Key takeaways
- G7 = no tender-value ceiling. It is the only CIDB grade that lets you bid on unlimited-value construction contracts — infrastructure, mega-commercial, industrial and government projects alike.
- RM750,000 paid-up capital is the base requirement for the PPK (contractor registration certificate); SPKK (government-project access) requires approximately RM1,500,000.
- Two qualified technical staff are mandatory: either two Degree holders (one with 5+ years' experience) or one Degree + one Diploma holder (both with 5+ years' experience). These must be Malaysian citizens.
- Foreign companies must incorporate a Malaysian Sdn Bhd first. A pure foreign-entity registration is project-specific only and does not grant SPKK or a standing grade.
- SCORE 3-star rating is required to maintain G7 SPKK eligibility; 40 CCD points per year are needed to renew the PPK licence.
- From 1 January 2027, all G7 SPKK holders must hold a valid MS ISO 37001 Anti-Bribery Management System certificate. Begin your gap assessment now — certification takes 6–12 months.
Why CIDB G7 Matters: The Legal Foundation and the Commercial Prize
The Construction Industry Development Board (CIDB) of Malaysia was established under the CIDB Act 1994 (Act 520), and registration is mandatory — not optional. Under Section 25 of Act 520, every contractor, whether local or foreign, must be registered with CIDB before signing or executing any construction work in Malaysia. Violating this provision can result in a fine of between RM10,000 and RM100,000, and the Board can issue a written stop-work notice under Section 30.
Within the CIDB system, contractors are classified from G1 to G7, with each grade setting a ceiling on the contract value the holder may undertake and imposing corresponding financial and technical requirements. G7 sits at the apex of this hierarchy for one powerful reason: there is no contract-value ceiling. A G7 company can legally bid on a RM500 million government infrastructure contract or a RM2 billion private mixed-development — the licence imposes no financial ceiling whatsoever.
For foreign construction companies — particularly large-scale contractors from China, Taiwan, Hong Kong, and Singapore who are accustomed to bidding on significant infrastructure or commercial projects — G7 is therefore the only commercially meaningful grade. Lower grades cap tender value (G6, for instance, is often cited in the RM10–20 million range), creating a structural disadvantage for companies whose typical project size far exceeds those limits. G7 removes that ceiling entirely and opens the door to Malaysia's most lucrative public-sector pipeline.
The Two-Track System: Foreign Entity vs. Malaysian Sdn Bhd
Before discussing the G7 requirements themselves, foreign companies must understand that CIDB offers two structurally different registration tracks, and the choice has profound commercial consequences.
Track 1: Project-Based Foreign Contractor Registration
A foreign entity that has been awarded a specific construction contract in Malaysia can register with CIDB as a foreign contractor on a project-specific basis. The certificate issued is valid only for the named project and expires when that project's completion date passes. If the project is extended, the contractor must apply to CIDB within 14 days before the certificate's expiry to extend it. This route does not grant a standing G-grade, does not qualify for SPKK, and cannot be used to bid independently on future tenders. It is, in essence, a legal gateway for executing a single awarded contract — not a platform for market entry.
Track 2: Local Sdn Bhd with a Full G-Grade (the G7 route)
The commercially meaningful route for any foreign company targeting Malaysia as an ongoing market is to incorporate a Malaysian private limited company (Sdn Bhd) with the Companies Commission of Malaysia (SSM) and then register that company with CIDB as a local contractor under the G1–G7 grade system. This grants a standing PPK certificate (renewable for up to three years depending on CCD points), eligibility to apply for SPKK (which unlocks government tenders), and the full commercial profile of a Malaysian-based G7 contractor.
The good news for foreign investors: Malaysia has substantially liberalised foreign-ownership rules in many construction sub-sectors, and a Sdn Bhd company can in many cases be 100% foreign-owned. You should verify sector-specific ownership requirements with a market-entry consultant, but foreign majority or full ownership is generally achievable in construction services. The key constraint is not shareholding but technical personnel: the CIDB requires that technical staff listed on your registration file are Malaysian citizens, which means your company will need to hire qualifying Malaysian engineers or diploma holders.
The G7 Requirements in Detail: What You Must Have on Day One
To register for CIDB G7, a company must satisfy requirements across five dimensions simultaneously. There is no sequential or phased approach — all criteria must be met before the application is submitted.
| Requirement | G7 Specification | Notes / Common Pitfalls |
|---|---|---|
| SSM Incorporation | Registered Sdn Bhd (or Bhd) with SSM | Must be active and in good standing; no outstanding SSM penalties |
| Paid-up Capital (PPK) | Minimum RM750,000 | Verified by bank statement or audited accounts; cash only — assets and equipment excluded |
| Paid-up Capital (SPKK) | Approximately RM1,500,000 | Roughly double the PPK base; needed to qualify for government-project certificate |
| Technical Personnel — Option A | Two Degree holders in a construction-related field; at least one with 5+ years' experience | Must be Malaysian citizens; EPF contribution records required as proof of employment |
| Technical Personnel — Option B | One Degree holder + one Diploma holder; both with minimum 5 years' experience | Either option is acceptable; the degree/diploma must be in a relevant technical field |
| Application Filing | Via CIDB CIMS portal (cims.cidb.gov.my); must be submitted by a company director or owner | Processing fee: RM50 (one-off); annual licence fee payable upon approval |
| ISO 9001 | ISO 9001 Quality Management System certification recommended/expected at G7 | Required by many government procurement frameworks and major private clients |
| Business Premise | Physical registered business address in Malaysia | A premise sketch/map (not a Google Maps screenshot) is required with the application |
The Paid-Up Capital Rule: Why Cash Is King
The RM750,000 paid-up capital requirement for G7 PPK registration is frequently misunderstood by foreign applicants. CIDB verifies this amount by examining your bank statement (typically the most recent month) or your latest audited accounts. Only actual cash counts — equipment values, property assets, receivables, or other non-liquid items are not accepted. CIDB checks SSM records and bank statements in parallel. If you withdraw the balance before approval is granted, your application is likely to be rejected. The capital must also be maintained throughout the registration period; if your balance falls below the threshold during a compliance audit, you are technically non-compliant and face grade suspension or downgrade at renewal.
For SPKK (government-project) eligibility, the capital floor approximately doubles to RM1,500,000. This reflects the higher financial responsibility that government projects impose and the need for contractors to sustain project execution under public-sector payment cycles, which can be slower than private-sector timelines.
Technical Personnel: The Malaysian Citizen Constraint for Foreign Companies
For G4 through G7, technical personnel are mandatory. At G7, you need either two Degree holders (one with at least five years' construction experience) or one Degree holder and one Diploma holder (both with at least five years' experience). These individuals must be full-time employees on your Malaysian payroll, evidenced by EPF (Employees Provident Fund) contribution records — a common sticking point for foreign companies that initially attempt to use parent-company staff or secondees.
Critically, CIDB requires that technical personnel be Malaysian citizens. This is the single most important structural consideration for a foreign-owned company building toward G7. You must recruit, employ, and retain qualified Malaysian engineers. If a technical staff member resigns, you are required to notify CIDB within 14 days of their departure and replace them with an equally qualified person before your next renewal. Operating without the required technical staff at G5–G7 is treated as non-compliance and can result in a grade downgrade or suspension.
The PPK → SPKK Pathway: Unlocking Government Projects
Many foreign companies target G7 specifically because it enables bidding on Malaysian government construction contracts — a procurement market worth many billions of ringgit annually. However, there are two distinct certificates in the CIDB system, and both are required to access government tenders.
PPK — Perakuan Pendaftaran Kontraktor (Contractor Registration Certificate)
This is the foundational CIDB licence. It assigns your grade (G7), your categories of work (Building/B, Civil Engineering/CE, Mechanical & Electrical/ME, or Specialist/F), and your specialisations. Without a valid PPK, you cannot legally undertake any construction work or bid on any tender — government or private. The PPK is issued for one year initially (new registrations receive a two-year initial period) and can be renewed for up to three years at renewal, depending on accumulated CCD points. All PPK applications incur a one-off processing fee of RM50, with an annual licence fee payable upon approval (RM1,400 per year at G7 is commonly cited).
SPKK — Sijil Perolehan Kerja Kerajaan (Government Work Procurement Certificate)
SPKK is the additional certificate, issued separately by CIDB, that specifically authorises a contractor to participate in government procurement. To qualify for SPKK, you must first hold a valid PPK at the relevant grade. SPKK holders are eligible to participate in government construction procurement in accordance with Treasury Circular No. 6 of 2012 and the amended Treasury Instruction No. 3 of 2012 issued by the Malaysian Ministry of Finance. There is no registration fee for SPKK itself — the cost lies in meeting the higher capital and SCORE requirements.
If your SPKK lapses or is suspended, the consequences are severe: you lose the right to bid on all new government tenders, and existing government contracts may be affected. Disciplinary action taken against your PPK automatically affects the status of your SPKK — the two certificates are operationally linked.
SCORE, CCD Points, and the Renewal Treadmill
Obtaining G7 PPK and SPKK is not a one-and-done exercise. CIDB has built a continuous performance and development framework that contractors must sustain every year. Two components are particularly important for foreign-owned companies to understand: the SCORE assessment system and the CCD points requirement.
SCORE — Contractor Capability and Capacity Assessment
SCORE (Sistem Contractor Rating/Penilaian Keupayaan dan Kapasiti Kontraktor) is a specialised programme developed by CIDB in collaboration with SME Corp that measures contractor capability across seven parameters: Business Performance, Financial Capability, Technical Capability, Project Management, Procurement Management, Best Practices, and Management Capability. Each parameter carries 30 marks, for a total of 210 marks. The rating scale runs from 0 to 5 stars: achieving 51–70% of the total marks earns 3 stars.
For G7 SPKK, a minimum of 3 stars in the SCORE assessment is required. For G2–G4 SPKK, the minimum is 2 stars. SCORE certificates are valid for two years; contractors must renew before expiry to maintain their assessment status. SCORE fees at G5–G7 are RM2,000 for the PPK (no star rating) and RM2,500 for the SPKK version (with star rating). PPK renewal does not require a minimum star rating — any G2–G7 company can renew PPK without achieving a SCORE rating — but SPKK renewal requires the 3-star minimum.
CCD Points — Contractor Continuous Development
CCD is CIDB's mandatory professional development programme. G7 contractors must accumulate 40 CCD points per year to renew their PPK licence. (G5–G6 need 30 points/year; G3–G4 need 20; G1–G2 need 10.) The total points needed scale with the renewal period chosen: a G7 contractor renewing for three years needs 120 CCD points accumulated before the renewal application is submitted. Critically, from 27 November 2023, only courses from PLCCD-registered (Penyedia Latihan Contractor Continuous Development) providers count toward CCD points. If a training provider is not PLCCD-certified, the points from their courses will not be recognised by CIDB, regardless of whether you attended and received a certificate.
| Grade | Paid-up Capital (PPK) | Paid-up Capital (SPKK) | Technical Staff | CCD Points/Year | SCORE for SPKK |
|---|---|---|---|---|---|
| G1 | RM5,000 | RM10,000 | Optional (1 Tech. Cert.) | 10 | N/A (frozen) |
| G2 | RM25,000 | ~RM50,000 | 1 Tech. Cert. (optional) | 10 | 2-star min. |
| G3 | RM50,000 | ~RM100,000 | 1 Tech. Cert. (optional) | 20 | 2-star min. |
| G4 | RM150,000 | ~RM300,000 | 1 Diploma holder | 20 | 2-star min. |
| G5 | RM250,000 | ~RM500,000 | 1 Diploma (5 yrs) or 1 Degree (1 yr) | 30 | 3-star min. |
| G6 | RM500,000 | ~RM1,000,000 | 1 Diploma + 1 Degree (one with 3 yrs) | 30 | 3-star min. |
| G7 | RM750,000 | ~RM1,500,000 | 2 Degree (one 5 yrs) OR 1 Degree + 1 Diploma (both 5 yrs) | 40 | 3-star min. |
The 2026/2027 Game-Changer: ISO 37001 Anti-Bribery Certification for G7 SPKK
The most significant regulatory development affecting G7 contractors in 2026 is CIDB Pekeliling Bil. 1/2026 (Circular 1/2026), issued in December 2025 and formally announced on CIDB's website in February 2026. This circular makes MS ISO 37001:2016 Anti-Bribery Management System (ABMS) certification a mandatory condition for all G7 contractors applying for or renewing SPKK, effective from 1 January 2027.
This is a binding regulatory requirement — not a voluntary best-practice recommendation — enforced through CIDB's statutory powers under Act 520. A G7 contractor without a valid ISO 37001 certificate from an accredited certification body cannot hold SPKK from 1 January 2027 onward. Without SPKK, that contractor cannot tender for any government construction project. The financial and reputational stakes could not be higher.
The Pekeliling is scoped to G7 with SPKK only. G1–G6 contractors and G7 contractors without SPKK are not currently in scope. However, market pressures are already expanding the de facto scope: government-linked companies (GLCs), Bursa-listed developers, and ESG-conscious private clients are increasingly requiring ISO 37001 as a prequalification condition regardless of SPKK status.
For foreign-owned companies, this requirement actually aligns well with international practice — many Chinese state-owned enterprises and Taiwanese and Singaporean contractors operating in regulated markets will have existing anti-bribery compliance frameworks. The key task is getting that framework formally certified to MS ISO 37001 standard by a CIDB-recognised accreditation body. The certification process typically takes 6–12 months from gap assessment to certification audit. Companies targeting SPKK in 2026 should begin immediately.
A Worked Scenario: How a Chinese Construction Company Gets to G7
To make these rules concrete, consider a Chinese infrastructure contractor — let's call them SinoConstruct Sdn Bhd — that has been awarded a subcontract on a large private mixed-use development in Kuala Lumpur and wants to establish a long-term presence in Malaysia.
Step 1 — Incorporate the Malaysian entity (Month 1–2). SinoConstruct's parent registers a Malaysian Sdn Bhd with SSM. The company is initially incorporated with a paid-up capital of RM1,500,000 to cover both the G7 PPK requirement (RM750,000) and the SPKK requirement (approximately RM1,500,000), injecting share capital from the Chinese parent. All capital is deposited into a Malaysian corporate bank account and a bank confirmation letter is obtained.
Step 2 — Hire Malaysian technical personnel (Month 2–3). The company identifies and employs two Malaysian civil engineers, each holding a Bachelor of Engineering degree, with one having over seven years of construction experience and the other with five years. Both are placed on Malaysian payroll with EPF contributions commenced. Their original degree certificates, MyKad copies, and EPF records are prepared for the CIDB application file.
Step 3 — Obtain SSM documents and business premise (Month 1–3). The company secures a registered business address in Malaysia (not just a virtual office — a physical premise with a sketch/map), obtains a business premise licence, and compiles audited financial statements or the latest bank statement showing the RM1,500,000 balance.
Step 4 — Apply for PPK G7 via CIMS (Month 3–4). A company director creates an account on the CIDB CIMS portal and submits the PPK G7 application, uploading all required documents. The one-off RM50 processing fee is paid online. CIDB typically processes complete applications within seven working days. Upon approval, the G7 PPK certificate is printed online via the CIMS portal.
Step 5 — Apply for SCORE assessment (Month 4–6). With the PPK in hand, SinoConstruct applies for SCORE assessment (SPKK version, 3-star track) at the G5–G7 fee of RM2,500. CIDB assesses the company across seven parameters. The company prepares documentation on project experience, financial records, management systems, and quality and safety practices. If 3-star is achieved (51–70% of 210 marks), a SCORE certificate is issued, valid for two years.
Step 6 — Apply for SPKK (Month 6–7). With a valid PPK G7 and a valid SCORE certificate of at least 3 stars, SinoConstruct applies for SPKK. On approval, the company can now submit bids for Malaysian government construction projects in any category for which they are registered.
Step 7 — Begin ISO 37001 gap assessment (Month 1, in parallel). Because the 1 January 2027 deadline requires ISO 37001 certification for SPKK renewal, SinoConstruct commences its gap assessment immediately — ideally in parallel with the company incorporation process. The internal anti-bribery management system is documented, staff trained, an internal audit conducted, and a certification body engaged. The certification audit is targeted for completion no later than Q3 2026 to provide a buffer before the January 2027 deadline.
Common Mistakes and Pitfalls for Foreign Companies
1. Treating the project-based route as equivalent to G7. Foreign companies that register on a project-specific basis do not receive a standing CIDB grade and cannot independently tender for future contracts or access SPKK. If your business plan involves multiple Malaysian projects over time, the Sdn Bhd + G7 route is the only viable structure.
2. Undercapitalising the Sdn Bhd. Many foreign investors incorporate the Malaysian entity with minimal capital (e.g., RM1,000) to reduce initial cost, then scramble to increase it before the CIDB application. Capital increases through SSM require time and additional filings. Build in the RM750,000–RM1,500,000 capital from the outset.
3. Using expatriate or seconded engineers as "technical personnel." CIDB requires technical staff to be Malaysian citizens. Foreign engineers on Employment Passes cannot fulfil the technical personnel requirement for PPK/SPKK registration. This is the most common reason foreign-owned G7 applications are delayed or rejected.
4. Withdrawing capital during the verification window. CIDB checks bank balances as part of the verification process. If the RM750,000 is withdrawn from the account before the PPK is granted — even briefly — the application may be rejected. The capital must be visible and maintained until the licence is in hand.
5. Not tracking CCD points from day one. CCD points are required for the first renewal, which comes around year two for new registrations. Foreign-owned companies often deprioritise this until the renewal deadline is imminent, then cannot find sufficient PLCCD-accredited courses in time. Budget for at least four to five recognised training events or courses per year for G7.
6. Leaving ISO 37001 until late 2026. The certification timeline is not under the contractor's control — it depends on the readiness of the certification body and the state of the company's existing compliance infrastructure. Starting in late 2026 creates a serious risk of not achieving certification before the 1 January 2027 SPKK renewal deadline. Foreign companies should treat this as an immediate parallel workstream, not a future task.
What to Do Next: Your Action Plan
If you are a foreign construction company evaluating Malaysia as a market, the pathway to G7 is clear but requires deliberate sequencing and sufficient capital commitment. The regulatory framework is well-defined, consistently enforced, and — importantly — designed to be accessible to foreign-owned companies that are prepared to make a genuine operational commitment to Malaysia. G7 does not require local partnership or Bumiputera shareholding for the PPK itself (Bumiputera ownership requirements apply to certain specific government procurement categories and should be verified for your target project types).
Start by confirming your target project types and the categories of work you wish to be registered under (Building/B, Civil Engineering/CE, Mechanical & Electrical/ME, or Specialist/F), as these affect both the grade assigned and the technical staff qualifications needed. Then work backwards from the G7 capital and personnel requirements to design your Malaysian entity with the right structure from inception.
ONEKEY BIZ provides end-to-end market-entry support for construction companies targeting Malaysia: from SSM Sdn Bhd incorporation and corporate secretarial services to CIDB application management, accounting and tax compliance, Employment Pass applications for expatriate management, and ISO readiness advisory. Our team understands both the regulatory framework and the practical realities that foreign-owned companies face — including the technical personnel constraint, the capital verification process, and the new ISO 37001 certification timeline.
Ready to start? Contact our team for a no-obligation consultation, or learn more about our full market-entry services for construction companies.
]]>Frequently asked questions
What is the minimum paid-up capital for CIDB G7 registration in Malaysia?
The minimum paid-up capital for CIDB Grade G7 is RM750,000 for the standard Perakuan Pendaftaran Kontraktor (PPK) licence. If your company also applies for the Sijil Perolehan Kerja Kerajaan (SPKK) — the government-work procurement certificate — the required paid-up capital roughly doubles to approximately RM1,500,000. The capital must be verified by bank statement or audited accounts and must be maintained throughout the registration period; it cannot consist of equipment, assets, or other non-cash items.
Can a 100% foreign-owned company obtain a CIDB G7 licence in Malaysia?
Yes. A foreign company can obtain a CIDB G7 licence through one of two routes. The preferred long-term route is to incorporate a Malaysian Sdn Bhd (which can be 100% foreign-owned in most construction sub-sectors since Malaysia liberalised foreign ownership rules) and then apply for G1–G7 registration as a local contractor under Act 520. Alternatively, a foreign entity without a local subsidiary registers on a project-specific basis, receiving a certificate valid only for the named project. To access ongoing contracts, government tenders, and SPKK, forming a local Sdn Bhd and obtaining a full G7 grade is the commercially practical path. Technical personnel listed on the CIDB file must be Malaysian citizens, so foreign-owned companies will need to employ qualifying Malaysian staff.
What is SPKK and why does a G7 contractor need it to bid on government projects?
SPKK (Sijil Perolehan Kerja Kerajaan, or Government Work Procurement Certificate) is an additional layer of certification issued by CIDB that specifically authorises a contractor to bid on Malaysian government construction projects. To obtain SPKK, a contractor must first hold a valid PPK (contractor registration certificate) at the relevant grade. For G7 SPKK, the paid-up capital requirement is approximately RM1,500,000, and the company must achieve a minimum SCORE rating of 3 stars. Without a valid SPKK, a G7 company cannot legally tender for government contracts — and if the SPKK lapses, clients can cancel contracts on government projects.
What is the ISO 37001 requirement for CIDB G7 contractors and when does it take effect?
Under CIDB Pekeliling Bil. 1/2026, issued in December 2025 and formally announced in February 2026, all CIDB G7 contractors holding or applying for SPKK must obtain a valid MS ISO 37001:2016 Anti-Bribery Management System (ABMS) certification from an accredited certification body. This requirement takes effect from 1 January 2027. A G7 contractor that cannot present a valid ISO 37001 certificate at the point of SPKK application or renewal after that date will be refused SPKK — meaning it loses the right to tender for all government construction projects. G1–G6 contractors are not currently in scope, but the requirement is expected to cascade down over time. Foreign-owned G7 companies should begin their ISO 37001 gap assessment immediately, as the certification process typically takes 6–12 months.
Sources & references
This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.