Malaysia Rules of Origin & Certificates of Origin 2026: The Complete Export-Compliance Guide for Foreign Manufacturers — MITI's ePCO System, the 40% RVC Test, the US-Bound NPCO Monopoly and Strategic Trade Permits

Most foreign manufacturers who move production to Malaysia are chasing one thing: a Malaysian origin on the customs declaration at the other end. It is the whole point of the relocation — a Malaysian-origin good enters ASEAN, China, Japan, India and Australia at preferential duty rates, and it carries a different tariff exposure into the United States than a Chinese-origin good does. But origin is not conferred by geography. It is not enough that the factory stands in Penang, that the workers are Malaysian, or that the company is registered with SSM. Origin is a legal test applied product by product, proven with a Certificate of Origin issued by MITI after a mandatory Cost Analysis — and since 6 May 2025, every non-preferential certificate for a US-bound shipment must come from MITI itself, no longer from a chamber of commerce. Get the test wrong and the consequence is not a fine on a form; it is a retroactive duty assessment, a blacklisting, and in the current enforcement climate an accusation of transshipment fraud. This guide sets out how origin is actually determined in Malaysia, how the certificates are obtained, what the Strategic Trade Act adds on top, and where foreign manufacturers most often get it wrong.

Two certificates, two entirely different purposes

Malaysia issues two families of origin document, and confusing them is the first and most common error. They serve different functions, follow different rules, and — critically — are issued by different bodies.

The practical reading is this. If the buyer is in Jakarta, Shanghai, Osaka or Sydney and wants to pay less duty, the exporter needs a PCO under the relevant agreement, and the product must actually satisfy that agreement's origin rule. If the buyer is in a market where no FTA applies, or simply wants documentary proof of where the goods were made, an NPCO is the instrument. The two are not interchangeable and a PCO cannot be used as a general-purpose origin statement.

The Cost Analysis: the gate before the gate

Exporters routinely assume the Certificate of Origin is the process. It is not. It is the output. The real work is the Cost Analysis (CA), a product-level submission in which the manufacturer discloses the bill of materials, the origin and value of every input, the direct labour and overhead, and the ex-works or FOB price. MITI uses it to determine, for that specific product, whether the origin rule is met.

The sequence and the official service standards are as follows:

• Cost Analysis approval: 5 working days under the preferential route.
• PCO issuance: 24 working hours after the CA is approved.
• An approved CA is generally valid for around two years for exporters under the Certified Exporter scheme, after which it must be refreshed.

Three consequences follow that manufacturers consistently underestimate. First, the CA is per product, not per company — a factory with forty SKUs may need forty cost analyses. Second, the CA must be redone when the sourcing changes: switching a component supplier from a Malaysian vendor to a Chinese one can quietly push a product below the value-content threshold, and continuing to issue certificates on the old CA is a false declaration. Third, the CA exposes the cost structure to a government agency, which means the numbers must be defensible and consistent with the company's accounting records, its customs declarations and its transfer pricing position.

How origin is actually determined: RVC, CTC and de minimis

Almost every FTA rule of origin is built from the same three components, and understanding them removes most of the confusion:

• Wholly Obtained (WO) — the good is entirely produced in the country: minerals extracted there, crops grown there, fish caught in its waters. Straightforward, and largely irrelevant to manufacturers.
• Regional Value Content (RVC) — a percentage of the good's value must originate in the FTA region. The common threshold is 40%.
• Change in Tariff Classification (CTC) — the imported inputs must be classified under a different HS heading from the finished good, evidencing genuine transformation. CTH means a change at the 4-digit heading level; CTSH at the 6-digit subheading level.

Layered on top is de minimis (also called tolerance): a small proportion of non-originating material may fail the CTC test and the good still qualifies. This is the rule that rescues borderline products — and its precise formulation varies more than most exporters realise.

Four traps are worth naming explicitly, because each has cost real exporters real money:

• ATIGA gives textiles no tolerance at all. A garment that misses the CTC rule by a single non-originating fabric does not qualify, full stop.
• CPTPP measures de minimis against the value of the good, not FOB. Applying the ASEAN habit of "10% of FOB" produces the wrong answer.
• AANZFTA's familiar default rule was deleted in April 2025. Guidance written before that date is now wrong, and a product that qualified under the old RVC40/CTH default may not have a qualifying product-specific rule.
• MJEPA has no general de minimis. There is no safety net; the product-specific rule is the whole test.

Note too the direction of travel on self-certification. CPTPP already allows the exporter, producer or even the importer to self-certify. ATIGA permits it through the ASEAN-Wide Self-Certification scheme for Certified Exporters. RCEP phases it in over roughly a decade for Malaysia. Self-certification removes the queue at the issuing authority — but it transfers the entire risk of an incorrect origin determination onto the company, enforced by post-clearance audit in the importing country. It is a benefit only for exporters whose cost analyses are genuinely robust.

6 May 2025: the US route changed completely

The most consequential recent development for foreign manufacturers in Malaysia is procedural rather than legal. On 5 May 2025 MITI announced that, with effect from 6 May 2025, it would become the sole issuer of non-preferential Certificates of Origin for exports to the United States. The chambers of commerce — MICCI, FMM, DPMM, MAICCI, ACCCIM and others, some of which had been authorised since January 1982 — ceased issuing NPCOs for that destination immediately.

The stated reason was direct: to tighten control over illegal transshipment — the practice of routing third-country goods through Malaysia and papering them as Malaysian-origin to escape tariffs applied to their true origin. MITI described false origin declaration as a serious offence and announced enhanced audits of CO applications, joint investigation with the Royal Malaysian Customs Department, cooperation with US authorities, and blacklisting of offending companies for one year, with the blacklist circulated to all authorised chambers.

Two points deserve attention. First, the timeline is materially longer than the preferential route: 14 working days plus 3, against 5 plus 1. A company shipping to the US on a tight production schedule must build roughly a month of documentary lead time into its first shipment. Second, the 25% local content criterion has been reported as under review, with an increase toward 40% discussed publicly but not, as at the date of writing, confirmed in a published MITI instrument. Manufacturers whose US-bound products sit between 25% and 40% local content should treat that gap as a live planning risk rather than a settled position.

The Strategic Trade Act 2010: a second permit regime

Rules of origin decide the duty rate. The Strategic Trade Act 2010 (STA 2010) decides whether the export is permitted at all, and it operates independently. It controls the export, transhipment, transit and brokering of strategic items — goods, software and technology with potential military or weapons-of-mass-destruction application, listed in the Strategic Items List.

The provision that has caught the widest set of companies is the Section 12 catch-all. It requires notification to the authorities at least 30 days before exporting, transhipping or transiting an item that is not on the Strategic Items List, where the exporter knows or has reasonable grounds to suspect it may be used for a restricted activity or by a restricted end-user. Catch-all obligations do not depend on a list — they depend on knowledge, which makes end-user due diligence a compliance duty rather than a commercial nicety.

That mechanism was used visibly on 14 July 2025, when MITI announced with immediate effect that the export, transhipment and transit of high-performance US-origin AI chips requires a Strategic Trade Permit, pending consideration of whether to add them to the Strategic Items List. For electronics distributors, data-centre suppliers and semiconductor traders operating out of Malaysia, that single announcement converted a routine re-export into a permitted activity overnight.

Administratively, STA permits are handled through the ePermit platform operated by DagangNet, with brokers requiring a separate certificate valid one year. Email submission of applications was discontinued from 1 January 2026. Penalties under the Act are severe, extending to substantial fines and imprisonment; exporters should take advice on the specific provisions rather than rely on summaries.

Export licensing and the customs layer

Beneath the origin and strategic-trade regimes sits ordinary export control. The operative instrument is the Customs (Prohibition of Exports) Order 2023, P.U.(A) 122/2023, which schedules goods that are absolutely prohibited from export and goods that may be exported only under licence or permit.

The division of responsibility is worth stating plainly, because companies routinely address the wrong agency:

• RMCD (Kastam) enforces at the border. The export declaration (K2) is lodged through uCustoms, the single-window platform that replaced the legacy system from 2019.
• MITI and other Permit Issuing Agencies issue the underlying Approved Permits, submitted through ePermit.

Neither substitutes for the other. A shipment with a valid permit but a defective declaration is held at the port; a clean declaration covering goods that required a permit nobody applied for is a customs offence. And both systems have operational risk: the ASEAN Single Window gateway suffered an outage affecting preferential CO applications from 1 April 2026, restored on 6 April 2026, and the portals close for public holidays. Export documentation should never be left to the last working day before a vessel cut-off.

The 40% that is not the other 40%

This is the misconception that costs foreign manufacturers the most time, and it is worth isolating.

Under the Industrial Coordination Act 1975 (ICA), a manufacturing licence is required — applied for through MIDA — where the company's shareholders' funds reach RM2.5 million or it employs 75 or more full-time paid employees. Below both thresholds a company may apply for an Exemption Letter. Among the approval criteria for a manufacturing licence are Capital Investment Per Employee of at least RM140,000, a workforce at least 80% Malaysian, and either at least 25% managerial, technical and supervisory staff or value added of at least 40%.

Foreign manufacturers planning a Malaysian operation should therefore run three parallel workstreams from the outset: the manufacturing licence and MIDA approvals, the product-level cost analyses that will determine FTA eligibility, and the strategic-trade screening of the product range and customer list. Companies that also import inputs under duty exemption should read our guide to LMW and AEO customs licensing, which interacts directly with the origin calculation.

A volatile tariff backdrop — and why it argues for stricter compliance

The commercial reason origin has become urgent is the tariff environment, which has moved repeatedly and remains unsettled. The verifiable chronology, which should be read as history rather than as a current rate card:

• 2 April 2025 — the United States announced reciprocal tariffs, with Malaysia initially set at 24%.
• 6 May 2025 — MITI became sole issuer of US-bound non-preferential COs.
• 14 July 2025 — Strategic Trade Permit imposed on high-performance US-origin AI chips.
• 26 October 2025 — a US–Malaysia Agreement on Reciprocal Trade was signed, under which the US committed to a 19% rate for Malaysia.
• 20 February 2026 — the US Supreme Court held that the emergency statute relied on did not authorise those tariffs, removing the legal basis for the rate.
• 16 March 2026 — Malaysia's Minister of Investment, Trade and Industry stated publicly that the agreement was no longer operative; the following day he clarified that no formal notification had been received from the US side and that engagement continued.

That last point is the strategic one. Tariff volatility increases the temptation to manipulate origin, which is precisely why enforcement has tightened. A manufacturer with clean cost analyses, traceable bills of materials and genuine substantial transformation is well positioned regardless of where rates settle. A manufacturer relying on light assembly and an accommodating certificate is exposed in every scenario — and increasingly to two customs administrations at once.

Where foreign manufacturers actually get caught

• Screwdriver assembly. Importing a near-complete product, adding packaging or a final fastening step in Malaysia, and claiming Malaysian origin. This fails both the CTC and RVC tests in almost every agreement and is the paradigm case of transshipment fraud.
• The stale Cost Analysis. Sourcing changed eighteen months ago; certificates are still being issued on the original CA. Every certificate since the change is a potentially false declaration.
• The wrong certificate. A PCO obtained under one FTA is presented to a buyer in a country covered by a different agreement, or an NPCO is used to claim preference. Both are refused, and both cause demurrage.
• Textile tolerance assumed. A garment exporter applies the 10% de minimis habit under ATIGA, where textiles have none.
• Catch-all ignored. A distributor re-exports controlled-adjacent electronics to a customer it has never diligenced, with no Section 12 notification and no end-user check.
• Documentary lead time underestimated. A first US shipment is booked assuming a chamber can issue an NPCO in a day, as it could before May 2025. The correct assumption is roughly a month.
• Origin treated as paperwork. The CO is delegated to a shipping clerk rather than owned by procurement and finance — the two functions that actually control whether the test is met.

Getting the sequence right

Origin compliance rewards companies that treat it as a design constraint and punishes those that treat it as documentation. The workable order is: identify the target markets and the FTA that will be claimed before finalising the bill of materials; run a cost analysis on the intended sourcing and confirm the specific product-specific rule for the HS code, not the general rule; adjust procurement if the product falls short, while adjustment is still cheap; register on ePCO and obtain CA approval; screen the product range and customer list against the Strategic Items List and the Section 12 catch-all; and only then quote preferential prices to buyers. Behind that, calendar the CA refresh, re-run the analysis whenever a supplier changes, and keep the bills of materials audit-ready — because a post-clearance audit in the importing country arrives years after the shipment, when the people who prepared the file have moved on.

ONEKEY BIZ works with foreign manufacturers on the whole entry sequence — company incorporation, the MIDA manufacturing licence and incentive applications, customs and duty-exemption facilities, and the origin and permit compliance that determines whether the Malaysian operation actually delivers the tariff outcome it was built for. If you are moving or expanding production into Malaysia, talk to our team before the sourcing is locked — origin is far cheaper to design in than to litigate afterwards.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.