Section 17A MACC Act: corporate liability and adequate procedures

What section 17A says

Section 17A was inserted into the Malaysian Anti-Corruption Commission Act 2009 (Act 694) by the MACC (Amendment) Act 2018. The amendment was gazetted on 4 May 2018 and section 17A was given a two-year grace period so companies could prepare. It came into force on 1 June 2020.

The offence is simple to state. A commercial organisation commits an offence if a person associated with it corruptly gives, agrees to give, promises or offers any gratification to anyone, with the intent to obtain or retain business for the organisation, or to obtain or retain an advantage in the conduct of its business.

Three features make it different from the older offences in the Act:

• The organisation itself is the accused. Before 2020, prosecutors went after the individual who paid the bribe. Now the company can be charged as well.
• Management knowledge is not required. The company can be liable whether or not its top management or representatives knew about the corrupt act.
• There is one defence. The company must prove it had adequate procedures in place to prevent associated persons from carrying out corrupt practices. Saying “we did not know” is not a defence.

Section 17A covers the giving side of bribery done for the company’s benefit. Employees who accept bribes are still dealt with under the other offences in the Act, and your policies should cover both.

Who it applies to: commercial organisations and associated persons

A commercial organisation under section 17A includes:

• a company incorporated under the Companies Act 2016 that carries on business in Malaysia or elsewhere;
• a company incorporated anywhere that carries on a business, or part of a business, in Malaysia;
• a partnership under the Partnership Act 1961 or a limited liability partnership under the Limited Liability Partnerships Act 2012, carrying on business in Malaysia or elsewhere; and
• a partnership formed anywhere that carries on a business, or part of a business, in Malaysia.

There is no size threshold. A family-run Sdn Bhd and a listed group are both covered. A foreign company with a branch, project or sales activity here can also be caught.

An associated person is a director, partner or employee of the organisation, or any person who performs services for or on behalf of it. Whether someone performs services is decided on all the circumstances, not just on what the contract calls them. In practice this is where most of the risk sits: agents who deal with licensing authorities, sales consultants, freight and customs brokers, subcontractors and anyone else who represents you to a third party.

That is why the Guidelines on Adequate Procedures ask for due diligence on business associates before you sign with them, and for training and communication that reaches them as well as your own staff.

Penalties and director liability under section 17A(3)

The RM1 million floor matters. Even a small facilitation payment of a few hundred ringgit, if charged under section 17A, exposes the company to a minimum fine of RM1 million.

Section 17A(3) shifts the burden onto senior people. A director cannot simply say the bribe happened in a department they never visited. They have to show they did not consent or connive, and that they took the precautions their role required. Board minutes approving the anti-corruption programme, reviewing risk assessments and acting on audit findings are the kind of evidence that supports a due diligence argument.

The individual who paid the bribe still faces the ordinary offences under the Act, so a section 17A case can mean three sets of defendants: the person who paid, the company and its senior management.

Adequate procedures: the T.R.U.S.T. principles

Section 17A(5) requires the Minister to issue guidelines on adequate procedures. The Prime Minister’s Department issued the Guidelines on Adequate Procedures in December 2018. They are principle-based, not a checklist, and are meant to be applied in proportion to the size, nature, industry, risk and complexity of the organisation. It is for the court to decide in each case whether the procedures were adequate.

For a smaller organisation, the Guidelines say the reporting channel can be as simple as a dedicated e-mail address. Proportionate does not mean optional, though. Each principle should have something real behind it that you can show.

What anti-bribery training should cover

Principle V lists the formats the Guidelines have in mind: induction programmes with anti-corruption elements, role-specific training for positions exposed to particular risks, corporate courses, web-based programmes and town halls. A training programme that helps your defence usually has these parts:

1. Everyone, at induction and yearly: what a bribe is under Malaysian law, that the company can be liable for staff and agents, the gifts and hospitality rules, how to declare a conflict of interest and how to use the reporting channel.
2. Role-specific modules: procurement and tender committees, sales and business development, staff who deal with permits, inspections and licences, and finance staff who approve payments.
3. Third parties: a short briefing and a signed acknowledgement for agents, consultants and key contractors.
4. Records: who completed what and when, with scores. If the company is ever charged, these records are part of the evidence that adequate procedures existed.

Reading a policy does not teach someone what to do when a contractor slides an envelope across the table. Short scenario practice works better. In the WorkQuest2U Anti-Bribery & Corruption and Gifts, Hospitality & Donations lessons, staff walk through a 3D scene and decide what to do with an offer, a festive hamper or a request to “help speed things up”, and the lesson records the result.

Common gaps in adequate procedures

• A policy with nothing behind it. An anti-bribery policy on the website but no risk assessment, no gifts register and no evidence that anyone read it.
• Third parties left out. Due diligence is done on large suppliers but not on the small agent who handles approvals with local authorities, which is often where the risk is highest.
• One-off training. A briefing in 2020 when section 17A came in, then nothing. Staff turn over, and new joiners never hear the rules.
• No reporting channel people trust. A whistleblowing e-mail that goes to the managing director’s inbox, with no protection against retaliation.
• The Board never sees it. Risk assessments and audit results stay with the compliance officer and are never reported to the full Board, which weakens the s17A(3) due diligence position of directors.
• No review. The programme has not been reassessed after a merger, new market or change of business model.

A practical 90-day starting plan

If you are building or refreshing your programme, this order works for most Malaysian organisations:

1. Weeks 1 to 2: Board resolution adopting the anti-corruption policy and naming the person or function responsible for compliance.
2. Weeks 2 to 6: corruption risk assessment. List where the company meets public officials, who acts on its behalf, and which payments could hide a bribe. Add the results to the main risk register.
3. Weeks 4 to 8: update policies on gifts and hospitality, conflicts of interest, donations and sponsorships, and facilitation payments. Set up a gifts and conflicts register and a confidential reporting channel.
4. Weeks 6 to 10: due diligence on high-risk agents and contractors, and anti-corruption clauses in their contracts.
5. Weeks 8 to 12: train all staff, then role-specific groups; brief key third parties; keep completion records.
6. Ongoing: report to the Board at least yearly, review after any incident, and plan an internal or external audit.

This guide is general information, not legal advice. For a specific situation, speak to a lawyer who handles anti-corruption matters.