MY · run world-payments-2026-06-24 v13.3.0
content: ai_generated 118 sources retrieved model claude-opus-4-8 ·

Malaysia

MY schema world-payments-v1 trajectory: not recorded

Last updated · 14 modules · 64 sourced findings · 118 sources in the cumulative register

14Modulesbaseline.modules[]
64Findingsmodules[].findings[]
33Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix (sums to 14 rendered modules; click to filter)

Jurisdiction brief

Lead Signal

Malaysia's Bank Negara Malaysia (BNM) has completed a broad-based tightening of the country's single-regulator payments architecture, moving simultaneously on operational resilience, customer-fund safeguarding and settlement infrastructure. The revised Policy Document on Electronic Money took effect 31 January 2025, replacing the 2022 version and imposing mandatory trust-account or segregated-deposit safeguarding on non-bank e-money issuers, alongside tightened governance, cybersecurity and a three-year exit-strategy requirement; minimum capital now runs from RM100,000 for small schemes to RM5 million or 8% of outstanding e-money liabilities for large schemes. That safeguarding upgrade sits alongside the Risk Management in Technology (RMiT) policy document issued 28 November 2025, which imposes a 120-minute per-incident and four-hour cumulative annual downtime tolerance on critical systems, a one-hour incident-notification window to BNM, and binds banks, insurers, payment system operators and e-money issuers alike; stand-in-processing and capacity obligations become binding by 30 September 2027. At the same time, PayNet's RENTAS+ enhancement, launched October 2025, made Malaysia's real-time gross settlement system the first in ASEAN to offer continuous 24/7 settlement, now clearing DuitNow retail payments on a gross basis. The combined effect is a coordinated compliance-cost escalation for banks and non-banks together, run in parallel with a step-change in settlement-finality infrastructure — though non-bank participants in PayNet's Real-time Retail Payments Platform still have no direct RENTAS access and must settle through settlement banks, leaving a structural tiering between bank and non-bank market participants intact even as the rails around them modernise.

14 of 14 modules
Signal
Density

Selections OR within a group, AND across groups. Press / to search.

#

Consumer Credit Act 2025 (Act 873) in force 1 March 2026 under new Consumer Credit Commission; licensing/registration commences 1 June 2026 with transition to 30 Nov 2026.

Movement — NEWConsumer Credit Act 2025 in force with new SKP licensing regimeFirst-cycle baseline capture of a newly-enacted statutory regime.
Standing sub-brief264 words · last cycle wpm-2026-08-21

Licensing, Authorisation & Market Access

Malaysia operates a single-regulator payments regime under Bank Negara Malaysia (BNM), with market access governed by the Financial Services Act 2013 (FSA) and its Islamic-finance counterpart, the Islamic Financial Services Act 2013 (IFSA). There is no separate electronic-money-institution licence of the kind seen in the UK or EU; instead, operators route through three FSA mechanisms: payment-system-operator (PSO) approval under section 11, designated payment-instrument approval under section 11 for e-money and card schemes, and merchant-acquiring registration under section 17. The FSA repealed and consolidated the former Payment Systems Act 2003, with deemed continuity preserved for approvals granted under the earlier regime. Both bank and non-bank entities are authorisable under this framework, and local incorporation or presence is generally required for market entry. This single-regulator, non-EMI-regime architecture is the foundational market-access fact for any payments operator assessing entry into Malaysia: rather than a licence taxonomy split by activity type, BNM applies a unified approval process spanning payment-system operation, e-money issuance and merchant acquiring, with prudential and conduct obligations attached to each approval type rather than to a standalone licence class.

Periodic update · new data 2026-08-25 · run wpm-2026-08-21

Licensing, Authorisation & Market Access

The Consumer Credit Act 2025 (Act 873) is the defining licensing-and-market-access development for Malaysia this cycle. Gazetted on 31 December 2025, the Act entered into force on 1 March 2026, with Part V, the licensing provisions, commencing separately on 1 June 2026. The Act establishes a unified statutory regime for buy-now-pay-later providers, leasing companies, factoring companies, and debt-collection businesses, replacing what had previously been a fragmented multi-ministry patchwork of oversight split across Bank Negara Malaysia, the Securities Commission, and other legacy ministries.

A newly-established Consumer Credit Commission, known as SKP, is the new licensing and registration authority under the Act. BNPL, leasing, and factoring companies must obtain an SKP licence; debt-collection agencies, impaired-loan-acquisition entities, and debt-counselling agencies must register with SKP instead. A six-month transition period runs from 1 June to 30 November 2026, during which existing market participants must complete their licence or registration applications as oversight is phased in from the legacy ministries.

Outlook

The transition deadline of 30 November 2026 is the key near-term watchpoint. Whether SKP completes the phased transfer of oversight from the legacy ministries smoothly, and whether the existing BNPL, leasing, factoring, and debt-collection population completes licensing or registration within the six-month window, will determine whether this reform is remembered as an orderly consolidation or a disruptive one.

1 earlier distinct update(s)
Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Licensing, Authorisation & Market Access

Bank Negara Malaysia's regulatory-perimeter clarification for electronic money took effect on 31 January 2025 through a revised e-money Policy Document and accompanying FAQ, formally exempting limited-purpose e-money issuers from BNM's purview under two 2024 Exemption Orders, P.U.A 463/2024 and its Islamic-finance equivalent P.U.A 461/2024. This is a genuine perimeter-narrowing event rather than a mere clarification of existing practice: the Financial Services (Limited Purpose Electronic Money) (Exemption) Order 2024 supersedes the prior full-scope supervisory treatment that had applied to limited-purpose issuers, meaning a defined category of e-money issuer now sits outside BNM's direct licensing perimeter entirely.

At the same time, BNM's licence-processing channel for new payments entrants remains active: SunRate's licence approval, reported 28 April 2026, illustrates continued throughput for new entrants even as the regulator narrows its supervisory scope at the margins. This is a single T3-sourced report without primary BNM licence-register confirmation this cycle, so it is best read as an illustrative data point on continued market access rather than a confirmed count of new licensees.

Read together, these two developments describe a liberalising market-access posture this cycle: BNM is simultaneously narrowing which e-money issuers require its direct oversight and continuing to process new licence applications. The distinction between bank and non-bank payment institution treatment is central to reading this correctly: the e-money exemption orders apply specifically to non-bank e-money issuers operating limited-purpose models, and do not alter BNM's supervisory posture toward bank-issued e-money or full-purpose non-bank e-money issuers, which remain within the standard licensing perimeter.

Outlook

Further BNM licence-processing activity for new payments entrants is expected through the remainder of 2026 via the existing sandbox and standard application channels. Primary-source confirmation of the SunRate approval, and of the practical operating impact of the two 2024 Exemption Orders on the limited-purpose e-money issuer population, are the most valuable confirmations to seek next cycle.

Sources and findings (5)
  1. T3https://www.lexology.com/library/detail.aspx?g=efce9f8d-681b-47e9-b293-cd3552dbf3c8 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  2. T1https://www.bnm.gov.my/-/pd-pso-2022
  3. T1https://www.bnm.gov.my/application-for-approval-and-registration
  4. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T1https://www.commonlii.org/my/legis/consol_act/psa2003221/

#

BNM's Technology Requirements Policy Document (TR PD) — a four-tier technology-governance framework for payment regulatees — was issued March 2026 (substantive effect 12 March 2027), overlapping the existing RMiT regime and newly capturing licensed money-services businesses.

Standing sub-brief320 words · last cycle wpm-2026-08-05

Conduct, Safeguarding & Promotions

The live conduct-and-safeguarding story in Malaysia is the revised Policy Document on Electronic Money, effective 31 January 2025, which replaced the 2022-vintage PD and materially raised the bar for non-bank e-money issuers. Large-scheme issuers must now hold customer funds in a Trustee Act 1949 trust account maintained with a licensed institution; small-scheme issuers must use a separated or dedicated deposit account managed on trust-like terms; and Shariah-compliant e-money issuers use a qard structure within a Shariah-compliant trust or dedicated deposit account. The revised PD also tightens governance and cybersecurity expectations and introduces a three-year exit-strategy requirement for issuers. Minimum capital is tiered at RM100,000 for small-scheme issuers and RM5 million, or 8% of outstanding e-money liabilities, for large-scheme issuers. Because Malaysia has no FSCS-style deposit-protection scheme extending to non-bank e-money balances, this trust/segregation mechanism is the primary consumer-fund protection in the wallet-dominated Malaysian market — a market where non-bank issuers outnumber bank issuers by roughly eight to one. Confidence in this reading was upgraded to Confirmed following verification that the revised PD is in force via a Bank Negara Malaysia primary source. On the conduct side, BNM issued a Policy Document on Complaints Handling on 28 March 2025, superseding 2009-vintage guidelines. It applies to financial service providers including eligible e-money issuers and establishes an escalation pathway to the Financial Markets Ombudsman Service or BNMLINK. Most of the document enters force on 1 April 2026, though Paragraph 12 took effect immediately on issuance (28 March 2025).

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Conduct, Safeguarding & Financial Promotions

Bank Negara Malaysia's Technology Requirements Policy Document (TR PD) took effect in March 2026, with its substantive obligations becoming effective 12 March 2027. The TR PD introduces a four-tier proportional technology-governance structure that overlaps the existing Risk Management in Technology (RMiT) framework, and it extends coverage beyond RMiT's traditional bank-centric scope to capture e-money issuers, merchant acquirers, licensed money-services businesses and PayNet itself. This is the clearest conduct-and-safeguarding-adjacent development of the cycle: extending technology-governance obligations to non-bank payment institutions and the domestic scheme operator alongside banks addresses a proportionality gap between bank-grade and non-bank-grade technology oversight that has been a structural feature of Malaysia's payments-conduct regime.

The TR PD's tiering structure is explicitly proportional rather than uniform: entities already captured under RMiT sit in Tier 1, larger regulatees crossing defined annual transaction-value or volume thresholds face fuller Tier 2 obligations, smaller entities fall under a lighter Tier 3, and non-digital money changers sit in Tier 4. This tiering approach means the practical conduct burden on any individual payment institution depends heavily on its transaction scale, and a merchant acquirer or e-money issuer should not assume uniform treatment with its bank counterparts under the new framework.

Sourcing for the TR PD itself is a single Tier 4 advisory-firm article, with no primary Bank Negara Malaysia policy-document URL captured this cycle; this is recorded as an explicit sourcing gap and the finding should be treated as reported rather than fully confirmed pending primary-source retrieval.

Outlook

Primary-source confirmation of the TR PD from Bank Negara Malaysia directly is the priority research item for this module next cycle, together with market clarity on tier-applicability boundaries, which advisory-firm commentary suggests remains an active point of confusion among regulatees ahead of the March 2027 effective date. Payment institutions should expect a 90-day gap-analysis and remediation-plan submission requirement following licence-approval issuance once the framework is confirmed.

Sources and findings (5)
  1. T3https://www.rahmatlim.com/perspectives/articles/23492/mykh_new-bank-negara-policy-document-updates-e-money-regulatory-framework [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  2. T3https://fintechnews.my/47925/digital-banking-news-malaysia/bnm-e-money-policy-impact-issuers-consumers/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.lexology.com/library/detail.aspx?g=27648eab-afb4-4322-9f88-cf29c6ed67d5 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.lexology.com/library/detail.aspx?g=d9ca31ce-34a4-4352-9b88-e9cc03e27f00 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

Malaysia has NO finalised payment-stablecoin framework in force as of mid-2026. Crypto/digital assets that exhibit investment characteristics are classified as securities and regulated by the Securities Commission Malaysia (SC) under the Capital Markets and Services Act 2007 and the 2019 Prescription Order; BNM retains monetary/financial-stability and AML oversight, and does not recognise crypto as legal tender. Stablecoins are not yet specifically regulated; routing is activity-dependent (payment-use may trigger BNM payment-instrument licensing, trading/custody falls to SC). BNM launched a Digital Asset Innovation Hub (DAIH) in June 2025 and is evaluating ringgit-pegged stablecoin pilots; reserve expectations are converging on 1:1 fiat backing. A CBDC remains exploratory (Project Dunbar).

Open gap — wpm-int-3Stablecoin framework status is a negative (absence) claim supported only by T3 sources; no T1/T2 source confirms either a finalised payment-stablecoin regime OR its definitive absence. DAIH pilot outcomes and any BNM consultation (e.g. a CP) should be tracked for the first material W2 development.Emerging-market digital-money framework under-indexed; only vendor/law-firm T3 sources available.
Horizon · 2026 (±multi_year)BNM payment-stablecoin framework / DAIH pilot outcomesproposed · T3
Standing sub-brief235 words · last cycle wpm-2026-06-24

Stablecoins & Digital Money

Malaysia has no finalised payment-stablecoin licensing regime in force as of mid-2026. Regulatory routing is activity-dependent: stablecoin use for payment purposes may trigger BNM payment-instrument licensing, while exchange, custody and trading activity falls to the Securities Commission under the Capital Markets and Services Act 2007 and the 2019 Prescription of Securities (Digital Currency and Digital Token) Order. Reserve expectations are converging on 1:1 fiat backing even in the absence of a codified rulebook. BNM's Digital Asset Innovation Hub, launched June 2025, is evaluating a reported 30-plus ringgit-stablecoin project submissions, and BNM is separately exploring central bank digital currency questions through Project Dunbar. This is an absence-of-framework finding rather than a confirmed negative; no Tier-1 or Tier-2 source has yet announced either a finalised regime or a definitive decision not to regulate, so the Assessed confidence tier reflects genuine calibration rather than under-research. For operators considering a ringgit-pegged stablecoin, the practical consequence is market-access uncertainty pending the outcome of BNM's DAIH pilot programme.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T1https://www.sc.com.my/regulation/guidelines/digital-assets
  2. T3https://globallawexperts.com/stablecoins-regulation-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://www.sanctionscanner.com/blog/cryptocurrency-regulations-in-malaysia-1180 [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.kevinwuassociates.com/post/cryptocurrency-legality-in-malaysia-a-2025-legal-overview [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.lexology.com/library/detail.aspx?g=01ac9292-6db7-4569-91ea-5fa6f006ec7c [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

TR PD issued 12 March 2026, consolidating technology-risk governance into a four-tier proportionality structure; BNM enforcement record shows escalating cybersecurity-related penalties including Bank Rakyat's second AMP in seven months.

Movement — NEWTR PD issued and Bank Rakyat repeat enforcementNew technology-risk policy document and escalating enforcement pattern surfaced this cycle.
Standing sub-brief244 words · last cycle wpm-2026-08-21

Operational Resilience & Critical Infrastructure

BNM's Risk Management in Technology (RMiT) policy document, issued 28 November 2025, is a substantial revision of the 2019/2020 framework (as further updated 1 June 2023) and functions as Malaysia's DORA-analogue. It applies to banks, insurers and takaful operators, development financial institutions, payment system operators and approved e-money issuers. The policy sets prescriptive tolerances: critical systems face a maximum tolerable downtime of 120 minutes per incident and four hours cumulative annually; incidents must be notified to BNM within one hour of detection, with a full report due within 14 days and a post-incident review within 30 days. Stand-in-processing and capacity obligations do not bind immediately — firms have until 30 September 2027 to comply. The regime also requires dual reporting to the National Cyber Security Agency under the Cyber Security Act 2024. A November 2024 exposure draft signalled BNM's intent to extend equivalent resilience standards to non-bank merchant acquirers, a scope expansion that would bring RMiT-style obligations to a wider non-bank population than the current in-force text covers.

Periodic update · new data 2026-08-25 · run wpm-2026-08-21

Operational Resilience & Critical Infrastructure

Bank Negara Malaysia issued its Policy Document on Technology Requirements for Payment Services Regulatees on 12 March 2026, establishing a four-tier proportionality structure for technology-risk governance. The framework sets a Tier-2 threshold at annual transaction value above RM1.5 billion or transaction volumes above seven million, and requires affected regulatees to maintain board-approved technology-risk-management and cyber-resilience frameworks, appoint a certified chief information security officer, and establish cross-functional technology committees. The policy document consolidates technology-risk governance across electronic-money issuers, merchant acquirers, licensed money-services businesses, and PayNet operators.

Against this backdrop, Bank Negara Malaysia imposed a RM1,000,000 administrative monetary penalty on Bank Kerjasama Rakyat Malaysia Berhad on 20 January 2026 for cybersecurity and customer-information-protection breaches following an external threat-actor intrusion. This is the second such penalty imposed on the same institution within roughly seven months, following a RM2.85 million fine in June 2025.

Outlook

Watch for how Bank Kerjasama Rakyat Malaysia Berhad remediates the underlying deficiency behind its second cybersecurity penalty in seven months. Separately, the phased application of the four-tier Technology Requirements Policy Document across Tier-1 through Tier-4 regulatees will be the structural story to track over coming cycles.

Sources and findings (5)
  1. T2https://regulations.ai/regulations/malaysia-2023-06-bnm-rmit
  2. T3https://www.picussecurity.com/resource/blog/meeting-bank-negara-malaysias-rmit-requirements-with-picus [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  3. T3https://theos-cyber.com/articles/mtdr/bnm-rmit-2025-compliance-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  4. T3https://www.simplydata.com.my/bnm-rmit-compliance-malaysia/ [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]
  5. T3https://www.ey.com/en_my/technical/take-5-business-alert/inside-the-risk-management-in-technology-rmit-exposure-draft [CAVEAT: Tier 3 secondary source — Assessed; verify vs primary pre-publication]

#

Card-scheme economics are regulated domestically by BNM's Payment Cards Framework (PCF) policy document (issued 19 August 2022, interchange ceilings effective 1 January 2023), which superseded the 2014 Payment Card Reform Framework (PCRF). The PCF lowered interchange ceilings (credit capped at 0.6%; domestic debit at the lesser of 0.1% or RM0.37 + 0.001%), subject to review every three years from 1 January 2023. Surcharging and minimum-purchase-amount practices on debit/credit card transactions are prohibited, with a cardholder complaint mechanism. Visa/Mastercard/JCB operate as international schemes; the domestic debit scheme MyDebit is operated by PayNet.

Open gap — wpm-int-1PCF interchange fee ceiling three-year review (first window early 2026): a BNM document dated 28 July 2025 titled 'Adjustment to the Debit Card Interchange Fee Ceiling' suggests a review/adjustment may have occurred, but the content was not accessible. The current standing position cites only the original 2023 ceilings — needs verification of any 2025/2026 adjustment before the W4 caps are treated as current.Possible live interchange-ceiling adjustment unverified due to inaccessible BNM PDF (Challenger f-004, verify_before_publish).
Standing sub-brief235 words · last cycle wpm-2026-06-24

Scheme & Network Compliance

Card-scheme economics in Malaysia are set by BNM's Payment Cards Framework (PCF), issued 19 August 2022 and superseding the 2014 Payment Card Reform Framework. Interchange ceilings took effect 1 January 2023: credit-card interchange is capped at 0.6%, and domestic debit interchange at the lesser of 0.1% or RM0.37 plus 0.001%. The PCF also prohibits surcharging and minimum-purchase practices and requires a cardholder complaint mechanism. International schemes Visa, Mastercard and JCB operate alongside MyDebit, the domestic debit scheme operated by PayNet. The interchange ceilings are subject to review every three years from 1 January 2023, placing the first scheduled review window in early 2026. A BNM document dated 28 July 2025 and titled "Adjustment to the Debit Card Interchange Fee Ceiling" suggests this review may already have produced a change to the debit ceiling, but its content was not accessible during this research cycle and the adjustment remains unverified — the current standing position therefore still cites the original 2023 ceilings pending confirmation.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T1BNM Payment Card Reform Framework (interchange ceilings, 3-yr review from 1 Jan 2023) (bnm.gov.my)
  2. T2https://www.kansascityfed.org/documents/11143/PublicAuthorityInvolvementPaymentCardMarkets_VariousCountries_August2025Update.pdf
  3. T1https://www.bnm.gov.my/-/payment-card-reform-23122014
  4. T1https://www.bnm.gov.my/-/response-to-fmt-article-entitled-consumer-body-abolish-surcharges-on-credit-cards-

#

IFTF issued 30 June 2026, mandating full phase-out of proprietary/closed-loop QR networks by 30 June 2028; DuitNow QR cross-border corridors continue expanding.

Movement — NEWIFTF issued with closed-loop QR phase-out deadlineNew payment-corridor interoperability framework surfaced this cycle.
Standing sub-brief178 words · last cycle wpm-2026-08-21

Payment Corridor Dynamics

Malaysia's domestic instant-payments rail, DuitNow, runs on PayNet's Real-time Retail Payments Platform (RPP), live since December 2018 and built on ISO 20022 messaging, with DuitNow QR serving as the unified national QR standard. Malaysia has become one of the more active participants in ASEAN's Regional Payment Connectivity initiative, signed November 2022, with multiple live cross-border QR and real-time transfer linkages: DuitNow–PromptPay with Thailand, DuitNow–QRIS with Indonesia, and a DuitNow–NETS/PayNow real-time transfer link with Singapore established November 2023 that notably includes non-bank participation (subject to transaction limits). Further linkages extend to China and Cambodia, among others. This multi-corridor cross-border QR network is a genuine differentiator for remittance and travel-payment flows and aligns with the G20's cross-border payments roadmap.

Periodic update · new data 2026-08-25 · run wpm-2026-08-21

Payment Corridor Dynamics

Bank Negara Malaysia issued its Interoperable Fund Transfer Framework on 30 June 2026, replacing the December-2019 Interoperable Credit Transfer Framework and extending its application to banks, Islamic banks, development financial institutions, e-money issuers, payment system operators, and registered merchant acquirers. The framework's most consequential provision sets 30 June 2028 as the deadline for the full phase-out of proprietary and closed-loop QR payment networks, meaning that banks and e-wallet operators currently running their own proprietary QR schemes have a defined two-year window to migrate toward the interoperable standard.

This domestic interoperability push runs alongside continued expansion of Malaysia's cross-border payment corridors. DuitNow QR corridors were live with Singapore, Thailand, Indonesia, China, and Cambodia as of end-2025, and an India corridor is expected to go live during 2026.

Outlook

The two-year transition window to 30 June 2028 is the defining structural deadline in this domain; watch for how quickly banks and e-wallet operators currently running proprietary QR schemes announce migration timelines. On the cross-border side, the expected 2026 India corridor launch would be the next concrete milestone in DuitNow QR's regional expansion.

Sources and findings (5)
  1. T1https://www.bot.or.th/en/financial-innovation/digital-finance/digital-payment/cross-border-payment.html
  2. T1https://www.bnm.gov.my/-/duitnow-qris-link-my-id
  3. T3https://www.lightspark.com/knowledge/instant-payments-malaysia
  4. T2https://amro-asia.org/enhancing-regional-payment-connectivity-across-asean3-economies
  5. T4https://www.travelandtourworld.com/news/article/malaysia-joins-philippines-singapore-and-thailand-shatter-global-financial-norms-in-2026-as-unstoppable-cross-border-qr-payment-network-for-booming-travel-what-you-need-to-know/

#

Malaysia's payments market is a bank/non-bank hybrid centred on PayNet (national payments utility, BNM the single largest shareholder alongside 11 financial institutions). The e-wallet segment is led by TNG Digital (Touch 'n Go), Boost, ShopeePay, GrabPay and BigPay; the regulatee population shows non-bank EMIs far outnumbering bank EMIs (~47–48 non-bank vs ~6 bank). The market is rapidly growing (18.4 billion e-payment transactions in 2025, +25% YoY) and is being reshaped by five digital banks licensed by BNM in 2022 (Boost-RHB, GXBank, SeaMoney-YTL, AEON, KAF). Digital payments hold roughly half the fintech market by service proposition.

Open gap — wpm-int-2Digital-bank consortium attribution: the W6 finding labelled one 2022 conventional licence holder as a 'Grab-Singtel-Kuok consortium' separate from the GXS Bank consortium; per BNM's 29 Apr 2022 announcement the licence was awarded to the GXS Bank-Kuok Brothers consortium (GXS being the Grab-Singtel entity), with Islamic licences to AEON-MoneyLion and KAF Investment Bank. Corrected in claim notes/cycle_delta (Challenger f-005).no under-indexing note recorded
Standing sub-brief237 words · last cycle wpm-2026-06-24

Industry Structure & Commercial Dynamics

Malaysia's payments market is a bank/non-bank hybrid centred on PayNet, in which BNM is the single largest shareholder alongside eleven financial institutions. The e-wallet segment is led by TNG Digital, Boost, ShopeePay, GrabPay and BigPay, and non-bank e-money issuers (approximately 47) far outnumber bank e-money issuers (approximately 6). The market processed 18.4 billion e-payment transactions in 2025, up 25% year-on-year, with retail e-payment value of RM831 billion and a 17% compound annual growth rate since 2022. BNM awarded five digital-bank licences in 2022: on the conventional (FSA) side, to Boost-RHB, GXS Bank-Kuok Brothers, and Sea-YTL; on the Islamic (IFSA) side, to AEON-MoneyLion and KAF Investment Bank. (An earlier characterisation of one conventional licensee as a "Grab-Singtel-Kuok consortium" has been corrected: GXS Bank is the Grab-Singtel entity, and its licence was awarded jointly with Kuok Brothers.) Digital payments account for roughly 50.7% of Malaysia's fintech market in 2025. Taken together, this is a non-bank-dominated, rapidly growing market being reshaped by the 2022 digital-bank cohort.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdf
  2. T3https://www.zitadelleag.com/news/malaysia-merchant-acquiring-license-mas-regulatory-guide-licensing-support-by-zitadelle-ag
  3. T3https://www.pcalaw.com.my/2021/12/09/e-money-overview/
  4. T1BNM — digital bank licences (29 Apr 2022); FSA 2013 / IFSA 2013 (bnm.gov.my)
  5. T3https://www.mordorintelligence.com/industry-reports/malaysia-fintech-market

Payments-relevant legal action in Malaysia is dominated by BNM administrative enforcement (compound/monetary penalties) rather than landmark civil litigation, focused on AML/CFT/sanctions-screening and operational-resilience (RMiT) breaches. Notable actions include the May 2023 penalty on TNG Digital (sanctions-screening lapse), the July 2025 RM340,000 fine on Alipay Malaysia (AIMY Merchant Services) for failing to update its sanctions database, and July 2025 penalties totalling over RM7 million on Bank Islam, Bank Rakyat and BSN for RMiT/availability and sanctions-screening breaches. The AMLA was amended in December 2024 to strengthen supervision and enforcement.

Standing sub-brief178 words · last cycle wpm-2026-06-24

Legal & Litigation

Malaysia's payments-enforcement landscape is dominated by BNM administrative penalties rather than landmark civil litigation, with recent actions concentrated on sanctions-screening and RMiT-related operational-resilience breaches. TNG Digital was penalised in May 2023 over sanctions-screening failures. In July 2025, BNM fined Alipay Malaysia (operating as AIMY Merchant Services) RM340,000 for a sanctions-database failure, and in the same month imposed penalties totalling more than RM7 million on three banks — Bank Islam (RM3.445 million), Bank Rakyat (RM2.85 million) and Bank Simpanan Nasional (RM995,000) — for RMiT and sanctions-screening breaches. The Anti-Money Laundering Act was amended in December 2024. Enforcement activity spans both bank and non-bank PSPs, indicating BNM's administrative posture is applied consistently across the industry rather than concentrated on one segment.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3https://fintechnews.my/54303/regtech-fintech-regulation-malaysia/bnm-alipay-fine/
  2. T3https://www.freemalaysiatoday.com/category/nation/2025/07/30/3-banks-fined-more-than-rm7mil-for-regulatory-breaches
  3. T3https://www.flagright.com/post/bnms-e-money-exposure-draft-aml-cft-implications-for-fintechs-and-wallet-providers
  4. T3https://sumsub.com/blog/malaysian-aml-requirements/

#

Merchant acquiring is a registered (not licensed) activity under section 17 FSA 2013, with BNM's Policy Document on Merchant Acquiring Services (issued 15 September 2021) setting governance, operational-risk, IT-management, minimum-capital (non-bank) and merchant-onboarding/recruitment requirements. The PD took effect for bank acquirers from 15 March 2022 and for non-bank acquirers (minimum capital) from 15 September 2023. The registered acquirer base is broad — including TNG Digital, GHL, ShopeePay, Razer Merchant Services, Stripe and FIS Worldpay — and the November 2024 RMiT exposure draft would extend resilience standards to non-bank merchant acquirers.

Standing sub-brief166 words · last cycle wpm-2026-06-24

Merchant Acquiring & Risk

Merchant acquiring in Malaysia is a registered, not licensed, activity under section 17 of the FSA 2013. BNM's Policy Document on Merchant Acquiring Services, issued 15 September 2021, sets governance, operational-risk, IT and merchant-onboarding requirements, alongside minimum-capital requirements for non-bank acquirers; the requirements became effective for bank acquirers from 15 March 2022 and for non-bank capital requirements from 15 September 2023. The registered base is broad, including TNG Digital, GHL, ShopeePay, Razer, Stripe and FIS Worldpay among more than 40 registered acquirers. A November 2024 RMiT exposure draft would extend operational-resilience standards to non-bank merchant acquirers, which are not currently within RMiT's in-force scope.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T1https://www.bnm.gov.my/-/pd-merchant-acquiring-services
  2. T3https://www.rahmatlim.com/publication/articles/19392/bank-negara-issues-policy-document-on-merchant-acquiring-services
  3. T3https://www.zitadelleag.com/news/malaysia-merchant-acquiring-license-mas-regulatory-guide-licensing-support-by-zitadelle-ag
  4. T3https://www.capco.com/intelligence/capco-intelligence/empowering-compliance-with-bank-negara-malaysias-rmit

#

DuitNow remains MY's core instant-payments rail; 2026 developments include cross-border QR interoperability expansion (2.5x growth to 29.7m transactions in 2025) and deepened Project Nexus multilateral integration via a PayNet-NETS joint venture appointed Nexus Technical Operator (Feb 2026).

Standing sub-brief172 words · last cycle wpm-2026-08-05

Product Innovation & Market Development

BNM's product-development agenda runs through the Financial Sector Blueprint 2022–2026, PayNet's RPP modernisation programme, and the Interoperable Credit Transfer Framework (ICTF), which gives banks and eligible non-bank e-money issuers fair, open access to shared payments infrastructure. Live build-out includes DuitNow QR, Request-to-Pay, e-mandates/AutoDebit, cross-border QR expansion and tap-to-phone acceptance (via Soft Space). Sandbox activity is running at both BNM (the Digital Asset Innovation Hub, launched June 2025) and the Securities Commission (a digital-asset/tokenisation sandbox, 2025), alongside CBDC-exploratory work through Project Dunbar and tokenised-deposit pilots. The ICTF's open-access mandate is a distinct market-access lever for non-bank EMIs, separate from the specific product launches tracked in W13.

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Product Innovation & Market Development

Malaysia's instant-payments infrastructure deepened its regional and cross-border reach this cycle on two fronts. DuitNow QR, operated by PayNet, is now interoperable with Thailand's PromptPay, Singapore's NETS, Indonesia's QRIS, Chinese payment networks, and, as of 2025, Cambodia's Bakong, and cross-border QR transaction volume grew 2.5 times to 29.7 million transactions in 2025. Separately, a PayNet-NETS joint venture was appointed Nexus Technical Operator by Nexus Global Payments in February 2026, formalising Malaysia's role as a founding member of Project Nexus alongside India, the Philippines, Singapore and Thailand, with Bank Indonesia joining in 2026 as the scheme's sixth member.

These two developments are structurally connected: DuitNow's bilateral QR interoperability agreements and Malaysia's Project Nexus participation both extend the same underlying domestic instant-payments rail outward, but they operate through different technical models — QR interoperability is a bilateral, scheme-to-scheme linkage model, while Project Nexus is a multilateral hub-and-spoke interlinkage architecture designed to let any participating country's instant-payment system reach any other participant's system through common infrastructure operated by the appointed Technical Operator. Malaysia now has meaningful exposure to both models simultaneously, and the PayNet-NETS joint venture's appointment as Technical Operator gives Malaysia direct operational influence over the multilateral rail rather than participation as a connecting member only.

The 2.5-times growth in cross-border QR transaction volume is a genuine product-adoption signal, though it should be read as a single-year comparison rather than an established multi-year trend given the sourcing available this cycle.

Outlook

Bank Indonesia's 2026 addition to Project Nexus as a sixth member will be a useful comparator for whether the interlinkage model scales smoothly as membership grows, and the PayNet-NETS joint venture's early performance as Technical Operator is worth tracking as the first indicator of Malaysia's execution capacity in that operational role. Continued DuitNow QR interoperability expansion to additional ASEAN or wider Asia-Pacific corridors would be the next logical development to watch for.

Sources and findings (4)
  1. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdf
  2. T3https://www.aciworldwide.com/blog/putting-malaysia-on-the-path-to-payments-innovation
  3. T3https://www.lexology.com/library/detail.aspx?g=01ac9292-6db7-4569-91ea-5fa6f006ec7c
  4. T3https://www.ainvest.com/news/malaysia-proposes-major-digital-asset-exchange-regulations-115-trading-volume-surge-2507/

#

Consumer protection rests on BNM's conduct framework (Fair Treatment of Financial Consumers; Complaints Handling PD of March 2025, effective April 2026) with redress via the Financial Markets Ombudsman Service (FMOS) — created 1 January 2025 by merging the Ombudsman for Financial Services (OFS) and SIDREC — and BNMLINK. Malaysia has NO statutory mandatory APP-fraud reimbursement scheme equivalent to the UK PSR model; instead BNM requires banks to ensure fair redress for unauthorised-transaction victims who took protective steps and did not act fraudulently, coordinated via the National Scam Response Centre / PDRM / MCMC anti-scam framework.

Standing sub-brief201 words · last cycle wpm-2026-06-24

Consumer Protection & APP Fraud

Malaysia has no statutory mandatory reimbursement scheme for authorised-push-payment fraud victims equivalent to the UK's PSR-mandated model. Instead, BNM requires banks to ensure fair redress for victims of unauthorised transactions who took reasonable protective steps and did not act fraudulently, with case coordination running through the National Scam Response Centre alongside the police (PDRM) and the communications regulator (MCMC). Redress channels were consolidated on 1 January 2025 with the creation of the Financial Markets Ombudsman Service (FMOS) from the merger of the Ombudsman for Financial Services and SIDREC, alongside the BNMLINK channel. The Complaints Handling policy document, issued 28 March 2025, enters full force 1 April 2026 and formalises the FMOS/BNMLINK escalation pathway for financial service providers. The absence of a mandatory APP-reimbursement liability model materially lowers PSP consumer-fraud liability exposure in Malaysia relative to jurisdictions with statutory reimbursement mandates.

No periodic updates recorded against this sub-brief.

Sources and findings (5)
  1. T1https://www.bnm.gov.my/-/combating-financial-fraud
  2. T2http://www.fmos.org.my/en/
  3. T3https://www.scamproof.my/
  4. T3https://www.lexology.com/library/detail.aspx?g=d9ca31ce-34a4-4352-9b88-e9cc03e27f00
  5. T1https://www.bnm.gov.my/index.php?ch=en_financialconsumeralert

#

[SENTINEL-FED] Sentinel.gi payments-context position: Malaysia's AML/CFT regime rests on the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), supervised by BNM's Financial Intelligence & Enforcement Department (FIED). Payments-context posture: stringent sanctions/PEP screening and CDD obligations on EMIs and payment institutions, active administrative enforcement (TNG Digital 2023; Alipay/AIMY 2025), AMLA strengthened December 2024 ahead of the 2025 FATF mutual evaluation, with CPF (counter-proliferation-financing) provisions added. No original FIM analysis performed here.

Standing sub-brief172 words · last cycle wpm-2026-06-24

AML/CFT & Financial Crime

[Sentinel-sourced] Malaysia's AML/CFT regime rests on the Anti-Money Laundering Act 2001, supervised by BNM's Financial Intelligence and Enforcement Department (FIED). In the payments context, this translates into stringent sanctions and PEP-screening and customer-due-diligence obligations on e-money issuers and payment institutions: reporting institutions, including e-money issuers, must screen both new and existing customers against the Domestic List and UN sanctions lists. The AMLA was strengthened in December 2024 with counter-proliferation-financing provisions, timed ahead of Malaysia's 2025 FATF mutual evaluation. This intelligence is attributed to the Sentinel.gi feed; the payments-context sanctions-screening and CDD posture described here is carried as the relevant EMI/PSP compliance-cost signal, and readers seeking the underlying illicit-finance and sanctions-evasion analysis should refer to the Financial Intelligence Monitor, to which this material has been cross-referenced.

No periodic updates recorded against this sub-brief.

Sources and findings (4)
  1. T3sentinel://sumsub.com/blog/malaysian-aml-requirements
  2. T?FIM (sentinel.gi) per-JID baseline profile — Malaysia — Malaysia operates under the AMLA 2001 (Act 613), supervised by Bank Negara Malaysia, the Securities Commission and the Labuan FSA, coordinated via the National Coordination Committee to Counter Money Laundering. FATF's Dec 2025 MER rates Malaysia compliant on 24 Recommendations and largely compliant on 16, citing a sound legal/supervisory architecture but persistent weaknesses converting investigations into prosecutions, dissuasive sanctions, and BO/TCSP oversight in Labuan.
  3. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003) — Gap: enforcement-absence
  4. T?FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: legal-gap

#

Foreign PSPs are gaining direct domestic-rail access: Wise connected directly to PayNet in mid-2026, its ninth global and fifth APAC direct domestic-system connection.

Open gap — wpm-int-4Non-bank settlement-access and tiered RENTAS access dynamics rely on a 2021 World Bank case study; current (2026) non-bank participation thresholds and any RENTAS+ direct-access changes for PSPs are not confirmed and should be refreshed.Non-bank PSP settlement access is an under-indexed access dynamic; primary data dated 2021.
Standing sub-brief215 words · last cycle wpm-2026-08-05

Correspondent Banking, Settlement & Access

The analytical spine of this module is Malaysia's bank/non-bank settlement-access asymmetry. RENTAS, operated by PayNet since July 1999, is Malaysia's only large-value payment system, settling high-value ringgit interbank funds and scripless securities with finality across BNM's books; it supports payment-versus-payment settlement through a ringgit–USD CHATS link with Hong Kong established November 2006, and foreign-currency settlement via Onshore Settlement Institutions. Non-bank participants in PayNet's Real-time Retail Payments Platform have no direct access to RENTAS and must settle through settlement banks — a structural constraint on non-bank market participants that persists even as the settlement rails around them are modernised. That modernisation arrived in October 2025 with the launch of RENTAS+, the first ASEAN RTGS system to offer round-the-clock (24/7) gross settlement, which now settles DuitNow retail transactions on a gross basis with an automated liquidity facility.

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Correspondent Banking, Settlement & Access

Wise connected directly to PayNet this cycle, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is the clearest correspondent-banking-access development of the cycle and should be read against this module's central analytical spine: the structural asymmetry between bank and non-bank access to domestic payment rails. A direct PayNet connection allows Wise, a non-bank payment institution, to settle DuitNow QR transactions without routing through a correspondent bank intermediary, reducing both cost and settlement-time exposure to intermediary-bank risk that non-bank PSPs have historically had to absorb when accessing domestic rails indirectly.

The significance of this connection is best understood by its place in a sequence: it is explicitly Wise's ninth global and fifth Asia-Pacific direct domestic connection, indicating this is part of a deliberate, scaling strategy by a major non-bank PSP to secure direct rail access across multiple jurisdictions rather than an isolated Malaysia-specific event. For Malaysia specifically, it demonstrates that PayNet's direct-connection model is open to non-bank PSPs meeting its access criteria, which is itself informative for other non-bank payment institutions evaluating whether direct domestic-rail access is a realistic alternative to correspondent-bank-intermediated access in Malaysia.

Outlook

Whether other major non-bank PSPs follow Wise's path to direct PayNet connection is the key development to watch in this module next cycle, as is whether PayNet's access criteria evolve as its direct-connection non-bank population grows. This connection also bears watching alongside the Technology Requirements Policy Document reported elsewhere this cycle, since PayNet itself is named as newly captured under that framework's technology-governance obligations.

Sources and findings (4)
  1. T1https://www.bnm.gov.my/types-of-payment-systems
  2. T1https://www.bnm.gov.my/index.php?ch=ps&pg=ps_mps_type&ac=177&lang=en
  3. T1https://fastpayments.worldbank.org/sites/default/files/2021-09/World_Bank_FPS_Malaysia_RPP_Case_Study.pdf
  4. T3https://fintechnews.my/54449/payments-remittance-malaysia/bank-negara-malaysia-bnm-launches-rentas-plus-for-24-7-interbank-settlement/

#

Trailing-12-month commercial activity (run date 2026-06-24) centres on capital injections into e-wallet/digital-banking players and merchant-acquiring/cross-border product expansion. TNG Digital secured ~USD 75 million from strategic investors and targeted first full-year profitability in 2025; Axiata's Boost was reportedly in talks with a potential new shareholder (regulatory approval pending). Funding leaders include TNG Digital (~USD 168m cumulative), BigPay (~RM475m) and Boost (~RM308m). RENTAS+ (Oct 2025) and continued cross-border QR linkages are the principal product releases.

Open gap — wpm-int-5W13 commercial-event data (TNG Digital USD75m, Boost shareholder talks, BigPay/Boost cumulative funding) rests on T3 trade-press/aggregator sources (mordorintelligence, fintechnews.my, tracxn); deal values and round stages are not corroborated by primary filings, and Boost's shareholder change is rumoured/pending regulatory approval.Private-company commercial signals under-indexed; values unverified against primary sources.
Standing sub-brief175 words · last cycle wpm-2026-08-05

Commercial Intelligence (M&A, Investment & Product)

Three discrete commercial events are recorded for Malaysia this cycle. TNG Digital (Touch 'n Go) raised USD 75 million from strategic investors in 2025, targeting first full-year profitability the same year; the round brings TNG Digital's cumulative funding to roughly USD 168 million, making it Malaysia's most-funded fintech as of October 2025. Axiata's Boost Holdings is reportedly in talks with a potential new shareholder; the amount involved is not publicly disclosed, and the investment still requires regulatory approval. Separately, PayNet launched RENTAS+ in October 2025 — an in-house, cloud-based enhancement enabling continuous 24/7 interbank settlement and the first such round-the-clock RTGS capability in ASEAN, now settling DuitNow retail paymentson a gross basis (also recorded as a structural settlement development under W12).

Periodic update · new data 2026-08-11 · run wpm-2026-08-05

Commercial Intelligence & Fintech

This cycle's discrete commercial event is Wise's direct connection to PayNet, announced 30 July 2026, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is a product-launch and market-access event specific to Wise and PayNet rather than a structural industry-wide trend, and it is treated here as a discrete commercial development distinct from the broader correspondent-banking-access analysis this same event supports under this cycle's W12 reading.

No merger, acquisition, or funding-round event was identified for Malaysia this cycle. SunRate's reported BNM licence approval on 28 April 2026 is a market-access event more than a commercial-intelligence event in the M&A/investment/product-launch sense this module tracks, and is addressed under this cycle's W1a licensing reading rather than duplicated here.

Outlook

Continued monitoring for disclosed M&A, investment, or product-launch activity among Malaysia-licensed payment institutions is warranted next cycle, particularly given the active licence-processing and technology-governance developments recorded elsewhere this cycle that may prompt commercial responses from incumbent and new-entrant PSPs alike.

Sources and findings (5)
  1. T3https://www.mordorintelligence.com/industry-reports/malaysia-fintech-market
  2. T3https://fintechnews.my/49867/funding/top-5-most-funded-fintechs-in-malaysia-for-2025/
  3. T3https://fintechnews.my/49867/funding/top-5-most-funded-fintechs-in-malaysia-for-2025/
  4. T3https://tracxn.com/d/explore/fintech-startups-in-malaysia/__7PwJ-m65RwujGFYmL7TNrStzlh1_W8LNMDG2FsXFR7g
  5. T3https://www.businesstoday.com.my/2025/10/08/rentas-brings-24-7-settlement-to-malaysias-banking-system/
No modules match.

Filters combine as OR inside a group and AND across groups.

Editorial metadata

Provenance only. Nothing below gates publication or affects the render.

Editorial metadata for Malaysia
FieldValue
trust.lawyer_review.statusnever_reviewed
trust.lawyer_review.reviewernot recorded
trust.content_sourceai_generated

Provenance and declared absence

Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.

Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.

Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score; per-module RAG traffic light; derived_scores = {}.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-08-26. A year-precision row is never promoted into a tighter band.

Orphan deltas: 0 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card.

Envelope: baseline resolved at jurisdiction_json.baseline; 14 module(s), 64 finding(s), 115 source(s) in the cumulative register.