Selling to the Malaysian Government in 2026: The Procurement Act Is Gazetted but Not in Force — MOF Registration, Bumiputera Status, SPKK, and the Novation Offence That Ends the Fronting Model

Malaysia's government spends tens of billions of ringgit a year buying goods, services and construction works, and for most of the country's history it did so without a single dedicated statute. That changed on 26 May 2026, when the Government Procurement Act 2025 was gazetted — Malaysia's first standalone public procurement law. What did not change on that date is anything about how the government actually buys. Under section 1(2) the Act comes into operation on a date appointed by the Finance Minister by notification in the Gazette, and Second Finance Minister Datuk Seri Amir Hamzah Azizan told the Dewan Rakyat that enforcement is expected in 2027. So Malaysia now has a procurement law that exists and does not yet operate. For a foreign-owned company weighing whether the public sector is a market it can realistically enter, that gap is the most useful thing on the calendar: the rules of the next decade are already published, and the registrations that gate entry take months to build.

What was actually passed, and where it stands today

The Government Procurement Bill 2025 passed the Dewan Rakyat on 28 August 2025 and the Dewan Negara in September 2025. It received royal assent and was gazetted on 26 May 2026. In May 2026 the Federation of Malaysian Manufacturers publicly pressed for gazettement without further delay — an indication of how much of the business community treats this Act as overdue rather than unwelcome.

The Act creates, for the first time in statute, a framework of transparency, competition and accountability across federal and state procuring entities. Until it commences, procurement continues to run on the pre-existing patchwork: the Financial Procedure Act 1957, the Government Contracts Act 1949, and — carrying most of the operational weight — Treasury Instructions and Treasury Circulars issued by the Ministry of Finance, executed through the ePerolehan platform.

The regime you are actually selling into today

Under the current Treasury-circular regime, the procurement method is determined by contract value. The tiers below are the ones a supplier meets in practice, and they explain why the RM500,000 line is the single most important number in Malaysian public procurement — it is the point at which a purchase must be openly advertised rather than invited.

MOF registration: the gate, and what it costs

Registration with the Ministry of Finance, administered through ePerolehan, is the certificate that makes a company eligible to supply the federal government, state governments, statutory bodies, local authorities and many government-linked entities. Without it, a company is not merely uncompetitive — for quotation-level procurement it is not on the list at all.

The fee is trivial. The prerequisites are not. Field codes must be consistent with what the company is actually registered and licensed to do, which means sector regulators sit upstream of MOF: construction requires CIDB registration; pharmaceutical and medical device supply requires NPRA product registration; ICT supply is subject to public-sector technical and cybersecurity standards. A company that applies for codes it cannot substantiate does not get a faster route in — it gets a rejection and a delay.

Where foreign ownership actually bites

Two separate constraints are frequently conflated, and the difference matters.

The first is field-code restriction. Not every category is open to a foreign-owned entity. Categories such as consulting, IT services and certain medical product supply are generally available; logistics, construction and public infrastructure categories commonly require Malaysian or Bumiputera equity, in several cases at 51% or more. The restrictions vary code by code and are not published in plain, consolidated terms — which is precisely why the field-code selection should be settled before the equity structure is finalised, not after.

The second is Bumiputera status, a separate certificate on top of MOF registration. For 51% Bumiputera status the requirement runs well beyond the shareholder register: at least 51% Bumiputera equity, plus Bumiputera directors, management and staff, with the largest individual shareholder and the highest-paid employee also Bumiputera. For 100% status, all of it. Approval involves declaration, verification, bank certification and a site visit. This is not a certificate a foreign-controlled group obtains; it is one it either partners with or forgoes.

Construction works are a separate universe: CIDB and SPKK

Anyone carrying out construction work in Malaysia must be registered with CIDB under Act 520. But CIDB registration alone does not let you tender for a government project. That requires the Sijil Perolehan Kerja Kerajaan (SPKK) — the Government Works Procurement Certificate — issued by CIDB and referenced to Treasury circular requirements. Without SPKK, a contractor is confined to private-sector work.

Foreign contractors sit outside the G1–G7 ladder entirely: under Act 520 they are registered on a project-by-project basis rather than given a standing grade, which is covered in our guide to CIDB registration for foreign contractors. The ISO 37001 condition for G7 from 1 January 2027 links directly to the anti-bribery regime discussed in our note on section 17A corporate liability — and it is a good preview of where procurement compliance is heading generally.

What the Government Procurement Act 2025 will change

When commencement arrives, five changes matter most to a supplier.

Open and competitive procurement becomes the statutory default. The Act defines it as procurement in which all registered persons may participate; departures require prescribed alternative methods rather than administrative discretion.

Approval authority is tiered by value in statute, replacing circular-level practice:

Supplier registration becomes statutory, administered by a Registrar, with express grounds for refusal and debarment: corruption-related convictions including foreign ones, Competition Act 2010 infringements, insolvency, and registration under the Registration of Criminals and Undesirable Persons Act 1969.

Conflict of interest becomes a disclosure obligation with teeth. Any person involved in procurement administration with a direct or indirect interest must disclose it, including beneficial ownership, with family members and associates defined broadly.

A real remedies channel appears. Complaints go to an internal Review Panel, and from there to an independent Procurement Appeal Tribunal: appeal within 14 days of the panel's decision, application to suspend within 7 days of the notice of appeal, with binding corrective orders. Today there is no statutory remedy at all — an aggrieved bidder's options are judicial review or a civil claim.

The offence foreign groups should read twice

The Act makes unauthorised transfer, assignment or novation of an awarded contract an offence, punishable by a fine of not less than three times the value of the grant or contract, or RM1 million, whichever is higher, imprisonment of up to five years, or both.

Read that against the most common way foreign companies have historically approached Malaysian public work: find a registered local entity with the right status, let it win, then perform the contract behind it and take the margin. Under the current regime that arrangement is a policy problem and a contractual breach. Once the Act commences, it is a criminal offence with a penalty floor measured in multiples of the contract value — not the profit, and not the fee paid to the front. On a RM6 million contract, the floor is RM18 million.

This is the point at which the entry strategy has to be decided honestly rather than improvised. Malaysia is not a party to the WTO Government Procurement Agreement — it holds observer status only — so there is no non-discrimination obligation owed to foreign suppliers, domestic preference is lawful, and foreign participation is permitted only where a tender is opened internationally, with obligations arising solely from the tender documents. Public procurement here is openly an instrument of policy: Bumiputera participation, technology transfer to local industry, reducing foreign-exchange outflow, and creating openings for local service firms.

Four entry routes that survive scrutiny

1. Supply or subcontract to the prime. The most under-used route. You sell to the contractor or system integrator that holds the registration and the risk, on ordinary commercial terms. No status certificate required, no fronting, and the receivable is against a private counterparty rather than a government payment cycle.

2. A genuine joint venture. Real equity, real board seats, real capital at risk, documented in a constitution rather than a side letter. This is the only route that reaches Bumiputera-status categories, and the price of admission is accepting that you are a minority in that vehicle.

3. Open categories, entered directly. Consulting, IT and several specialised supply categories accept foreign-owned entities. Register the codes you can substantiate, start at quotation level, and build a delivery record that supports open tenders later.

4. The adjacent market. GLCs, GLICs, universities, hospitals and state-owned utilities buy at scale, and several use ePerolehan or mirror its registration requirements while applying commercial rather than statutory procurement rules. It is often the fastest place to build a Malaysian public-sector reference.

What to do in the window before commencement

The Act is gazetted and dormant, and enforcement is expected in 2027. That is roughly a year of preparation time, and the items on the list are all things that take time rather than money.

• Incorporate and settle the equity structure first, with the target field codes already identified — restructuring shareholding after registration is far more expensive than getting it right at incorporation.
• Build the substantiation a field code needs: sector licence, premises, staff, and the SSM nature-of-business entries that must match.
• Get MOF registration done early. It is valid for three years and cheap; the value is in the clock starting, not the certificate itself.
• Fix the compliance file the Act will make relevant: beneficial ownership records, a conflict-of-interest policy, anti-bribery procedures. Debarment grounds include foreign convictions.
• Build bid capacity: audited accounts, a bank that will issue performance bonds, and a delivery record — public or private.
• Retire any fronting arrangement now. A structure that is merely non-compliant today becomes a criminal exposure on commencement.

Public procurement in Malaysia is winnable for foreign-invested companies, but not on the terms most groups first imagine. It rewards a properly constituted local entity, honest categorisation, patience through a three-year registration cycle, and a willingness to enter through the supply chain rather than the front door. If you are assessing whether the public sector is a realistic channel for your Malaysian operation — or you need the entity, the licences and the registrations put in place before the Act commences — talk to us about CIDB and SPKK registration, or contact our team to map your field codes and equity structure before you file.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.