AML Reporting Obligations for Businesses in Malaysia Explained

Who is a reporting institution under AMLA?

A reporting institution is any person carrying on an activity listed in the First Schedule to the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Act 613). Since 1 March 2026 the Act's title also refers to anti-restricted activity financing. Bank Negara Malaysia is the competent authority.

Besides banks, insurers and other financial institutions, the First Schedule covers designated non-financial businesses and professions and non-bank financial institutions. Bank Negara's policy document for these sectors, issued on 5 February 2024, lists them:

For the professions, the policy document applies to practitioners, partners and employees of professional firms, not to in-house accountants, lawyers or company secretaries employed by other businesses or by government agencies.

What does customer due diligence require?

Customer due diligence (CDD) means identifying and verifying who you deal with and keeping that information current. Section 16 of AMLA prohibits anonymous accounts and accounts in fictitious or false names, and requires CDD when:

• establishing a business relationship;
• carrying out a transaction above the threshold set for the sector, such as RM10,000 for casinos or RM50,000 in cash for dealers in precious metals or stones;
• there is any suspicion of money laundering or terrorism financing, whatever the amount;
• the business doubts information it obtained earlier.

CDD covers the customer, anyone acting for the customer, and the beneficial owner. For a company, Bank Negara's policy document uses an ownership threshold of more than 25% to identify the individuals behind it. Verification may be delayed only for low-risk customers and for no more than ten working days.

Higher-risk customers need enhanced due diligence. For a politically exposed person, the business must establish both the source of wealth and the source of funds, and obtain senior management approval. Lawyers, accountants, company secretaries and trust companies must apply enhanced checks where they provide nominee services.

If CDD cannot be completed, the business must not open the account, start the relationship or carry out the transaction, must end an existing relationship, and should consider filing a suspicious transaction report.

When must a suspicious transaction report be filed?

A reporting institution must report promptly whenever it has reason to suspect that a transaction involves proceeds of an unlawful activity or instrumentalities of an offence, or is linked to terrorism financing. This duty is in section 14(1)(b) of AMLA. Since 1 March 2026 it extends to activities as well as transactions, and to dealings linked to restricted activities and proliferators.

A suspicious transaction report (STR) goes to the Financial Intelligence and Enforcement Department (FIED) of Bank Negara Malaysia in the form Bank Negara prescribes. Staff raise concerns with the compliance officer, who evaluates them before reporting. Common triggers include:

• a customer whose transactions do not match his or her known income or business;
• a cash property purchase, or a price far above market value;
• a customer who refuses to explain the source of funds or the purpose of a structure;
• payments split to stay below a reporting threshold.

Section 14(1)(a) separately requires reports of transactions above amounts Bank Negara specifies, known as cash threshold reports.

Two protections make reporting safer. Section 20 overrides secrecy obligations for these duties, and section 24 bars civil, criminal or disciplinary proceedings against a person for a report made in good faith.

What is tipping off, and how do businesses avoid it?

Tipping off is telling anyone, including the customer, that a suspicious transaction report has been made or is being made, or passing on information from it. Under section 14A of AMLA it is an offence punishable with a fine of up to RM3 million, imprisonment of up to five years, or both. Recording or further disclosing such information is also caught.

The section allows limited exceptions, such as disclosures needed to carry out duties under the Act, reports to a supervisory authority, sharing customer risk information with a related Malaysian financial group company, and disclosures authorised in writing by the competent authority. A separate offence in section 35 covers disclosures likely to prejudice an investigation, with the same maximum penalty.

In practice the risk arises in ordinary conversations. An estate agent's staff member who tells a buyer the deal is on hold "because compliance has reported it" may commit the offence. Bank Negara's policy document recognises the problem at the CDD stage: if further checks would tip off the customer, the business may stop the checks, record its reasons and file an STR immediately.

• Limit knowledge of STRs to the compliance officer and those who need to know.
• Give front-line staff neutral wording for delays.
• Keep STR files separate from the client file.

What records must be kept, and what else is required?

Reporting institutions must keep CDD and transaction records for at least six years from the date the account is closed or the relationship, transaction or activity ends. This is in section 17 of AMLA, and since 1 March 2026 the records must be enough to reconstruct the transactions and activities. Breaching section 17 is an offence carrying a fine of up to RM3 million, imprisonment of up to five years, or both.

Section 13, as amended in 2026, now covers all domestic and international transactions and activities, and the records must include the identity and address of any person acting for the customer.

Section 19 requires a compliance programme that fits the size of the business, including:

• internal policies, procedures and controls;
• screening of employees and ongoing training;
• an independent audit function;
• a compliance officer at management level.

Bank Negara must be told of the appointment or change of a compliance officer within ten working days. Since 1 March 2026, several Part IV obligations, and liability for offences, extend expressly to the institution's directors, officers and employees, so a director cannot assume that compliance is only the company's problem.

How does Bank Negara enforce AML obligations?

Bank Negara enforces through on-site examinations, compounds, prosecutions and, since 1 March 2026, wider administrative and civil powers. Many offences under AMLA can be compounded under section 92, meaning the institution pays an amount instead of being prosecuted. Published examples include:

In the Labuan case, prosecution began when the first compounds were not paid on time.

The 2025 amendments added a power to issue directions under section 83, with a fine of up to RM1 million for non-compliance, action plans under section 83A, administrative action under section 83B and civil action under section 83C. Directors and officers can also face personal consequences.

If your business receives an examination report, a compound offer or a notice of investigation, take legal advice on the response, and on any link to a money laundering investigation, before you reply.