BNM Corporate Banking & FX Guide 2026: CDD Requirements, Foreign Exchange Rules, Digital Banks and How a Foreign Company Opens a Malaysian Corporate Account

1. Why Malaysia's Banking Sector Is Both Attractive and Demanding for Foreign Companies

Malaysia's banking sector is overseen exclusively by Bank Negara Malaysia and is regarded as one of the most stable and internationally connected in ASEAN. The system comprises 27 commercial banks — eight local institutions and 19 foreign-owned banks — alongside a thriving Islamic banking segment representing approximately 43% of total banking system assets, making Malaysia a globally recognised leader in Islamic finance.

For a foreign company setting up its first Malaysian subsidiary, these numbers are encouraging: choice is not the problem. The challenge is compliance. Since the enactment of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), Malaysian financial institutions have adopted stringent Know Your Customer (KYC) and Customer Due Diligence (CDD) protocols mandated by BNM. Banks adopt a risk-based approach and typically classify foreign-owned entities or non-resident individuals as "higher risk" until they have been verified. This means more documents, longer review timelines, and — critically — the possibility of outright rejection if paperwork is incomplete or inconsistent.

BNM's 2025 regulatory updates strengthened CDD requirements further, particularly for foreign-owned companies and businesses operating in sectors considered higher-risk such as fintech, crypto, trading, consultancy, and cross-border e-commerce. If your business falls into any of these verticals, you should budget additional time and engage specialist support early.

2. BNM's CDD and Enhanced CDD Framework: What It Means for Your Company

Under BNM's AML/CFT policy framework, Customer Due Diligence (CDD) is the process by which a bank identifies and verifies the identity of its customer — including understanding the purpose and intended nature of the business relationship and, crucially, tracing who ultimately owns or controls the corporate entity.

Standard CDD

Standard CDD applies to all new corporate accounts. The bank must identify and verify:

• The legal entity itself (registration details, constitutional documents)
• The nature and purpose of the business
• All directors and authorised signatories
• All beneficial owners — defined by BNM as the individual(s) who ultimately own or control the company through any chain of ownership

A beneficial owner must be a natural person (individual), not another legal entity. For a Chinese, Taiwanese, or Hong Kong holding company owning a Malaysian Sdn Bhd, the bank must trace the ownership chain all the way to the ultimate individual(s) at the top. This is where many foreign companies encounter the first serious delay: incomplete or incorrectly presented ultimate beneficial ownership (UBO) documentation.

Enhanced CDD — When It Triggers and What It Demands

Enhanced CDD applies when a bank assesses a customer as carrying higher money laundering or terrorism financing (ML/TF) risk. For foreign-owned companies, this is frequently the default starting point. Under BNM's framework, Enhanced CDD requires the bank to:

• Establish the customer's and beneficial owners' source of wealth and source of funds
• Gather additional information about the customer's business activities
• Obtain senior management approval before establishing the relationship
• Conduct on-going monitoring of transactions more frequently or in more detail than for lower-risk customers

In practical terms, this means the compliance officer at your chosen bank cannot approve the account at branch level — it must escalate to head office or a dedicated compliance committee. The average approval timeline for a foreign-owned company undergoing Enhanced CDD is 3–6 weeks, and can stretch longer if source-of-funds evidence (e.g., audited financials from the parent entity, bank statements from the home country) is not ready at the outset.

3. BNM's Foreign Exchange Policy (FEP): The Rules That Govern Your Cross-Border Cash Flows

One of the most common misconceptions among foreign companies is that Malaysia operates tight capital controls similar to those in China. The reality is the opposite. BNM's Foreign Exchange Policy is explicitly designed to be a liberal framework — part of its broad prudential toolkit to maintain monetary and financial stability while supporting cross-border real economic activity.

What Non-Residents Can Do Freely

Under the FEP, a non-resident company or investor may, without requiring BNM's prior approval:

• Undertake any type of investment in ringgit assets or foreign-currency assets in Malaysia (direct or portfolio investment)
• Open a ringgit account or a foreign-currency account (FCA) with any licensed onshore bank in Malaysia
• Remit funds freely into and out of those accounts, subject only to the bank's normal due diligence process
• Repatriate divestment proceeds, profits, dividends, or any income arising from investments in Malaysia — though repatriation must be made in foreign currency (FC), not ringgit
• Hedge FX exposure arising from Malaysian investments via a licensed onshore bank or an Appointed Overseas Office (AOO)

Export Proceeds Repatriation: The 6-Month Rule

For companies that export goods out of Malaysia, BNM imposes a specific obligation under the FEP. An exporter must repatriate the full value of export proceeds to Malaysia within 6 months from the date of shipment. A 24-month extension is available only for reasons genuinely beyond the exporter's control or other specifically permitted reasons. Exporters may also undertake offsetting, netting-off, and writing-off arrangements on export proceeds, but only under permitted conditions.

This rule matters enormously for manufacturing or trading subsidiaries that sell goods globally from a Malaysian base: failing to repatriate on time is an FEP violation and can attract regulatory scrutiny, affecting your banking relationship.

Residents with Domestic Ringgit Borrowing: Investment Limits

Once your Malaysian Sdn Bhd takes on domestic ringgit borrowing (any credit facility from a local bank), it becomes subject to a cap: it may invest up to RM 1 million equivalent per calendar year in foreign-currency assets (onshore or offshore) without BNM's prior approval. Investments above that threshold require an application through BNM's online submission portal. A company without domestic ringgit borrowing faces no such limit and may invest freely in foreign-currency assets.

4. The Five Digital Bank Licences: What They Mean (and Don't Mean) for Foreign Companies

BNM has awarded five digital banking licences, and as of mid-2026 all five licensees are operational. The digital banking landscape has expanded significantly, with institutions including GX Bank (backed by Grab), AEON Bank (Malaysia's first fully Shariah-compliant digital bank), and KAF Digital Bank now serving Malaysian consumers and small businesses.

However, foreign-owned companies should be aware of a critical limitation: as of mid-2026, all five BNM-licensed digital banks restrict their services to Malaysian residents holding a valid MyKad (national identity card). Foreign nationals and foreign-owned companies cannot open accounts with GX Bank, AEON Bank, Boost Bank, or similar digital-only institutions. This is a deliberate policy choice — BNM designed the digital bank licences to serve underserved Malaysian communities, not to serve international corporate clients.

For foreign companies, this means digital banks are not a shortcut around the conventional bank's CDD process. You will still need to go through a conventional commercial bank or one of the established international banks operating in Malaysia.

Fintech Alternatives: MSBs and E-Wallet Platforms

Several Money Services Business (MSB) licensees — including platforms licensed under BNM's MSB framework — offer multi-currency wallets, DuitNow-linked accounts, and cross-border payment services. These can be useful as supplementary tools for cross-border collections and FX conversions, but they do not replace a conventional corporate bank account for purposes of trade finance, PIDM deposit insurance, corporate cheques, or regulatory reporting to LHDN. For full tax compliance and banking functionality, a conventional corporate account remains mandatory.

5. The OCBC Singpass Breakthrough (June 2026): A Game-Changer for Singaporean Entrants

The single most significant recent development for foreign companies opening Malaysian corporate bank accounts came in June 2026, when OCBC became the first bank to enable Singaporeans and Singapore permanent residents (PRs) to use Singapore's national digital identity — Singpass — to remotely authenticate themselves as part of OCBC Malaysia's corporate account opening process.

This innovation brings the account-opening timeline down from approximately three weeks to as short as five working days — a dramatic reduction driven by the elimination of physical document notarisation and in-branch verification for eligible applicants. It marks the first time Singpass has been used beyond Singapore-based services, representing a meaningful milestone in cross-border digital banking between Malaysia and Singapore.

For Singaporean-owned SMEs expanding across the Causeway, this changes the practical calculus significantly: a company can now obtain SSM incorporation and a fully operational bank account within roughly 10 business days with the right preparation. If you are a Singapore-based business owner considering Malaysian market entry, OCBC Malaysia is the logical first port of call for banking. ONEKEY BIZ's bank account opening service (OCBC & Alliance Bank) is structured precisely around this use case.

6. Step-by-Step Document Checklist for Foreign-Owned Sdn Bhd Corporate Account Opening

Document preparedness is the single largest determinant of how fast your account opens. Below is the comprehensive 2026 checklist based on BNM's CDD requirements and bank practice:

Corporate / Entity Documents

• SSM Notice of Incorporation (Section 14) — must be current
• SSM Business Profile (e-Info) — must be dated within the last 30 days at time of submission
• Company Constitution (formerly Memorandum & Articles of Association)
• Section 17 (Register of Members / Shareholders) and Section 58 (Register of Directors)
• Board Resolution to Open and Operate Bank Account — prepared and certified by your Company Secretary, signed by at least two directors, naming the authorised signatories
• Corporate Tax Identification Number (TIN — "C" number) issued by LHDN — banks now strictly require this for MyInvois integration
• Proof of Malaysian business address — tenancy agreement or utility bill; a registered-office virtual address alone is typically not sufficient

Director / Shareholder / UBO Documents

• Passports of all directors and authorised signatories (all pages, certified true copy)
• Valid Malaysian work permits, Employment Passes, or long-term passes for any director present in Malaysia
• Proof of residential address for all directors (overseas utility bill or bank statement)
• Beneficial Ownership Declaration — tracing the full ownership chain to the ultimate individual(s) controlling the company
• Source of funds / source of wealth evidence for the UBOs — typically audited financial statements of the parent entity, or personal bank statements

Additional Documents for Foreign Parent Companies

• Certificate of Incorporation of the parent entity from the home country (certified copy, apostilled or notarised as required by the bank)
• Register of Shareholders / Directors of the parent entity
• Certified translation into English or Bahasa Malaysia for any document in another language (e.g., Chinese-language corporate documents from China, Hong Kong, or Taiwan)
• Business plan or business narrative in English — explaining the Malaysian entity's purpose, target market, revenue model, and expected cash flows

7. Comparing Bank Options: Who Works Best for Which Foreign Company Profile?

International banks (OCBC, HSBC, UOB, Standard Chartered) often have more streamlined processes for international companies due to their global operational experience. For companies from Greater China — mainland China, Hong Kong, or Taiwan — OCBC and HSBC are typically the best starting points because their compliance teams are experienced in handling Chinese corporate documents and Mandarin-language notarisations.

8. CRS, FATCA, and Tax Reporting: What Foreign Shareholders Must Know

Foreign-owned companies opening Malaysian corporate bank accounts must understand that their account data is not confidential in the way it might be in some other jurisdictions. Malaysian banks report non-resident account details — including the Taxpayer Identification Number and account balances — to Malaysian tax authorities (LHDN), who then share this data with relevant foreign tax authorities under two international frameworks:

• Common Reporting Standard (CRS): Malaysia participates in the OECD's automatic tax information exchange. Account information of non-resident shareholders is reported to and from more than 100 participating jurisdictions — including China, Hong Kong, Singapore, and Taiwan.
• FATCA: For any shareholder or beneficial owner who is a US person (US citizen or green card holder), the bank will report account information to the US Internal Revenue Service via LHDN.

This is not a reason to avoid Malaysia — it is simply the modern global standard. But it does mean that the financial records of your Malaysian entity and its beneficial owners will be visible to tax authorities in your home jurisdiction. Ensure your group's transfer pricing, intra-group loans, and profit repatriation structure is properly documented before you open the account.

9. A Worked Scenario: A Shenzhen Manufacturing Company Opens a Malaysian Account

To make all of the above concrete, consider the following real-world scenario that our team at ONEKEY BIZ regularly assists with.

Background: A Shenzhen-based electronics manufacturer (Company A) incorporates a wholly foreign-owned Sdn Bhd in Malaysia — MyCo (M) Sdn Bhd — to serve as a regional sales hub and light-assembly operation. The two directors are a Chinese national (based in Shenzhen) and a Malaysian resident (appointed via ONEKEY BIZ). Company A holds 100% of MyCo's shares.

Bank chosen: OCBC Malaysia — selected because OCBC's compliance team is experienced with Chinese corporate documents, the bank has strong trade-finance capabilities, and the account can eventually be linked to OCBC's Group network if Company A also banks with OCBC China or Singapore.

Week 1: SSM Business Profile obtained, Board Resolution drafted by Company Secretary, all director passports certified. Parent company documents (Chinese Business Licence, Articles of Association) translated into English and notarised at the Malaysian Consulate in Guangzhou. Corporate TIN obtained from LHDN. Business narrative prepared in English.

Week 2: Application submitted to OCBC. Malaysian resident director visits the branch in person for face-to-face KYC verification. Chinese director participates via video KYC (if accepted) or submits documents remotely.

Week 3–4: OCBC compliance team conducts Enhanced CDD — source of funds evidence requested (Company A's latest audited accounts). ONEKEY BIZ liaises with the bank's relationship manager to respond to document queries.

Week 5: Account approved and activated. Initial deposit of RM 5,000 made. Corporate internet banking, DuitNow, and SWIFT/telegraphic transfer capabilities activated. MyCo begins receiving its first customer payments.

Key lesson: The entire process took 5 weeks rather than the possible 8–12 weeks, because all documents were prepared correctly before submission. The single most time-sensitive item was obtaining certified English translations of the Chinese parent's corporate documents — do not underestimate the time this takes.

ONEKEY BIZ's bank account opening service (OCBC & Alliance Bank) manages this entire workflow on your behalf — document checklist, translation coordination, bank liaison, and follow-up on compliance queries — so you can focus on your business rather than the paperwork.

10. Common Mistakes and Pitfalls to Avoid

• Submitting an out-of-date SSM Business Profile: Banks require the e-Info to be dated within 30 days. If yours is older, the bank will reject it immediately.
• No operational business address: A Company Secretary's registered office is not sufficient. You need a tenancy agreement or utility bill proving where the business physically operates.
• Missing the UBO chain: If your Malaysian Sdn Bhd is owned by a BVI holding company, which is in turn owned by a Hong Kong intermediate, which is owned by an individual — the bank needs documents tracing all the way to that individual. Missing any layer will trigger a rejection or a lengthy requests-for-information loop.
• Unsigned or incorrectly worded Board Resolution: The Board Resolution to open the bank account must be drafted precisely — naming the specific bank, account type, and authorised signatories. A generic resolution will not be accepted.
• Providing documents in Chinese without certified translation: All documents in a language other than English or Bahasa Malaysia must be accompanied by a certified English translation. This applies to Chinese business licences, articles of association, and shareholder registers.
• Trying to open the account before the Corporate TIN is issued: Banks now require the LHDN Corporate Tax Identification Number ("C" number) at onboarding. Apply for it immediately after SSM incorporation — do not wait.
• Ignoring the 6-month export repatriation rule: Foreign manufacturers using Malaysia as an export base must comply with BNM's FEP export proceeds rules. Set up an internal reminder system and ensure finance staff understand the obligation from Day 1.

What to Do Next

Opening a Malaysian corporate bank account as a foreign-owned company is very achievable — but it rewards preparation and penalises improvisation. The regulatory environment, while demanding, is designed to be transparent and rule-based: understand what BNM requires, present clean and complete documentation, choose the right banking partner for your profile, and the account will open.

ONEKEY BIZ specialises in exactly this process for companies from China, Hong Kong, Taiwan, and Singapore. Our bank account opening service (OCBC & Alliance Bank) covers end-to-end document preparation, certified translation coordination, bank liaison, and compliance query management — typically getting foreign-owned companies to account activation within 4–6 weeks. If you need additional guidance on FX structuring, profit repatriation, or transfer pricing, our team can also connect you with the right specialist.

Ready to get started? Contact us today for a free 30-minute consultation and a customised document checklist tailored to your company's ownership structure and home jurisdiction.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.