AML/CFT Compliance in Malaysia: Requirements and Readiness

What is AML/CFT compliance?

AML/CFT stands for anti-money laundering and countering the financing of terrorism. In Malaysia the legal basis is the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).

AML/CFT is not a certificate. It is a regulatory compliance programme supervised by the regulator. Bank Negara Malaysia’s policy document “AML/CFT/CPF and TFS for DNFBPs and NBFIs” was issued on 5 February 2024 and took effect on 6 February 2024, replacing the 2019 version. It requires reporting institutions to apply a risk-based approach to money laundering, terrorism financing and proliferation financing risks, and to comply with targeted financial sanctions. Financial institutions have their own BNM policy document.

Who needs it

AMLA obligations apply to reporting institutions. These include designated non-financial businesses and professions (DNFBPs) and non-bank financial institutions (NBFIs) — for example:

• Lawyers, accountants and company secretaries
• Real estate agents
• Dealers in precious metals and stones
• Money services businesses
• Moneylenders and pawnbrokers

This is not a complete list. Check whether your business is a reporting institution and which policy document applies to you.

Smaller firms are not exempt because of their size. A sole practitioner, a small agency or a single-branch pawnbroker can be a reporting institution with the same core obligations, applied in proportion to its risks.

Being ready for a regulatory review protects the business, its customers and its reputation, and it gives management confidence that obligations under AMLA are being met day to day.

What AML/CFT compliance requires

A compliant programme brings together governance, risk assessment and day-to-day controls:

• Board and senior management oversight of the AML/CFT programme.
• A compliance officer with clear authority.
• An institutional risk assessment covering money laundering, terrorism financing and proliferation financing (ML/TF/PF).
• Risk-based policies and procedures built on that assessment.
• Customer due diligence, including identifying and verifying beneficial owners.
• Enhanced due diligence for higher-risk customers and politically exposed persons.
• Ongoing monitoring of customers and transactions.
• Targeted financial sanctions screening.
• Suspicious transaction reporting.
• Record keeping.
• Employee screening and training.
• Independent audit of the programme.

Documents and evidence auditors expect

During a regulatory review or an independent audit, reporting institutions are typically asked for:

• Board-approved AML/CFT policies and records of management oversight
• Compliance officer appointment and reporting lines
• The documented ML/TF/PF institutional risk assessment
• Customer due diligence and beneficial ownership records
• Enhanced due diligence files for higher-risk customers and politically exposed persons
• Ongoing monitoring and customer review records
• Sanctions screening records and how matches were handled
• Internal escalation records and suspicious transaction reporting procedures
• Employee screening and training records
• Independent audit reports and evidence that findings were closed

Retention periods and reporting deadlines are set by law and the applicable policy document, so confirm them against the current requirements.

Reviewers look for consistency between documents and practice. A policy that requires enhanced due diligence is only credible if customer files show it was done, and a training plan only counts when attendance records back it up.

How regulatory review works

There is no certification audit for AML/CFT. Instead, you build and run a programme that can stand up to supervision at any time:

• Readiness check — compare your current programme with the requirements.
• Risk assessment — document your ML/TF/PF risks across customers, products, channels and geographies.
• Policies and controls — put risk-based procedures, due diligence, screening and reporting in place.
• Train and operate — train staff and keep records as the programme runs.
• Independent audit — have the programme independently audited and track findings to closure.
• Regulatory review — the regulator may examine your programme and records; being ready means evidence is current and easy to retrieve.

How CertiFlow gets you review-ready

For AML/CFT, CertiFlow checks your policies, risk assessment and procedures against the programme elements, lists open tasks, drafts missing documents and keeps records ready so you can be ready for a regulatory review.

1. Free pre-certification check — Answer 5 quick questions and get your full questionnaire by email, or choose an AI audit of your documents.
2. AI certification audit — Upload your policies, procedures and forms. AI checks them against the requirements and lists every task still open.
3. Fix the gaps — AI drafts missing policies, procedures and forms so your team reviews and approves instead of writing from scratch.
4. Collect and verify evidence — Keep documents, photos and videos in one place, organised by requirement and checked by AI.
5. Audit day — Everything your auditor needs is verifiable and in one place.

Free pre-certification check

Start with 5 quick questions about your AML/CFT compliance review / BNM examination. Receive your full questionnaire by email, or upload policies, SOPs and evidence for an AI compliance review.

Start your free pre-certification check

Frequently asked questions

Who must comply with AMLA in Malaysia?

Reporting institutions, including financial institutions, designated non-financial businesses and professions, and non-bank financial institutions — for example lawyers, accountants, company secretaries, real estate agents, dealers in precious metals and stones, money services businesses, moneylenders and pawnbrokers.

Is there an AML certificate for companies?

No. AML/CFT compliance is supervised by the regulator rather than certified. Individual staff can hold professional AML qualifications, but the organisation’s programme is assessed through supervision and independent audit.

What does the 2024 BNM policy document change?

The risk-based approach now explicitly covers proliferation financing (CPF) alongside money laundering and terrorism financing, together with targeted financial sanctions. It replaced the 2019 version from 6 February 2024.

What documents should a reporting institution have ready?

Board-approved policies, the compliance officer appointment, the ML/TF/PF risk assessment, customer due diligence and enhanced due diligence records, monitoring and sanctions screening records, suspicious transaction reporting procedures, training records and independent audit reports.

Can AI help us prepare?

Yes. AI can check your documents against the programme elements, list gaps, draft missing policies and organise evidence. Supervision and enforcement remain with the regulator.