There is a sentence that gets said in almost every meeting with a newly arrived foreign-owned company in Malaysia, usually about a stuck licence or a slow customs clearance: "we found someone who can handle it." Since 1 June 2020, that sentence has carried a specific and severe legal consequence. Section 17A of the Malaysian Anti-Corruption Commission Act 2009 makes a commercial organisation criminally liable when a person associated with it — an employee, a director, an agent, a consultant, a runner, a freight forwarder acting on its behalf — gives a bribe intended to benefit the organisation. The company is liable whether or not management knew. Under section 17A(3), the directors and senior managers are deemed to have committed the same offence personally, and must prove their own innocence. The penalty is a fine of not less than ten times the value of the gratification or RM1 million, whichever is higher, imprisonment of up to 20 years, or both. There is exactly one defence — that the organisation had adequate procedures in place — and it is only available to a company that built them before anything happened.
What section 17A actually changed
Before June 2020, Malaysian corruption law prosecuted individuals. A company whose agent paid a bribe was, in practice, a bystander to its own scandal. Section 17A — inserted by the MACC (Amendment) Act 2018 and brought into force on 1 June 2020 — reversed that in three ways at once.
It created corporate criminal liability. The organisation itself is charged, not merely the person who handed over the money.
It removed the knowledge requirement. The offence does not require senior management to have known, approved, or been wilfully blind. It requires only that a person associated with the organisation gave, or agreed to give, gratification with intent to obtain or retain business or an advantage for the organisation.
It reversed the burden of proof. This is the part that most surprises foreign directors, who often assume that "innocent until proven guilty" carries the same weight here as at home. Under section 17A(4), once the organisation is found liable, every director, controller, officer, partner and person concerned in its management at the time is deemed to have committed the offence — unless that person proves the offence was committed without their consent or connivance and that they exercised due diligence to prevent it, having regard to the nature of their function and the circumstances. The company must likewise prove its adequate procedures. The prosecution does not have to disprove them.
| Element | Position under section 17A |
|---|---|
| In force since | 1 June 2020 |
| Who can be charged | The commercial organisation itself, plus deemed liability for directors, controllers, officers, partners and management |
| Mental element required of the company | None — liability does not depend on management's knowledge or approval |
| Who triggers it | Any "person associated" — director, partner, employee, or any person performing services for or on behalf of the organisation |
| Purpose element | Gratification given to obtain or retain business or an advantage for the organisation |
| Penalty | Fine of not less than 10× the gratification or RM1 million, whichever is higher; and/or imprisonment up to 20 years |
| Only defence | Adequate procedures — proved by the organisation, on the balance of probabilities |
| Directors' escape route | Prove no consent or connivance and that due diligence was exercised |
"Commercial organisation" is broader than foreign directors expect
The definition captures a company incorporated in Malaysia and carrying on business here or elsewhere, a partnership formed in Malaysia, and — critically for inbound investors — a company or partnership formed outside Malaysia that carries on business or part of a business in Malaysia.
Three practical consequences follow:
- A newly incorporated Sdn Bhd with three staff is a commercial organisation. There is no small-company exemption, no turnover threshold, and no grace period after incorporation.
- A Chinese, Singaporean or Hong Kong parent that carries on part of its business in Malaysia — through a project office, a representative arrangement, or personnel operating here — can itself fall within scope.
- The offence bites at the point the gratification is given, not at the point a licence is granted. A refused application does not cure it.
The "associated person" problem: this is where foreign companies actually get caught
A person is associated with the organisation if they are a director, partner or employee, or if they perform services for or on behalf of the organisation. That second limb is where the real exposure sits, because it captures exactly the intermediaries a newly arrived company relies on most.
| Function | Typical intermediary | What creates the exposure |
|---|---|---|
| Licensing and permits | "Runners", licence agents, well-connected fixers | An unexplained "expediting fee"; a fee far above market with no deliverable described |
| Import and clearance | Freight forwarders, customs brokers | Payments to release a container faster or to smooth a classification dispute |
| Construction and utilities | Main contractors, site agents, connection facilitators | Payments for inspection sign-off, connection priority, or approval of a variation |
| Government sales and tenders | Local partners, distributors, "consultants" on success fees | Success fees with no scope of work; commissions paid to a party with no capacity to perform |
| Hospitality | Sales and BD staff | Gifts, travel, entertainment for officials or for a customer's decision-maker |
| Recruitment and immigration | Agents, labour suppliers | Payments to secure quota, approvals or endorsements outside the published process |
The only defence: adequate procedures, and the T.R.U.S.T. principles
Section 17A(4) gives a commercial organisation one way out: proving it had in place procedures designed to prevent associated persons from undertaking such conduct. The Prime Minister's Department issued the Guidelines on Adequate Procedures in December 2018, structured around five principles under the acronym T.R.U.S.T.
| Principle | What it means | Minimum evidence for a 10–50 person subsidiary |
|---|---|---|
| T — Top level commitment | The board and senior management own the anti-bribery position and are seen to | Board-adopted anti-bribery policy; a signed statement from the managing director; a standing board agenda item |
| R — Risk assessment | A documented, periodic assessment of where bribery risk actually arises in this business | A written risk register covering licensing, customs, government sales, hospitality and recruitment; reviewed at least every three years and on material change |
| U — Undertake control measures | Proportionate controls that respond to the identified risks | Third-party due diligence before appointment; anti-bribery clauses in every agent and contractor agreement; gift, entertainment and donation limits with pre-approval; a whistleblowing channel; dual authorisation on payments |
| S — Systematic review, monitoring and enforcement | The controls are tested and enforced, not merely written | Periodic review; audit of third-party payments; documented disciplinary action when a breach occurs |
| T — Training and communication | Everyone who could create exposure has been trained, and the policy is communicated externally | Induction plus periodic refresher training with attendance records; policy issued to agents, suppliers and contractors |
The word that decides cases is adequate, not existent. A policy PDF translated from the parent company's global manual, never localised, never trained, never applied to the Malaysian agent network, is not a defence — it is evidence that the risk was recognised and not managed. What makes procedures adequate is proportionality to the actual risk profile, and a documentary trail showing they operated.
Enforcement is real, and the first cases set the pattern
The first charge under section 17A came in March 2021, against Pristine Offshore Sdn Bhd, a ship-chartering company, in connection with alleged bribery to secure a sub-contract in the oil and gas sector — establishing early that the provision was not symbolic. In April 2025, a company director was charged at the Sessions Court over an alleged offer of RM500,000 a year for fifteen years as an inducement to a minister to expedite a concession takeover, with the company, Hydroshoppe Sdn Bhd, charged under section 17A(1)(a) alongside him.
The pattern in the reported cases is consistent and instructive: the corporate charge follows the individual charge, and the company's exposure derives from conduct undertaken by a person acting in its interest. Neither case involved a company that had built a defence in advance.
ISO 37001 — and why 1 January 2027 matters if you build anything
MS ISO 37001 Anti-Bribery Management Systems (ABMS) is the certifiable standard that maps most directly onto the adequate procedures defence. Certification is not a statutory safe harbour — no certificate guarantees acquittal — but a functioning, audited ABMS is the strongest available evidence that the five principles were implemented and operating.
For one industry it has stopped being optional. CIDB has mandated that Grade G7 contractors obtain ISO 37001 certification as a condition of new SPKK applications and SPKK renewals from 1 January 2027. SPKK is the certificate required to tender for government works, so for a G7 contractor the standard is now a condition of market access rather than a governance nicety. Foreign-linked contractors working toward G7 should treat certification as part of the upgrade timeline, not as a later add-on — the implementation and audit cycle alone typically runs six to twelve months. Our CIDB G7 registration guide sets out the surrounding requirements.
What is coming: the Deferred Prosecution Agreement framework
Malaysia is moving to introduce a Deferred Prosecution Agreement (DPA) mechanism through amendments to the MACC Act 2009. In October 2025 the Special Cabinet Committee on National Governance agreed to establish the legal framework, with the MACC and the Attorney General's Chambers drafting the provisions; as of January 2026 the MACC had publicly pressed for the bill to be expedited, with tabling anticipated in a 2026 parliamentary session. The stated intent is to confine DPAs to grand corruption cases, prioritising asset recovery, shortening prosecutions and protecting innocent stakeholders — employees, creditors and minority shareholders who would otherwise be destroyed by the collapse of a charged company.
The strategic point for foreign-owned companies is not the mechanism itself but what it rewards. DPA regimes elsewhere consistently price two things into the outcome: self-reporting and the quality of the compliance programme already in place. A company that discovers a problem, investigates it, reports it and can show a genuine programme is in a materially different position from one that discovers the same problem through a raid. That asymmetry exists whether or not the bill passes on schedule — build the programme now, and it works under both regimes.
How this connects to the rest of your obligations
Section 17A does not sit alone. It sits alongside directors' duties under the Companies Act 2016, where the same individuals already carry personal exposure for the company's compliance failures — set out in our guide to director duties, liabilities and disqualification — and alongside the employer duties under the Occupational Safety and Health Act, where section 52 similarly reaches through the company to the individuals who run it, covered in our OSHA employer duties guide.
The common thread is that Malaysian regulation increasingly attaches personal liability to the people who direct the company, and increasingly accepts documented systems — not intentions — as the answer. If your Malaysian operation depends on intermediaries to obtain licences, clear goods or win public-sector work, this is the exposure to close first. And if the fastest route to a licence has been described to you as a relationship rather than a process, our companion guide on what the licence chain actually looks like shows what the legitimate path costs in time — which is usually less than the alternative costs in risk.
Where to start
The defence cannot be assembled after an investigation begins; by then the absence of it is the case against you. What it takes is a documented risk assessment, a localised policy the board has actually adopted, contractual and due diligence controls over every third party acting in your name, and training records proving people were told. For most Malaysian subsidiaries that is weeks of work, not months, and it is the cheapest insurance on the compliance list.
ONEKEY BIZ advises foreign-owned Malaysian companies on section 17A readiness — risk assessment, policy adoption, third-party due diligence and contract clauses, gift and hospitality controls, training, and ISO 37001 preparation where a G7 contractor upgrade or a government-facing business requires it. If you are already using agents to obtain licences or clear goods, start with a review of who is acting in your name and on what terms. Reach us through the contact page or WhatsApp +60 12-321 1349, or see our legal and compliance advisory service.
Frequently asked questions
Our Malaysian subsidiary has ten staff. Does section 17A really apply to us?
Yes. The definition of "commercial organisation" captures a company incorporated in Malaysia carrying on business here or elsewhere, a partnership formed in Malaysia, and — critically for inbound investors — a company or partnership formed outside Malaysia that carries on business or part of a business in Malaysia. There is no small-company exemption, no turnover threshold and no grace period after incorporation. A newly registered Sdn Bhd with three staff is a commercial organisation from day one, and a Chinese, Singaporean or Hong Kong parent operating part of its business here through a project office or personnel on the ground can itself fall within scope. Note also that the offence bites when the gratification is given, not when a licence is granted — a refused application does not cure it.
We only paid a small amount to speed up a routine approval. Is that really an offence?
Yes. Malaysian law has no facilitation-payment exception. Some jurisdictions tolerate small "grease payments" to speed up a routine act to which the payer is already entitled; Malaysia does not. A RM200 payment to move a file up a queue is a corruption offence. And because the section 17A penalty floor is ten times the value of the gratification or RM1 million, whichever is higher, the fine for a small bribe is still at least RM1 million — the size of the payment does not scale the penalty down. Imprisonment of up to 20 years is also available. This is the single most common misconception among newly arrived operators, and it usually surfaces through a licensing agent's invoice line that nobody asked about.
Is our parent company's global anti-bribery policy enough to be a defence?
Usually not. The statutory word is adequate, not existent. A policy PDF translated from the parent's global manual, never localised, never trained, never applied to the Malaysian agent network, is not a defence — it is evidence that the risk was recognised and not managed. What makes procedures adequate is proportionality to the actual risk profile plus a documentary trail showing they operated. The 2018 Guidelines on Adequate Procedures structure this as T.R.U.S.T.: Top level commitment (board-adopted policy, a signed statement from the managing director); Risk assessment (a written register covering licensing, customs, government sales, hospitality and recruitment, reviewed at least every three years); Undertake control measures (third-party due diligence, anti-bribery clauses in every agent and contractor agreement, gift and donation limits with pre-approval, a whistleblowing channel, dual payment authorisation); Systematic review, monitoring and enforcement (audit of third-party payments, documented discipline); and Training and communication (induction plus refreshers with attendance records, policy issued to agents and suppliers).
Does ISO 37001 certification protect us, and is it mandatory?
Certification is not a statutory safe harbour — no certificate guarantees acquittal. But MS ISO 37001 Anti-Bribery Management Systems maps most directly onto the adequate procedures defence, and a functioning, audited ABMS is the strongest available evidence that the five T.R.U.S.T. principles were implemented and operating. For one industry it has stopped being optional: CIDB has mandated that Grade G7 contractors obtain ISO 37001 certification as a condition of new SPKK applications and SPKK renewals from 1 January 2027. Since SPKK is the certificate required to tender for government works, for a G7 contractor the standard is now a condition of market access rather than a governance nicety. Implementation and the audit cycle typically run six to twelve months, so contractors working toward G7 should build it into the upgrade timeline rather than treat it as a later add-on.
What is the Deferred Prosecution Agreement framework, and does it change what we should do now?
Malaysia is moving to introduce a DPA mechanism through amendments to the MACC Act 2009. In October 2025 the Special Cabinet Committee on National Governance agreed to establish the legal framework, with the MACC and the Attorney General's Chambers drafting the provisions; as of January 2026 the MACC had publicly pressed for the bill to be expedited, with tabling anticipated in a 2026 parliamentary session. The stated intent is to confine DPAs to grand corruption cases, prioritising asset recovery, shortening prosecutions and protecting innocent stakeholders such as employees, creditors and minority shareholders. It does not change what you should do now — if anything it raises the stakes, because DPA regimes elsewhere consistently price two things into the outcome: self-reporting and the quality of the compliance programme already in place. A company that finds a problem, investigates, reports and can show a genuine programme is in a materially different position from one that learns of the same problem through a raid. Build the programme now and it works under either regime.
Sources & references
- Malaysian Anti-Corruption Commission (SPRM/MACC) — Section 17A Enforced 1 June 2020
- Prime Minister's Department — Guidelines on Adequate Procedures (T.R.U.S.T.)
- Attorney General's Chambers Malaysia — Federal Legislation Portal (MACC Act 2009)
- Construction Industry Development Board Malaysia (CIDB) — Contractor Registration and SPKK
- Department of Standards Malaysia — MS ISO 37001 Anti-Bribery Management Systems
This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.