Malaysia Compliance Report

Generated 2026-09-22

Comprehensive Framework

Regulatory Overview

Regulatory Status: Dedicated crypto/VA legislation, licensing regime, active enforcement
Key Regulator(s): Securities Commission, United Nations Security Council, Central Bank of Malaysia
Risk Level: low
Primary Legislation: Capital Markets and Services (Prescription of Securities) Order 2019, Guidelines on Digital Assets
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: No capital gains tax for individuals; income tax if trading is a business. P2P trading and offshore platform access remain common.. Business Income (Taxable): If an individual or company engages in systematic, repetitive, and organized trading activities with the intention of profit, it will likely be treated as a "business" under Section 4(a) of the ITA 1967.. Frequency and volume of transactions: High frequency and volume suggest trading.. System and organisation: Use of sophisticated trading strategies, dedicated software, or a structured approach.. Duration of ownership: Short holding periods.

Key Facts

aml Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLATFPUAA 2001) AML/CFT and Targeted Financial Sanctions for Financial Institutions (AML/CFT TFS for FIs) Policy Document (BNM Policy Document): Issued by Bank Negara Malaysia, this comprehensive policy document provides detailed guidance and requirements for reporting institutions to comply with AMLATFPUAA 2001. This document has specific sections/appendices applicable to "Digital Currencies" or "Virtual Assets." Guidelines on Recognised Markets (SC Guidelines): Specifically for operators of recognised markets, including DAX, detailing operational, conduct, and AML/CFT requirements. Role: The central bank of Malaysia and the primary regulator for AML/CFT compliance across all reporting institutions, including VASPs, under the AMLATFPUAA 2001. BNM also houses the Financial Intelligence Unit (FIU) responsible for receiving Suspicious Transaction Reports (STRs). Role: Regulates the capital markets in Malaysia. The SC specifically licenses and oversees Digital Asset Exchanges (DAX) and other entities involved in the offering or trading of digital assets that are classified as securities. SC-regulated entities must comply with both SC-specific AML/CFT requirements and the broader BNM framework. Exchanges between digital currencies and fiat currencies. Exchanges between one or more forms of digital currencies. Transfers of digital currencies.
enforcement Entity Targeted: Binance Holdings Limited and its CEO, Changpeng Zhao (CZ). Violation Type: Operating a Digital Asset Exchange (DAX) without registration/license, which is a violation under the Capital Markets and Services Act 2007. The SC considers digital assets as securities, and operating a platform for trading them requires authorization. Penalty Amount: No explicit monetary fine was announced at the time of the public reprimand. The penalties were operational: a public reprimand, an order to cease all operations in Malaysia, disable access to its website and mobile applications, and cease all media and marketing activities targeting Malaysian investors. Outcome: Binance was forced to shut down its direct operations in Malaysia. Malaysian users were advised to withdraw their funds. The action led Binance to later pursue a compliant pathway to re-enter the Malaysian market by acquiring a stake in and partnering with a licensed local Digital Asset Exchange (DAX), MX Global, demonstrating the effectiveness of the SC's enforcement in driving regulatory compliance. Entity Targeted: Various unauthorized digital asset platforms, investment schemes involving crypto, and individuals promoting them. (Specific names are too numerous to list here, but are updated frequently). Violation Type: Operating or promoting unauthorized investment schemes, digital asset exchanges, or services without the necessary licenses or approvals from the SC Malaysia. Penalty Amount: Typically no specific monetary penalty is announced publicly for being added to the alert list. The "penalty" is a public warning, which often leads to the platform being unable to operate effectively in Malaysia and subsequent cessation of operations or blocking of access. Outcome: Public awareness is raised, and investors are warned against dealing with these entities. This often leads to reduced or ceased operations for the targeted entities within Malaysia.
general Securities Commission Malaysia (SC) Guidelines on Digital Assets: These guidelines, particularly the latest amendments, impose specific AML/CTF requirements on DAX operators (VASPs) licensed by the SC. They mandate the implementation of policies and procedures to prevent money laundering and terrorism financing, which inherently includes sanctions compliance. SC Guidelines on Digital Assets (Revised as at 13 June 2023): https://www.sc.com.my/api/documentms/download.ashx?id=f06536b1-0941-4c67-9c98-dfd79b90c29f (Refer particularly to Chapter 8: Anti-Money Laundering and Countering Financing of Terrorism and Proliferation Financing) Bank Negara Malaysia (BNM) Policy Document on Anti-Money Laundering, Countering Financing of Terrorism and Targeted Financial Sanctions (AML/CFT and TFS Policy Document): This document sets out the regulatory requirements for financial institutions, including reporting institutions dealing with digital assets, regarding AML/CTF and targeted financial sanctions. It is mandatory for VASPs to adhere to the principles and requirements outlined in this policy. BNM AML/CFT and TFS Policy Document (issued 28 September 2023): https://www.bnm.gov.my/documents/20124/963836/AML+CFT+and+TFS+Policy+Document.pdf UN Security Council Consolidated List: This is the primary and mandatory list for screening, as it is directly implemented into Malaysian law. Domestic TFSR List: Any specific lists declared by the Minister under AMLA 2001. Best Practice Screening: Given the indirect applicability of OFAC and EU sanctions, and the global nature of crypto, leading VASPs in Malaysia will also screen against:
licensing SC Malaysia — Digital asset exchange registration, IEO oversight, cease-and-desist enforcement BNM — AML/CFT standards Capital Markets and Services (Prescription of Securities) Order 2019 (2019) — Digital currency and digital token as prescribed securities Guidelines on Digital Assets (2020) — DAX operator requirements VASP: Recognized Market Operator (RMO) — DAX registration with SC. Only 5 operators registered (Luno, Tokenize, MX Global, Sinegy, Hata). SC strict and slow on registrations. 6-12 months. CUSTODY: Included under DAX registration; customer asset segregation required EXCHANGE: DAX registration with SC — MYR 5M (~$1.1M USD) minimum shareholders' funds. SC issued cease-and-desist orders against unregistered operators (incl. Binance 2021). IEO framework requires separate SC approval.
sanctions Direct Implementation: Malaysia implements UN Security Council Resolutions (UNSCRs) related to targeted financial sanctions (TFSR) through the AMLA 2001 and specific Ministerial Orders. The Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities (Declaration of Specified Entities and Reporting Requirements) Order 2014 (and subsequent amendments) lists individuals and entities designated by the UN Security Council as terrorists or terrorist financiers, and those involved in proliferation financing. AMLA 2001: https://www.bnm.gov.my/documents/20124/963836/AMLA+2001.pdf Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities (Declaration of Specified Entities and Reporting Requirements) Order 2014: While a direct official government link might be harder to find due to frequent updates, it is enacted under Section 66B of AMLA 2001 and is referenced extensively in the BNM AML/CFT and TFS Policy Document. The consolidated list is found on the UN website. UN Security Council Consolidated List: https://www.un.org/securitycouncil/sanctions/consolidated-list VASP Obligations: VASPs in Malaysia are required to immediately freeze the funds and assets of individuals and entities on the UN Security Council Consolidated List and the domestic list (derived from the UN list), and report such freezes to the Financial Intelligence Unit (FIU) at BNM without delay. They must also prohibit making any funds or financial services available to such designated persons. Indirect Applicability & Risk: Malaysian VASPs may not be legally compelled by Malaysian law to enforce OFAC sanctions directly, but practical and commercial realities dictate compliance: Correspondent Banking Relationships: Most Malaysian financial institutions rely on U.S. correspondent banks for international transfers. Non-compliance with OFAC sanctions could lead to de-risking by these correspondent banks, affecting a VASP's ability to conduct international transactions.
securities Crypto is legal in Malaysia but regulated through the securities framework administered by the Securities Commission Malaysia (SC), established under the Securities Commission Malaysia Act 1993. A CMSL is required for regulated capital market activities; no digital asset-specific licences have been confirmed under the provided sources. The SC regulates the market through licensing, monitoring fitness and propriety of applicants. The SC has indicated revisions to the Guidelines on Recognized Markets to strengthen the regulatory framework for Digital Asset Exchanges (DAX). The Securities Commission Malaysia (SC) was established on 1 March 1993 under the Securities Commission Malaysia Act 1993 (SCA) and is the sole licensing authority for capital market intermediaries in Malaysia. REGULATION | Securities Commission Malaysia The Capital Markets and Services Act 2007 (CMSA), effective 28 September 2007, introduced a single licensing regime for capital market intermediaries, replacing the Securities Industry Act 1983 and the Futures Industry Act 1993. Licensing - REGULATION | Securities Commission Malaysia The CMSA repealed the earlier acts; under the new regime, a capital market intermediary needs only one licence to carry on one or more regulated activities. Licensing - REGULATION | Securities Commission Malaysia The SC was established under the Securities Commission Malaysia Act 1993 (as amended by Act A1539 effective 24 November 2017). Securities Commission Malaysia Act 1993 - Acts | Securities Commission Malaysia
stablecoin Criteria: If a stablecoin functions as a widely accepted medium of exchange, stores value, and is used for payment purposes, it is likely to be classified as e-money under the Payment Systems Act 2003 (PSA) and the Financial Services Act 2013 (FSA). Key Consideration: BNM's Guidelines on E-Money (BNM/RH/GL 002-7) define e-money as monetary value represented by a claim on the issuer, stored electronically, issued on receipt of funds, and accepted as a means of payment by persons other than the issuer. Payment Systems Act 2003: https://www.bnm.gov.my/documents/20124/960537/Payment+Systems+Act+2003.pdf Financial Services Act 2013: https://www.bnm.gov.my/documents/20124/960537/Financial+Services+Act+2013.pdf Guidelines on E-Money (updated 2021): https://www.bnm.gov.my/documents/20124/938096/Guidelines+on+E-Money.pdf Criteria: If a stablecoin is structured to represent an interest in a company, debt, or an asset, or is offered as an investment product where buyers expect a return, it may be classified as a security token or digital token under the Capital Markets and Services Act 2007 (CMSA). Key Consideration: The SC's Guidelines on Digital Assets define "digital assets" and "digital tokens" and outline the circumstances under which they are considered "securities." The crucial test is whether the token falls within the definition of "securities" in the CMSA, which includes shares, debentures, units in a collective investment scheme, and derivatives. Capital Markets and Services Act 2007: https://www.sc.com.my/api/documentms/download.ashx?id=e74c7e3f-671c-4235-8663-e387c932a39a
status Malaysia regulatory status: comprehensive
tax No capital gains tax for individuals; income tax if trading is a business. P2P trading and offshore platform access remain common. Business Income (Taxable): If an individual or company engages in systematic, repetitive, and organized trading activities with the intention of profit, it will likely be treated as a "business" under Section 4(a) of the ITA 1967. Frequency and volume of transactions: High frequency and volume suggest trading. System and organisation: Use of sophisticated trading strategies, dedicated software, or a structured approach. Duration of ownership: Short holding periods. Financing: Use of borrowed funds for trading. Nature of the asset: While crypto itself isn't productive, the intent behind its acquisition and disposal matters. Taxpayer's motive: Clear intention to make a profit from buying and selling.
travel rule Travel Rule adopted — threshold: MYR 3,000 Bank Negara Malaysia (BNM) Policy Document on Anti-Money Laundering, Counter-Terrorism Financing and Targeted Financial Sanctions for Financial Institutions (AML/CFT and TFS Policy Document): This is the primary document. Specifically, Paragraph 10.1.2 states: "A reporting institution that conducts virtual asset transfers shall apply the obligations outlined in this policy document relating to funds or wire transfers to virtual assets." This explicitly extends the Travel Rule to virtual assets. Official URL (latest version): You can typically find the latest version on BNM's website under their AML/CFT section. As of my last update, a significant version was issued in 2020 with subsequent amendments. Search for "BNM AML CFT Policy Document" on www.bnm.gov.my. Securities Commission Malaysia (SC) Guidelines on Digital Assets: These guidelines govern Digital Asset Exchanges (DAX) and other entities dealing with digital assets. They mandate compliance with BNM's AML/CFT framework. Section 9 (Anti-Money Laundering and Counter-Terrorism Financing): Requires registered Digital Asset Exchanges (DAX) to comply with the AMLA and BNM's AML/CFT and TFS Policy Document. Official URL (latest version): Search for "SC Guidelines on Digital Assets" on www.sc.com.my. Cross-Border Transfers (both traditional and virtual assets): All required originator and beneficiary information must be obtained and transmitted, regardless of the amount.

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-09-06. View full profile