Malaysia - BNM, SC, CCC and Labuan perimeter

Malaysia financial permissions and regulator dossier

Malaysia divides prudential and payment supervision through Bank Negara Malaysia, capital markets through the Securities Commission, new consumer-credit activity through the CCC, and Labuan business through Labuan FSA. This dossier maps the split as of July 2026.

Talk to an advisor

Route facts

Jurisdiction facts

Regulator map

BNM for banks, insurance, takaful, payment systems, e-money and money services; SC for capital markets, funds, private retirement schemes and digital assets; CCC for new consumer-credit routes; Labuan FSA for Labuan IBFC.

Moving rule

Consumer Credit Act 2025 commenced on 1 March 2026; relevant licensing and registration started on 1 June 2026 with a six-month transition for existing providers.

Permission coverage

Banking, Islamic finance, payments, e-money, remittance, markets, funds, insurance, credit, digital assets, trusts, retirement and Labuan services.

Capital basis

Activity-specific under FSA 2013, IFSA 2013, MSBA 2011, CMSA 2007, Consumer Credit Act 2025 and Labuan statutes.

Territorial reach

Domestic BNM or SC status does not equal a Labuan licence or an overseas passport. Labuan status must not be marketed as unrestricted Malaysian domestic permission.

Review date

Regulatory summary reviewed as of 11 July 2026.

Read the perimeter first

Malaysia has several licensing systems and each register answers a different question

Bank Negara Malaysia's directory distinguishes licensed commercial, Islamic, investment and digital banks from approved payment-system operators, e-money issuers, registered merchant acquirers, card issuers, money-services licensees, insurers, takaful operators and approved intermediaries. The Securities Commission issues Capital Markets Services Licences to principals and representative licences to individuals, registers recognised market operators and digital-asset custodians, and approves collective investment and private retirement schemes. Since 1 June 2026, the Consumer Credit Commission has also begun the licensing and registration phase for activities brought under the Consumer Credit Act 2025, including buy-now-pay-later, leasing, factoring and specified credit-service businesses. Labuan FSA is a separate authority for Labuan IBFC banks, insurers, securities licensees, fund businesses, trust companies and other international services. Incorporation, a sandbox admission or a Labuan licence does not substitute for the domestic BNM, SC or CCC status required by the actual customer and service model.

Permission families

Malaysia licence, authorisation and registration routes

Family	Official instrument and authority	Activities and exclusions	Entry, capital and reach
Family Banking, Islamic banking and deposit taking	Official instrument and authority Licensed commercial, Islamic, investment or digital bank under the Financial Services Act 2013 or Islamic Financial Services Act 2013, supervised by BNM	Activities and exclusions Accept deposits, provide financing and conduct only the banking, Islamic or investment-bank activities in the licence and BNM approvals. An e-money, MSB or CMSL status does not authorise deposits.	Entry, capital and reach BNM applies legal-form, controller, financial-resource, governance, Shariah where relevant, technology, risk and resolution tests. Capital and liquidity depend on the bank category and current BNM policy documents.
Family Payment systems, acquiring and e-money	Official instrument and authority BNM approval for designated payment-system operators and e-money issuers, registration for non-bank merchant acquirers, and card-issuer approvals under FSA or IFSA and policy documents	Activities and exclusions Operate the approved system, issue stored value, acquire merchants or issue cards only within the recorded category. A white-label partner operates under the accountable e-money issuer and is not itself automatically an issuer.	Entry, capital and reach The applicant must satisfy BNM ownership, governance, safeguarding or trust, operational resilience, technology, fraud, AML/CFT and consumer-protection requirements. Approval and registration have different legal effects.
Family Money changing, remittance and wholesale currency	Official instrument and authority Class A, B, C or other Money Services Business licence under the Money Services Business Act 2011, with principal and agent approvals by BNM	Activities and exclusions Conduct only the money-changing, remittance or wholesale-currency combination stated in the licence. An MSB agent acts for its approved principal and does not hold an independent principal licence.	Entry, capital and reach BNM reviews the Malaysian applicant, controllers, responsible officers, capital, security, AML/CFT, systems, agents and outlets. Digital channels and business-to-business remittance need the relevant written approval.
Family Investment services, advice, custody and markets	Official instrument and authority Capital Markets Services Licence and representative licence under CMSA 2007; recognised market operator registration or exchange approval under SC guidelines	Activities and exclusions Deal in securities or derivatives, advise, manage investments, plan finances, provide custody or operate a recognised market only within the CMSL or registered-market scope.	Entry, capital and reach SC's Licensing Handbook controls organisational competence, fit and proper, Bumiputera or ownership rules where applicable, capital, responsible persons, client assets and application forms. One CMSL can record multiple approved regulated activities.
Family Funds, trustees and private retirement schemes	Official instrument and authority Fund-management CMSL, authorisation of unit trusts, wholesale funds, ETFs or REITs, trustee approval or registration, and SC approval of PRS providers and schemes	Activities and exclusions Manage and market collective schemes or private retirement products, act as scheme trustee and distribute interests only after the required manager, product, deed and disclosure steps.	Entry, capital and reach Manager capital, trustee independence, custody, valuation, delegation, Shariah governance, prospectus, reporting and marketing rules differ by product. Scheme authorisation is not a licence for the manager.
Family Insurance, reinsurance, takaful and intermediation	Official instrument and authority Licensed insurer, reinsurer, takaful or retakaful operator under FSA or IFSA; BNM approval or registration for brokers, financial advisers, adjusters and related intermediaries	Activities and exclusions Underwrite only approved classes or distribute and advise in the recorded capacity. Insurance and takaful statuses remain distinct, and an intermediary cannot assume underwriting risk.	Entry, capital and reach BNM applies capital adequacy, actuarial, governance, policyholder-protection, Shariah, reinsurance and fit-and-proper requirements. Product, branch and key-person approvals can be additional steps.
Family Consumer credit, leasing, factoring and credit services	Official instrument and authority Consumer Credit Commission licence for covered credit providers and registration for covered credit-service providers under Consumer Credit Act 2025; BNM remains responsible for its regulated financial institutions	Activities and exclusions From 1 June 2026, covered BNPL, leasing, factoring and other providers require the new CCC status, while debt collection, impaired-loan acquisition and debt counselling or management use registration as allocated.	Entry, capital and reach The Act commenced on 1 March 2026 and a six-month application transition began on 1 June 2026. Verify current CCC forms, grandfathering, conduct standards, fees and whether another regulator remains primary for the entity.
Family Crowdfunding and digital market platforms	Official instrument and authority SC recognised market operator registration for equity crowdfunding, peer-to-peer financing and property crowdfunding under the Guidelines on Recognized Markets	Activities and exclusions Operate only the approved platform type, issuer or fundraiser eligibility and investor limits. A merchant-acquiring or company registration does not authorise investment solicitation.	Entry, capital and reach SC reviews controllers, responsible persons, capital, platform governance, due diligence, client money, disclosure, cyber resilience and reporting. BNM or CCC permission can also be needed for payment or credit functions.
Family Digital assets	Official instrument and authority SC registration for a digital asset exchange as recognised market operator, IEO operator registration and digital asset custodian registration under the Digital Assets and Recognized Markets Guidelines	Activities and exclusions Trade approved digital assets, facilitate permitted token offerings or custody assets only in the registered capacity. The status is not a general cryptocurrency, payment or deposit licence.	Entry, capital and reach Revised DAX requirements took effect on 20 May 2026. Verify the current SC register, approved assets, shareholder and management standards, client-asset safeguards, technology, AML and any BNM payment perimeter.
Family Trust, company and fiduciary administration	Official instrument and authority Domestic trustee or fiduciary status under the applicable trust, company and capital-market law; separate Labuan trust company licence for business in Labuan IBFC	Activities and exclusions Act as scheme trustee or licensed Labuan trust company only within the relevant statute. Ordinary corporate secretarial or formation work is not automatically a BNM or SC financial permission.	Entry, capital and reach Identify client-money, trust, fund and AML functions. Labuan trust company requirements, local office, professional staff, capital and insurance do not create unrestricted domestic Malaysian authority.
Family Pensions and retirement products	Official instrument and authority SC approval of private retirement scheme providers, administrators, trustees and schemes; statutory EPF arrangements sit outside a commercial financial licence	Activities and exclusions Provide voluntary PRS products and administration within the approved scheme. A fund-management CMSL alone does not establish or approve a private retirement scheme.	Entry, capital and reach PRS provider eligibility, trustee, administrator, approved core funds, disclosure, valuation and contribution rules apply. Verify the current SC PRS Guidelines and approved-scheme list.
Family Labuan international financial services	Official instrument and authority Labuan FSA licence under Labuan Financial Services and Securities Act 2010 or Islamic counterpart for banking, insurance, securities, funds, leasing, trust and other Labuan businesses	Activities and exclusions Conduct the international or Labuan business recorded in the licence. Labuan incorporation or licence does not automatically authorise domestic BNM, SC or CCC regulated activity.	Entry, capital and reach Labuan FSA applies its own applicant, home-supervisor, substance, working-fund, governance, AML, audit, fee and reporting rules. Customer location and Malaysian ringgit activity can add BNM conditions.
Family Gambling and other special permissions	Official instrument and authority No gambling permission appears in the BNM, SC, CCC or Labuan financial licence schedules; gaming and betting require separate analysis under Malaysian federal and state law	Activities and exclusions A bank, e-money, CMSL, digital-asset or Labuan licence never includes gaming operations. Payment processing for gaming does not legalise the underlying product.	Entry, capital and reach Confirm the product, location, promotion, payment flow and current specialist authority before launch. Do not market a financial registration as an online gambling licence.

Entry conditions

A Malaysian application must allocate each function to the correct authority

The applicant file should begin with a matrix showing which entity issues value, handles customer money, extends credit, solicits investments, manages assets, underwrites risk or operates a platform. That determines whether BNM, SC, CCC, Labuan FSA or more than one authority owns the work. The accepted legal form, Malaysian registered office, head office and local substance vary by instrument. Controllers, ultimate beneficial owners, directors and responsible officers must meet fit-and-proper and financial-soundness standards, while the board and control functions need relevant banking, payment, capital-market, insurance, consumer-credit or digital-asset competence. The submission normally combines the programme, forecasts and capital evidence with governance, Shariah arrangements where applicable, AML/CFT, safeguarding or client assets, cyber security, outsourcing, complaints, business continuity and wind-down. SC uses its Licensing Handbook and electronic application platform; BNM and CCC use their own current forms and policy documents; Labuan FSA maintains a separate application and fee system. Exact capital, fees and processing standards must be taken from the current category, not a single Malaysia fintech number.

Regulator-facing process

A Malaysian multi-regulator mandate, stage by stage

The work succeeds when the domestic, consumer-credit and Labuan perimeters are separated before any application is assembled.

Stage 01 - Allocation

Fix the regulator and legal status for every service

Map deposits, stored value, merchant acquiring, remittance, investment solicitation, lending, underwriting, token activity and Labuan business to BNM, SC, CCC or Labuan FSA.

Record whether each result is a licence, approval, registration, product authorisation or agent status, and identify any overlapping payment, credit or capital-market function.

Stage 02 - Establishment

Build the eligible Malaysian or Labuan applicant

Choose the required company and office, disclose controllers and responsible persons, and evidence category-specific capital, governance, AML, safeguarding, client assets and technology.

The Labuan route uses a separate statutory and substance framework. Do not use a Labuan entity as a substitute for an onshore regulated applicant.

Stage 03 - Submission

File through the authority's current channel

Use BNM policy documents, the SC Licensing Handbook and EASy platform, the CCC transition instructions or Labuan FSA forms as applicable, keeping all forecasts and policies consistent.

An SC sandbox or experimental permission, BNM approval in principle, or CCC transition application is not authority to operate beyond its express legal effect.

Stage 04 - Activation

Verify the register and all pre-launch conditions

Confirm the licence or registration line, approved people, product or scheme approvals, client-money controls, reporting calendar and any cross-authority conditions before serving customers.

Ownership changes, new activities, white-label arrangements, agents and material outsourcing can require separate consent or notification after initial entry.

After entry

Ongoing supervision follows the BNM, SC, CCC or Labuan instrument

Malaysian regulated firms maintain the capital, liquidity, safeguarding, solvency or professional cover required by their category, together with governance, AML/CFT, sanctions controls, Shariah oversight where relevant, client-asset reconciliations, complaints, technology risk, outsourcing, audit and periodic returns. BNM, SC, CCC and Labuan FSA maintain different registers, reporting systems and enforcement powers. A group holding an e-money approval, merchant-acquirer registration and CMSL must preserve each status separately. The new Consumer Credit Act transition is especially time-sensitive in July 2026: existing providers must verify whether they are within the six-month application window and what conduct duties already apply. Direct and indirect controller changes, acquisitions through prescribed thresholds, appointments of key people, variations of business and transfers of customer portfolios can require advance approval or notification. Buying shares does not move a licence away from its company. Diligence must test the exact authority record, scope, renewal, capital, client money, complaints, remediation, technology and counterparty contracts. No Malaysian or Labuan status gives an automatic foreign passport or guarantees continuing banking and scheme access.

Verify it yourself

Primary official sources

BNM Financial Sector Participants Directory
The official directory distinguishes licensed banks, insurers and takaful operators from e-money issuers, payment-system operators, merchant acquirers, card issuers and approved intermediaries - bnm.gov.my.
BNM Money Services Business operators
The official MSB pages separate principal licensees, agents, money changing, remittance, wholesale currency and approved digital channels - bnm.gov.my.
SC Licensing and Registration Guidelines
The official Licensing Handbook and application kit govern CMSL, representative and registered capital-market service routes - sc.com.my.
SC Digital Assets and Recognized Markets Guidelines
The official material covers DAX, IEO, digital asset custodian, equity crowdfunding and peer-to-peer platform registration, including the May 2026 revision - sc.com.my.
Ministry of Finance Consumer Credit Act notice
The official March 2026 notice confirms CCC licensing and registration from 1 June 2026 and the six-month transition for covered providers - mof.gov.my.
Labuan FSA regulator and licence catalogue
The official Labuan pages identify the separate IBFC authority, licences, application forms and financial-institution directory - labuanfsa.gov.my.

FAQ

Malaysia regulator dossier questions

01 Does a Labuan licence cover Malaysia generally?

No. Labuan FSA regulates business in the Labuan IBFC statutory framework. Domestic customers, ringgit activity or services reserved to BNM, SC or CCC require a separate perimeter and any necessary permission.

02 Is a Malaysian digital asset exchange licensed by BNM?

A DAX is registered by the Securities Commission as a recognised market operator. Payment, e-money or banking functions can separately involve BNM. DAX status is not a generic crypto or deposit licence.

03 What changed for BNPL, leasing and factoring in 2026?

The Consumer Credit Act 2025 commenced on 1 March 2026, and covered provider licensing or service-provider registration began on 1 June with a six-month transition. Check current CCC instructions before operating.

04 Can one CMSL cover several capital-market activities?

The SC can record one or more approved regulated activities on a principal's CMSL, but the firm must meet the requirements for each activity and cannot infer unrecorded payment, credit or insurance powers.

05 Is merchant-acquirer registration the same as e-money approval?

No. BNM's directory records them as distinct statuses. An acquirer handles merchant acceptance within its registration; issuing stored value requires the applicable e-money status.

Reviewed by the SKY7 advisory team. Last reviewed: 11 July 2026. Regulatory statements are made as of July 2026. This page is general information only, not legal, regulatory, tax, investment or financial advice. The Consumer Credit Act transition, SC digital-asset rules and Labuan boundary are time-sensitive. Verify the current legislation, official register, application forms, capital method, fee schedule and transition notices before relying on any Malaysian permission or market-access statement.

Tell us what you need

Scope a regulated route in Malaysia

Bring the products, customer locations, Malaysian or Labuan structure, ownership and full flow of funds. SKY7 will allocate BNM, SC, CCC and Labuan FSA workstreams. Advisory fees and entity prices are on request.