaysian Payment Landscape: FPX, DuitNow QR, and Cards

Choosing a payment gateway for a Malaysian e-commerce store or digital business is not simply a matter of finding the lowest advertised fee.

Domestic purchasing behavior in Malaysia has distinct architectural requirements:

• PayNet FPX (Online Banking): A long-established checkout method for mid-to-high ticket orders where customers prefer logging into Maybank2u, CIMB Clicks, or Public Bank. PayNet, the national payments network operator, reported 8.44 billion digital payment transactions processed across Malaysia in 2025 — evidence of how mainstream bank-rail payments have become, even without a single precise "share of checkout volume" figure to cite.
• DuitNow QR: The national interoperable QR standard. Consumers expect instant scan-and-pay capability directly from their mobile banking or e-wallet apps (Touch 'n Go, GrabPay).
• Credit & Debit Cards (Visa/Mastercard): Essential for international buyers, corporate procurement cards, and automated recurring billing (SaaS, memberships, retainer services).

Selecting the wrong gateway leads to checkout friction, abandoned carts, delayed settlement cash flows, and catastrophic webhook dropouts. Below is an engineering and commercial comparison of the five leading payment providers operating in Malaysia in 2026: Stripe, Billplz, ToyyibPay, Curlec (by Razorpay), and HitPay.

---

1. Stripe Malaysia: The Developer Standard for Cards & Subscriptions

Stripe remains the benchmark for API ergonomics, documentation, and international card processing. For businesses running subscription billing or selling internationally, it is difficult to surpass.

Cost Structure (verified against stripe.com/en-my/pricing, Sept 2026)

• Credit / Debit Cards (Domestic): 3% + RM1.00 per successful transaction.
• Credit / Debit Cards (International): add 1 percentage point (so around 4% + RM1.00), plus 2% if currency conversion is required.
• PayNet FPX: 3% + RM1.00 per successful transaction — Stripe prices FPX the same as a card transaction, not as a flat, lower fee. Custom volume-based pricing is available on request.
• GrabPay: 3% per successful charge. Alipay: 2.9% + RM1.00.
• Monthly / Setup Fees: RM0.

Operational Characteristics

• Settlement Timeline: Not published as one fixed number — Stripe sets a payout schedule per account based on its own risk assessment, so treat any specific "T+X days" claim from a third party as unverified until you see it in your own dashboard.
• Recurring Engine: Native Stripe Billing supports metered billing, automated retry logic (Smart Retries), and customer self-service portals.
• Mobile Wallets: Out-of-the-box integration for Apple Pay and Google Pay.

Engineering Assessment

Stripe's webhook infrastructure is best-in-class. Every event carries an idempotent event ID, cryptographic signature verification (stripe-signature), and automatic exponential backoff retry schedules. If your origin server experiences a brief 10-second hiccup, Stripe will retry sending the payment confirmation until your server acknowledges with an HTTP 200.

Best Suited For: SaaS platforms, digital exports, high-margin consumer brands, and any platform requiring automated recurring credit card billing.

---

2. Billplz: The Low-Cost Volume Leader for PayNet FPX

Billplz is a domestic powerhouse built specifically around the Malaysian banking ecosystem. Where card fees would severely erode margins on high-value orders, Billplz offers flat-rate FPX transactions.

Cost Structure (verified against main.billplz.com/pricing, Sept 2026)

• Basic Plan (free): FPX B2C RM1.25 flat per transaction; FPX B2B RM3.00; card payments 1.8% (MYR) / 3.8% (non-MYR, optional); DuitNow QR and e-wallets 1.5%.
• Standard Plan (RM999/year membership, not RM100/month): FPX B2C drops to RM0.75 flat; FPX B2B RM2.00; card payments 1.5% (MYR) / 3.5% (non-MYR).
• Credit Cards: Processed natively by Billplz at the rates above — not routed through a third party like PayPal or 2C2P.

Operational Characteristics

• Settlement Timeline: FPX payouts next business day; card payouts T+2 business days.
• Direct PayNet Membership: Deep integration with local bank rails ensures high transaction success rates during peak bank maintenance windows.

Engineering Assessment

Billplz's REST API is straightforward and lightweight. However, developers must pay close attention to callback handling. When a customer pays via Maybank2u and closes the browser tab before returning to your store, your system must rely strictly on Billplz's server-to-server webhook callback to transition the WooCommerce order from "Pending" to "Processing".

Best Suited For: High-volume domestic e-commerce, wholesale B2B portals, building materials, tuition fees, and automotive merchants where orders exceed RM300 and a 3% card fee is commercially unacceptable.

---

3. ToyyibPay: Frictionless Micro-SME & Domestic Collections

ToyyibPay has captured widespread adoption among Malaysian sole proprietorships, NGOs, and micro-merchants due to its zero-friction onboarding process.

Cost Structure (verified against toyyibpay.com/pricing-plans, Sept 2026)

• PayNet FPX (Standard plan, all users): RM1.00 flat per B2C transaction, RM2.00 flat per B2B transaction. Registered non-profits can apply for the Santai plan, which waives the B2C fee entirely.
• DuitNow QR: 1% of the transaction or RM1.00, whichever applies, per the published schedule.
• Credit Cards: Supported through partner acquirers at 1.5% (local cards) or 3.5% (foreign cards) — but unlike FPX, card acceptance carries a RM100 onboarding fee and a RM100/year fee from the second year.
• FPX Setup & Annual Fees: RM0.

Operational Characteristics

• Onboarding Velocity: Often approved within 24 to 48 hours for registered SSM businesses and associations.
• Settlement Timeline: Standard plan pays out over the next 1–4 business days; the Santai (non-profit) plan settles over the next 10 business days.

Engineering Assessment

ToyyibPay is simple to implement with off-the-shelf WordPress and WooCommerce plugins. However, its webhook mechanisms and API tooling are less advanced than Stripe or Curlec. High-concurrency operations (e.g. flash sales with 50 simultaneous checkouts per minute) can encounter rate limiting or delayed webhook delivery.

Best Suited For: Small businesses, boutique service agencies, non-profit donation forms, and businesses looking for a simple, low-cost domestic FPX gateway without complex contract negotiations.

---

4. Curlec (by Razorpay): The Malaysian Recurring Direct Debit Specialist

Curlec was acquired by India's Razorpay to serve as their Southeast Asian operational hub. Curlec's primary architectural advantage is its mastery of FPX Direct Debit (automated recurring bank deductions authorized directly from the customer's bank account).

Cost Structure (verified against curlec.com/pricing, Sept 2026)

• Basic plan (RM0 setup, no annual fee): FPX 1.5% (minimum RM1 per transaction); DuitNow Pay/AutoDebit 1.2% (minimum RM0.30); domestic cards 2.4%; foreign cards 3.3%; e-wallets (Touch 'n Go, Boost, GrabPay) 1.5%.
• Premium plan (RM999 one-off setup, no annual fee): the same methods at lower rates — FPX 1.0% (minimum RM1), DuitNow Pay 1.0% (minimum RM0.30), domestic cards 2.0%, foreign cards 3.1%.
• Curlec's published pricing is percentage-based rather than a flat per-mandate fee — we could not verify a separate flat "mandate creation fee" schedule for recurring bank debits, so we're not quoting one.

Operational Characteristics

• The Direct Debit Advantage: In Malaysia, many consumers and businesses do not hold high-limit credit cards, and debit cards frequently fail recurring billing due to bank-enforced OTP/3DS requirements or insufficient funds. Curlec's DuitNow AutoDebit / FPX Direct Debit lets businesses pull agreed amounts directly from a customer's bank account on a recurring schedule instead.

Engineering Assessment

Curlec's API is modern and engineered specifically for subscription lifecycles. It provides webhook events for mandate approval, mandate cancellation, deduction initiation, and deduction failure. Handling bank-side maintenance schedules (e.g. nightly Maybank maintenance between 00:00 and 01:00 MYT) requires building scheduled retry queues.

Best Suited For: Gym memberships, recurring monthly maintenance retainers, tuition centres, subscription boxes, and commercial property management fees.

---

5. HitPay Malaysia: Unified Omni-Channel POS & Online Payments

HitPay has gained significant traction among modern retailers who operate both physical brick-and-mortar storefronts (in shopping malls like Mid Valley or 1 Utama) and an online e-commerce catalogue.

Cost Structure (verified against hitpayapp.com/my/pricing, Sept 2026)

• PayNet FPX: 1.8% + RM0.40 per transaction — a percentage-plus-flat fee, not a flat RM1.20.
• DuitNow QR: 1.2% of the transaction (also percentage-based, not a flat fee).
• Credit Cards: 1.2% + RM1.00 for domestic cards; 3% + RM1.00 for international cards (plus 2% on foreign-currency transactions).
• Setup Fees: RM0 (POS hardware terminals purchased separately, from roughly RM310).

Operational Characteristics

• Omni-Channel Inventory Sync: HitPay allows merchants to accept DuitNow QR, credit cards, and FPX both on their WooCommerce/Shopify store and in person via wireless Android POS terminals, keeping inventory synchronized in a single dashboard.
• Settlement Timeline: Non-card balances pay out T+2 business days; card balances from T+1 business day.

Engineering Assessment

HitPay provides well-maintained WooCommerce and Shopify plugins, alongside native mobile SDKs. The integration handles DuitNow QR dynamic generation cleanly, displaying a dynamic QR code on checkout that expires after 10 minutes to prevent stale payment conflicts.

Best Suited For: Boutique retail, fashion brands, specialty cafes, and multi-location businesses needing a unified payment processor across physical outlets and online stores.

---

Malaysian Payment Gateway Comparison Matrix (2026)

Figures above are each provider's own published standard-plan pricing as of September 2026 — always confirm current rates on the provider's own pricing page before committing, since these change without notice.

---

The Technical Reality: Handling Asynchronous FPX Callbacks

A common failure mode in Malaysian WooCommerce stores is order status desynchronization.

When a shopper selects FPX and redirects to their banking portal (e.g. Maybank2u), two separate communication channels exist:

1. Front-End User Redirect: The browser redirects the customer back to your store's "Order Received" page after completion.
2. Back-End Server-to-Server Webhook: PayNet or the gateway sends a direct HTTP POST payload to your server endpoint (https://yourdomain.my/wc-api/gateway_callback).

If the user closes their mobile browser tab immediately after the bank confirms the deduction, the front-end redirect never executes. If your gateway integration is poorly coded or relies solely on the browser redirect, the order remains stuck in "Pending Payment". The customer is charged, your inventory is not decremented, and your customer support team receives an angry WhatsApp message.

// Example: Defensive Webhook Idempotency Pattern in WooCommerce
add_action( 'woocommerce_api_jagaweb_fpx_callback', 'handle_fpx_callback' );

function handle_fpx_callback() {
    $payload = file_get_contents( 'php://input' );
    $signature = $_SERVER['HTTP_X_GATEWAY_SIGNATURE'] ?? '';

    // 1. Verify cryptographic signature from payment gateway
    if ( ! verify_gateway_signature( $payload, $signature ) ) {
        status_header( 401 );
        exit( 'Unauthorized webhook signature.' );
    }

    $data = json_decode( $payload, true );
    $order_id = absint( $data['order_id'] );
    $order = wc_get_order( $order_id );

    if ( ! $order ) {
        status_header( 404 );
        exit( 'Order not found.' );
    }

    // 2. Idempotency Check: Prevent duplicate processing if already completed
    if ( $order->has_status( array( 'processing', 'completed' ) ) ) {
        status_header( 200 );
        exit( 'Order already processed.' );
    }

    // 3. Verify Payment Status & Transition Order
    if ( $data['status'] === 'PAID' && floatval( $data['amount'] ) === floatval( $order->get_total() ) ) {
        $order->payment_complete( $data['transaction_reference'] );
        $order->add_order_note( sprintf( 'FPX Payment Verified via Webhook. Ref: %s', $data['transaction_reference'] ) );
        status_header( 200 );
        exit( 'Success' );
    }

    status_header( 400 );
    exit( 'Payment status invalid.' );
}

Malaysian businesses above the applicable revenue threshold are also being phased into LHDN's MyInvois e-invoicing framework, which is a reason to keep transaction references and order data clean and exportable — but this is an obligation on the business issuing invoices, not something the payment gateway itself is required to certify.

---

Choosing the Right Payment Architecture for Your Store

There is no universal gateway for all Malaysian businesses. The optimal architecture frequently combines multiple providers:

• A high-volume retail brand might implement Billplz or ToyyibPay as the primary FPX button (their standard-plan FPX fees run roughly RM0.75–RM1.25 per transaction) while maintaining Stripe exclusively for credit card checkout and Apple Pay.
• A recurring service firm or agency should implement Curlec to secure direct bank account debits, shielding cash flow from credit card expirations.

At JagaWeb, we engineer robust payment infrastructures for Malaysian businesses. Custom payment-gateway wiring and defensive webhook handling are scoped under a Fixed-Scope Project (from RM30,000); adding or changing a gateway integration on a site you already have moves through Care + Changes (RM1,500/month).

For existing e-commerce operators experiencing failed payments, orphaned orders, or webhook drops, our JagaWeb Care retainer (RM450/month) includes SSL renewal monitoring and expiry alerts and 24/7 uptime monitoring and incident response, so a broken checkout gets caught quickly rather than sitting unnoticed.