Do You Need a Consumer Credit Licence in Malaysia 2026? The Consumer Credit Act 2025, the New SKP Regime for BNPL, Leasing and Factoring, and the Transition Deadline Foreign-Owned Companies Are About to Miss

Malaysia acquired a brand-new financial regulator on 1 March 2026, and most foreign-owned companies have not noticed. The Consumer Credit Act 2025 (Act 873) created the Suruhanjaya Kredit Pengguna (SKP) — the Consumer Credit Commission — and made six previously unregulated businesses licensable. Three of them are activities that Chinese trading, equipment and platform groups run in Malaysia every day without thinking of themselves as financial firms at all: buy now pay later, leasing and factoring. Licensing opened on 1 June 2026 with a six-month transition window. That window closes at the end of 2026, and after it, carrying on the business without authorisation is an offence carrying a fine of up to RM5 million, five years' imprisonment, or both. This is the map: who is caught, who is exempt, what it costs, and what a foreign parent has to clear before it can hold shares in a licensed entity.

1. What changed on 1 March 2026, and the date your finance team has not diarised

The Consumer Credit Act 2025 was gazetted on 31 December 2025 and came into force on 1 March 2026. It consolidates what was previously a patchwork — the Moneylenders Act 1951, the Hire-Purchase Act 1967, the Pawnbrokers Act 1972, plus large stretches of entirely unregulated activity — into one framework, supervised by a single competent authority.

SKP moved quickly. On 5 June 2026 it issued two foundational rulebooks: the Authorisation Standards (who may enter the market and how) and the Conduct Standards (how authorised entities must behave). Both had been preceded by industry briefings on 18 and 19 May 2026 attended by more than 400 practitioners — a number worth pausing on, because Malaysia's non-bank credit population is far larger than 400 firms, and the ones who did not attend are overwhelmingly the ones who do not realise they are in scope.

Note the structure of the risk. This is not a case where a new rule applies to new entrants and grandfathers everyone else. The transition period exists precisely so that existing operators can regularise. Once it lapses, an existing business that never applied is not "pending" — it is unlicensed.

2. The six regulated activities, and the two doors

Act 873 splits authorisation into two regimes with different names, different thresholds and different fees. Licensing applies to a credit business; registration applies to a credit service business. Both are mandatory; neither is a formality.

Two structural points follow from the table. First, a separate authorisation is required for each activity. Under the Authorisation Standards an entity may apply only for the business it intends to carry on immediately, not for a future one; if you later add leasing to a BNPL licence, that is a fresh application. Second, there is a narrow incidental-activity carve-out: a licensed BNPL provider that runs its own in-house collections team, chasing only its own customers, does not need a separate debt-collection registration. The moment that team collects for a related company or a third party, it does.

3. The question that decides everything: is your customer a "credit consumer"?

Act 873 regulates consumer credit. If none of your borrowers is a credit consumer, you fall outside the licensing requirement entirely — but you do not fall outside the Act. Getting this boundary right is the single most valuable hour of analysis you will spend, so it is worth setting out the definition exactly as SKP does.

A credit consumer is:

• an individual who obtains, has obtained, or intends to obtain credit for personal, domestic or household purposes;
• a micro or small enterprise (as defined by SME Corporation Malaysia) that obtains credit up to RM300,000; and
• an individual acting as a social guarantor to a credit consumer.

This is not a hypothetical. It is the most common way a foreign-owned Malaysian subsidiary drifts into scope: the product ladder gets extended downwards to reach smaller buyers, and nobody re-runs the regulatory test. Two practical consequences for anyone structuring a Malaysian credit offering:

• Set a hard product floor, or get licensed. If your commercial plan needs facilities at or below RM300,000 for MSEs, or any consumer lending at all, treat the licence as a line item in the business case, not as a contingency.
• The test is per facility, not per customer. The size of the customer does not exempt you; the size of the credit does. Splitting a large facility into tranches to stay flexible can pull you into scope rather than out of it.

4. Leasing and factoring: the two traps for industrial and trading groups

BNPL is the activity everyone associates with the new Act, because it is the one the press covered. For our clients, the two that actually bite are leasing and factoring — because neither is marketed as finance.

Leasing. A Chinese machinery, vehicle or IT-hardware supplier establishing a Malaysian Sdn. Bhd. very often offers customers a lease or a rental-with-purchase-option structure rather than an outright sale. It is a sales tool. Under Schedule 4 it is a credit business, and if any lessee is an individual or an MSE taking RM300,000 or less, it is a licensable one. The same analysis applies to Islamic leasing (ijarah) structures — the Act covers conventional and Shariah-compliant credit business alike, and Islamic credit providers carry the additional obligation of end-to-end Shariah compliance, including a dedicated Shariah committee or a qualified Shariah adviser, plus complete segregation of funds for any "Islamic window" operation.

Factoring. Trading groups and supply-chain finance arms that buy receivables at a discount are carrying on factoring. Where the seller of those receivables is a micro or small enterprise and the facility is RM300,000 or less, the credit consumer definition is met. Many Chinese supply-chain finance platforms entering Southeast Asia through Malaysia are built precisely to serve small suppliers — which is to say, built precisely inside the licensed perimeter.

Neither activity requires a Bank Negara Malaysia approval, and that is exactly why they get missed: a compliance review that starts and ends at BNM's website returns a clean result. If your business also moves, stores or exchanges money — remittance, an e-wallet balance, merchant acquiring — that is a separate and additional regime, and we have mapped it in the guide to BNM payment licences, MSB, e-money and merchant acquiring. If instead you are operating a P2P financing or crowdlending platform, you are on the Securities Commission's side of the boundary; see the guide to the Capital Markets Services Licence and Recognized Market Operator framework.

5. Who is out of scope — and the annual declaration you still owe

Schedule 5 of Act 873 lists the persons to whom the licensing and registration requirements do not apply. It is a short list, and it is institutional rather than activity-based:

• licensed banks and licensed insurers under the Financial Services Act 2013;
• licensed Islamic banks and licensed takaful operators under the Islamic Financial Services Act 2013;
• prescribed institutions under the Development Financial Institutions Act 2002;
• approved issuers of credit cards and charge cards (and their Islamic equivalents) under the FSA/IFSA;
• licensees under the Money Services Business Act 2011 (Act 731); and
• co-operative societies registered under the Co-operative Societies Act 1993.

Everyone else who carries on one of the six activities is either authorised or in breach — with one further category that catches almost every foreign-owned group and is almost universally missed.

All submissions — applications, declarations, notifications of material change, periodic data — run through the CORE System (Consumer Credit Commission Online Regulatory System), SKP's centralised digital platform.

6. The money: minimum financial requirements and the full fee ladder

The Authorisation Standards set a financial threshold that must be met at all times, not merely at application. It is expressed as shareholders' funds or total equity, which is a stricter test than paid-up capital: accumulated losses erode it.

Where an entity holds more than one authorisation, the higher threshold applies to the whole entity. And SKP does not stop at the balance sheet: in evaluating financial adequacy it will consider the capacity of the applicant's controllers and other shareholders to continuously provide financial support. For a thinly capitalised Malaysian subsidiary of a Chinese parent, that means the parent's own financials become part of the assessment.

Fees are prescribed by the Consumer Credit (Fees) Regulations 2026 and are non-refundable:

Three details in the fee mechanics are worth knowing before you plan the timing of an application:

• Approval date halves the first fee. Applications approved between 1 January and 30 June pay the full inaugural fee; those approved between 1 July and 31 December pay 50%.
• Miss the 30 days and the approval lapses. If the inaugural fee is not paid within 30 days of approval, SKP's authorisation approval simply falls away and you start again.
• The annual fee is due by the last day of February each year, banded on revenue reported in the most recent audited financial statements — with a revenue breakdown attributable specifically to the credit business. Late payment attracts RM500 per calendar month, irrespective of how many days late. Separately, a licensed credit provider must appoint an auditor annually, at its own expense, to audit its credit business.

7. Entity, key persons and the 33% rule that binds a foreign parent

Three organisational requirements matter disproportionately to foreign investors.

The applicant must be a company incorporated in Malaysia under the Companies Act 2016. A foreign company registered as a branch under section 561 cannot hold an SKP authorisation. If your Malaysian presence today is a branch or a representative office, incorporating a Sdn. Bhd. is step one, and it sits on the critical path — see our step-by-step guide to incorporating a Sdn. Bhd. in Malaysia for the resident-director and licensed-secretary requirements that govern it.

Key persons must be fit and proper. "Key persons" means controllers (corporate and individual), directors and senior management, including the person responsible for compliance. Each individual key person must complete a fit-and-proper declaration within 30 calendar days before the application date. SKP conducts financial, professional and criminal background checks, and may contact key persons directly. The Appendix to the Authorisation Standards sets out the minimum criteria: no unsatisfied judgment debt, no compromise or scheme of arrangement with creditors, no disqualification from directorship, and SKP's satisfaction as to educational qualification or experience.

The practical implication for a China-headquartered group is direct: your holding structure is a regulatory matter, not merely a corporate one. A parent taking 100% of a Malaysian BNPL or leasing company is a controller by definition and needs approval before the acquisition, not after. So does a subsequent internal reorganisation that moves the shares between group entities. Build the approval into the transaction timetable, alongside the equity and paid-up capital analysis set out in our guide to foreign equity and paid-up capital rules in Malaysia.

8. Moneylending is a different licence — and it is still KPKT's

A frequent and expensive confusion: lending money is not one of the six Phase 1 activities. Conventional moneylending remains licensed by the Ministry of Housing and Local Government (KPKT) under the Moneylenders Act 1951 (Act 400) and the Moneylenders (Control and Licensing) Regulations 2003. The Authorisation Standards themselves acknowledge this parallel regime, and Act 873 expressly contemplates a "licensed credit provider regulated by the Ministry of Housing and Local Government" — meaning KPKT sits inside the Act's architecture as a regulatory and supervisory authority while retaining its own licensing.

The Act 400 regime has its own hard edges, and they are unforgiving:

• Interest is capped by law: not more than 12% per annum on a secured loan and not more than 18% per annum on an unsecured loan.
• Every moneylending agreement must be attested under section 27 of Act 400, before an advocate and solicitor of the High Court, an officer of the Judicial and Legal Service, a Commissioner for Oaths, a Justice of the Peace, a District Officer, or a person appointed by the Minister. An agreement not properly attested may be void, invalid and unenforceable.
• Prescribed forms are mandatory — Schedule J for unsecured loans, Schedule K for secured loans — and the borrower is entitled to a free copy of the agreement.
• Licensing practice requires substantial paid-up capital (RM2 million is the figure applied to corporate applicants), with the licence itself issued for two-year terms.

Under section 48(3), becoming a substantial shareholder — the Companies Act 2016 section 136 definition — of a KPKT-licensed credit provider requires the Registrar's prior written approval. That is a lower trigger than the 33% controller test applied to SKP licensees, so a foreign investor buying into a Malaysian moneylending business faces the tighter constraint of the two.

The direction of travel is clear. The Consumer Credit Act was designed to be implemented in phases, and moneylenders, pawnbrokers and non-bank hire purchase are slated to move from KPKT and the Ministry of Domestic Trade (KPDN) to SKP in a later phase. That transfer has not happened. Until it does, apply to the regulator that holds the licence today — and structure on the assumption that supervision will tighten, not loosen, when it does.

9. What non-compliance actually costs

Section 40(1) is the operative prohibition: no person shall carry on a credit business set out in Schedule 4, or hold himself out as carrying on such business, unless licensed. The "holding out" limb matters — advertising an instalment plan you are not licensed to offer is itself within the prohibition. Section 40(2) sets the penalty at a fine not exceeding RM5 million or imprisonment not exceeding five years, or both. The parallel provision for unregistered credit service business sits in section 57.

Beyond the criminal exposure, three consequences tend to be more immediately damaging to a foreign-owned group:

• Banking. Malaysian banks apply enhanced due diligence to foreign-controlled companies as a matter of course. An unlicensed regulated activity discovered during onboarding or periodic review is an account-closure event, not a query.
• Enforceability. Credit agreements written outside a required licensing regime carry real enforceability risk — the Act 400 attestation rule is the clearest illustration of how a Malaysian court treats formality defects in credit documents.
• The public register. Once the inaugural fee is paid, SKP publishes the entity's details and authorisation status on its website. Absence from that list is visible to your customers, your merchant partners and your competitors.

Schedule 6 of the Act separately lists prohibited business conduct — misleading or deceptive conduct as to the nature, features, terms or price of a credit product, and inducing a consumer through false, misleading or recklessly made statements, illustrations, promises, forecasts or comparisons. These bind conduct regardless of how confident you are about the licensing analysis.

10. What to do before the window closes

A disciplined sequence, in the order the work actually has to happen:

• Run the scope test on your real product terms. List every arrangement under which a Malaysian customer receives goods, services or money now and pays later. For each, record the counterparty type and the facility size against the RM300,000 MSE line.
• Decide licence, registration, or declaration. Those are the three outcomes. There is no fourth outcome in which you do nothing.
• Fix the entity. Confirm you hold a Malaysian-incorporated Sdn. Bhd., that shareholders' funds meet the applicable threshold, and that you can evidence it.
• Clear the key persons early. Fit-and-proper declarations must be signed within 30 calendar days before the application, and background checks on overseas directors are the step most likely to add weeks.
• Get controller approval on the transaction timetable. Any holding of 33% or more needs prior written approval — before the shares move.
• Budget the recurring cost. Annual fee by the last day of February, annual audit of the credit business, ongoing data submissions and notification of material changes.

ONEKEY BIZ works with foreign-owned Malaysian companies on exactly this class of problem — establishing whether an activity is regulated, structuring the entity and shareholding so the answer is workable, and assembling the application. If you are running BNPL, leasing, factoring or collections in Malaysia and have not tested your position under Act 873, that assessment is worth doing now rather than in December. Talk to us through our regulatory and licensing advisory service, or contact our team directly on WhatsApp at +60 12-321 1349.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.