Why Your Malaysian Corporate Account Takes Four Months (2026): The AMLA 2001 System From the Customer's Side — Who Is a Reporting Institution, the CDD File Your Bank and Your Company Secretary Must Each Build, the 25% Beneficial-Owner Test Behind SSM's e-BOS Register, the RM25,000 Cash Threshold Report, the Suspicious Transaction Report You Will Never Be Told About, and the Section 4 Penalty of 15 Years and Five Times the Proceeds

A Chinese group incorporates a Malaysian Sdn. Bhd. in three working days, then spends four months trying to open its bank account. The documents keep coming back: a shareholding chart that stops at a BVI holding company, a "source of funds" answer that says "shareholder capital", a director who cannot be reached for a video call, an expected-turnover figure of RM50 million against a paid-up capital of RM1,000. Nobody at the bank is being obstructive, and nothing in the file is illegal. What is happening is that the bank is a reporting institution under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001, and it is legally required to build a file on you that it can defend to Bank Negara Malaysia. So is your company secretary. So is your auditor. This guide explains that system from the customer's side — who owes these duties, what they must collect, the 25% beneficial-owner test that also drives SSM's register, the reports filed about you that you will never see, and the penalties that explain why nobody bends.

Who is a reporting institution — and why you keep answering the same questions

The AMLA does not regulate you directly unless you are in a listed sector. It regulates the businesses you must deal with in order to operate, and it makes them responsible for knowing who you are. The First Schedule to the Act lists reporting institutions across three broad tiers:

That third tier is the one foreign investors misread. Your company secretary is a reporting institution. So is the accounting firm that keeps your books and the law firm that drafts your lease. Each of them owes its own customer due diligence duty and cannot discharge it by pointing at the bank's file. This is why the same passport, the same shareholding chart and the same source-of-funds explanation are demanded three or four times by different parties who appear to be on the same side. They are not duplicating work; each is building a file that it, individually, must be able to defend.

What customer due diligence actually asks for

CDD is not a form; it is an evidence standard. For a corporate customer, a reporting institution is expected to identify and verify the legal person, understand the ownership and control structure, identify the natural persons behind it, understand the purpose of the relationship, and keep monitoring it afterwards. Translated into what lands in your inbox:

Enhanced due diligence — deeper questions, senior approval, closer ongoing monitoring — is triggered by higher risk rather than by nationality: politically exposed persons and their close associates, complex or unusual structures, transactions with no apparent economic purpose, and links to jurisdictions identified as higher risk. A cross-border group structure is not itself suspicious; a cross-border group structure that nobody in management can explain is.

The 25% test, and why it appears twice

The beneficial owner is the natural person who ultimately owns or controls the customer. In practice the working threshold is ownership or control of more than 25% of shares or voting rights, with control tests catching those who exercise ultimate effective control by other means — the right to appoint directors, a dominant shareholders' agreement, or de facto direction of the board.

This same concept has a second, separate life in company law. Since the Companies (Amendment) Act 2024 brought the beneficial ownership reporting framework into the Companies Act 2016, a Malaysian company must identify its beneficial owners, keep a register of them at its registered office, and notify SSM through the e-BOS system on the SSM4U portal, with records preserved for seven years after a person ceases to be a beneficial owner.

The two reports filed about you

Section 14 of the AMLA creates the reporting duties. There are two, and they behave very differently.

The cash threshold report

The CTR obligation under section 14(1)(a) applies to cash transactions at or above RM25,000 — but, importantly, Bank Negara has confirmed that this obligation is directed at banking institutions, selected prescribed development financial institutions, Lembaga Tabung Haji and licensed casinos, rather than at every reporting institution. It is mechanical: cross the threshold in a single transaction or a series of related ones and a report is filed, within a short prescribed window, to the Financial Intelligence and Enforcement Department. No suspicion is required and none is implied.

The practical consequences are ordinary and worth planning for. Structuring deposits to stay under the threshold is far more damaging than crossing it — deliberate splitting is itself a classic indicator that will generate the second kind of report. Businesses that genuinely collect cash should say so in the account-opening interview and evidence it, rather than surprising the bank three months later.

The suspicious transaction report

The STR has no threshold and no floor. Where a reporting institution suspects that a transaction involves proceeds of unlawful activity, it must report — and it must not tell you. Tipping off defeats the purpose of the regime and is treated accordingly. This explains behaviour that customers routinely misinterpret:

• A transfer is held, then released, with no explanation offered.
• An account is closed with the minimum contractual notice and no reason given.
• A relationship manager who has been helpful suddenly cannot discuss the file.
• An onboarding that was progressing simply stops.

None of these means you have been accused of anything. It means someone made a report and is legally prohibited from discussing it. Arguing with the branch is futile; the decision has left the branch. The productive response is to strengthen the underlying file — documentary evidence for the transactions concerned — and, where a relationship has been exited, to approach the next institution with that evidence prepared rather than hoping the question will not arise.

Sanctions screening: a separate obligation with faster consequences

Targeted financial sanctions run alongside AML and operate differently. Names on domestic and United Nations Security Council lists must be screened, and a match requires immediate freezing rather than a risk assessment. Screening is applied not only to the customer but to directors, beneficial owners, counterparties and, in trade finance, to vessels, ports and end-users.

For manufacturers and traders this is the most underestimated exposure in the whole regime, because it reaches through your supply chain into transactions you did not directly negotiate. Dual-use goods, transshipment through a third country, and end-users whose stated purpose does not match the specification are the recurring themes. A trade finance application that fails screening will not be explained to you either.

How to make your company easy to bank

Everything above reduces to one operational insight: the institutions dealing with you are not assessing whether you are honest. They are assessing whether they can evidence that they took reasonable steps to know who you are. Make that easy and the process compresses from months to weeks.

1. Prepare an ownership chart to the natural persons before you apply. Every layer, every jurisdiction, every percentage, ending in named individuals with identification documents attached. If a layer exists for a commercial reason, write the reason down.
2. Answer source of funds and source of wealth separately, with evidence. Audited accounts of the parent, a sale agreement, dividend vouchers, a bank statement showing accumulation. One line of narrative is not an answer.
3. Keep SSM records, the constitution, the BO register and your bank forms consistent. Contradictions between what SSM shows and what the form says are the fastest route to escalation — and they are almost always the result of a filing nobody updated. Our note on the 14-day and 30-day SSM clocks lists what must be updated and when.
4. Make projected activity match the company you actually built. If turnover projections are large, show the contracts, the premises, the headcount and the capital that make them plausible — or revise the projection.
5. Have directors available for verification. Video verification, live document checks and short interviews are normal. A director who is permanently unreachable is a risk indicator in itself.
6. Brief your own team. The person who answers the bank's follow-up call should know the group structure and the funding history. Inconsistent answers from different staff members do more damage than a slow answer.

Groups incorporating from China should read this alongside our guide to corporate banking and foreign exchange policy in Malaysia, which covers account types, the foreign exchange rules on inbound and outbound flows, and the documentation banks expect for cross-border transfers.

The compliance duties your own company may owe

Two categories of foreign-owned company find themselves on the other side of the counter. The first is any business in a listed DNFBP sector — a dealer in precious metals or stones, a real estate agency, a trust or corporate services provider. The second is any business handling client money or acting as an intermediary in payments. If that is you, the obligations are structural rather than procedural: a written AML/CFT policy, a designated compliance officer with authority, a risk assessment covering customers, products, channels and geographies, staff training, record retention, screening systems and internal escalation to reporting.

These are supervised obligations with examinations attached, and the penalty exposure sits on the institution and on its officers. Building the programme after the first examination is considerably more expensive than building it at licensing.

The bottom line

Malaysia's AML regime is not aimed at foreign investors, but foreign investors feel it most, because their structures are longer, their funds cross borders and their beneficial owners are further from the counter. The regime is document-driven and evidence-driven: it rewards companies whose ownership is transparent, whose records agree with each other, and whose stated business matches its actual transactions.

The practical takeaway is unglamorous. Build the ownership chart, evidence the money, keep SSM and the bank telling the same story, and treat your company secretary's questions as part of the same system rather than as bureaucracy. Companies that do this open accounts in weeks. Companies that treat it as an obstacle to be argued around spend a year discovering that nobody on the other side of the desk has the authority to bend.

ONEKEY BIZ prepares corporate account-opening files for foreign-owned Malaysian companies, maintains beneficial ownership registers and SSM filings as licensed company secretaries, and works with our banking partners on China-linked structures. Book a free consultation, or read more about our corporate bank account opening service.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.