Money laundering red flags: what Malaysian staff should spot and do

The law: AMLA and the 2026 amendments

Malaysia’s main anti-money laundering law is Act 613, first passed in 2001. The Minister of Finance has appointed Bank Negara Malaysia (BNM) as the competent authority under it, and reporting institutions send their reports to BNM. Sector regulators such as the Securities Commission and Labuan FSA supervise their own industries.

The Act was amended by an amendment act passed by Parliament in December 2024. According to a Skrine alert, it came into operation on 1 March 2026. The main changes:

• The Act is renamed to add Anti-Restricted Activity Financing, and a new offence covers financing linked to proliferation and other restricted activities under the Strategic Trade Act 2010.
• Reporting duties now cover “activities” as well as transactions.
• Obligations on record keeping, customer due diligence and compliance now extend to directors, officers and employees of reporting institutions.
• The Public Prosecutor can require a sworn explanation of property that looks excessive for a person’s income.
• Seizure and forfeiture periods are extended in several cases.

What counts as money laundering

Under section 4(1), a person commits money laundering if they engage in a transaction involving the proceeds of an unlawful activity or the instrumentalities of an offence, or if they acquire, receive, possess, disguise, transfer, convert, exchange, carry, dispose of or use those proceeds, bring them into or out of Malaysia, or conceal their true nature, origin or ownership.

Two points catch ordinary businesses out:

• Knowledge can be inferred. Under section 4(2), a court can infer from the facts that a person knew, had reason to believe or reasonably suspected that property was criminal proceeds, or that they failed without reasonable excuse to take reasonable steps to check. “Nobody told me” is weak when the red flags were obvious.
• No predicate conviction is needed. A person can be convicted of money laundering even if nobody has been convicted of the underlying crime.

Section 4A separately makes it an offence to structure transactions, for example splitting cash deposits, to avoid the reporting threshold. The penalty is a fine of up to five times the total amount or up to seven years in prison, or both.

Reporting institutions, STRs and tipping off

A reporting institution is a business listed in the First Schedule to the Act. It includes licensed banks and insurers, capital market licensees, money services businesses, casinos and gaming outlets, and gatekeepers such as accountants, lawyers, company secretaries, trust companies, moneylenders, pawnbrokers, registered estate agents and dealers in precious metals or precious stones.

Under section 14, a reporting institution must promptly report to the competent authority:

• cash transactions above the threshold the authority sets;
• any transaction where the identity of the person, the transaction or the circumstances give an officer or employee reason to suspect proceeds of an unlawful activity or instrumentalities of an offence (the suspicious transaction report, or STR); and
• any transaction or property suspected to be linked to terrorism financing, and since 2026, to restricted activity financing.

Attempted and proposed transactions count. Reporting institutions must also run compliance programmes with employee training and designate compliance officers at management level.

Tipping off. Section 14A makes it an offence for anyone who knows or suspects that a report is being made or has been made to disclose that to another person. The penalty is a fine of up to RM3 million or up to five years in prison, or both. In practice: never tell a customer or colleague that “compliance is looking at your payment”.

KYC and beneficial ownership

Section 16 bans reporting institutions from running anonymous accounts or accounts in false names and requires customer due diligence (CDD). Often called KYC, it means verifying who the customer is, who owns and controls them, and what the relationship is for, then monitoring it.

The hard part is usually the beneficial owner: the natural person who ultimately owns or controls a company, sometimes behind layers of holding companies, nominees or trusts. Since 1 April 2024, under the Companies (Amendment) Act 2024, companies registered under the Companies Act 2016 must keep and lodge beneficial ownership information with the Companies Commission of Malaysia (SSM) through its e-BOS system. That gives everyone a better starting point, but it does not replace your own checks.

Non-financial companies are not usually reporting institutions, but basic counterparty checks protect them from receiving criminal money and from fraud. Check that the legal name, contract name and bank account name match, that the owners make sense, and that the business has a real address and trading history.

Money laundering red flags in payments, trade and customers

One red flag does not prove laundering. It is a reason to ask, record and escalate, not to accuse. Several together, or one that the counterparty cannot explain, should go to compliance the same day.

Red flags also overlap with fraud and sanctions. A supplier e-mail asking you to pay a new account abroad may be business e-mail compromise rather than laundering, and a shipment routed through a sanctioned country may breach trade controls. The response is the same: hold, record and escalate. Specialists can then decide which law applies.

What non-financial staff should do

1. Pause. Do not process the payment, refund or shipment until the question is answered, if your procedure allows you to hold it.
2. Ask neutral questions that any normal business would ask: why a third party is paying, why bank details changed. Do not say you suspect money laundering.
3. Record what you saw: names, amounts, dates, documents and why it concerned you.
4. Escalate to your compliance officer, finance controller or legal team through the channel in your policy. In a reporting institution, that is the internal route to an STR.
5. Do not tip off the customer, supplier or colleagues outside the escalation route.
6. Do not investigate on your own or try to trace funds. That is for compliance and, if needed, the authorities.

Practice helps people recognise a pattern before it is real. In the WorkQuest2U Anti-Money Laundering lesson, learners work through a 3D port commercial office with third-party payments, refund requests and trade-based laundering, and decide when to escalate without tipping off. Know Your Counterparty and Ownership Checks & Due Diligence Decisions cover identity, beneficial owners and screening, and Payment Fraud & Scams covers changed bank details and fake invoices. They sit in the Anti-Money Laundering Awareness topic. These lessons build awareness; they do not replace the AML/CFT training your regulator requires.

This guide is general information, not legal advice.