Malaysia's Dual-Regulator Fintech Landscape
Malaysia operates a split regulatory system for financial services: Bank Negara Malaysia (BNM) governs banking, insurance, and payment systems, while the Securities Commission Malaysia (SC) regulates capital markets, digital assets, and investment-related activities. Fintech companies often need to engage both regulators depending on the nature of their services.
Malaysia punches above its weight in fintech innovation for a country of 33 million people. The BNM FinTech Enabler Group (FTEG) runs a well-regarded regulatory sandbox, and Malaysia's digital banking framework (5 licences issued in 2022) has attracted global attention. The country is also a world leader in Islamic fintech — the SC's Shariah-compliant digital asset framework and BNM's Islamic finance expertise create unique opportunities for halal fintech products.
For crypto and digital asset businesses, the SC Malaysia is the primary regulator. The SC recognised its first Digital Asset Exchanges (DAX) in 2019–2020 and has since built out a comprehensive Digital Assets Guidelines framework covering exchanges, IEOs (Initial Exchange Offerings), and digital asset fund management.
Bank Negara Malaysia (BNM) Licence Types
BNM regulates payment services under the Financial Services Act 2013 (FSA) and the Islamic Financial Services Act 2013 (IFSA). The key fintech-relevant licences include:
| Licence Type | Activity | Min Capital | Timeline |
|---|---|---|---|
| E-Money Issuer | Issuing stored-value instruments, prepaid wallets, e-wallets | MYR 5M (large float); MYR 1M (small float < MYR 25M) | 6–12 months |
| Money Services Business (MSB) | Currency exchange, remittance, wholesale currency | MYR 5M–50M depending on activity | 6–9 months |
| Payment System Operator | Operating interbank payment infrastructure | MYR 20M+ | 12–18 months |
| Digital Bank | Full digital banking licence (limited to 5 issued) | MYR 300M (operational); MYR 100M transitional | 18–24 months |
| Issuer of Designated Payment Instruments | Charge cards, debit/credit facilities | MYR 20M | 9–15 months |
Securities Commission: Digital Asset Exchange (DAX)
The SC Malaysia regulates digital assets under a recognition framework for market operators. A Recognised Market Operator (RMO) approval is required before operating a Digital Asset Exchange in Malaysia. As of 2025, approved DAX operators include Luno, MX Global (MXC), Tokenize, and SINEGY.
DAX Recognition Requirements
Paid-Up Capital
Minimum MYR 5 million paid-up share capital. Liquid assets (cash or government securities) of at least 50% of capital (MYR 2.5M) maintained at all times.
Fit & Proper
All controllers (≥5% shareholders), directors, and senior management must pass SC fit and proper assessment. No criminal convictions, no regulatory sanctions, strong financial integrity.
AML/CFT Framework
Comprehensive AML/CFT programme per SC's Anti-Money Laundering guidelines and AMLA 2001 obligations. Digital assets classified as "designated payment instrument" under Malaysian AML law.
Technology & Cybersecurity
SC Technology Risk Management Framework compliance. Mandatory penetration testing, incident response plan, hot/cold wallet segregation (at least 80% in cold storage), customer asset reconciliation procedures.
Customer Asset Segregation
Strict segregation of customer digital assets and fiat. Customer assets held in trust; DAX cannot use customer assets for proprietary trading or business operations. Monthly reconciliation reports to SC.
Listing Rules
Digital assets listed on a Malaysian DAX must meet SC's Digital Assets Assessment Framework. SC maintains a whitelist of approved digital assets; operators cannot list new tokens without prior SC approval.
Initial Exchange Offerings (IEO) Framework
The SC Malaysia's IEO Guidelines (issued 2020) created one of Asia's most structured frameworks for token fundraising. IEOs allow companies to raise capital through digital token offerings hosted on a SC-recognised DAX platform.
IEO Key Parameters
- Maximum IEO fundraising: MYR 100 million per issuer per campaign
- Retail investor cap: MYR 2,000 per issuer per IEO
- Accredited investors (assets > MYR 3M): no individual limit
- IEO host platform must be SC-recognised DAX operator
- Issuer must publish SC-reviewed disclosure document (IEO White Paper)
- 6-month token lock-up for founders and early team members
- Digital assets issued must comply with SC's Digital Asset Assessment Framework
- Post-IEO secondary trading only on SC-recognised DAX platforms
Islamic FinTech: Malaysia's Unique Advantage
Malaysia is the world's most developed Islamic finance market and has translated this strength into Islamic fintech regulation. The SC's Shariah Advisory Council (SAC) has issued specific rulings on digital assets, and both BNM and SC have frameworks for Shariah-compliant fintech products.
SC Shariah-Compliant Digital Assets
The SC's Digital Assets Guidelines allow for Shariah-compliant digital asset offerings. Issuers wishing to market tokens as Shariah-compliant must obtain a Shariah pronouncement from the SC's SAC or an SC-registered Shariah adviser confirming the token structure meets Islamic finance principles (asset-backed, no riba/interest, permissible underlying activity).
BNM Islamic Fintech
Under the IFSA 2013, fintech companies can obtain Islamic variants of BNM licences — e.g., an Islamic e-money issuer licence for Shariah-compliant digital wallets. BNM's FIKRA (formerly known as the Investment Account Platform) supports Islamic equity crowdfunding, and BNM's regulatory sandbox has approved multiple Islamic fintech pilots.
Labuan IBFC: Offshore Fintech Structure
Labuan is a Federal Territory of Malaysia that houses a separate offshore financial centre — the Labuan International Business and Financial Centre (IBFC). Labuan operates under its own regulatory framework (Labuan FSA) and offers significantly lower tax rates for international business, while retaining the benefit of Malaysia's double-tax treaty network (70+ treaties).
| Feature | Labuan IBFC | Mainland Malaysia |
|---|---|---|
| Corporate tax | 3% on audited net profits (trading); 0% on non-trading income | 24% standard; 17% for small companies |
| DTA access | Yes (via Malaysia's treaty network) | Yes |
| Digital Asset Licence | Labuan Digital Token (LDT) regulation under LIFSSA | SC Digital Assets Guidelines (DAX/IEO) |
| Minimum substance | 2 locally-resident directors + 2 FTE staff in Labuan | Standard Malaysian company requirements |
| Customer restrictions | Must primarily serve non-Malaysian customers | Can serve Malaysian residents |
| Regulatory body | Labuan FSA (LFSA) | BNM / SC Malaysia |
The Labuan Digital Token (LDT) framework, introduced in 2020 under the Labuan Financial Services and Securities Act (LFSSA), allows Labuan entities to issue, exchange, or provide custody of digital tokens for international customers. Labuan is particularly attractive for offshore crypto exchanges targeting Southeast Asian customers outside Malaysia.
BNM Financial Technology Enabler Group (FTEG) Sandbox
BNM's FTEG regulatory sandbox has been running since 2016 and has graduated over 30 fintech pilots to full licences. The sandbox allows fintech companies to test innovative products within defined parameters for up to 12 months, with the possibility of extension.
- Sandbox available for payment, lending, insurance, and investment-related innovations
- Participant cap typically limited to 1,000–10,000 customers during sandbox phase
- Transaction value limits imposed to contain systemic risk
- BNM assigns a dedicated relationship manager to each sandbox participant
- Successful graduates receive expedited full licence processing
- SC Malaysia runs a parallel sandbox for capital market fintech innovations
Licence Application Process
-
Pre-Application Consultation
Engage BNM FTEG or SC Digital Markets team for an informal pre-application discussion. Both regulators encourage early dialogue. Confirm which licence(s) are applicable and understand specific requirements for your business model before incurring full application costs.
-
Incorporate Malaysia Entity
Incorporate a Sdn Bhd (private limited company) via the Companies Commission of Malaysia (SSM). Minimum two shareholders and two directors (at least one Malaysian resident director required). Complete SSM registration typically within 1–3 working days.
-
Build Compliance & Technology Infrastructure
Draft AML/CFT programme per SC or BNM guidelines. Establish KYC workflows, transaction monitoring, and sanction screening. For DAX applicants, document technology risk management framework, cybersecurity controls, and customer asset segregation procedures.
-
Submit Formal Application
Submit application to BNM (via BNM eServices) or SC (via eServices portal) with complete documentation: corporate documents, business plan, financial projections, fit and proper declarations, AML/CFT programme, IT architecture description, and source of funds for capital injection.
-
Regulatory Review & Interview
BNM/SC will conduct document review and may invite key management for a formal regulatory interview. Technology inspections may be conducted for DAX applicants. Respond promptly to all information requests — delays extend overall timeline. Both regulators typically issue conditional approvals before final licence.
-
Capital Injection & Licence Issuance
Upon conditional approval, inject required capital into the licensed entity. Submit evidence of capital injection and fulfillment of conditions. Final licence issued by BNM or SC. For DAX, SC recognition order published on SC website. Begin commercial operations within 6 months of licence issuance or risk withdrawal.
Frequently Asked Questions
