Malaysia’s payment ecosystem has expanded quickly. Customers now expect faster and more convenient ways to move money, whether through remittances, currency exchange, digital channels or agent networks. Money Services Business (MSB) licensees sit at the centre of this, serving individuals, migrant workers, businesses, tourists and cross-border trade.
The sector no longer runs through traditional counters alone. Many licensees now operate through digital channels, electronic terminals, agents, system providers and third-party arrangements. This has improved access and efficiency, but it has also widened exposure to financial crime, technology, operational and conduct risk. That is why Bank Negara Malaysia (BNM) continues to supervise the industry closely. The objective is not to restrict growth, but to ensure it rests on sound governance, proper controls and customer protection.
Risk areas that draw regulatory attention
Licence scope. The first question for any licensee is whether it still operates within its approved licence. This matters more following the Money Services Business (Amendment) Act 2024, which widens the definition of remittance to cover not only transferring funds but facilitating transfers: arranging them, accepting or receiving funds, providing the system used, or being involved in settlement. BNM may therefore look beyond the party physically moving money to those enabling or settling the flow. Any new product, corridor, agent structure or settlement model should be reviewed before launch.
Governance. A sound MSB business depends on clear accountability, not only transaction volume. The board, senior management, compliance officer, branches and agents should each understand their roles, with approvals, escalation and reporting properly documented. BNM’s Governance, Risk Management and Operations policy document expects controls to be applied consistently across head office, branches, agents and digital channels, rather than left on the shelf.
AML/CFT. Customer due diligence, sanctions and politically exposed person screening, transaction monitoring, suspicious transaction reporting and record-keeping remain the most sensitive areas. The common weakness is rarely a complete absence of controls. More often it is inconsistency: an alert cleared without a recorded rationale, a customer profile that does not match the transaction pattern, or a decision discussed internally but never documented. These are the gaps that turn a routine query into a finding.
Technology and third parties. As services digitise, system access, cybersecurity, incident handling and business continuity become part of the control environment. Where licensees rely on agents, system providers or overseas partners, accountability stays with the licensed MSB, so due diligence, ongoing monitoring and audit access matter.
When practice no longer matches the framework
Non-conformity tends to arise when actual practice drifts from what is approved or documented. A licensee should offer only the activities its licence permits, unless BNM has given prior written approval. Customer funds should remain reconcilable with the liabilities of the remittance business. And BNM should be notified of significant changes to the business or operating model, including payment and settlement flows, at least 20 business days before they take effect. Where these points slip, an internal process gap can become a supervisory concern.
What non-compliance can cost
The consequences are significant. Carrying on MSB without the required licence can, on conviction, bring imprisonment of up to ten years and a fine of between MYR 50,000 and MYR 5 million. The 2024 amendments also allow property used in an offence to be forfeited, and clarify abetment: a remittance system provider that keeps supporting an unlicensed business, or a landlord that continues renting to an unlicensed currency exchange after BNM has given notice, can both be caught.
For licensed MSBs, serious control failures can also affect licence standing and raise questions of fitness and propriety, not only trigger a penalty. The commercial impact follows: regulatory queries, remediation, higher compliance cost, delayed approvals, lost banking relationships and reputational damage.
Building a stronger MSB business
Strong compliance is not about making the business harder to run. It is about growing without creating avoidable regulatory, operational or reputational risk. In practice that means clear standard operating procedures, trained staff, effective screening, meaningful transaction monitoring, complete records, genuine oversight of branches and agents, reliable systems, and management reporting that reflects what is actually happening on the ground. The most resilient licensees tend to be those that can show their controls work in practice.
How Alpadis Malaysia can help
Alpadis Malaysia supports payment service providers and MSB licensees in strengthening their governance, compliance and operational control frameworks. Our work includes regulatory gap assessments, AML/CFT framework reviews, policy and SOP enhancement, screening and transaction monitoring procedures, STR escalation processes, third-party control reviews, technology risk procedures, business continuity and disaster recovery documentation, compliance monitoring plans and staff training. The approach is practical: translating regulatory expectations into workable controls and a clear evidence trail.
