By the APAC Compliance Lead, UWAY Innovation. Program-level guidance; operational, not legal advice.

For a foreign entrant, the first Malaysia KYC and KYB question is who carries reporting-institution status. That status controls the CDD duty, third-party reliance and access to beneficial ownership records.

Malaysia has detailed customer due diligence rules. The difficult market-entry question sits one step earlier: which entity in the operating structure is the reporting institution?

That identity determines who owes the duty, who can rely on another institution, who must keep the evidence and who has a route into the beneficial ownership system. A foreign technology vendor can supply verification tools and evidence. It does not acquire the local institution's regulatory status through the commercial contract.

This distinction matters for payment, remittance, gaming and digital-asset businesses entering Malaysia. Before designing an onboarding flow, the entrant needs to locate the regulated party inside the structure and understand which parts of the evidence chain remain under that party's control.

The Two Doors

On 30 September 2026, Bank Negara Malaysia published an enforcement action against SMJ Teratai Sdn. Bhd. The administrative monetary penalty was RM6,900, decided on 23 July 2026, after the licensed money-changing operator failed to conduct CDD on a customer. BNM attributed the failure to a lack of reasonable care by staff and stated that reporting institutions must identify and verify a person authorised to represent a company through a letter of authority or directors' resolution (BNM enforcement notice).

The notice identifies the party that received the penalty: the licensed operator. It also exposes two gates that a foreign entrant will encounter.

The first gate concerns reliance. A Malaysian reporting institution may rely on a qualifying third party for parts of CDD, subject to conditions. The responsibility stays with the Malaysian reporting institution. The second gate concerns corporate evidence. Malaysia's beneficial ownership register has a defined access perimeter. A foreign entrant has no general right to query that register simply because it sells services to, integrates with or contracts for a Malaysian business.

These gates change the sequence of market-entry work. Product design can begin early, but control ownership must be mapped first. The same sequence appears in cross-border KYC and KYB practice when the customer sits in another jurisdiction: the evidence can move across systems while the statutory duty remains attached to a specific entity.

The Duty Attaches to a Reporting Institution, and It Stays There

Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 places the CDD duty in section 16 and defines regulated activities through the First Schedule. BNM's financial-institution policy then applies detailed requirements to fourteen classes of licensed or supervised bodies, together with relevant branches and subsidiaries and any additional persons designated by BNM (BNM AML/CFT/CPF policy document).

The Securities Commission takes the same institutional approach for capital markets. Its 2024 guidelines apply to a reporting institution and extend to branches and majority-owned subsidiaries outside Malaysia that conduct First Schedule activities. Where the host country's standards are less stringent, the Malaysian reporting institution must apply measures consistent with the Malaysian standard to the extent local law permits. Where host-country law prevents that application, the institution must add mitigation and inform the SC.

The direction of travel is clear. A Malaysian licence can extend controls outward through a group. A foreign parent, platform or vendor does not pull the Malaysian statutory duty away from the licensed entity.

The text on third-party reliance makes this explicit. BNM paragraph 16.2 says the ultimate responsibility and accountability for CDD remains with the reporting institution relying on the third party. The SC repeats the same allocation in paragraph 8.6.7. Outsourcing can change who performs a task. It does not change who must answer for the result.

For money services, the local perimeter is also visible at entry. BNM's public FAQ says only a company incorporated under the Companies Act 2016 or corresponding previous law may apply for an MSB licence. The same local-incorporation condition applies to appointment as an MSB agent. A foreign shareholder may participate, subject to BNM assessment and fit-and-proper requirements, but the licensed operating entity is local.

"Properly Regulated" Is the Reliance Test

Reliance is narrower than procurement. A reporting institution can buy software from a technology provider. Treating another party's CDD as the institution's regulatory CDD requires a different analysis.

BNM paragraph 16.5 requires the relied-on party to be properly regulated and subject to AML/CFT/CPF supervision by the relevant authority. The institution must be satisfied that the third party has adequate CDD measures, can provide information without delay and can supply the underlying documents immediately on request. Reliance on a third party in a higher-risk country is prohibited, and ongoing due diligence stays with the reporting institution.

The SC standard is closely aligned. Its definition of a third-party institution describes a supervised and monitored financial institution meeting paragraph 8.6. The relied-on institution must be properly regulated and supervised, provide an attestation and make the CDD material available. The reporting institution cannot assign ongoing due diligence to that third party.

This does not exclude every foreign entity. A foreign regulated financial institution may satisfy the test if the Malaysian reporting institution can establish the required supervision, controls and document access. An unregulated foreign KYC vendor occupies a different position. It can provide technology, data and workflow support; its output remains evidence used by the Malaysian institution, and the Malaysian institution must decide whether that evidence satisfies its CDD obligation.

For market entry, the commercial contract should therefore distinguish technology supply from regulatory reliance. The first is common. The second requires a regulated counterparty, an evidence-access commitment and a Malaysian reporting institution willing to retain accountability.

The Register Door: Beneficial Ownership Has an Access Perimeter

Malaysia's Companies Act beneficial ownership framework took effect on 1 April 2024. Companies maintain beneficial ownership information and lodge changes through the Electronic Beneficial Ownership System. The practice directive requires lodgement within fourteen days after the information is entered in the company's register.

The access rule is narrower than a conventional company search. Paragraph 62 of the SSM beneficial ownership guidelines identifies the competent authority, law-enforcement agencies, the beneficial owner and persons authorised by that owner. It also allows the Minister to prescribe other public bodies and reporting institutions gazetted under the First Schedule of AMLA.

A foreign entrant has no general access entitlement merely because it needs the information for onboarding. Access may arise through an authorised person, a qualifying reporting institution or another prescribed route. The entity carrying out KYB must know which route it is using and what evidence can be retained from that route.

Foreign companies also face a direct filing point. The SSM guidelines state that foreign companies must lodge beneficial ownership information at registration under paragraph 562(1)(fa) of the Companies Act. That filing duty helps populate the register. It does not convert every filer or service provider into a party with open search access.

This is where a beneficial ownership trace through a chain of entities meets a jurisdictional boundary. Corporate documents, ownership charts and attestations can travel with the customer. The authoritative registry view remains controlled by Malaysian law and by the access status of the party requesting it.

Two Thresholds, One Company

Malaysia uses two ownership thresholds in this area, each for a different regulatory purpose.

SSM's company-law framework treats direct or indirect ownership of not less than 20 percent as one criterion for beneficial ownership. It also captures a person below that level who exercises significant control or influence over directors or management. The register is designed to record who ultimately owns or controls the company under section 60A of the Companies Act.

BNM's CDD policy uses more than 25 percent in the first step of its cascading identification test for a legal person's controlling ownership. If no natural person is identified through ownership, the institution moves to control by other means and then to senior management. The SC guidelines also use more than 25 percent for shareholders in a corporation and for capital contribution or voting rights in a limited liability partnership.

Consider a natural person holding 22 percent of a company without another form of control. That person meets SSM's ownership criterion of at least 20 percent. The holding does not cross the more-than-25-percent ownership step in the BNM and SC CDD cascade. Other control tests may still identify the person, and the institution still needs to understand the ownership and control structure.

The two numbers serve two records. One governs the company-law beneficial ownership register. The other starts a risk-based CDD identification cascade. A market-entry data model should preserve both fields and their source. Collapsing them into one universal "Malaysia UBO threshold" loses the purpose attached to each result.

What Your Malaysian Partner Will Ask You For

The Malaysian reporting institution needs enough evidence to establish the legal person, its authority structure, its authorised representative and its beneficial owners.

Under BNM's policy, the evidence can include the certificate of incorporation, constitution or partnership agreement, a tax identification number, directors' resolutions, the names of senior management, the registered office and the principal place of business. The authorised representative must be identified and verified through written authority or a directors' resolution. The SC guidelines refer to certified or notarised Forms 24 and 49, or an equivalent document for a foreign body corporate, together with identity documents for relevant shareholders, directors, partners and office bearers.

Digital onboarding adds a separate control layer. The BNM e-KYC policy requires document verification, biometric matching and liveness detection for individuals. For legal persons it calls for identification and verification of the entity as a legitimate business, the authorised person and the beneficial owners. The policy gives video calls with directors or authorised persons as one possible way to test business legitimacy.

Performance evidence also enters the relationship. Where false-acceptance rate exceeds 5 percent for any two months in a four-month period, the institution must notify BNM and submit its assessment and mitigation. The minimum sample must meet a 95 percent confidence level and 3 percent margin of error, or 400 cases per month, whichever is higher.

For licensed money changers, remittance providers and specified non-bank payment issuers, implementation timing depends on regulatory approval. Paragraph 11.1 requires written approval from BNM's payment-services oversight department before implementing e-KYC or changing the appointed technology provider. A vendor replacement can therefore affect the launch plan even when the integration is technically ready.

These requirements explain why identity-verification details decide whether a file survives review. The Malaysian partner will assess both the customer evidence and the operating evidence behind the verification system.

Where This Leaves a Foreign Entrant

A foreign entrant can obtain a Malaysian licence where its business model and the applicable regime allow it. That route brings local incorporation, regulatory assessment, governance, control and technology-approval obligations. It gives the entrant a regulated position; it also makes the entrant responsible for the evidence produced from that position.

Other structures place a Malaysian bank, payment institution, MSB, capital-markets intermediary or another regulated party at the centre. In those structures, the foreign business should map four facts before launch: which entity is the reporting institution; which CDD steps it performs itself; which foreign evidence it will accept; and which registry data remains available only through an authorised Malaysian route.

This article occupies a different place from the comparison between Hong Kong and Singapore licensing regimes. The question here comes before jurisdictional comparison. It asks who the Malaysian rules recognise inside the proposed operating structure.

The result can be placed beside the APAC control map for regulatory ownership. Product, partnership and vendor decisions then follow the same institutional map. Malaysia's rules are detailed. Their clearest feature is the identity of the party that must carry them.