On 6 April 2026, BNM imposed a RM520,000 penalty on AEON Credit Service (M) Berhad (P.N. 11/2026). An applicant was a positive name match against a sanctions list, and AEON did not reject the application. It also failed to freeze a customer's funds immediately once confirmed as a specified entity. Paragraphs 27.6.2 and 27.6.1 of BNM's policy document set those duties.
What is AMLA, and which elements make up the Act?
AMLA is Act 613, Malaysia's anti money laundering statute, in force since 15 January 2002; on 1 March 2026 its name gained "Anti-Restricted Activity Financing". Act A1761, gazetted on 14 May 2025, brought restricted activity financing (proliferation financing) into the Act, and P.U. (B) 76/2026 fixed the start date.
Like the AML regulations of other jurisdictions, AMLA was written to meet FATF standards. BNM's summary of the Act names its elements: the offences of money laundering and restricted activity financing, measures to prevent those offences and terrorism financing, investigation powers, and the forfeiture of proceeds, terrorist property and proliferator property.
BNM is the competent authority, and its Financial Intelligence and Enforcement Department (FIED) is the financial intelligence unit. Enforcement agencies, among them the Royal Malaysia Police, the Malaysian Anti-Corruption Commission (MACC) and the Royal Malaysian Customs Department, investigate the predicate crimes. Sector supervisors apply the rules. The National Coordination Committee to Counter Money Laundering (NCC), set up in 1999, brings 17 ministries and agencies together, chaired by BNM.
Picture an estate agent in Johor Bahru (an illustrative case) paid a deposit from a stranger's account. If it looks suspicious, the agent owes FIED a suspicious transaction report, while the crime behind it is for the police or MACC.
Who must comply with AMLA in Malaysia?
Any person carrying on an activity listed in AMLA's First Schedule is a reporting institution, branches and subsidiaries included. BNM's reporting institution questionnaire tells you whether your business qualifies. The main groups:
- Banks and development financial institutions. Licensed, investment and Islamic banks; BNM supervises them, and banks file the cash threshold report.
- Insurers and takaful operators. Life business and family takaful; part 14B of BNM's policy document sets their CDD.
- Money services businesses. Money changing, remittance and wholesale currency; CDD sits in part 14C.
- Payment instrument issuers. Non bank issuers of designated payment instruments, electronic money among them.
- Capital market firms. Dealers in securities or derivatives and fund managers, supervised by the Securities Commission Malaysia.
- Labuan financial institutions. Supervised by the Labuan Financial Services Authority.
- Lawyers, accountants and company secretaries. Only for listed work, such as property deals, client money or forming companies.
- Other businesses. Trust companies, moneylenders, pawnbrokers, estate agents, dealers in precious metals or stones, digital currency exchanges, casinos and betting, under BNM's policy document for these sectors.
What are AMLA's measures? The obligations for reporting institutions
Twelve duties follow. The legal basis column cites AMLA, as amended from 1 March 2026, and BNM's policy document for financial institutions (FI PD), in effect since 6 February 2024; other sectors follow the parallel DNFBP and NBFI policy document. complead, formerly Sanction Scanner, appears in the last column with the record it keeps for every row.
| Obligation | Legal basis | What a program must do | How complead does it |
|---|---|---|---|
| Institutional risk assessment and compliance program | AMLA s. 19; FI PD 10.2.1, 10.4.1 and part 11 | Identify, assess and understand money laundering and terrorism financing risk across customers, countries, products, services, transactions and delivery channels, and proliferation financing risk under 10.4; run a compliance program sized to that risk. | Detection rules are versioned with a one click rollback, and the log names who changed each rule, when and why. |
| Compliance officer | FI PD 11.4.2, 11.4.9 | Appoint an officer with enough stature, authority and seniority; tell FIED in writing within ten working days of an appointment or change. | The search audit trail records who ran each screening search, on which name, at what time and with what result. |
| Customer due diligence | AMLA s. 16; FI PD 14A.1 | Identify and verify the customer and the person conducting the transaction on business relations, money changing, wires, electronic money, occasional or cash transactions of RM25,000 and above, on any suspicion regardless of amount, and on any doubt about the veracity or adequacy of information obtained earlier. | One engine holds onboarding, screening and monitoring, so each customer has a single risk score. |
| Beneficial owner | FI PD 14A.9.6 | Identify the natural persons with a controlling ownership interest, at minimum directors or shareholders with equity above 25 percent, then control by other means. | Owners, parents and controlling entities are "followed up the chain until natural persons are reached" in KYB and UBO verification; unresolved layers are reported as unresolved. |
| PEPs and enhanced CDD | FI PD 15.2.1, 15.2.3, 15.3.1 | Treat every foreign PEP as high risk with enhanced CDD; assess domestic PEPs; for higher risk, get source of wealth and funds and senior management approval, and monitor more closely. | Match thresholds can differ by list type and by single list, so a PEP list need not share the threshold of a sanctions list. |
| Suspicious transaction report | AMLA s. 14(1)(b); FI PD 22.1.1 | Report to FIED "promptly" when a transaction or activity, including an attempt, appears unusual, has no clear economic purpose or appears illegal, regardless of amount. | Case management includes reporting support, and agents attach the evidence, a narrative and a work log to each case; the compliance officer decides whether to file. |
| Cash threshold report | AMLA s. 14(1)(a); FI PD 21.3.1, 21.4.3 | Report cash of RM25,000 and above in one account in a day, deposits and withdrawals added, within five working days. | A no code rule adds up each account's cash for the day; before release it is tested against 30, 60 or 90 days of past data. |
| Targeted financial sanctions | FI PD 27.3.5, 27.3.7, 27.4.1 | Keep a database of the UNSCR 1267, 1988, 1718 and 2231 lists and the Home Affairs Domestic List, updated without delay on Gazette publication; screen customers at CDD and during ongoing due diligence. | Lists screened: 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. |
| Wire transfers | FI PD 14A.11.4, 19.2.1 | Standard CDD at RM3,000 and above; cross-border wires of RM3,000 and above carry originator and beneficiary information. | Transaction screening checks both sender and receiver through the API as the transfer is being processed. |
| Ongoing due diligence | AMLA s. 16; FI PD 14A.13 | Check that transactions fit the customer's business and risk profile, and keep CDD documents current, more often for higher risk. | API triggers start or stop ongoing monitoring for each name. |
| Record keeping | AMLA s. 17; FI PD 24.3 | Keep CDD, transaction and analysis records for at least six years, in a form admissible under the Evidence Act 1950. | Searches that found no match stay in the audit trail beside the ones that did. |
| No tipping off | AMLA s. 14A | Do not tell the customer or anyone else that an STR has been or will be filed, except as the Act allows. | The case record shows who reviewed each alert and who decided it. |
For an individual, BNM's minimum CDD record holds nine items, from full name and NRIC or passport number to occupation and employer, each verified against reliable and independent sources.
Two words govern one STR clock. The policy document says "promptly", and BNM's reporting page puts the limit at the next working day after the compliance officer establishes the suspicion. MBSB Bank paid RM560,000 for STRs it never filed, although the transactions fitted its own red flags. Members of the public carry no STR duty and can pass information to BNMLINK instead.
At what ringgit amount does each duty start?
Sanctions screening has no threshold (FI PD 27.4.2), whatever the amount. The other duties start at these lines:
- RM25,000. CDD on occasional transactions, single or linked within a day, and on cash (14A.1(e), (f)); a CTR for that daily cash in one account (21.3.1).
- RM10,000. Standard CDD for money changing (14A.11.2) and casino transactions (DNFBP PD).
- RM3,000. Standard CDD on wires (14A.11.4); full data on cross-border wires (19.2.1).
- RM50,000. Cash deals by dealers in precious metals or stones (DNFBP PD).
Splitting cash to stay under RM25,000 is structuring (AMLA s. 4A).
What must a firm do after a positive name match?
BNM's sanctions guidance and part 27 of the policy document turn a name match into five steps. Each 2026 screening penalty below broke at least one of them.
| Step | Input | Output | Who decides |
|---|---|---|---|
| 1. Update the database | Domestic List published in the Gazette; UNSCR list change | Sanctions database updated without delay (27.3.5, 27.3.7) | Compliance function |
| 2. Screen | New, existing and potential customers; the whole base, dormant accounts included, after each update (27.4.1, 27.4.4) | Potential matches | Screening system flags; analyst reviews |
| 3. Determine | Potential match | True or false match after further inquiries (27.4.8, 27.4.9) | Analyst, then compliance officer |
| 4. Act | True match | Potential customer rejected (27.6.2); funds frozen or transactions blocked immediately (27.6.1) | Compliance officer |
| 5. Report | Frozen funds or rejected customer | Immediate report to FIED and the Inspector General of Police (27.7.1); STR to FIED | Compliance officer |
What penalty does money laundering carry in Malaysia?
On 15 April 2026 a company secretary pleaded guilty to two charges of not filing STRs, under section 86 read with section 14(1)(b) of AMLA, and to two Companies Act 2016 charges brought with the Companies Commission of Malaysia. Fines totalled RM50,000, and the Commission revoked her practising certificate (P.N. 09/2026).
AMLA offences go to court or, with the Public Prosecutor's consent, are compounded (s. 92); for policy document breaches, BNM imposes administrative monetary penalties under the Financial Services Act 2013 and its Islamic, development finance and money services counterparts. Since 1 March 2026, Act A1761 also writes "the director, officer or employee" into the reporting and CDD sections, so people carry the duty too.
| Offence or breach | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Money laundering | AMLA s. 4(1), wording amended by A1761 | Up to 15 years in prison and a fine of at least five times the proceeds or RM5 million, whichever is higher |
| Structuring to avoid the cash threshold report | AMLA s. 4A | Fine up to five times the aggregate sum, up to 7 years in prison, or both |
| Tipping off; records; accounts in a false name | AMLA ss. 14A, 17, 18 | RM3 million fine, 5 years in prison, or both |
| Failing to report under s. 14(1), or breaching BNM's directions on reporting (institution, director, officer or employee) | AMLA s. 14(5), inserted by A1761 | RM1 million fine |
| Any other breach of AMLA, its regulations or BNM requirements | AMLA s. 86 | RM1 million fine where no other penalty is set |
Section 4(1) once said an offender "shall on conviction be liable to imprisonment". It now reads "shall, on conviction, be punished with imprisonment".
Money laundering cases in Malaysia: BNM enforcement in 2025 and 2026
Malaysia's best known case, 1MDB, sits among the biggest money laundering scandals. BNM's enforcement register shows the routine side: late or missing reports and sanctions screening gaps.
| Date | Firm | What BNM found | Penalty |
|---|---|---|---|
| 20 Nov 2025 | MBSB Bank | No STRs although transactions fitted its internal red flags | RM560,000 |
| 20 Nov 2025 | SME Development Bank | STR not submitted promptly | RM460,000 |
| 10 Dec 2025 (plea 15 Apr 2026) | Company secretary, Continuum Corporate House | Two STRs not submitted | RM50,000 total court fine (AMLA and Companies Act) |
| 19 Jan 2026 (announced 29 Apr 2026) | Zurich General Insurance Malaysia and Zurich General Takaful Malaysia | Domestic List database not updated; customers not screened against it; potential match not resolved; funds not frozen and no immediate report | RM1,040,000 and RM520,000 |
| 6 Apr 2026 | AEON Credit Service | Applicant with a positive name match not rejected; customer funds not frozen immediately | RM520,000 |
| 15 Apr 2026 | Setel Ventures | Database not updated on Domestic List publication; whole base not rescreened; potential match not resolved | RM637,500 |
| 10 Jun 2026 | Standard Chartered Bank Malaysia and Standard Chartered Saadiq | Domestic List not kept current; customers not screened against it | RM132,000 each |
| 10 Sep 2026 | AmBank and AmBank Islamic | Cash threshold reports not submitted promptly | RM276,000 each |
Selected AML actions; administrative monetary penalties unless marked, as published on BNM's register (read 3 November 2026).
Malaysia according to FATF: the 2025 mutual evaluation
Malaysia joined FATF in February 2016 and has belonged to the Asia/Pacific Group on Money Laundering (APG) since May 2000, BNM records. Assessors evaluated it in 2001, 2007 and 2014. Each round tests the laws against the FATF Recommendations and checks how well they work in practice; the NCC leads Malaysia's preparation.
On 24 October 2025 the FATF Plenary in Paris adopted Malaysia's fifth round mutual evaluation, a joint FATF and APG assessment based on an on site visit in February 2025. The APG published the report on 11 December 2025, and FATF's summary gives Malaysia a roadmap of Key Recommended Actions to complete within three years.
At home, the National Risk Assessment 2023 is Malaysia's fifth. BNM shares its results with reporting institutions and supervisors so they can set priorities, so your own risk assessment should cite it. The APG holds its 2026 Typologies Workshop from 14 to 16 December.
AML solutions for Malaysia: can your system add up a day of cash?
BNM's own example: a RM20,000 deposit and a RM10,000 withdrawal on one account in one day are not offset. They add up to RM30,000, so the bank files a CTR (FI PD 21.3.2). An illustrative day: RM15,000 in cash at 10am and RM12,000 at 3pm make RM27,000, and a CTR is due within five working days. RM24,000 a day for a week triggers no CTR, yet it looks like structuring under section 4A and may warrant an STR.
Your monitoring system has to hold that arithmetic. In complead's transaction monitoring, a team writes the RM25,000 daily sum per account as a rule without code and backtests it over the past 30, 60 or 90 days; each later change is logged with who made it and why.
The compliance officer decides and files on FINS, while agents close routine cases with the evidence, a narrative and the work log attached. Ask any vendor, complead included, how fast a Gazette update to the Domestic List reaches its database: that gap sits behind the Setel and Standard Chartered penalties.
Which AML changes reached Malaysia between May 2025 and November 2026?
- 14 May 2025. Act A1761 gazetted.
- 24 October 2025. The FATF Plenary adopted Malaysia's mutual evaluation, published on 11 December 2025 with Key Recommended Actions due within three years.
- 20 November 2025. BNM penalized MBSB Bank and SME Development Bank over STRs.
- 19 January 2026. BNM penalized Zurich General Insurance Malaysia and Zurich General Takaful Malaysia RM1,040,000 and RM520,000 over sanctions screening, announced on 29 April 2026.
- 1 March 2026. A1761 in force: the new name, restricted activity financing, the section 4 wording, duties on directors, officers and employees, and section 22 deleted.
- April to June 2026. Penalties on AEON Credit, Setel Ventures and two Standard Chartered entities over sanctions screening.
- 10 September 2026. AmBank and AmBank Islamic penalized for late CTRs.
Still open: BNM's AMLA page says it does not yet incorporate A1761, and its penalties page still lists section 22, so read the amended Act beside both. The FI and DNFBP policy documents in force are the February 2024 editions, issued before A1761.
Onboarding is the next question once these obligations are mapped: which documents verify an NRIC holder or a foreign customer, and where eKYC fits BNM's CDD rules. KYC requirements by country sets Malaysia's onboarding rules beside its neighbors'.
The Malaysia AML file: checklist and two templates (PDF)
Every rule above stays open on this page. What the 16 page PDF (2026 edition) adds is paperwork you can file: a program checklist in 14 points, a template of customer risk factors for Malaysia, and a decision record for suspicious transaction cases you reviewed and chose not to report.
