Do You Need a BNM Payment Licence in Malaysia 2026? The Money Services, E-Money and Merchant Acquiring Map — Class A to D Capital Tables, the RM1m/RM5m E-Money Split, and the 12 March 2027 Technology Deadline

If your business moves other people's money in Malaysia — remitting funds to China, exchanging currency, issuing a wallet balance, or settling card and QR transactions for merchants — you are not running a technology company with a payments feature. You are carrying on a regulated financial business, and doing it without the right approval from Bank Negara Malaysia is a criminal offence carrying up to ten years' imprisonment. The problem for foreign founders is that there is no single "payment licence" in Malaysia. There are four separate doors, three separate statutes, and four separate capital tables — and the door you walk through is decided by the mechanics of your money flow, not by what you call your product. This is the map, with the numbers as they stand in 2026.

1. First, the boundary that saves you six months: BNM or the Securities Commission?

Before you ask which licence you need, establish which regulator you belong to. Malaysia splits its financial regulation cleanly, and applicants who guess wrong lose a full application cycle.

Bank Negara Malaysia (BNM) regulates banking, insurance and takaful, money services (money changing, remittance, wholesale currency), payment instruments and payment systems. Its authorities are the Financial Services Act 2013 (FSA), the Islamic Financial Services Act 2013 (IFSA) and the Money Services Business Act 2011 (Act 731, "MSBA").

The Securities Commission Malaysia (SC) regulates anything that is a security, a derivative, a collective investment scheme or a digital asset that has been prescribed as a security — capital markets services licences, recognised market operators, digital asset exchanges. If you are building a crypto exchange, a tokenised-securities platform, a fund manager or a P2P financing operator, you are on the SC side of the line and should read our companion guide to the Capital Markets Services Licence and Recognized Market Operator framework instead.

The practical test is simple. If the customer's money is being moved, stored as a spendable balance, or exchanged between currencies, that is BNM. If the customer's money is being invested, pooled, traded or converted into an instrument whose value depends on someone else's performance, that is the SC. A great many Chinese fintech groups arrive in Kuala Lumpur convinced they need "a BNM crypto licence." No such thing exists.

2. The four BNM doors, and how to tell which one is yours

Under BNM's own supervisory vocabulary, the non-bank payment population is called Payment Services Regulatees. It comprises four distinct approval types, and it is entirely normal for a serious operator to end up holding two or three of them.

Read the table against your own flow. A Chinese cross-border payments platform that lets Malaysian SMEs pay suppliers in RMB is doing remittance — MSB, Class B at minimum. If the same platform also gives those SMEs a multi-currency account balance they can spend, that balance is e-money and needs a separate FSA section 11 approval. If it also onboards Malaysian merchants to accept payments from Chinese tourists, that is merchant acquiring, a third registration.

This stacking is not theoretical. Airwallex began in Malaysia with a Class B MSB licence and registered merchant acquirer status, and in 2026 obtained both an e-money issuing licence and a Class A licence from BNM in order to launch a full commercial offering. Four approvals, one business.

3. The MSB licence: four classes and a capital table that is set by branch count, not ambition

The MSBA 2011 created a single, dedicated regime for money services and replaced the older patchwork of exchange-control approvals. It recognises four licence classes:

• Class A — money-changing business and remittance business
• Class B — remittance business only
• Class C — money-changing business only
• Class D — wholesale currency business only

The minimum capital funds are prescribed by regulation, and the structure catches applicants off guard because it scales with physical footprint, not with transaction value:

An MSB licence is granted to a company, and it runs for a term of three years before renewal. There is no fixed foreign-equity ceiling written into the MSBA — but that is a much weaker comfort than it sounds. Every licensee must obtain BNM's written approval for any new substantial shareholder holding 5% or more, and every shareholder, director and senior officer must satisfy BNM's fit-and-proper criteria. In practice BNM assesses the whole ownership chain, including the ultimate beneficial owners sitting above your Hong Kong or BVI holding company. If you cannot document that chain cleanly, the capital table is irrelevant — see our guide to AMLA customer due diligence and beneficial ownership for what "cleanly" means to a Malaysian financial institution.

4. What the 2024 amendment changed — and why unlicensed "testing the market" is now reckless

The Money Services Business (Amendment) Act 2024 came into force on 1 August 2024, and it moved the regime in two directions at once.

Against illegal operators, it hardened considerably. The amendment sharpened the definition of remittance business and widened the scope of evidence admissible to charge an unlicensed operator, introduced property forfeiture on prosecution, and clarified the liability of those who abet illegal operations. Penalties for unlicensed money services business run to a fine of up to RM5 million, imprisonment of up to ten years, or both — with the amendment introducing a minimum fine of RM50,000 and up to ten years' imprisonment for illegal operators.

For licensed operators, it moved the other way, shifting routine operational breaches from automatic criminal prosecution toward proportionate administrative action. That is a meaningful improvement in the risk profile of holding a licence — and a sharp deterioration in the risk profile of not holding one.

5. E-money: the RM1 million / RM5 million split, and the trigger that moves you across it

E-money is approved under section 11 of the FSA 2013 (or the IFSA 2013 for its Islamic equivalent), and governed by BNM's Policy Document on Electronic Money. The definition that matters is functional: if you issue a prepaid, stored value that the holder can spend with parties other than you, you are an e-money issuer. A closed-loop gift card for your own stores is not e-money. The moment that balance can be spent at a third-party merchant, it is.

BNM splits issuers into two tiers, with capital requirements that took effect from 30 December 2023:

Two features of this table deserve a line in your financial model. First, the 8% floor is dynamic: capital is not a one-off gate but a permanent ratio against float. A wallet holding RM100 million of customer balances needs RM8 million of capital funds, not RM1 million. Second, promotion to Eligible EMI is automatic on the metrics, not elective. A successful campaign that pushes you past 500,000 active users for six straight months quintuples your regulatory capital floor. Model the capital call at the same time you model the growth curve.

Separately, e-money float is not your money. It must be safeguarded, and it is not available to fund operations, working capital, or the parent's cash pooling. Foreign groups used to sweeping subsidiary cash upstream should read our note on profit repatriation and the Foreign Exchange Policy before assuming any of this balance is extractable.

6. Merchant acquiring: the cheapest door, and the one most often overlooked

If you sign up Malaysian merchants to accept card or QR payments and you settle those transactions to them, you are providing merchant acquiring services — a registered business under the FSA 2013. Minimum capital funds have applied since 1 October 2021, introduced by the Financial Services (Requirements and Submission of Documents or Information) (Registered Business) (Amendment) Order 2021 [P.U.(A) 351/2021]:

Average monthly transaction value is measured either as an actual 12-month moving average or as a projection for the following 12 months — which means a credible business plan showing scale can put you in the RM1 million bracket from day one, before you have processed a single ringgit. Under-projecting to reduce the capital requirement is a poor trade: BNM reads the plan against the market.

7. The deadline nobody has budgeted for: technology requirements by 12 March 2027

On 12 March 2026, BNM issued its Policy Document on Technology Requirements for Payment Services Regulatees. It applies to approved e-money issuers, registered merchant acquirers, licensed money services businesses and designated payment system operators. Banks are excluded — they already sit under the RMiT framework — which means this document is aimed squarely at exactly the population reading this article.

The substantive obligations are heavier than most start-up boards expect:

• The board must set a technology risk appetite and oversee a cybersecurity strategy spanning at least three years.
• An independent Chief Information Security Officer must be appointed — a named, dedicated role, not a co-opted CTO.
• A full technology risk management framework is required, covering system classification, risk monitoring and incident response, together with tested business continuity and disaster recovery capability.
• A customer-facing "kill switch" must let a user instantly suspend their account on suspicion of fraud.
• Outsourcing does not transfer accountability. If your core ledger runs on a vendor platform in Shenzhen or Singapore, the Malaysian licensee remains fully answerable to BNM for its security and reliability.

Requirements are tiered across four bands by transaction volume, with a significant threshold at entities processing more than RM1.5 billion annually or seven million transactions, and simplified treatment for non-digital money services businesses doing only currency exchange or wholesale work. The timeline is fixed: a gap analysis within 90 days of issuance, and full compliance by 12 March 2027.

8. What an application actually requires, and what to budget

Every route starts with the same foundation, and the sequence matters.

The entity. A Malaysian company — in almost every case a Sdn. Bhd. — properly capitalised for the class you are applying for. Note the distinction between paid-up capital and capital funds: BNM tests capital funds, which is a regulatory measure, and losses erode it. Applicants who capitalise to exactly the floor breach it in their first year of operating losses. Capitalise above the line. Our guide to foreign equity and paid-up capital rules covers how this interacts with the general foreign-ownership thresholds.

The people. Directors and senior management who pass fit-and-proper assessment, with demonstrable payments or financial-services experience. A board composed entirely of the Chinese parent's executives, none of whom has run a regulated entity, is a common reason for a stalled file. Malaysian resident directorship is a statutory company-law requirement in its own right — see the resident director requirement and section 196(4).

The ownership chain. Full disclosure to ultimate beneficial owner, with BNM written approval for any 5%-or-greater shareholder.

The compliance stack. An AML/CFT programme built to the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 standard, a compliance officer, sanctions screening, transaction monitoring, and — from 12 March 2027 — the full technology framework above.

The business case. BNM is not a registry. It exercises judgement on whether the applicant adds value to the Malaysian payments ecosystem, has a viable model, and can absorb losses through the ramp-up. Expect a process measured in quarters, not weeks, with substantive rounds of queries.

9. The five mistakes that cost foreign applicants a cycle

Calling it a technology licence. There is no BNM approval for "a fintech." BNM licenses activities. Describe your money flow step by step — who holds funds, for how long, and who can spend them — and the correct door becomes obvious.

Assuming one approval covers the product. Wallet plus cross-border plus merchant acceptance is three approvals. Sequence them, because each has its own capital floor and they are cumulative in the same entity.

Capitalising to the minimum. The floors in this article are floors, tested continuously against capital funds that operating losses reduce. Build headroom.

Treating float as working capital. E-money balances are customer money and must be safeguarded. This surprises groups accustomed to less prescriptive jurisdictions, and it changes the amount of shareholder funding the Malaysian entity genuinely needs.

Launching first and applying later. Since 1 August 2024 the downside includes forfeiture and a minimum fine, on top of the pre-existing exposure to RM5 million and ten years.

10. What to do next

Work in this order. Write down your money flow as a numbered sequence of who holds whose money and when. Map each step to one of the four doors in section 2. Add up the capital floors that apply cumulatively, then add headroom for the first two years of losses and for the 8% e-money ratio at your projected float. Only then incorporate and capitalise — because changing the capital structure after BNM has begun assessing your file is the single most reliable way to lose a quarter.

ONEKEY BIZ handles the corporate side of that sequence end to end for foreign-owned financial and payments groups entering Malaysia — incorporation and capitalisation of the Sdn. Bhd., the resident director and shareholder documentation BNM will test, the beneficial-ownership chain in a form a Malaysian regulator accepts, and the accounting discipline a capital-funds test demands. Talk to us through our legal and regulatory advisory service, or contact our consultants in Mandarin or English for a scoped assessment of which BNM door your model actually needs.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.