MY v13.3.0
content: ai_generated 118 sources retrieved model claude-opus-4-8 · 2026-06-24

Malaysia

MY schema world-payments-v1 trajectory: not yet assessed

Last updated · 14 modules · 64 sourced findings · 138 sources in the cumulative register

14Modulesbaseline.modules[]
64Findingsmodules[].findings[]
33Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 14 rendered modules; click to filter)
No modules moved this cycle.

Jurisdiction brief

Latest update · 11 October 2026

Lead Signal

Malaysia's Budget 2027 announcement has confirmed a new Basic Credit Card (BCC) regime, requiring banks to begin phased rollout from October 2026 of credit cards capped at a maximum interest or profit rate of 14% per annum, with free balance transfers available from existing cards. This is a direct conduct-and-pricing intervention into the consumer credit-card market rather than a licensing or market-structure change, and it lands as the most concrete, Confirmed-confidence payments development for Malaysia this period. The measure signals a consumer-conduct-first posture from Budget 2027, prioritizing affordability caps over market liberalization in the card-issuing segment.

14 of 14 modules
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Consumer Credit Act 2025 (Act 873) in force 1 March 2026 under new Consumer Credit Commission; licensing/registration commences 1 June 2026 with transition to 30 Nov 2026.

Standing sub-brief · as of 7 July 2026264 words · last cycle 2026-10-04

Licensing, Authorisation & Market Access

Malaysia operates a single-regulator payments regime under Bank Negara Malaysia (BNM), with market access governed by the Financial Services Act 2013 (FSA) and its Islamic-finance counterpart, the Islamic Financial Services Act 2013 (IFSA). There is no separate electronic-money-institution licence of the kind seen in the UK or EU; instead, operators route through three FSA mechanisms: payment-system-operator (PSO) approval under section 11, designated payment-instrument approval under section 11 for e-money and card schemes, and merchant-acquiring registration under section 17. The FSA repealed and consolidated the former Payment Systems Act 2003, with deemed continuity preserved for approvals granted under the earlier regime. Both bank and non-bank entities are authorisable under this framework, and local incorporation or presence is generally required for market entry. This single-regulator, non-EMI-regime architecture is the foundational market-access fact for any payments operator assessing entry into Malaysia: rather than a licence taxonomy split by activity type, BNM applies a unified approval process spanning payment-system operation, e-money issuance and merchant acquiring, with prudential and conduct obligations attached to each approval type rather than to a standalone licence class.

Periodic update · new data 2026-09-28

Licensing, Authorisation & Market Access

Malaysia's licensing perimeter for payments-adjacent credit activity expanded materially this cycle. The Consumer Credit Act 2025 (Act 873) was gazetted 31 December 2025 and came into force on 1 March 2026, establishing the Consumer Credit Commission (SKP) as an independent regulator for buy-now-pay-later, leasing, factoring, debt-collection and debt-counselling activities. This creates a licensing perimeter for sectors that had previously operated without dedicated prudential or conduct oversight, most notably BNPL, which had scaled significantly in Malaysia's consumer market ahead of any bespoke regulatory framework. Licensing and registration requirements for credit providers and credit service businesses take effect 1 June 2026, with a transition period running through to 31 December 2026, giving existing market participants roughly seven months to achieve compliance before enforcement of the full licensing requirement begins.

Separately, Malaysia's Real-time Retail Payments Platform (RPP), operated by PayNet, was confirmed as a designated payment system as of March 2026 under the Financial Services (Designated Payment System) Order 2023. This designation formalises RPP's position within Malaysia's supervised payments infrastructure, distinguishing it from the newly-licensed non-bank credit-services perimeter being built out under the Consumer Credit Act. The bank-PSP versus non-bank credit-services distinction is material here: RPP's designation operates through the existing bank-centric payment-systems oversight architecture, while the Consumer Credit Commission's new licensing regime is purpose-built for non-bank credit providers that fall outside that architecture.

Outlook

The 31 December 2026 end of the Consumer Credit Act's transition period is the key date for Malaysia's licensing perimeter this cycle. Market participants in BNPL, leasing, factoring, debt-collection and debt-counselling that have not secured licensing or registration by that date, following the 1 June 2026 requirement effective date, will fall outside the newly-formalised regulatory perimeter. Watch for Consumer Credit Commission guidance clarifying scope boundaries for these sectors as the transition period progresses.

3 earlier distinct update(s)
Periodic update · new data 2026-09-14

Licensing, Authorisation & Market Access

Malaysia's payment-systems licensing and market-access architecture is undergoing a structural consolidation this cycle. The Real-time Retail Payments Platform (RPP), the infrastructure underpinning DuitNow, carries a confirmed designation as a designated payment system under the Financial Services (Designated Payment System) Order 2023, establishing its regulatory standing as core national payment infrastructure. Alongside this standing designation, Bank Negara Malaysia's revised Policy Document on Electronic Money took effect 31 January 2025, introducing a two-tier issuer regime distinguishing e-money issuers by scale or risk profile; this fact carries Probable confidence, resting on a single Tier-4 aggregator source for the precise effective date pending further corroboration.

The most consequential development is Bank Negara Malaysia's Interoperable Fund Transfer Framework (IFTF), which requires all banks and e-wallet operators to retire proprietary and closed-loop QR payment networks by 30 June 2028 in favour of the interoperable DuitNow QR standard. This is a confirmed, materially significant market-access mandate: it removes the option for individual banks or e-wallets to maintain closed-loop QR ecosystems, pushing the entire retail payments market toward a single interoperable rail. For both bank-affiliated payment service providers and non-bank payment-instrument/e-money issuers, this represents a structural narrowing of permissible technical architecture rather than a change to licensing eligibility criteria themselves; both bank-PSPs and non-bank PIs/EMIs face the same 2028 deadline under the IFTF, though the two-tier e-money issuer regime under the revised Policy Document differentiates obligations by issuer scale within the non-bank segment specifically.

Outlook

The two-year runway to the 30 June 2028 QR-retirement deadline is the operative market-access timeline for the sector. Continued monitoring of BNM guidance on the two-tier e-money issuer regime's specific thresholds, and of migration progress among proprietary QR-network operators, will clarify how orderly this consolidation proves to be.

Periodic update · new data 2026-08-25

Licensing, Authorisation & Market Access

The Consumer Credit Act 2025 (Act 873) is the defining licensing-and-market-access development for Malaysia this cycle. Gazetted on 31 December 2025, the Act entered into force on 1 March 2026, with Part V, the licensing provisions, commencing separately on 1 June 2026. The Act establishes a unified statutory regime for buy-now-pay-later providers, leasing companies, factoring companies, and debt-collection businesses, replacing what had previously been a fragmented multi-ministry patchwork of oversight split across Bank Negara Malaysia, the Securities Commission, and other legacy ministries.

A newly-established Consumer Credit Commission, known as SKP, is the new licensing and registration authority under the Act. BNPL, leasing, and factoring companies must obtain an SKP licence; debt-collection agencies, impaired-loan-acquisition entities, and debt-counselling agencies must register with SKP instead. A six-month transition period runs from 1 June to 30 November 2026, during which existing market participants must complete their licence or registration applications as oversight is phased in from the legacy ministries.

Outlook

The transition deadline of 30 November 2026 is the key near-term watchpoint. Whether SKP completes the phased transfer of oversight from the legacy ministries smoothly, and whether the existing BNPL, leasing, factoring, and debt-collection population completes licensing or registration within the six-month window, will determine whether this reform is remembered as an orderly consolidation or a disruptive one.

Periodic update · new data 2026-08-11

Licensing, Authorisation & Market Access

Bank Negara Malaysia's regulatory-perimeter clarification for electronic money took effect on 31 January 2025 through a revised e-money Policy Document and accompanying FAQ, formally exempting limited-purpose e-money issuers from BNM's purview under two 2024 Exemption Orders, P.U.A 463/2024 and its Islamic-finance equivalent P.U.A 461/2024. This is a genuine perimeter-narrowing event rather than a mere clarification of existing practice: the Financial Services (Limited Purpose Electronic Money) (Exemption) Order 2024 supersedes the prior full-scope supervisory treatment that had applied to limited-purpose issuers, meaning a defined category of e-money issuer now sits outside BNM's direct licensing perimeter entirely.

At the same time, BNM's licence-processing channel for new payments entrants remains active: SunRate's licence approval, reported 28 April 2026, illustrates continued throughput for new entrants even as the regulator narrows its supervisory scope at the margins. This is a single T3-sourced report without primary BNM licence-register confirmation this cycle, so it is best read as an illustrative data point on continued market access rather than a confirmed count of new licensees.

Read together, these two developments describe a liberalising market-access posture this cycle: BNM is simultaneously narrowing which e-money issuers require its direct oversight and continuing to process new licence applications. The distinction between bank and non-bank payment institution treatment is central to reading this correctly: the e-money exemption orders apply specifically to non-bank e-money issuers operating limited-purpose models, and do not alter BNM's supervisory posture toward bank-issued e-money or full-purpose non-bank e-money issuers, which remain within the standard licensing perimeter.

Outlook

Further BNM licence-processing activity for new payments entrants is expected through the remainder of 2026 via the existing sandbox and standard application channels. Primary-source confirmation of the SunRate approval, and of the practical operating impact of the two 2024 Exemption Orders on the limited-purpose e-money issuer population, are the most valuable confirmations to seek next cycle.

Sources and findings (5)
  1. T3https://www.lexology.com/library/detail.aspx?g=efce9f8d-681b-47e9-b293-cd3552dbf3c8 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  2. T1https://www.bnm.gov.my/-/pd-pso-2022retrieved
  3. T1https://www.bnm.gov.my/application-for-approval-and-registrationretrieved
  4. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T1https://www.commonlii.org/my/legis/consol_act/psa2003221/retrieved

#

BNM's Technology Requirements Policy Document (TR PD) — a four-tier technology-governance framework for payment regulatees — was issued March 2026 (substantive effect 12 March 2027), overlapping the existing RMiT regime and newly capturing licensed money-services businesses.

Horizon · 2026-04-01 (±quarter)BNM Policy Document on Complaints Handling in forcein_force_pending · T3
Standing sub-brief · as of 7 July 2026320 words · last cycle 2026-10-11

Conduct, Safeguarding & Promotions

The live conduct-and-safeguarding story in Malaysia is the revised Policy Document on Electronic Money, effective 31 January 2025, which replaced the 2022-vintage PD and materially raised the bar for non-bank e-money issuers. Large-scheme issuers must now hold customer funds in a Trustee Act 1949 trust account maintained with a licensed institution; small-scheme issuers must use a separated or dedicated deposit account managed on trust-like terms; and Shariah-compliant e-money issuers use a qard structure within a Shariah-compliant trust or dedicated deposit account. The revised PD also tightens governance and cybersecurity expectations and introduces a three-year exit-strategy requirement for issuers. Minimum capital is tiered at RM100,000 for small-scheme issuers and RM5 million, or 8% of outstanding e-money liabilities, for large-scheme issuers. Because Malaysia has no FSCS-style deposit-protection scheme extending to non-bank e-money balances, this trust/segregation mechanism is the primary consumer-fund protection in the wallet-dominated Malaysian market — a market where non-bank issuers outnumber bank issuers by roughly eight to one. Confidence in this reading was upgraded to Confirmed following verification that the revised PD is in force via a Bank Negara Malaysia primary source. On the conduct side, BNM issued a Policy Document on Complaints Handling on 28 March 2025, superseding 2009-vintage guidelines. It applies to financial service providers including eligible e-money issuers and establishes an escalation pathway to the Financial Markets Ombudsman Service or BNMLINK. Most of the document enters force on 1 April 2026, though Paragraph 12 took effect immediately on issuance (28 March 2025).

Periodic update · new data 2026-10-11

Conduct, Safeguarding & Financial Promotions

Bank Negara Malaysia confirmed, via the Budget 2027 statement, a new Basic Credit Card (BCC) regime under which banks will begin offering basic credit cards in phases from October 2026, with a maximum interest or profit rate capped at 14% per annum and free balance transfers from existing cards. This is a direct conduct intervention in the card-issuing market: rather than relying on competitive dynamics or disclosure-based consumer protection, the regulator is capping the price of a specific credit product category outright. The phased rollout language indicates banks will not all launch compliant products simultaneously, and the free-balance-transfer feature is designed to let existing cardholders migrate to the capped product without cost penalty, which should accelerate uptake once products are available.

This measure sits squarely within conduct and financial-promotions territory because it constrains both the pricing term sheet banks can offer and, implicitly, how the product can be marketed: a basic credit card capped at 14% is a distinct product category from standard credit cards, and banks will need to ensure promotional materials clearly distinguish the two so consumers understand which rate applies to which product. The regime applies to the bank-PSP segment specifically, as it is a credit-card-issuing intervention tied to banking licenses rather than a non-bank payment-instrument or e-money rule.

The broader significance is that Budget 2027 has set a consumer-conduct-first tone for Malaysia's payments agenda this period: rather than opening market access or adjusting licensing thresholds, the government's most concrete payments intervention is a price cap paired with a friction-reducing balance-transfer feature. That combination suggests policymakers are targeting household debt-service costs on revolving credit specifically, rather than addressing payments infrastructure, scheme rules, or merchant-side dynamics.

Outlook

The near-term marker to watch is the pace and completeness of the phased bank rollout beginning October 2026: whether all card-issuing banks bring compliant basic-credit-card products to market within the announced phase-in window, and whether uptake is material given the free-balance-transfer incentive. Given the cap is now confirmed via the Budget 2027 statement, further conduct-side detail, including precise eligibility criteria, promotional disclosure requirements, and any BNM guideline elaborating phase-in timing by bank size or segment, is the next thing to track as implementation proceeds through the final months of 2026.

1 earlier distinct update(s)
Periodic update · new data 2026-08-11

Conduct, Safeguarding & Financial Promotions

Bank Negara Malaysia's Technology Requirements Policy Document (TR PD) took effect in March 2026, with its substantive obligations becoming effective 12 March 2027. The TR PD introduces a four-tier proportional technology-governance structure that overlaps the existing Risk Management in Technology (RMiT) framework, and it extends coverage beyond RMiT's traditional bank-centric scope to capture e-money issuers, merchant acquirers, licensed money-services businesses and PayNet itself. This is the clearest conduct-and-safeguarding-adjacent development of the cycle: extending technology-governance obligations to non-bank payment institutions and the domestic scheme operator alongside banks addresses a proportionality gap between bank-grade and non-bank-grade technology oversight that has been a structural feature of Malaysia's payments-conduct regime.

The TR PD's tiering structure is explicitly proportional rather than uniform: entities already captured under RMiT sit in Tier 1, larger regulatees crossing defined annual transaction-value or volume thresholds face fuller Tier 2 obligations, smaller entities fall under a lighter Tier 3, and non-digital money changers sit in Tier 4. This tiering approach means the practical conduct burden on any individual payment institution depends heavily on its transaction scale, and a merchant acquirer or e-money issuer should not assume uniform treatment with its bank counterparts under the new framework.

Sourcing for the TR PD itself is a single Tier 4 advisory-firm article, with no primary Bank Negara Malaysia policy-document URL captured this cycle; this is recorded as an explicit sourcing gap and the finding should be treated as reported rather than fully confirmed pending primary-source retrieval.

Outlook

Primary-source confirmation of the TR PD from Bank Negara Malaysia directly is the priority research item for this module next cycle, together with market clarity on tier-applicability boundaries, which advisory-firm commentary suggests remains an active point of confusion among regulatees ahead of the March 2027 effective date. Payment institutions should expect a 90-day gap-analysis and remediation-plan submission requirement following licence-approval issuance once the framework is confirmed.

Sources and findings (5)
  1. T3https://www.rahmatlim.com/perspectives/articles/23492/mykh_new-bank-negara-policy-document-updates-e-money-regulatory-framework [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  2. T3https://fintechnews.my/47925/digital-banking-news-malaysia/bnm-e-money-policy-impact-issuers-consumers/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.lexology.com/library/detail.aspx?g=27648eab-afb4-4322-9f88-cf29c6ed67d5 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.lexology.com/library/detail.aspx?g=d9ca31ce-34a4-4352-9b88-e9cc03e27f00 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

Malaysia has NO finalised payment-stablecoin framework in force as of mid-2026. Crypto/digital assets that exhibit investment characteristics are classified as securities and regulated by the Securities Commission Malaysia (SC) under the Capital Markets and Services Act 2007 and the 2019 Prescription Order; BNM retains monetary/financial-stability and AML oversight, and does not recognise crypto as legal tender. Stablecoins are not yet specifically regulated; routing is activity-dependent (payment-use may trigger BNM payment-instrument licensing, trading/custody falls to SC). BNM launched a Digital Asset Innovation Hub (DAIH) in June 2025 and is evaluating ringgit-pegged stablecoin pilots; reserve expectations are converging on 1:1 fiat backing. A CBDC remains exploratory (Project Dunbar).

Horizon · 2026 (±multi_year)BNM payment-stablecoin framework / DAIH pilot outcomesproposed · T3
Horizon · 2026 (±multi_year)BNM payment-stablecoin framework / DAIH pilot outcomesproposed · T3
Standing sub-brief · as of 7 July 2026235 words · last cycle 2026-10-11

Stablecoins & Digital Money

Malaysia has no finalised payment-stablecoin licensing regime in force as of mid-2026. Regulatory routing is activity-dependent: stablecoin use for payment purposes may trigger BNM payment-instrument licensing, while exchange, custody and trading activity falls to the Securities Commission under the Capital Markets and Services Act 2007 and the 2019 Prescription of Securities (Digital Currency and Digital Token) Order. Reserve expectations are converging on 1:1 fiat backing even in the absence of a codified rulebook. BNM's Digital Asset Innovation Hub, launched June 2025, is evaluating a reported 30-plus ringgit-stablecoin project submissions, and BNM is separately exploring central bank digital currency questions through Project Dunbar. This is an absence-of-framework finding rather than a confirmed negative; no Tier-1 or Tier-2 source has yet announced either a finalised regime or a definitive decision not to regulate, so the Assessed confidence tier reflects genuine calibration rather than under-research. For operators considering a ringgit-pegged stablecoin, the practical consequence is market-access uncertainty pending the outcome of BNM's DAIH pilot programme.

Periodic update · new data 2026-10-11

Stablecoins & Digital Money

Two distinct stablecoin-related developments mark this period for Malaysia. First, Bank Negara Malaysia and the Hong Kong Monetary Authority announced, on 7 October 2026, agreement to establish a joint policy-focused workstream exploring compliant cross-border stablecoin use cases between the two jurisdictions. This finding carries Probable rather than Confirmed confidence, as only trade-press coverage was located this period with no primary BNM or HKMA notice identified; it should be read as a cooperation-stage, policy-exploration announcement rather than a commenced bilateral framework or domestic stablecoin issuance regime. Second, the Securities Commission Malaysia's 14th revision of the Guidelines on Recognized Markets for Digital Asset Exchange operators, effective 20 May 2026, remains the governing in-force framework for DAX operators, with existing operators given until 20 May 2028 to meet new segregated capital and shareholding thresholds. That framework is a standing feature confirmed unchanged beyond the addition this period of DAX operators onboarding to the Financial Markets Ombudsman Service during 2026, giving retail digital-asset investors a formal dispute-resolution channel.

The combination of these two items supports the key judgment that Malaysia's current posture on digital money is cautious and cooperation-oriented rather than oriented toward near-term domestic stablecoin issuance. The DAX guidelines framework governs exchange-traded digital assets and their custody and operator standards, but it does not itself constitute a stablecoin-issuance licensing regime; and the BNM-HKMA workstream, while notable as the first concrete cross-border cooperation signal on stablecoins for Malaysia this period, remains exploratory. No indication was found this period that BNM intends to authorize a Malaysia-domiciled stablecoin issuer in the near term, nor that the cross-border workstream has produced any binding instrument.

The nonbank-PI/EMI segment is the more directly affected population for the DAX guidelines' transitional capital and shareholding requirements, since DAX operators are licensed under the Recognised Market Operator framework rather than as banks; the distinction matters because the capital adequacy expectations being phased in are calibrated to a non-bank platform-operator model rather than bank prudential standards.

Outlook

The stablecoin tracker for Malaysia remains on a watch trajectory. The key marker ahead is whether the BNM-HKMA cooperation workstream produces a primary regulatory notice, consultation paper, or joint statement that moves beyond trade-press characterization and specifies concrete terms for cross-border stablecoin use cases. On the DAX exchange side, the multi-year transition to the new capital and shareholding requirements continues toward its 20 May 2028 deadline, a structural compliance runway rather than a near-term event, but one firms affected by the 14th-revision Guidelines will need to plan against steadily rather than at the deadline itself.

Sources and findings (5)
  1. T1https://www.sc.com.my/regulation/guidelines/digital-assetsretrieved
  2. T3https://globallawexperts.com/stablecoins-regulation-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://www.sanctionscanner.com/blog/cryptocurrency-regulations-in-malaysia-1180 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.kevinwuassociates.com/post/cryptocurrency-legality-in-malaysia-a-2025-legal-overview [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.lexology.com/library/detail.aspx?g=01ac9292-6db7-4569-91ea-5fa6f006ec7c [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

TR PD issued 12 March 2026, consolidating technology-risk governance into a four-tier proportionality structure; BNM enforcement record shows escalating cybersecurity-related penalties including Bank Rakyat's second AMP in seven months.

Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. Open this jurisdiction's page on Dataprotection.gi →

Horizon · 2027-09-30 (±quarter)RMiT 2025 stand-in-processing / capacity obligations bindin_force_pending · T3
Standing sub-brief · as of 7 July 2026244 words · last cycle 2026-10-04

Operational Resilience & Critical Infrastructure

BNM's Risk Management in Technology (RMiT) policy document, issued 28 November 2025, is a substantial revision of the 2019/2020 framework (as further updated 1 June 2023) and functions as Malaysia's DORA-analogue. It applies to banks, insurers and takaful operators, development financial institutions, payment system operators and approved e-money issuers. The policy sets prescriptive tolerances: critical systems face a maximum tolerable downtime of 120 minutes per incident and four hours cumulative annually; incidents must be notified to BNM within one hour of detection, with a full report due within 14 days and a post-incident review within 30 days. Stand-in-processing and capacity obligations do not bind immediately — firms have until 30 September 2027 to comply. The regime also requires dual reporting to the National Cyber Security Agency under the Cyber Security Act 2024. A November 2024 exposure draft signalled BNM's intent to extend equivalent resilience standards to non-bank merchant acquirers, a scope expansion that would bring RMiT-style obligations to a wider non-bank population than the current in-force text covers.

Periodic update · new data 2026-09-28

Operational Resilience & Critical Infrastructure

Bank Negara Malaysia published a consolidated Technology Requirements Policy Document for payment-services regulatees (pd-tecreq-psr-mar2026) on 12 March 2026. The document introduces a tiered, proportionate cyber and technology-risk framework applicable to licensed payment-service providers, e-money issuers and virtual-asset service providers, replacing what had previously been dispersed technology-risk requirements across separate instruments. A 90-day gap-analysis deadline follows publication, with full compliance required by 12 March 2027, giving the regulated population roughly one year from publication to achieve complete conformance with the consolidated standard.

A separate, less-corroborated report indicates that Bank Negara Malaysia's Risk Management in Technology (RMiT) framework is being updated with new authentication rules pushing the industry away from SMS one-time-passwords toward passkeys, adaptive multi-factor authentication and device binding. This report is sourced to a single secondary outlet this cycle and has not been independently corroborated against a primary Bank Negara Malaysia publication, so it is presented here at reduced confidence relative to the Technology Requirements Policy Document itself, which is confirmed via primary-source retrieval.

Outlook

The 90-day gap-analysis deadline following the 12 March 2026 publication date, and the subsequent 12 March 2027 full-compliance deadline, are the two dates to track for Malaysia's operational-resilience perimeter this cycle. Independent corroboration of the RMiT authentication update would materially increase confidence in that specific development; until then it should be treated as a secondary-sourced signal rather than a confirmed regulatory change.

3 earlier distinct update(s)
Periodic update · new data 2026-09-14

Operational Resilience & Critical Infrastructure

Bank Negara Malaysia imposed a RM1,000,000 Administrative Monetary Penalty on Bank Kerjasama Rakyat Malaysia Berhad for breaches of the Risk Management in Technology Policy Document (RMiT PD) and the Management of Customer Information and Personal Data Policy Document (MCIPD PD), following a cybersecurity incident involving unauthorised external access. This is a confirmed, Tier-1-sourced enforcement action drawn from BNM's own primary press release, and it is the clearest operational-resilience signal in Malaysia's payments environment this cycle.

The action illustrates that BNM's technology-risk and customer-data-management policy frameworks carry real financial consequences for breaches, evidencing an actively enforced rather than merely aspirational resilience-standard regime. As a bank-affiliated payment service provider, Bank Kerjasama Rakyat Malaysia's exposure here sits squarely within the bank-PSP supervisory track that BNM applies to licensed banking institutions, distinct from the resilience expectations BNM applies to non-bank payment-instrument issuers and e-money institutions, though both categories fall under the same underlying RMiT policy architecture.

Outlook

Whether this enforcement action is followed by comparable actions against other institutions, bank or non-bank, will determine whether this represents an isolated case or the leading edge of a broader supervisory sweep on technology-risk and customer-data-protection compliance across Malaysia's payments sector.

Periodic update · new data 2026-09-08

Operational Resilience & Critical Infrastructure

Malaysia's core settlement infrastructure has been materially upgraded with the 2025 launch of RENTAS+, an upgraded core settlement platform that delivers near real-time, 24/7 processing, replacing the prior batch-oriented settlement cadence with continuous availability. This is a bank-side infrastructure development: RENTAS is the interbank real-time gross settlement system Bank Negara Malaysia operates, and the RENTAS+ upgrade sits squarely within the bank-supervised settlement layer rather than the non-bank payment-institution space. Alongside the settlement-platform upgrade, Malaysia completed full adoption of ISO 20022 messaging for cross-border payments ahead of the global SWIFT migration deadline, and is reported to be the first country to complete this transition. ISO 20022 adoption matters operationally because it replaces the older, less structured MT-format messaging with a richer, structured data format that materially improves straight-through-processing rates and reduces manual intervention in cross-border payment reconciliation, a resilience benefit as much as an efficiency one, since manual intervention is itself an operational-risk vector.

Together, the RENTAS+ near-real-time settlement capability and full ISO 20022 adoption represent a genuine critical-infrastructure modernisation rather than a cosmetic system update, and the sequencing, settlement-platform upgrade paired with messaging-standard modernisation, is the combination that typically underpins the kind of cross-border corridor integration Malaysia is separately pursuing through regional instant-payment linkages.

Outlook

The question for coming cycles is whether RENTAS+'s near-real-time settlement capability and Malaysia's completed ISO 20022 migration produce measurable improvements in cross-border payment processing times or failure rates, and whether the infrastructure upgrade is followed by comparable resilience investment on the non-bank payment-institution side of Malaysia's payments ecosystem, which was not evidenced this cycle.

Periodic update · new data 2026-08-25

Operational Resilience & Critical Infrastructure

Bank Negara Malaysia issued its Policy Document on Technology Requirements for Payment Services Regulatees on 12 March 2026, establishing a four-tier proportionality structure for technology-risk governance. The framework sets a Tier-2 threshold at annual transaction value above RM1.5 billion or transaction volumes above seven million, and requires affected regulatees to maintain board-approved technology-risk-management and cyber-resilience frameworks, appoint a certified chief information security officer, and establish cross-functional technology committees. The policy document consolidates technology-risk governance across electronic-money issuers, merchant acquirers, licensed money-services businesses, and PayNet operators.

Against this backdrop, Bank Negara Malaysia imposed a RM1,000,000 administrative monetary penalty on Bank Kerjasama Rakyat Malaysia Berhad on 20 January 2026 for cybersecurity and customer-information-protection breaches following an external threat-actor intrusion. This is the second such penalty imposed on the same institution within roughly seven months, following a RM2.85 million fine in June 2025.

Outlook

Watch for how Bank Kerjasama Rakyat Malaysia Berhad remediates the underlying deficiency behind its second cybersecurity penalty in seven months. Separately, the phased application of the four-tier Technology Requirements Policy Document across Tier-1 through Tier-4 regulatees will be the structural story to track over coming cycles.

Sources and findings (5)
  1. T2https://regulations.ai/regulations/malaysia-2023-06-bnm-rmitretrieved
  2. T3https://www.picussecurity.com/resource/blog/meeting-bank-negara-malaysias-rmit-requirements-with-picus [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://theos-cyber.com/articles/mtdr/bnm-rmit-2025-compliance-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.simplydata.com.my/bnm-rmit-compliance-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.ey.com/en_my/technical/take-5-business-alert/inside-the-risk-management-in-technology-rmit-exposure-draft [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

Card-scheme economics are regulated domestically by BNM's Payment Cards Framework (PCF) policy document (issued 19 August 2022, interchange ceilings effective 1 January 2023), which superseded the 2014 Payment Card Reform Framework (PCRF). The PCF lowered interchange ceilings (credit capped at 0.6%; domestic debit at the lesser of 0.1% or RM0.37 + 0.001%), subject to review every three years from 1 January 2023. Surcharging and minimum-purchase-amount practices on debit/credit card transactions are prohibited, with a cardholder complaint mechanism. Visa/Mastercard/JCB operate as international schemes; the domestic debit scheme MyDebit is operated by PayNet.

Horizon · 2026-Q1 (±year)PCF interchange fee ceiling three-year reviewconsultation · T2
Standing sub-brief · as of 7 July 2026235 words · last cycle 2026-06-24

Scheme & Network Compliance

Card-scheme economics in Malaysia are set by BNM's Payment Cards Framework (PCF), issued 19 August 2022 and superseding the 2014 Payment Card Reform Framework. Interchange ceilings took effect 1 January 2023: credit-card interchange is capped at 0.6%, and domestic debit interchange at the lesser of 0.1% or RM0.37 plus 0.001%. The PCF also prohibits surcharging and minimum-purchase practices and requires a cardholder complaint mechanism. International schemes Visa, Mastercard and JCB operate alongside MyDebit, the domestic debit scheme operated by PayNet. The interchange ceilings are subject to review every three years from 1 January 2023, placing the first scheduled review window in early 2026. A BNM document dated 28 July 2025 and titled "Adjustment to the Debit Card Interchange Fee Ceiling" suggests this review may already have produced a change to the debit ceiling, but its content was not accessible during this research cycle and the adjustment remains unverified — the current standing position therefore still cites the original 2023 ceilings pending confirmation.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1BNM Payment Card Reform Framework (interchange ceilings, 3-yr review from 1 Jan 2023) (bnm.gov.my)
  2. T2https://www.kansascityfed.org/documents/11143/PublicAuthorityInvolvementPaymentCardMarkets_VariousCountries_August2025Update.pdfretrieved
  3. T1https://www.bnm.gov.my/-/payment-card-reform-23122014retrieved
  4. T1https://www.bnm.gov.my/-/response-to-fmt-article-entitled-consumer-body-abolish-surcharges-on-credit-cards-retrieved

#

IFTF issued 30 June 2026, mandating full phase-out of proprietary/closed-loop QR networks by 30 June 2028; DuitNow QR cross-border corridors continue expanding.

Standing sub-brief · as of 7 July 2026178 words · last cycle 2026-09-14

Payment Corridor Dynamics

Malaysia's domestic instant-payments rail, DuitNow, runs on PayNet's Real-time Retail Payments Platform (RPP), live since December 2018 and built on ISO 20022 messaging, with DuitNow QR serving as the unified national QR standard. Malaysia has become one of the more active participants in ASEAN's Regional Payment Connectivity initiative, signed November 2022, with multiple live cross-border QR and real-time transfer linkages: DuitNow–PromptPay with Thailand, DuitNow–QRIS with Indonesia, and a DuitNow–NETS/PayNow real-time transfer link with Singapore established November 2023 that notably includes non-bank participation (subject to transaction limits). Further linkages extend to China and Cambodia, among others. This multi-corridor cross-border QR network is a genuine differentiator for remittance and travel-payment flows and aligns with the G20's cross-border payments roadmap.

Periodic update · new data 2026-09-14

Payment Corridor Dynamics

Malaysia's cross-border payment corridor activity expanded materially in 2025. Cross-border DuitNow QR transactions grew 2.5 times to 29.7 million in 2025, according to PayNet's own published figures, with a new corridor linkage to Cambodia added during the period. This is a confirmed, Tier-2 primary-corporate-sourced finding that establishes continued growth in Malaysia's regional QR-payment interoperability network, which already spans several ASEAN markets.

Separately, and with somewhat thinner Tier-3 sourcing carrying Probable confidence, the PayNet-NETS joint venture was appointed Nexus Technical Operator for the Bank for International Settlements' Project Nexus multilateral instant-payments scheme in February 2026. If confirmed at primary source in a future cycle, this would place Malaysia's domestic payment-scheme infrastructure operator inside a significant multilateral cross-border settlement architecture connecting multiple national instant-payment systems, extending Malaysia's corridor reach beyond the bilateral QR-linkage model that has characterised its cross-border expansion to date.

Together, these two developments describe a corridor-dynamics environment where Malaysia is simultaneously deepening bilateral QR linkages within the region and positioning itself within a multilateral settlement infrastructure initiative at the technical-operator level.

Outlook

Primary-source confirmation of the Project Nexus Technical Operator appointment is the key item to track, alongside further corridor additions to the DuitNow cross-border QR network beyond the newly added Cambodia linkage.

2 earlier distinct update(s)
Periodic update · new data 2026-09-08

Payment Corridor Dynamics

Malaysia's domestic and cross-border payment corridors both showed material growth this cycle. Total e-payment transactions reached 18.4 billion in 2025, a 25 percent increase from 14.7 billion transactions in 2024, according to Bank Negara Malaysia's Annual Report 2025, a jurisdiction-wide volume signal spanning both bank and non-bank payment rails. Within that broader growth, DuitNow QR, Malaysia's real-time QR-based payment scheme, saw its transaction volume double to 3 billion transactions in 2025, supported by a touchpoint network that has grown to nearly 3 million registered merchant and acceptance points, a scheme-level growth rate that materially outpaced the overall e-payment growth rate and points to QR-based instant payments as the fastest-growing segment of Malaysia's domestic corridor activity.

On the cross-border side, Phase 2 of the Malaysia-Cambodia cross-border QR payment linkage went live in 2025, extending real-time QR interoperability beyond Malaysia's borders into a specific bilateral corridor. More broadly, Malaysia is a participant in Project Nexus, the Bank for International Settlements Innovation Hub initiative designed to link multiple countries' instant-payment systems together, with the initial participant group spanning Malaysia, Singapore, Thailand, India and the Philippines. Project Nexus represents a materially more ambitious corridor-integration effort than a single bilateral QR linkage, since it is designed as a multilateral instant-payment interoperability layer rather than a pairwise arrangement, and Malaysia's participation places it among the founding cohort of that initiative.

Outlook

The corridor dynamics to watch in coming cycles are whether Project Nexus moves from participant status toward live multilateral transaction flows, and whether the Malaysia-Cambodia QR linkage's Phase 2 volume growth is disclosed in future reporting to allow direct comparison against the domestic DuitNow QR growth rate. The overall trajectory across both domestic and cross-border corridor measures this cycle is unambiguously toward higher instant-payment volume and broader interoperability.

Periodic update · new data 2026-08-25

Payment Corridor Dynamics

Bank Negara Malaysia issued its Interoperable Fund Transfer Framework on 30 June 2026, replacing the December-2019 Interoperable Credit Transfer Framework and extending its application to banks, Islamic banks, development financial institutions, e-money issuers, payment system operators, and registered merchant acquirers. The framework's most consequential provision sets 30 June 2028 as the deadline for the full phase-out of proprietary and closed-loop QR payment networks, meaning that banks and e-wallet operators currently running their own proprietary QR schemes have a defined two-year window to migrate toward the interoperable standard.

This domestic interoperability push runs alongside continued expansion of Malaysia's cross-border payment corridors. DuitNow QR corridors were live with Singapore, Thailand, Indonesia, China, and Cambodia as of end-2025, and an India corridor is expected to go live during 2026.

Outlook

The two-year transition window to 30 June 2028 is the defining structural deadline in this domain; watch for how quickly banks and e-wallet operators currently running proprietary QR schemes announce migration timelines. On the cross-border side, the expected 2026 India corridor launch would be the next concrete milestone in DuitNow QR's regional expansion.

Sources and findings (5)
  1. T1https://www.bot.or.th/en/financial-innovation/digital-finance/digital-payment/cross-border-payment.htmlretrieved
  2. T1https://www.bnm.gov.my/-/duitnow-qris-link-my-idretrieved
  3. T3https://www.lightspark.com/knowledge/instant-payments-malaysiaretrieved
  4. T2https://amro-asia.org/enhancing-regional-payment-connectivity-across-asean3-economiesretrieved
  5. T4https://www.travelandtourworld.com/news/article/malaysia-joins-philippines-singapore-and-thailand-shatter-global-financial-norms-in-2026-as-unstoppable-cross-border-qr-payment-network-for-booming-travel-what-you-need-to-know/retrieved

#

Malaysia's payments market is a bank/non-bank hybrid centred on PayNet (national payments utility, BNM the single largest shareholder alongside 11 financial institutions). The e-wallet segment is led by TNG Digital (Touch 'n Go), Boost, ShopeePay, GrabPay and BigPay; the regulatee population shows non-bank EMIs far outnumbering bank EMIs (~47–48 non-bank vs ~6 bank). The market is rapidly growing (18.4 billion e-payment transactions in 2025, +25% YoY) and is being reshaped by five digital banks licensed by BNM in 2022 (Boost-RHB, GXBank, SeaMoney-YTL, AEON, KAF). Digital payments hold roughly half the fintech market by service proposition.

Standing sub-brief · as of 7 July 2026237 words · last cycle 2026-06-24

Industry Structure & Commercial Dynamics

Malaysia's payments market is a bank/non-bank hybrid centred on PayNet, in which BNM is the single largest shareholder alongside eleven financial institutions. The e-wallet segment is led by TNG Digital, Boost, ShopeePay, GrabPay and BigPay, and non-bank e-money issuers (approximately 47) far outnumber bank e-money issuers (approximately 6). The market processed 18.4 billion e-payment transactions in 2025, up 25% year-on-year, with retail e-payment value of RM831 billion and a 17% compound annual growth rate since 2022. BNM awarded five digital-bank licences in 2022: on the conventional (FSA) side, to Boost-RHB, GXS Bank-Kuok Brothers, and Sea-YTL; on the Islamic (IFSA) side, to AEON-MoneyLion and KAF Investment Bank. (An earlier characterisation of one conventional licensee as a "Grab-Singtel-Kuok consortium" has been corrected: GXS Bank is the Grab-Singtel entity, and its licence was awarded jointly with Kuok Brothers.) Digital payments account for roughly 50.7% of Malaysia's fintech market in 2025. Taken together, this is a non-bank-dominated, rapidly growing market being reshaped by the 2022 digital-bank cohort.

no periodic updates on record for this sub-brief

Sources and findings (5)
  1. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdfretrieved
  2. T3https://www.zitadelleag.com/news/malaysia-merchant-acquiring-license-mas-regulatory-guide-licensing-support-by-zitadelle-agretrieved
  3. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/retrieved
  4. T1BNM — digital bank licences (29 Apr 2022); FSA 2013 / IFSA 2013 (bnm.gov.my)
  5. T3https://www.mordorintelligence.com/industry-reports/malaysia-fintech-marketretrieved

Payments-relevant legal action in Malaysia is dominated by BNM administrative enforcement (compound/monetary penalties) rather than landmark civil litigation, focused on AML/CFT/sanctions-screening and operational-resilience (RMiT) breaches. Notable actions include the May 2023 penalty on TNG Digital (sanctions-screening lapse), the July 2025 RM340,000 fine on Alipay Malaysia (AIMY Merchant Services) for failing to update its sanctions database, and July 2025 penalties totalling over RM7 million on Bank Islam, Bank Rakyat and BSN for RMiT/availability and sanctions-screening breaches. The AMLA was amended in December 2024 to strengthen supervision and enforcement.

Standing sub-brief · as of 7 July 2026178 words · last cycle 2026-06-24

Legal & Litigation

Malaysia's payments-enforcement landscape is dominated by BNM administrative penalties rather than landmark civil litigation, with recent actions concentrated on sanctions-screening and RMiT-related operational-resilience breaches. TNG Digital was penalised in May 2023 over sanctions-screening failures. In July 2025, BNM fined Alipay Malaysia (operating as AIMY Merchant Services) RM340,000 for a sanctions-database failure, and in the same month imposed penalties totalling more than RM7 million on three banks — Bank Islam (RM3.445 million), Bank Rakyat (RM2.85 million) and Bank Simpanan Nasional (RM995,000) — for RMiT and sanctions-screening breaches. The Anti-Money Laundering Act was amended in December 2024. Enforcement activity spans both bank and non-bank PSPs, indicating BNM's administrative posture is applied consistently across the industry rather than concentrated on one segment.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T3https://fintechnews.my/54303/regtech-fintech-regulation-malaysia/bnm-alipay-fine/retrieved
  2. T3https://www.freemalaysiatoday.com/category/nation/2025/07/30/3-banks-fined-more-than-rm7mil-for-regulatory-breachesretrieved
  3. T3https://www.flagright.com/post/bnms-e-money-exposure-draft-aml-cft-implications-for-fintechs-and-wallet-providersretrieved
  4. T3https://sumsub.com/blog/malaysian-aml-requirements/retrieved

#

Merchant acquiring is a registered (not licensed) activity under section 17 FSA 2013, with BNM's Policy Document on Merchant Acquiring Services (issued 15 September 2021) setting governance, operational-risk, IT-management, minimum-capital (non-bank) and merchant-onboarding/recruitment requirements. The PD took effect for bank acquirers from 15 March 2022 and for non-bank acquirers (minimum capital) from 15 September 2023. The registered acquirer base is broad — including TNG Digital, GHL, ShopeePay, Razer Merchant Services, Stripe and FIS Worldpay — and the November 2024 RMiT exposure draft would extend resilience standards to non-bank merchant acquirers.

Standing sub-brief · as of 7 July 2026166 words · last cycle 2026-06-24

Merchant Acquiring & Risk

Merchant acquiring in Malaysia is a registered, not licensed, activity under section 17 of the FSA 2013. BNM's Policy Document on Merchant Acquiring Services, issued 15 September 2021, sets governance, operational-risk, IT and merchant-onboarding requirements, alongside minimum-capital requirements for non-bank acquirers; the requirements became effective for bank acquirers from 15 March 2022 and for non-bank capital requirements from 15 September 2023. The registered base is broad, including TNG Digital, GHL, ShopeePay, Razer, Stripe and FIS Worldpay among more than 40 registered acquirers. A November 2024 RMiT exposure draft would extend operational-resilience standards to non-bank merchant acquirers, which are not currently within RMiT's in-force scope.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T1https://www.bnm.gov.my/-/pd-merchant-acquiring-servicesretrieved
  2. T3https://www.rahmatlim.com/publication/articles/19392/bank-negara-issues-policy-document-on-merchant-acquiring-servicesretrieved
  3. T3https://www.zitadelleag.com/news/malaysia-merchant-acquiring-license-mas-regulatory-guide-licensing-support-by-zitadelle-agretrieved
  4. T3https://www.capco.com/intelligence/capco-intelligence/empowering-compliance-with-bank-negara-malaysias-rmitretrieved

#

DuitNow remains MY's core instant-payments rail; 2026 developments include cross-border QR interoperability expansion (2.5x growth to 29.7m transactions in 2025) and deepened Project Nexus multilateral integration via a PayNet-NETS joint venture appointed Nexus Technical Operator (Feb 2026).

Standing sub-brief · as of 7 July 2026172 words · last cycle 2026-10-11

Product Innovation & Market Development

BNM's product-development agenda runs through the Financial Sector Blueprint 2022–2026, PayNet's RPP modernisation programme, and the Interoperable Credit Transfer Framework (ICTF), which gives banks and eligible non-bank e-money issuers fair, open access to shared payments infrastructure. Live build-out includes DuitNow QR, Request-to-Pay, e-mandates/AutoDebit, cross-border QR expansion and tap-to-phone acceptance (via Soft Space). Sandbox activity is running at both BNM (the Digital Asset Innovation Hub, launched June 2025) and the Securities Commission (a digital-asset/tokenisation sandbox, 2025), alongside CBDC-exploratory work through Project Dunbar and tokenised-deposit pilots. The ICTF's open-access mandate is a distinct market-access lever for non-bank EMIs, separate from the specific product launches tracked in W13.

Periodic update · new data 2026-10-11

Product Innovation & Market Development

Malaysia's Budget 2027 introduced a tokenised retail sukuk initiative as one of its product-innovation measures, allowing investors to choose whether their funds support education, healthcare, or social protection outcomes. This is a thematic product-access development distinct from a specific company's product launch: it reflects a regulatory and fiscal-policy direction toward linking tokenisation infrastructure with retail Islamic-finance investment products and social-impact allocation, rather than a single named firm bringing a specific tokenised product to market this period.

Read alongside the Basic Credit Card regime also announced in Budget 2027, the product-innovation signal from this budget cycle is that Malaysia's government is using the budget as a vehicle to shape retail financial-product design directly, in both consumer-credit and investment-product categories, rather than leaving product innovation entirely to market-led development under existing licensing frameworks. The tokenised retail sukuk initiative specifically extends the tokenisation theme already visible in Malaysia's capital markets into a retail-accessible, socially-directed investment format, building on Malaysia's broader government and Securities Commission interest in tokenisation as an asset-issuance mechanism.

This development should be read as an emerging product-innovation theme rather than a settled or fully specified instrument: the available sourcing describes the initiative's investor-choice feature and thematic allocation options, but does not establish full operational detail such as issuance mechanics, minimum investment thresholds, or the specific tokenisation infrastructure to be used. The regulatory layer for this initiative is national/federal, reflecting its origin in the national budget statement.

Outlook

The product-innovation trajectory for Malaysia is improving, with the tokenised retail sukuk initiative representing a concrete, if still high-level, policy commitment from Budget 2027. The next marker to watch is whether the Securities Commission or the relevant issuing authority publishes implementing detail, such as a prospectus, offering circular, or guideline, that converts this budget announcement into an operative retail investment product, and whether the social-outcome allocation choice is implemented as a binding feature of the instrument or remains a marketing-level description at this stage.

2 earlier distinct update(s)
Periodic update · new data 2026-09-08

Product Innovation & Market Development

Malaysia's payments product-innovation landscape shows two distinct signals this cycle, one broad but thinly sourced and one specific and better evidenced. On the broader signal, e-money licence applications are reported to be climbing sharply in 2026 as fintechs and corporates pursue Bank Negara Malaysia authorisation for stored-value and digital-wallet products; this finding currently rests on a single T4 market-commentary source and should be treated as an early, unconfirmed signal of rising product-innovation interest rather than a confirmed regulatory trend, pending corroboration from Bank Negara Malaysia's own licensing disclosures or additional independent reporting.

On the more specific and better-evidenced signal, Mobile Money International Sdn Bhd announced a partnership with Prepay Nation in January 2026 to deliver cross-border remittance and airtime-transfer services to more than 150 countries, explicitly targeting Malaysia's population of more than 2 million migrant workers as the addressable market for the service. The financial terms of this partnership were not publicly disclosed. This is a discrete commercial product-development event rather than a structural market-wide trend, and it signals continued fintech investment in Malaysia's outbound migrant-remittance corridor specifically, a segment distinct from the domestic DuitNow QR and e-payment volume growth tracked elsewhere.

Read together, the two signals point toward an active period of product experimentation in Malaysia's payments market, spanning both regulatory-authorisation-seeking activity (e-money licensing) and direct commercial partnership activity (cross-border remittance), though only the latter carries confirmed sourcing at this stage.

Outlook

The development to watch is whether the reported rise in e-money licence applications converts into a confirmed count of new Bank Negara Malaysia authorisations in coming disclosure cycles, which would upgrade this finding from an unconfirmed T4 signal to a verified regulatory trend. On the remittance side, watch for confirmation of transaction volume or revenue figures from the Mobile Money International-Prepay Nation partnership once it becomes operational.

Periodic update · new data 2026-08-11

Product Innovation & Market Development

Malaysia's instant-payments infrastructure deepened its regional and cross-border reach this cycle on two fronts. DuitNow QR, operated by PayNet, is now interoperable with Thailand's PromptPay, Singapore's NETS, Indonesia's QRIS, Chinese payment networks, and, as of 2025, Cambodia's Bakong, and cross-border QR transaction volume grew 2.5 times to 29.7 million transactions in 2025. Separately, a PayNet-NETS joint venture was appointed Nexus Technical Operator by Nexus Global Payments in February 2026, formalising Malaysia's role as a founding member of Project Nexus alongside India, the Philippines, Singapore and Thailand, with Bank Indonesia joining in 2026 as the scheme's sixth member.

These two developments are structurally connected: DuitNow's bilateral QR interoperability agreements and Malaysia's Project Nexus participation both extend the same underlying domestic instant-payments rail outward, but they operate through different technical models — QR interoperability is a bilateral, scheme-to-scheme linkage model, while Project Nexus is a multilateral hub-and-spoke interlinkage architecture designed to let any participating country's instant-payment system reach any other participant's system through common infrastructure operated by the appointed Technical Operator. Malaysia now has meaningful exposure to both models simultaneously, and the PayNet-NETS joint venture's appointment as Technical Operator gives Malaysia direct operational influence over the multilateral rail rather than participation as a connecting member only.

The 2.5-times growth in cross-border QR transaction volume is a genuine product-adoption signal, though it should be read as a single-year comparison rather than an established multi-year trend given the sourcing available this cycle.

Outlook

Bank Indonesia's 2026 addition to Project Nexus as a sixth member will be a useful comparator for whether the interlinkage model scales smoothly as membership grows, and the PayNet-NETS joint venture's early performance as Technical Operator is worth tracking as the first indicator of Malaysia's execution capacity in that operational role. Continued DuitNow QR interoperability expansion to additional ASEAN or wider Asia-Pacific corridors would be the next logical development to watch for.

Sources and findings (4)
  1. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdfretrieved
  2. T3https://www.aciworldwide.com/blog/putting-malaysia-on-the-path-to-payments-innovationretrieved
  3. T3https://www.lexology.com/library/detail.aspx?g=01ac9292-6db7-4569-91ea-5fa6f006ec7cretrieved
  4. T3https://www.ainvest.com/news/malaysia-proposes-major-digital-asset-exchange-regulations-115-trading-volume-surge-2507/retrieved

#

Consumer protection rests on BNM's conduct framework (Fair Treatment of Financial Consumers; Complaints Handling PD of March 2025, effective April 2026) with redress via the Financial Markets Ombudsman Service (FMOS) — created 1 January 2025 by merging the Ombudsman for Financial Services (OFS) and SIDREC — and BNMLINK. Malaysia has NO statutory mandatory APP-fraud reimbursement scheme equivalent to the UK PSR model; instead BNM requires banks to ensure fair redress for unauthorised-transaction victims who took protective steps and did not act fraudulently, coordinated via the National Scam Response Centre / PDRM / MCMC anti-scam framework.

Standing sub-brief · as of 7 July 2026201 words · last cycle 2026-10-04

Consumer Protection & APP Fraud

Malaysia has no statutory mandatory reimbursement scheme for authorised-push-payment fraud victims equivalent to the UK's PSR-mandated model. Instead, BNM requires banks to ensure fair redress for victims of unauthorised transactions who took reasonable protective steps and did not act fraudulently, with case coordination running through the National Scam Response Centre alongside the police (PDRM) and the communications regulator (MCMC). Redress channels were consolidated on 1 January 2025 with the creation of the Financial Markets Ombudsman Service (FMOS) from the merger of the Ombudsman for Financial Services and SIDREC, alongside the BNMLINK channel. The Complaints Handling policy document, issued 28 March 2025, enters full force 1 April 2026 and formalises the FMOS/BNMLINK escalation pathway for financial service providers. The absence of a mandatory APP-reimbursement liability model materially lowers PSP consumer-fraud liability exposure in Malaysia relative to jurisdictions with statutory reimbursement mandates.

Periodic update · new data 2026-09-28

Consumer Protection & APP Fraud

The Consumer Credit Act 2025 establishes the Consumer Credit Commission (SKP) as an independent regulator overseeing six previously-unregulated credit sectors: buy-now-pay-later, leasing, factoring, debt collection and debt counselling. Licensees under the new regime face a RM2 million minimum shareholders'-funds requirement, a prudential threshold intended to ensure a baseline of financial resilience among firms newly brought into the regulatory perimeter. Licensing and registration requirements take effect 1 June 2026, with the full transition period running to 31 December 2026.

This development is significant from a consumer-protection standpoint because BNPL in particular had operated in Malaysia largely without dedicated consumer-facing prudential or conduct oversight prior to the Act's commencement on 1 March 2026. Bringing BNPL under formal licensing alongside more traditional non-bank credit-services categories such as leasing and factoring closes a regulatory gap that had left consumers of these products without the same institutional oversight applied to bank-provided credit. The bank-PSP versus non-bank credit-services distinction is again relevant here: this is a non-bank credit-services regime, distinct from the bank-centric consumer-protection frameworks that already applied to licensed deposit-taking institutions.

Outlook

As the transition period runs to 31 December 2026, watch for the Consumer Credit Commission's early enforcement posture toward BNPL providers specifically, given that sector's rapid prior growth without dedicated oversight. The RM2 million minimum shareholders'-funds requirement may also prompt consolidation among smaller credit-service providers unable to meet the new prudential threshold within the transition window.

Sources and findings (5)
  1. T1https://www.bnm.gov.my/-/combating-financial-fraudretrieved
  2. T2http://www.fmos.org.my/en/retrieved
  3. T3https://www.scamproof.my/retrieved
  4. T3https://www.lexology.com/library/detail.aspx?g=d9ca31ce-34a4-4352-9b88-e9cc03e27f00retrieved
  5. T1https://www.bnm.gov.my/index.php?ch=en_financialconsumeralertretrieved

#

[SENTINEL-FED] Sentinel.gi payments-context position: Malaysia's AML/CFT regime rests on the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), supervised by BNM's Financial Intelligence & Enforcement Department (FIED). Payments-context posture: stringent sanctions/PEP screening and CDD obligations on EMIs and payment institutions, active administrative enforcement (TNG Digital 2023; Alipay/AIMY 2025), AMLA strengthened December 2024 ahead of the 2025 FATF mutual evaluation, with CPF (counter-proliferation-financing) provisions added. No original FIM analysis performed here.

Horizon · 2026 (±year)Malaysia 2025 FATF mutual evaluation outcomein_force_pending · T3
Standing sub-brief · as of 7 July 2026172 words · last cycle 2026-06-24

AML/CFT & Financial Crime

[Sentinel-sourced] Malaysia's AML/CFT regime rests on the Anti-Money Laundering Act 2001, supervised by BNM's Financial Intelligence and Enforcement Department (FIED). In the payments context, this translates into stringent sanctions and PEP-screening and customer-due-diligence obligations on e-money issuers and payment institutions: reporting institutions, including e-money issuers, must screen both new and existing customers against the Domestic List and UN sanctions lists. The AMLA was strengthened in December 2024 with counter-proliferation-financing provisions, timed ahead of Malaysia's 2025 FATF mutual evaluation. This intelligence is attributed to the Sentinel.gi feed; the payments-context sanctions-screening and CDD posture described here is carried as the relevant EMI/PSP compliance-cost signal, and readers seeking the underlying illicit-finance and sanctions-evasion analysis should refer to the Financial Intelligence Monitor, to which this material has been cross-referenced.

no periodic updates on record for this sub-brief

Sources and findings (4)
  1. T3sentinel://sumsub.com/blog/malaysian-aml-requirements
  2. T?FIM (sentinel.gi) per-JID baseline profile — Malaysia — Malaysia operates under the AMLA 2001 (Act 613), supervised by Bank Negara Malaysia, the Securities Commission and the Labuan FSA, coordinated via the National Coordination Committee to Counter Money Laundering. FATF's Dec 2025 MER rates Malaysia compliant on 24 Recommendations and largely compliant on 16, citing a sound legal/supervisory architecture but persistent weaknesses converting investigations into prosecutions, dissuasive sanctions, and BO/TCSP oversight in Labuan.
  3. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence
  4. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap

#

Foreign PSPs are gaining direct domestic-rail access: Wise connected directly to PayNet in mid-2026, its ninth global and fifth APAC direct domestic-system connection.

Standing sub-brief · as of 7 July 2026215 words · last cycle 2026-09-05

Correspondent Banking, Settlement & Access

The analytical spine of this module is Malaysia's bank/non-bank settlement-access asymmetry. RENTAS, operated by PayNet since July 1999, is Malaysia's only large-value payment system, settling high-value ringgit interbank funds and scripless securities with finality across BNM's books; it supports payment-versus-payment settlement through a ringgit–USD CHATS link with Hong Kong established November 2006, and foreign-currency settlement via Onshore Settlement Institutions. Non-bank participants in PayNet's Real-time Retail Payments Platform have no direct access to RENTAS and must settle through settlement banks — a structural constraint on non-bank market participants that persists even as the settlement rails around them are modernised. That modernisation arrived in October 2025 with the launch of RENTAS+, the first ASEAN RTGS system to offer round-the-clock (24/7) gross settlement, which now settles DuitNow retail transactions on a gross basis with an automated liquidity facility.

Periodic update · new data 2026-09-08

Correspondent Banking, Settlement & Access

Malaysia's correspondent-banking and settlement infrastructure improved materially this cycle through two connected developments: the 2025 launch of RENTAS+, an upgraded core settlement platform providing near real-time, 24/7 processing, and Malaysia's completion of full ISO 20022 messaging adoption for cross-border payments ahead of the global SWIFT migration deadline, reportedly making Malaysia the first country to complete that transition. These developments sit squarely within the bank-supervised settlement and correspondent layer, since RENTAS is Bank Negara Malaysia's interbank real-time gross settlement infrastructure, and ISO 20022 is the cross-border messaging standard used in correspondent-banking payment instructions between financial institutions.

The analytical spine of this module is the structural asymmetry between bank access to modernised settlement and messaging infrastructure and non-bank payment institutions' access to equivalent rails; this cycle's evidence base speaks specifically to the bank-supervised settlement layer, and no equivalent non-bank correspondent-access development was evidenced. Full ISO 20022 adoption ahead of the global deadline is nonetheless a structurally significant access development for any institution, bank or otherwise, that routes cross-border payment instructions through Malaysia's correspondent banking relationships, since it reduces message-format friction and improves straight-through processing rates for all counterparties transacting through Malaysian correspondent banks.

Outlook

The question for coming cycles is whether RENTAS+'s near-real-time processing capability and Malaysia's completed ISO 20022 migration are followed by any evidenced change in non-bank payment institutions' access to correspondent banking relationships or settlement rails, which would close the bank-versus-non-bank access asymmetry that remains the structural spine of this module absent new evidence.

1 earlier distinct update(s)
Periodic update · new data 2026-08-11

Correspondent Banking, Settlement & Access

Wise connected directly to PayNet this cycle, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is the clearest correspondent-banking-access development of the cycle and should be read against this module's central analytical spine: the structural asymmetry between bank and non-bank access to domestic payment rails. A direct PayNet connection allows Wise, a non-bank payment institution, to settle DuitNow QR transactions without routing through a correspondent bank intermediary, reducing both cost and settlement-time exposure to intermediary-bank risk that non-bank PSPs have historically had to absorb when accessing domestic rails indirectly.

The significance of this connection is best understood by its place in a sequence: it is explicitly Wise's ninth global and fifth Asia-Pacific direct domestic connection, indicating this is part of a deliberate, scaling strategy by a major non-bank PSP to secure direct rail access across multiple jurisdictions rather than an isolated Malaysia-specific event. For Malaysia specifically, it demonstrates that PayNet's direct-connection model is open to non-bank PSPs meeting its access criteria, which is itself informative for other non-bank payment institutions evaluating whether direct domestic-rail access is a realistic alternative to correspondent-bank-intermediated access in Malaysia.

Outlook

Whether other major non-bank PSPs follow Wise's path to direct PayNet connection is the key development to watch in this module next cycle, as is whether PayNet's access criteria evolve as its direct-connection non-bank population grows. This connection also bears watching alongside the Technology Requirements Policy Document reported elsewhere this cycle, since PayNet itself is named as newly captured under that framework's technology-governance obligations.

Sources and findings (4)
  1. T1https://www.bnm.gov.my/types-of-payment-systemsretrieved
  2. T1https://www.bnm.gov.my/index.php?ch=ps&pg=ps_mps_type&ac=177&lang=enretrieved
  3. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdfretrieved
  4. T3https://fintechnews.my/54449/payments-remittance-malaysia/bank-negara-malaysia-bnm-launches-rentas-plus-for-24-7-interbank-settlement/retrieved

#

Trailing-12-month commercial activity (run date 2026-06-24) centres on capital injections into e-wallet/digital-banking players and merchant-acquiring/cross-border product expansion. TNG Digital secured ~USD 75 million from strategic investors and targeted first full-year profitability in 2025; Axiata's Boost was reportedly in talks with a potential new shareholder (regulatory approval pending). Funding leaders include TNG Digital (~USD 168m cumulative), BigPay (~RM475m) and Boost (~RM308m). RENTAS+ (Oct 2025) and continued cross-border QR linkages are the principal product releases.

Standing sub-brief · as of 7 July 2026175 words · last cycle 2026-10-11

Commercial Intelligence (M&A, Investment & Product)

Three discrete commercial events are recorded for Malaysia this cycle. TNG Digital (Touch 'n Go) raised USD 75 million from strategic investors in 2025, targeting first full-year profitability the same year; the round brings TNG Digital's cumulative funding to roughly USD 168 million, making it Malaysia's most-funded fintech as of October 2025. Axiata's Boost Holdings is reportedly in talks with a potential new shareholder; the amount involved is not publicly disclosed, and the investment still requires regulatory approval. Separately, PayNet launched RENTAS+ in October 2025 — an in-house, cloud-based enhancement enabling continuous 24/7 interbank settlement and the first such round-the-clock RTGS capability in ASEAN, now settling DuitNow retail paymentson a gross basis (also recorded as a structural settlement development under W12).

Periodic update · new data 2026-10-11

Commercial Intelligence & Fintech

BLOX Blockchain Sdn Bhd, the issuer behind the MYRC ringgit-backed stablecoin, closed a seed funding round this period to scale its product. This is a discrete commercial event rather than a structural market-trend finding: a named fintech issuer has raised capital specifically earmarked for scaling a stablecoin product that, notably, currently operates without a dedicated statutory stablecoin-issuance framework in Malaysia. The event is commercially significant precisely because of that regulatory gap context: investors are backing a ringgit-denominated stablecoin issuer ahead of, rather than following, a clear domestic licensing pathway for that product category, which is itself a signal of investor confidence that a workable framework will eventually be put in place, whether domestically or through the cross-border cooperation channel BNM is exploring with Hong Kong's monetary authority.

This is distinct from the structural stablecoin-regime discussion carried under Stablecoins & Digital Money: this entry records the specific commercial fact of BLOX's funding event, not an assessment of the regulatory framework BLOX operates within. As a fintech commercial-intelligence matter, the event is relevant to market participants tracking capital flows into Malaysia's digital-asset issuer ecosystem and to competitors assessing the pace of private-sector stablecoin development in the Malaysian ringgit corridor specifically.

Outlook

The commercial-intelligence marker to watch is whether BLOX's funding round is followed by additional capital raises, a formal regulatory engagement outcome, or a product launch milestone that would upgrade this from a funding event to a market-structure development. Given the current absence of a dedicated regulatory framework for ringgit-backed stablecoin issuance, BLOX's trajectory is also a useful bellwether for how quickly Malaysia's policy environment adapts to accommodate private-sector stablecoin issuers already operating and raising capital in the space.

3 earlier distinct update(s)
Periodic update · new data 2026-09-14

Commercial Intelligence & Fintech

PayNet, Malaysia's national payment-scheme operator, processed 8.44 billion digital payment transactions in 2025, according to its own published corporate figures. This is a confirmed, Tier-2 primary-corporate-sourced data point underscoring the scale of continued domestic adoption of digital payment rails in Malaysia, positioning digital payments as the preferred transaction method at national scale.

This transaction-volume figure is a discrete commercial data point reported by PayNet itself rather than a structural market-analysis finding; it should be read as a scale indicator for the domestic digital-payments market rather than as evidence of any specific product launch or M&A event this cycle. No M&A, funding round, or discrete product-release event was located for the Malaysian market this cycle beyond this volume disclosure.

Outlook

Subsequent cycles' transaction-volume disclosures from PayNet will indicate whether 2025's growth rate is sustained, particularly as the IFTF-driven QR interoperability mandate and continued cross-border corridor expansion feed into future volume figures.

Periodic update · new data 2026-09-08

Commercial Intelligence & Fintech

The discrete commercial event of note in Malaysia's payments and fintech landscape this cycle is Mobile Money International Sdn Bhd's partnership with Prepay Nation, announced in January 2026. The partnership is structured to deliver cross-border remittance and airtime-transfer services covering more than 150 countries, explicitly targeting Malaysia's population of more than 2 million migrant workers as the primary addressable market. The financial terms of the partnership, including any transaction fees, revenue-sharing arrangement, or investment component, were not publicly disclosed, and this should be treated as a limitation on the depth of commercial analysis available for this event rather than an indication that no financial terms exist.

This event is properly classified as a discrete commercial partnership announcement rather than a structural industry-wide trend; it is distinct from any broader consolidation or competitive-landscape movement in Malaysia's remittance or payments sector, none of which was evidenced this cycle. The event is nonetheless commercially relevant as a signal of continued fintech capacity-building specifically in the outbound migrant-remittance corridor, a product-market segment with a large and identifiable addressable population in Malaysia given the scale of its migrant-worker workforce.

Outlook

The item to watch is whether the Mobile Money International-Prepay Nation partnership becomes operational with disclosed transaction volumes or revenue figures in a future cycle, which would allow this discrete commercial event to be assessed against actual market uptake rather than announcement-stage intent alone.

Periodic update · new data 2026-08-11

Commercial Intelligence & Fintech

This cycle's discrete commercial event is Wise's direct connection to PayNet, announced 30 July 2026, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is a product-launch and market-access event specific to Wise and PayNet rather than a structural industry-wide trend, and it is treated here as a discrete commercial development distinct from the broader correspondent-banking-access analysis this same event supports under this cycle's W12 reading.

No merger, acquisition, or funding-round event was identified for Malaysia this cycle. SunRate's reported BNM licence approval on 28 April 2026 is a market-access event more than a commercial-intelligence event in the M&A/investment/product-launch sense this module tracks, and is addressed under this cycle's W1a licensing reading rather than duplicated here.

Outlook

Continued monitoring for disclosed M&A, investment, or product-launch activity among Malaysia-licensed payment institutions is warranted next cycle, particularly given the active licence-processing and technology-governance developments recorded elsewhere this cycle that may prompt commercial responses from incumbent and new-entrant PSPs alike.

Sources and findings (5)
  1. T3https://www.mordorintelligence.com/industry-reports/malaysia-fintech-marketretrieved
  2. T3https://fintechnews.my/49867/funding/top-5-most-funded-fintechs-in-malaysia-for-2025/retrieved
  3. T3https://fintechnews.my/49867/funding/top-5-most-funded-fintechs-in-malaysia-for-2025/retrieved
  4. T3https://tracxn.com/d/explore/fintech-startups-in-malaysia/__7PwJ-m65RwujGFYmL7TNrStzlh1_W8LNMDG2FsXFR7gretrieved
  5. T3https://www.businesstoday.com.my/2025/10/08/rentas-brings-24-7-settlement-to-malaysias-banking-system/retrieved
No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Malaysia
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewerno reviewer on record
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band.

Orphan deltas: 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 64 finding(s), 138 source(s) in the cumulative register.

Think something on this page is wrong? Report an error.