BNM Banking Rules 2026: The Complete Guide for Foreign Companies — CDD, FX Policy, Digital Banks and How to Open a Malaysian Corporate Account

Opening a corporate bank account in Malaysia is one of the most critical — and most underestimated — steps for any foreign company entering the market. Under Bank Negara Malaysia's (BNM) 2025–2026 regulatory framework, banks operate under tightened Customer Due Diligence (CDD) rules, a liberalised but carefully structured Foreign Exchange Policy (FEP), and a rapidly evolving digital banking landscape that now includes five fully licensed digital banks. This guide cuts through the complexity and gives foreign business owners from China, Taiwan, Hong Kong and Singapore a complete, actionable roadmap — from understanding what BNM actually requires, to choosing the right bank, preparing documents, managing FX flows, and navigating the new digital banking ecosystem.

Why Malaysia's Banking Regulatory Landscape Matters to Foreign Companies

Malaysia's banking sector is one of Southeast Asia's most stable and internationally respected. Supervised by Bank Negara Malaysia (BNM), the system encompasses 27 commercial banks — eight local and 19 foreign-owned — along with Islamic banks, development financial institutions, and, since 2023–2025, five newly operational digital banks. Malaysia is also a globally recognised centre for Islamic finance, with Islamic banking representing approximately 43% of total banking system assets.

For a foreign company, this is both an opportunity and a compliance challenge. The opportunity is real: robust infrastructure, multi-currency capabilities, strong trade finance products, and direct connectivity to global payment networks. The challenge is equally real: regulations governing who can open an account, what documents are required, how ownership structures are scrutinised, and how foreign exchange flows are managed have all been significantly tightened in 2024–2026. BNM's 2025 regulatory updates specifically strengthened Customer Due Diligence (CDD) requirements for foreign-owned companies and high-risk business sectors. Understanding why these rules exist — not just what they say — is the key to navigating them efficiently.

The post-1MDB era fundamentally changed Malaysian banking compliance culture. Following the scandal, BNM overhauled its AML/CFT supervisory posture, amended the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act (AMLATFPUAA) in 2020 — raising maximum penalties to MYR 3 million per offence, or 5 years imprisonment, or both — and issued comprehensive AML/CFT policy documents that banks are now actively examined against. For a foreign company, this means banks are not being obstructive when they ask for extensive documentation: they are legally required to ask, and they face serious consequences if they do not.

BNM's CDD Framework: What It Means at the Bank Counter

The cornerstone of Malaysia's corporate bank account compliance framework is the Customer Due Diligence (CDD) requirement embedded in BNM's AML/CFT Policy Document. This document sets out three tiers of diligence, and understanding which tier applies to your company determines how straightforward — or demanding — your account opening will be.

The Three CDD Tiers

The key practical rule: verification must be based on independent and reliable sources — a customer self-certifying their identity is not sufficient. For individual customers, this means government-issued identification. For corporate customers, it extends to directors, authorised signatories, and ultimate beneficial owners (UBOs). This is not a bureaucratic formality; it is an active enforcement posture, and BNM has demonstrated willingness to penalise banks that fail these checks (a RM 600,000 fine was levied against one major e-wallet provider for sanctions screening failures in 2025).

Beneficial Ownership: The 25% Rule

One of the most important numbers for any foreign company to understand is 25%. Under BNM's framework, any individual who owns or controls 25% or more of a company's shares or voting rights must be identified and verified as a beneficial owner. This means that in a typical foreign-owned Sdn Bhd where a Chinese parent company holds 100% of the shares, the bank must trace ownership all the way to the natural persons who ultimately control the parent — not just the parent entity itself.

For multi-tier holding structures (e.g., a Hong Kong holding company owned by a BVI company, which is in turn owned by a Chinese founder), banks will typically require: certified copies of each entity's incorporation documents; official shareholder registers or register of members for each layer; passport copies of all UBOs at the 25% threshold; and a signed UBO declaration. This can be time-consuming if documentation is scattered across multiple jurisdictions or if home-country documents are not in English. Certified translations are accepted, but they add time and cost to preparation.

The Complete Document Checklist for Foreign-Owned Sdn Bhd Account Opening

Document preparation is the single most important variable in how quickly your account opens. Banks in Malaysia vary in their internal requirements, but the following checklist represents the robust standard that will satisfy virtually any licensed Malaysian bank's CDD requirements for a foreign-owned private limited company:

Company-Level Documents

• SSM Notice of Incorporation (issued by the Companies Commission of Malaysia upon registration)
• Current SSM e-Info profile (a live extract of company details from SSM's online system, dated within the past 30 days — banks will not accept outdated versions)
• Constitutive documents: Memorandum & Articles of Association or Constitution (where applicable)
• SSM statutory forms: Form 24 (allotment of shares), Form 44 (registered address), Form 49 / Section 58 (register of directors & secretaries) — these may be requested by banks as supporting documents
• Certified copy of the home-country Certificate of Incorporation (if the parent company is foreign-incorporated)
• Corporate Tax Identification Number (TIN) — the 'C' number issued by the Inland Revenue Board of Malaysia (LHDN). As of 2026, banks strictly require TIN during onboarding, as it links the corporate account to LHDN's MyInvois e-invoicing ecosystem
• Proof of business address: tenancy agreement or utility bill for the actual operating premises. Note: banks distinguish between a registered address (company secretary's office) and the actual business address — the latter must be demonstrated to show the business is operational

Director & Shareholder Documents

• Passports of all directors and authorised signatories (colour copies; some banks require certified copies)
• Residential address proof for each director (utility bill, bank statement, or government-issued document dated within 3 months)
• Passports and address proof of all UBOs holding 25% or more (directly or indirectly)
• UBO Declaration form (provided by the bank; must be signed by an authorised director)

Corporate Authorisation Documents

• Board Resolution authorising the opening of the bank account, specifying the bank, account type, and naming authorised signatories and their transaction limits. This must be prepared by your company secretary and signed by at least two directors (or as specified by the company constitution)
• Specimen signatures of all authorised signatories

Business Activity Documents (for EDD)

• Business plan or description of business activities
• Projected revenue and expected transaction volumes/values
• Key customer and supplier information (names, countries)
• Source of funds declaration (parent company financials or evidence of capital injection)
• For regulated industries: relevant licences or regulatory approvals

BNM's Foreign Exchange Policy: A Practical Guide for Operating Companies

Once your account is open, understanding BNM's Foreign Exchange Policy (FEP) is essential for managing the financial flows of a Malaysian operating company. The good news: BNM's FEP is genuinely liberal by regional standards. The important caveat: "liberal" does not mean "unregulated," and there are specific rules around repatriation, investment limits, and derivatives that every financial controller must understand.

Resident vs. Non-Resident: The Foundational Distinction

Everything in Malaysia's FEP hinges on residency status. Once your company is incorporated in Malaysia under the Companies Act 2016, it becomes a resident entity for FEP purposes. This changes your rights and obligations significantly compared to operating through a branch or trading with Malaysia from overseas.

The 6-Month Export Proceeds Rule

This is perhaps the most operationally critical FEP rule for companies engaged in trading or manufacturing. Under BNM's FEP, exporters of goods must repatriate export proceeds to Malaysia in full value within 6 months from the date of shipment. Repatriation beyond 6 months is permitted only for reasons beyond the exporter's control and other BNM-permitted reasons; extensions up to 24 months require justification. Additionally, if any proceeds remain outstanding after 24 months from shipment, the exporter must notify BNM within 21 days of the end of each calendar year.

For a Chinese or Taiwanese manufacturer setting up Malaysian operations and exporting to markets across the region, this rule has direct cash management implications. It means your overseas receivables must flow back to your Malaysian company account within six months — you cannot leave them parked offshore indefinitely. Failure to comply is an FEP violation reportable to BNM.

Foreign Currency Accounts

Resident entities can open and maintain foreign currency accounts with licensed onshore banks. This is strategically important for foreign companies that invoice in USD, EUR, SGD, CNY or other currencies — you can receive payment in the invoiced currency, hold it in a foreign currency account, and convert to MYR when the rate is favourable, without triggering immediate conversion. This is a common cash management strategy used by exporters and companies with significant cross-border payment flows.

Malaysia's Five Digital Banks: Opportunity or Mirage for Foreign Companies?

Malaysia's digital banking sector has developed rapidly. BNM awarded five digital banking licences, and all five banks commenced operations between 2023 and 2025, representing a foundational shift in how banking services are delivered in Malaysia.

The five licensed digital banks currently operational are:

• GX Bank Berhad — Conventional; backed by Grab Holdings and Kuok Brothers; launched 2023; the first BNM-licensed digital bank to go live
• Boost Bank Berhad — Conventional; consortium of Boost Holdings and RHB Bank; consumer and SME focused
• Ryt Bank (YTL Digital Bank Berhad) — Conventional; backed by YTL Digital Capital and Sea Limited; launched 2025; positioned as an AI-powered digital bank
• AEON Bank (M) Berhad — Islamic; backed by AEON Financial Services Japan and AEON Credit Malaysia; Malaysia's first fully Shariah-compliant digital bank; launched 2024
• KAF Digital Bank Berhad — Islamic; led by KAF Investment Bank; targeting retail and SME segments

During the foundational phase (up to five years), each digital bank operates under an asset cap of RM 3 billion and a minimum capital requirement of RM 100 million, expanding to RM 300 million upon completion of the foundational phase. This regulatory guardrail ensures stability while allowing the banks to build their operational track records.

The critical limitation for foreign companies: as of 2026, all five digital banks require account holders to be Malaysian residents with a valid MyKad. Foreign-owned companies and their non-resident directors cannot open accounts with these digital banks. This is not a policy gap — it reflects the digital banks' mandate to serve underserved Malaysian segments (micro-SMEs, gig workers, individuals in rural areas) rather than the corporate needs of multinational or foreign-owned entities. Foreign companies must therefore work with conventional local banks or international banks with Malaysian operations.

Choosing the Right Bank: A Strategic Comparison for Foreign Companies

Not all Malaysian banks handle foreign company onboarding equally well. The choice of bank affects not just account opening speed but also your long-term operating experience — multi-currency support, trade finance availability, international wire capabilities, and relationship manager quality all vary significantly.

International Banks with Malaysian Operations

For most foreign companies — particularly those with active cross-border transaction flows, parent company guarantees or trade finance needs — international banks with Malaysian operations are the natural first choice. OCBC Malaysia, UOB Malaysia, HSBC Malaysia, and Standard Chartered Malaysia have deep experience handling non-resident account openings, multi-currency accounts, and complex ownership structures. They are generally more comfortable with foreign directors who cannot be present in person throughout the process, and they offer sophisticated cash management and FX solutions directly relevant to multinationals.

OCBC Malaysia in particular is well-suited to Chinese, Taiwanese, and Singapore-headquartered companies due to its pan-ASEAN connectivity, Chinese-language support, and eBiz Account product that accepts lower minimum deposits (from RM 500) with online application processes. Our Bank Account Opening (OCBC & Alliance Bank) service directly supports foreign companies through the OCBC and Alliance Bank onboarding processes, handling document preparation, liaison with relationship managers, and follow-up on CDD queries.

Major Local Banks

Maybank, CIMB, Public Bank, and RHB Bank offer the broadest branch networks and are appropriate for companies with significant local MYR transaction volumes, payroll processing, or cash-heavy operations. They typically have deeper local SME product suites, including FPX integration, DuitNow QR, and trade financing facilities. However, their internal processes for foreign company onboarding can be more rigid, with stronger preferences for local directors and established business history in Malaysia.

Step-by-Step: How a Foreign Company Opens a Corporate Account in 2026

The following process reflects practical experience working with BNM-regulated Malaysian banks in 2025–2026. Timelines assume documents are complete and correct when submitted.

1. Incorporate your Sdn Bhd with SSM. You cannot open a corporate account without a valid SSM registration. Once incorporated, obtain your Notice of Incorporation and SSM e-Info profile. Allow at least 1–3 working days for SSM e-Info to reflect the new company.
2. Obtain your LHDN Tax Identification Number (TIN). Banks now strictly require the corporate TIN (C number) during onboarding, as it links your account to the MyInvois e-invoicing system. Apply immediately after incorporation — LHDN typically issues the TIN within 7–14 working days.
3. Prepare your complete CDD document package. Use the full checklist above. For foreign-owned companies, prepare UBO declarations and ownership chain documentation proactively — banks will ask for this, and having it ready avoids back-and-forth delays.
4. Have your company secretary prepare the Board Resolution. This must specifically authorise the named bank and account type and name the authorised signatories. A generic resolution is not sufficient.
5. Select your bank and contact the relationship manager or business banking team. Do not simply walk into a branch — call ahead or engage through official business banking channels to get assigned a relationship manager who handles corporate accounts. This significantly accelerates the process.
6. Submit the complete document package and attend the CDD interview. For foreign-owned companies, a director interview is typically required — either in person at the branch, or by video call at some banks. At least one director should be available for this. The bank will verify the nature of the business, expected transaction flows, and confirm the ownership structure matches the documents.
7. Fund the account with the initial deposit. Conventional bank corporate accounts typically require between RM 1,000 and RM 10,000 as an initial deposit, depending on the bank and account type. Some premium business accounts require higher amounts.
8. Receive account activation and set up internet banking. Once approved, you receive account details, internet banking credentials, and security tokens. Set up your authorised signatories and transaction limits in the internet banking system.

Typical timeline: 2–4 weeks for international banks with streamlined foreign company processes; 4–6 weeks for local banks or complex ownership structures requiring deeper EDD. The single biggest cause of delay is incomplete or non-certified documents — particularly UBO declaration chains for multi-tier structures.

A Worked Example: A Shenzhen Technology Company Entering Malaysia

To make this concrete, consider the following scenario: Shenzhen TechCo Ltd wishes to expand into Malaysia and has incorporated a 100% owned subsidiary, Malaysia TechCo Sdn Bhd, through SSM. The parent company is owned 80% by a Chinese founder and 20% by a venture capital fund incorporated in the Cayman Islands.

CDD Classification: Enhanced Due Diligence. Reasons: 100% foreign ownership, offshore parent structure, Cayman Islands VC investor (offshore jurisdiction), new company with no Malaysian operating history.

Documents needed above standard requirements:

• Certified copy of Shenzhen TechCo Ltd's Chinese business licence (营业执照), translated and notarised into English
• Chinese founder's passport and residential address proof
• VC fund's Cayman Islands incorporation documents and register of members
• Explanation of VC fund ownership structure (to identify if any UBO owns 25%+ of the VC fund, and therefore has indirect 20% in Malaysia TechCo) — note that 20% does not reach the 25% BO threshold but the bank may still request identity information given the offshore structure
• Source of funds declaration: evidence that initial capital was injected from Shenzhen TechCo's business operations (e.g., audited accounts) rather than undisclosed sources
• Business plan explaining the Malaysian operations — what products/services, who the customers are, expected annual revenue, transaction flow description

Bank choice: Given the China parent and need for CNY/USD/MYR multi-currency operations, OCBC Malaysia (with its strong Mandarin-speaking relationship teams and pan-ASEAN network) or HSBC Malaysia (for established global transaction banking) would be most appropriate. Our corporate bank account opening service handles exactly this type of scenario — liaising with the bank's compliance team on UBO documentation, preparing the Board Resolution, and managing the CDD interview process on behalf of the client.

Common Mistakes and How to Avoid Them

Based on practical experience with foreign company bank account openings in Malaysia, the following are the most frequent causes of rejection or significant delay:

• Outdated SSM e-Info profile: Always pull a fresh SSM e-Info on the day of submission. Banks reject profiles older than 30 days.
• Incomplete beneficial ownership chain: Tracing ownership only to the immediate corporate shareholder, rather than through to the natural person UBOs, is the most common EDD failure. Banks will keep asking until they can identify the humans behind the company.
• Unnotarised or uncertified foreign documents: Home-country documents (parent company certificates, shareholder registers) must be certified — either by a notary public in the home country, or apostilled where applicable. Uncertified photocopies are routinely rejected.
• Generic Board Resolution: A resolution that does not specifically name the bank, account type, and authorised signatories will be sent back for revision. Use the bank's standard template if provided, or ensure your company secretary drafts a resolution that covers all required points.
• Missing LHDN TIN: Companies that begin the bank application before obtaining their TIN from LHDN will hit a wall. Apply for TIN immediately after SSM incorporation.
• Inadequate business address evidence: Banks in 2026 require proof of an actual operating address, not just the company secretary's registered office. A virtual office arrangement at the registered address will not substitute for evidence that the business actually operates somewhere.
• Choosing the wrong bank for your profile: A Chinese-funded company with no local directors, complex offshore ownership, and all-foreign transaction flows will face a very difficult onboarding at some local banks that are less experienced with this profile. Choose a bank that actively handles international corporate onboarding.

CRS, FATCA and Cross-Border Tax Transparency

Foreign business owners must understand that opening a corporate account in Malaysia creates automatic reporting obligations. Under the Common Reporting Standard (CRS) and FATCA frameworks, Malaysian banks report non-resident account details — including Tax Identification Numbers and account balances — to Malaysian tax authorities, who then share this data with the relevant foreign tax jurisdictions. This applies to foreign-owned Sdn Bhds where the ultimate beneficial owners are non-Malaysian residents.

In practical terms: if you are a Chinese citizen owning a Malaysian Sdn Bhd and you are a Chinese tax resident, your Malaysian account balance and income flows will ultimately be reportable to Chinese tax authorities under CRS. This is not a reason to avoid Malaysian banking — it is simply a reason to ensure your overall tax structure and compliance posture is sound before opening the account. It is also a reason why Malaysian banks pay close attention to the tax residency of UBOs during onboarding.

What to Do Next: ONEKEY BIZ Can Accelerate Your Timeline

Corporate bank account opening in Malaysia is rarely difficult for a well-prepared foreign company — but it is consistently difficult for companies that approach it without adequate preparation. The combination of BNM's AML/CFT framework, multi-jurisdiction document requirements, EDD interviews, and the TIN-linking requirement creates multiple points of failure for uninitiated applicants.

ONEKEY BIZ's Bank Account Opening (OCBC & Alliance Bank) service manages the entire process on your behalf: we assess your company structure, identify which CDD tier you will face, prepare the complete document pack (including Board Resolution, UBO declarations, and document certification guidance), liaise directly with the bank's business banking team, and manage the CDD interview on your behalf where possible. Our track record with Chinese, Taiwanese, Hong Kong and Singapore-headquartered companies means we understand the documentation patterns that Malaysian banks look for — and the common gaps that cause delays.

Whether your immediate priority is opening the account, understanding your FX obligations under BNM's FEP, or structuring your corporate treasury to optimise MYR/USD/CNY flows, contact our team for a complimentary initial consultation. We'll assess your specific structure, identify the most appropriate bank partner for your profile, and give you a realistic timeline and document checklist before you commit any resources.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.