Malaysia AML/CFT Guide

Malaysia’s regime is led by Bank Negara Malaysia (BNM), which is the competent authority under AMLA, the financial intelligence unit and the main AML/CFT supervisor for banks, insurers, money services businesses and most designated non-financial businesses and professions (DNFBPs). The Securities Commission and the Labuan Financial Services Authority supervise their own sectors.

Malaysia’s exposure comes from a large banking sector, cash-intensive trade in gold and jewellery, the Labuan offshore centre, porous sea borders and a fast-growing online scam industry. The 1MDB scandal shaped the regime: it drove reforms and remains one of the world’s largest asset recovery cases.

How the regime fits together

• Policy and co-ordination. The National Coordination Committee to Counter Money Laundering (NCC), set up in 1999, is chaired by BNM and brings together ministries and agencies. It runs the national risk assessment and the NCC Roadmap 2024–2026.
• Financial intelligence and supervision. BNM’s FIED receives suspicious transaction and cash threshold reports, and supervises financial institutions and DNFBPs. The Securities Commission covers the capital market and digital asset exchanges; Labuan FSA covers the Labuan International Business and Financial Centre.
• Sanctions. UN Security Council lists apply through AMLA, and the Minister of Home Affairs keeps a domestic list of specified entities.
• Enforcement. The Royal Malaysia Police, the Malaysian Anti-Corruption Commission and other agencies investigate. The National Anti-Financial Crime Centre leads joint taskforces.

Key milestones

1. 1999

   The National Coordination Committee to Counter Money Laundering is set up, chaired by BNM.

2. January 2002

   AMLA comes into force on 15 January 2002.

3. 2007

   APG evaluation under the older 40+9 Recommendations.

4. 2014–2016

   Malaysia becomes an FATF observer in October 2014 and a full member at the February 2016 plenary, after a joint FATF–APG evaluation published in September 2015.

5. October 2024

   New Penal Code offences on mule accounts come into force.

6. December 2025

   The 2025 joint FATF–APG evaluation is published: 24 compliant and 16 largely compliant ratings, and regular follow-up.

7. March 2026

   The AMLA (Amendment) Act 2025 comes into force on 1 March 2026.

What has changed recently

• AMLA amendments (1 March 2026). Prison and a fine are now both mandatory for money laundering, any federal offence punishable by more than one year’s prison is a predicate, a new offence covers financing weapons of mass destruction, records must be kept for all transactions, and supervisors can impose administrative penalties of up to RM1 million per offence.
• Proliferation financing. BNM’s February 2024 policy documents added countering proliferation financing (CPF) to the rules for financial institutions and DNFBPs.
• Beneficial ownership register. Companies have had to report beneficial owners to the Companies Commission of Malaysia (SSM) since 1 April 2024.
• Anti-scam measures. Mule account offences took effect in October 2024, and the National Fraud Portal, built with BNM and PayNet, launched on 20 August 2024.
• Sanctions enforcement. Most of BNM’s 2025–2026 penalties were for sanctions screening failures, including RM3.26 million on HSBC Malaysia entities.

Malaysia’s framework rests on one main act, AMLA, supported by the Penal Code, the Companies Act and the Strategic Trade Act, with detailed rules in BNM policy documents and Securities Commission and Labuan FSA guidelines.

Primary laws

Regulations and supervisor rules

BNM is at the centre of the system: it is the competent authority under AMLA, the financial intelligence unit and the supervisor of most reporting institutions. Two other regulators cover the capital market and Labuan.

Supervisors

The financial intelligence unit: FIED

• Role. BNM’s Financial Intelligence and Enforcement Department receives suspicious transaction reports and cash threshold reports and shares intelligence with law enforcement.
• Reporting. Reports are filed through BNM’s online Financial Intelligence System (FINS). Labuan institutions also notify Labuan FSA.
• Volume. FIED received more than 430,000 suspicious transaction reports in 2025, up from about 342,000 in 2024.
• International. BNM’s financial intelligence unit is a member of the Egmont Group.

Who investigates and prosecutes

The Royal Malaysia Police investigate money laundering, with the Commercial Crime Investigation Department leading on scams and the Special Branch on terrorist financing. The Malaysian Anti-Corruption Commission investigates corruption-related laundering and leads on 1MDB asset recovery.

• Customs. The Royal Malaysian Customs Department receives cross-border declarations of cash and bearer instruments.
• Joint taskforces. The National Anti-Financial Crime Centre, set up under a 2019 act, co-ordinates multi-agency operations.
• Scam response. The National Scam Response Centre, run by the police Commercial Crime Investigation Department since July 2025, operates the 997 hotline.

Targeted financial sanctions

• Freeze. Freeze funds of listed persons without delay and block or reject their transactions.
• Report. Tell FIED within 30 days of a domestic list change whether you hold any of their property, and file six-monthly reports on 15 May and 15 November.
• Suspicious transaction reports. File one for positive name matches and attempted transactions.
• Enforcement focus. Failing to update screening lists promptly was the most common reason for BNM penalties in 2025–2026.

AMLA applies to “reporting institutions” listed in its First Schedule. They range from banks to lawyers and pawnbrokers, and each group has its own policy document or guidelines.

Financial institutions

• Banking and insurance. Licensed banks, investment banks and Islamic banks, insurers and takaful operators, development financial institutions, financial advisers and insurance and takaful brokers.
• Payments and money services. Money services businesses (remittance, money-changing and wholesale currency) and issuers of e-money.
• Others. Lembaga Tabung Haji, capital market intermediaries and fund managers, and Labuan financial institutions.

BNM’s 2024 policy document for financial institutions covers the banking, insurance, payments and money services groups. The capital market follows the Securities Commission’s guidelines, and Labuan institutions follow Labuan FSA’s.

Designated non-financial businesses and professions

BNM’s policy document for DNFBPs also covers non-bank financial institutions: moneylenders, pawnbrokers, and building credit, development finance, factoring and leasing businesses.

Digital assets

• Treated as securities. Digital currencies and digital tokens have been prescribed as securities since 2019.
• Exchanges and custodians. Digital asset exchanges must register with the Securities Commission as recognised market operators and follow its AML guidelines.
• Unregistered platforms. Banks and payment firms should treat flows to unregistered exchanges as higher risk.

Quick check: are you a reporting institution?

1. Are you licensed or approved by BNM, the Securities Commission or Labuan FSA? If yes, you are almost certainly a reporting institution, and your regulator’s rules apply.
2. Are you a lawyer, notary, accountant, company secretary, estate agent, trust company or dealer in precious metals or stones? If yes, check whether your activity or the cash amount brings you in scope.
3. Do you lend money, take pawns or offer factoring or leasing? If yes, BNM’s policy document for non-bank financial institutions applies.

BNM’s AML/CFT portal has a self-check page that points to the First Schedule of AMLA.

The obligations come from AMLA and BNM’s 2024 policy documents, with matching Securities Commission and Labuan FSA guidelines. The figures below are for financial institutions unless stated.

Key numbers

Thresholds differ by sector, so check the one that applies to your business.

What you must do

Penalties

• Money laundering (section 4). Up to 15 years’ prison and a fine of at least five times the proceeds or RM5 million, whichever is higher. Since March 2026 both prison and fine are mandatory.
• Tipping off and disclosure (sections 14A and 35). A fine of up to RM3 million, up to five years’ prison, or both.
• Breaching BNM directions (section 22). A fine of up to RM1 million, up to three years’ prison, or both.
• Undeclared cash at the border. A fine of up to RM3 million, up to five years’ prison, or both.
• Administrative penalties. Up to RM1 million per offence under the 2026 amendments. BNM has also used its powers under banking laws: HSBC Malaysia entities paid RM3.26 million in 2025, mostly for onboarding customers without sanctions screening.
• Mule accounts. Using another person’s account or payment instrument without lawful purpose carries three to ten years’ prison or a fine of RM10,000 to RM150,000.

Malaysia has been a full member of the FATF since February 2016 and is also a member of the Asia/Pacific Group on Money Laundering (APG). Its latest evaluation, a joint FATF–APG assessment adopted in October 2025, was one of the first under the FATF’s new assessment round.

Current status

The 2025 mutual evaluation

• Process. The on-site visit ran from 3 to 21 February 2025. The FATF plenary adopted the report on 22–24 October 2025 and it was published on 11 December 2025.
• Technical compliance. No Recommendation was rated partially or non-compliant. The 16 largely compliant ratings include R.15 (new technologies), R.24 (beneficial ownership of legal persons), R.22 and R.28 (DNFBPs) and R.36 to R.40 (international co-operation).
• Effectiveness. Six of the 11 outcomes were rated substantial (IO.1, IO.3, IO.6, IO.9, IO.10 and IO.11) and five moderate (IO.2, IO.4, IO.5, IO.7 and IO.8). The 2025 round renumbered the outcomes, so they do not map exactly onto 2015.
• Strengths. Asset recovery: the report records EUR 8.11 billion recovered from 2019 to February 2025, most of it linked to 1MDB.
• Weaknesses. 52 money laundering convictions from 2,648 investigations over the same period, under-used mutual legal assistance, DNFBP supervision needing major improvement, and weaker risk understanding at smaller institutions.
• Next steps. Malaysia has a three-year list of key recommended actions, focused on international co-operation, the sanctions framework and more money laundering prosecutions and convictions.

How the ratings changed

1. July 2007

   APG evaluation against the older 40+9 Recommendations: 9 compliant, 24 largely compliant, 15 partially compliant and 1 non-compliant, out of 49.

2. September 2015

   Joint FATF–APG report: 16 compliant, 21 largely compliant and 3 partially compliant (R.7, R.24 and R.25). Four outcomes substantial, seven moderate. Enhanced follow-up.

3. October 2018

   Follow-up report upgrades R.5, R.7, R.32 and R.34: 20 compliant, 18 largely compliant and 2 partially compliant.

4. December 2025

   Joint FATF–APG report: 24 compliant and 16 largely compliant, no partially or non-compliant ratings. Regular follow-up.

Grey list history

Malaysia has never been on the FATF’s list of jurisdictions under increased monitoring. It was not among the 22 jurisdictions listed after the June 2026 plenary.

What comes next

• Follow-up. In regular follow-up, Malaysia reports on its key recommended actions over three years. No date has been published for the follow-up assessment.
• National roadmap. The NCC Roadmap 2024–2026 is being recalibrated to the 2025 recommendations.
• Plenary to watch. FATF, 26–30 October 2026, Paris.

Malaysia’s 2023 national risk assessment, based on 2020–2022 data and published in December 2024, names fraud, corruption, drug trafficking, smuggling and organised crime as the highest money laundering threats. It lowered terrorist financing risk to medium, and a separate 2024 assessment rated proliferation financing risk medium-low.

Money laundering threats

Scams dominate. The 2025 FATF report cites EUR 685 million lost to online scams from 2021 to April 2024, with more than 95,800 victims. Police reported more than 66,000 online crime cases and almost RM3 billion in losses in 2025, with investment scams the largest category. Courts convicted 969 mule account holders in 2025, according to BNM.

Corruption proceeds remain a major theme. In December 2025 the High Court convicted former prime minister Najib Razak on all 25 1MDB charges, including money laundering; he is appealing. The Malaysian Anti-Corruption Commission reports RM31.3 billion recovered, about 74.5% of the RM42 billion misappropriated.

Most vulnerable sectors

The FATF assessors also gave significant weight to company secretaries and Labuan trust companies. Ratings for every sector were not available to us in full, so check the national risk assessment for your own sector.

Terrorist and proliferation financing

• Terrorist financing: medium. Malaysia is not a source country. The exposure comes from groups in neighbouring countries, such as ISIL, the Abu Sayyaf Group and Jemaah Islamiyah, and cases are mostly self-funded or involve sympathisers.
• Prosecutions. Seven people have been convicted of terrorist financing since 2019. The FATF questioned whether the sentences, of 18 months to six years, are dissuasive.
• Proliferation financing: medium-low. Past cases involved North Korean networks in Southeast Asia. Malaysia cut diplomatic ties with North Korea in March 2021.

Common typologies

Illustrative patterns linked to the threats the assessment identified.

• Mule accounts. Scam proceeds moved quickly through accounts opened or rented by students, workers or the elderly, often across several banks and e-wallets.
• Investment and impersonation scams. Victims send money to fake investment platforms or to callers posing as police, bank or court officials.
• Cash and gold. Proceeds of smuggling or drug trafficking converted into gold, jewellery or other high-value goods.
• Offshore structures. Companies and trusts in Labuan or abroad used to hold assets for politically exposed persons or to hide ownership.

Red flags to watch for

These examples draw on the risks above. They are not an official list; BNM’s policy documents include red flag appendices for each sector.

Eight scenario questions on the main points in this guide. Choose an answer, then open it to check. The answers use only the facts set out above.

1. Question 1. A walk-in customer with no account asks a Malaysian bank to make an occasional transaction of RM30,000. What applies?

   1. Nothing, because the threshold is RM50,000
   2. Customer due diligence, because the threshold for occasional transactions at financial institutions is RM25,000
   3. Only a report to the Securities Commission
   4. The bank must refuse the transaction
   Show answer

   Answer: B. BNM’s policy document requires due diligence for occasional transactions of RM25,000 or more at financial institutions. RM50,000 is the cash threshold for dealers in precious metals or stones.

2. Question 2. A bank onboards a company whose shareholders hold 30%, 22% and 48%. Under BNM’s beneficial ownership test, which shareholders does the bank start with?

   1. None, because no one holds more than 50%
   2. Only the 48% shareholder
   3. The 30% and 48% shareholders, because they hold more than 25%
   4. All three, because each holds more than 20%
   Show answer

   Answer: C. BNM’s test starts with directors and shareholders holding more than 25% of the equity, then looks at control by other means. The 20% reference point applies to companies’ own filings with SSM.

3. Question 3. A compliance officer establishes a suspicion on a Tuesday. By when should the suspicious transaction report reach FIED?

   1. By the next working day, through FINS
   2. Within 30 days
   3. Only once the customer has been told
   4. At the next board meeting
   Show answer

   Answer: A. BNM expects the report to be submitted within the next working day after the compliance officer establishes the suspicion, through the FINS system. Telling the customer would be tipping off.

4. Question 4. A jeweller in Kuala Lumpur sells a gold set for RM55,000, paid in cash. What must the jeweller do?

   1. Nothing, because jewellers are not reporting institutions
   2. File a cash threshold report with the Securities Commission
   3. Refuse all cash payments
   4. Apply customer due diligence, because dealers in precious metals or stones must do so for cash transactions of RM50,000 or more
   Show answer

   Answer: D. Dealers in precious metals or stones are reporting institutions and must apply due diligence to cash transactions of RM50,000 or more with a customer.

5. Question 5. The Minister of Home Affairs adds a new entity to the domestic list. What must a payment firm do?

   1. Wait for a court order
   2. Update its screening list at the next annual review
   3. Update screening, freeze any funds without delay and report holdings to FIED within 30 days
   4. Close the account and return the balance to the customer
   Show answer

   Answer: C. BNM directions require reporting institutions to freeze without delay, block transactions, report holdings within 30 days of the list change and file a report on any match. Late list updates were the most common reason for BNM penalties in 2025–2026.

6. Question 6. A student lets a stranger use her bank account and online banking login for a fee. What is the legal position?

   1. It is a criminal offence under the mule account provisions added to the Penal Code in 2024
   2. It is legal if she does not touch the money
   3. It only breaches her bank’s terms and conditions
   4. It is legal for amounts under RM25,000
   Show answer

   Answer: A. Since October 2024, giving your account or payment instrument to another person, or using one without lawful purpose, is an offence under the Penal Code.

7. Question 7. What did Malaysia’s 2025 FATF evaluation conclude about follow-up?

   1. Malaysia was placed on the grey list
   2. Malaysia stayed in enhanced follow-up
   3. Malaysia was suspended from the FATF
   4. Malaysia was placed in regular follow-up, the best category
   Show answer

   Answer: D. The 2025 report placed Malaysia in regular follow-up, an upgrade from enhanced follow-up after 2015. Malaysia has never been on the grey list.

8. Question 8. A traveller leaving Kuala Lumpur carries cash worth USD 15,000. What must they do?

   1. Nothing, if the cash is in ringgit
   2. Declare it to Customs, because cash and bearer instruments above USD 10,000 equivalent must be declared
   3. Tell their bank afterwards
   4. Declare it only if it exceeds USD 50,000
   Show answer

   Answer: B. Cash and bearer negotiable instruments above USD 10,000 equivalent, in any currency or combination, must be declared to Customs. Failing to declare can lead to a fine of up to RM3 million, prison or both.