Malaysia’s payment ecosystem has expanded quickly.Customers now expect faster and more convenient ways to move money, whetherthrough remittances, currency exchange, digital channels or agent networks.Money Services Business (MSB) licensees sit at the centre of this, servingindividuals, migrant workers, businesses, tourists and cross-border trade.
The sector no longer runs through traditional countersalone. Many licensees now operate through digital channels, electronicterminals, agents, system providers and third-party arrangements. This hasimproved access and efficiency, but it has also widened exposure to financialcrime, technology, operational and conduct risk. That is why Bank NegaraMalaysia (BNM) continues to supervise the industry closely. The objective isnot to restrict growth, but to ensure it rests on sound governance, proper controlsand customer protection.
Risk areasthat draw regulatory attention
Licence scope. The first question for any licensee is whether it stilloperates within its approved licence. This matters more following the MoneyServices Business (Amendment) Act 2024, which widens the definition ofremittance to cover not only transferring funds but facilitating transfers:arranging them, accepting or receiving funds, providing the system used, orbeing involved in settlement. BNM may therefore look beyond the partyphysically moving money to those enabling or settling the flow. Any new product,corridor, agent structure or settlement model should be reviewed before launch.
Governance. A sound MSB business depends on clear accountability, not onlytransaction volume. The board, senior management, compliance officer, branchesand agents should each understand their roles, with approvals, escalation andreporting properly documented. BNM’s Governance, Risk Management and Operationspolicy document expects controls to be applied consistently across head office,branches, agents and digital channels, rather than left on the shelf.
AML/CFT. Customer due diligence, sanctions and politically exposed personscreening, transaction monitoring, suspicious transaction reporting andrecord-keeping remain the most sensitive areas. The common weakness is rarely acomplete absence of controls. More often it is inconsistency: an alert clearedwithout a recorded rationale, a customer profile that does not match thetransaction pattern, or a decision discussed internally but never documented.These are the gaps that turn a routine query into a finding.
Technology and third parties. As services digitise, system access, cybersecurity,incident handling and business continuity become part of the controlenvironment. Where licensees rely on agents, system providers or overseaspartners, accountability stays with the licensed MSB, so due diligence, ongoingmonitoring and audit access matter.
When practiceno longer matches the framework
Non-conformity tends to arise when actual practice driftsfrom what is approved or documented. A licensee should offer only theactivities its licence permits, unless BNM has given prior written approval.Customer funds should remain reconcilable with the liabilities of theremittance business. And BNM should be notified of significant changes to thebusiness or operating model, including payment and settlement flows, at least20 business days before they take effect. Where these points slip, an internalprocess gap can become a supervisory concern.
Whatnon-compliance can cost
The consequences are significant. Carrying on MSB withoutthe required licence can, on conviction, bring imprisonment of up to ten yearsand a fine of between MYR 50,000 and MYR 5 million. The 2024 amendments alsoallow property used in an offence to be forfeited, and clarify abetment: aremittance system provider that keeps supporting an unlicensed business, or alandlord that continues renting to an unlicensed currency exchange after BNMhas given notice, can both be caught.
For licensed MSBs, serious control failures can alsoaffect licence standing and raise questions of fitness and propriety, not onlytrigger a penalty. The commercial impact follows: regulatory queries,remediation, higher compliance cost, delayed approvals, lost bankingrelationships and reputational damage.
Building astronger MSB business
Strong compliance is not about making the business harderto run. It is about growing without creating avoidable regulatory, operationalor reputational risk. In practice that means clear standard operatingprocedures, trained staff, effective screening, meaningful transactionmonitoring, complete records, genuine oversight of branches and agents,reliable systems, and management reporting that reflects what is actuallyhappening on the ground. The most resilient licensees tend to be those that canshow their controls work in practice.
How AlpadisMalaysia can help
Alpadis Malaysia supports payment service providers andMSB licensees in strengthening their governance, compliance and operationalcontrol frameworks. Our work includes regulatory gap assessments, AML/CFTframework reviews, policy and SOP enhancement, screening and transactionmonitoring procedures, STR escalation processes, third-party control reviews,technology risk procedures, business continuity and disaster recoverydocumentation, compliance monitoring plans and staff training. The approach ispractical: translating regulatory expectations into workable controls and aclear evidence trail.
