Who Needs a Securities Commission Licence in Malaysia 2026? The CMSL and Recognized Market Operator Map for Crypto Exchanges, Fund Managers and Fintech Platforms — Including the RM15 Million Paid-Up Capital That Took Effect on 20 May 2026

Malaysia has two financial regulators, and foreign founders routinely walk into the wrong one. Bank Negara Malaysia licenses banks, insurers, payment systems and money services. Everything that touches securities, derivatives, funds and digital assets belongs to the Securities Commission Malaysia (SC) under the Capital Markets and Services Act 2007 [Act 671] — and the SC's perimeter is wider than most people assume. Running a crypto exchange, managing other people's money, advising on investments, operating a crowdfunding or P2P lending platform, even offering a "financial planning" service: all of them are licensable, and carrying one on without authorisation is an offence under section 58(1) carrying a fine of up to RM10 million or imprisonment of up to 10 years, or both. On 20 May 2026 the SC rewrote the rules for digital asset exchanges — the minimum paid-up capital went from RM5 million to RM15 million, with existing operators given until 20 May 2028 to comply. This guide maps both doors into the SC, the capital table behind each, what actually changed in May, and the three structural traps that catch foreign applicants.

Two doors: a licence, or a registration

The SC does not have one authorisation. It has two, and they are governed by different documents with different thresholds.

The first is the Capital Markets Services Licence (CMSL), required under section 58 of the CMSA by anyone carrying on a "regulated activity" as a business. The regulated activities are set out in Schedule 2 of the Act, and the licensing criteria in the SC's Licensing Handbook. Individuals who carry on the regulated activity on behalf of a CMSL holder need their own licence — a Capital Markets Services Representative's Licence (CMSRL).

The second is registration as a Recognized Market Operator (RMO), governed by the SC's Guidelines on Recognized Markets, currently in its fourteenth revision, SC-GL/6-2015(R14-2026). This is the door for platforms: equity crowdfunding, peer-to-peer financing, digital asset exchanges, property crowdfunding and e-services. Registration is not a lighter version of a licence — as the numbers below show, several RMO categories demand more capital than most CMSL categories do.

Which regulated activity are you actually carrying on?

This is the question that decides everything else, and it is answered by conduct rather than by what the business calls itself. A company that pools client money and trades it is carrying on fund management whether it markets itself as a "family office", a "trading academy with a managed account option" or an "AI signal service with discretionary execution". The SC has repeatedly prosecuted under section 58(1) on exactly these facts, and in July 2026 a former company director was jailed for five years for unlicensed fund management activities together with money laundering.

The CMSL capital table

Table 1 of the SC's Licensing Handbook sets the minimum financial requirements by regulated activity. Where an applicant seeks more than one activity, the highest requirement applies — and it must be maintained throughout the licence term, not merely satisfied at application.

Two practical notes. First, the licence fee structure changed on 1 January 2026 under the Capital Markets and Services (Fees) Regulations 2025, moving fund managers to an AUM-based annual fee with a minimum of RM20,000 — a real running cost that boutique applicants often omit from their model. Second, if your financial position falls below any applicable minimum, you must not continue the regulated activity without the SC's written consent, and you must notify the SC immediately. It is a continuing condition, not a gate.

The RMO side: five platform types, and what each one costs

If your business is a platform — you match buyers and sellers, or issuers and investors — you are on the RMO side. The Guidelines on Recognized Markets set the eligibility bar for each category, and every one of them requires local incorporation.

Note how these compare to the general foreign-equity thresholds most China-invested subsidiaries are used to — RM500,000 for most service sectors, RM1 million for wholesale and retail. Capital markets sits an order of magnitude above both, and the money must be genuinely issued and paid up. If you are still designing the shareholding, resolve it during the equity and paid-up capital design stage, not after incorporation.

What changed for digital asset exchanges on 20 May 2026

The fourteenth revision of the Guidelines is the most consequential change to Malaysia's crypto regime since the 2019 prescription order that brought digital currencies and digital tokens inside the definition of securities. Regulated DAX trading value reached RM17.14 billion in 2025, up 23% from RM13.93 billion in 2024, and the SC's stated aim was to raise the standard of who is allowed to operate at that scale.

The shareholders' funds test also deserves care because it is dynamic. The 25%-of-operating-expenses limb is calculated on a rolling 12-month basis and reassessed at the end of every calendar month. A Direct Trade operator whose annual operating expenses pass RM28 million is required to hold more than RM7 million, and must be able to evidence the calculation with management or audited accounts. Growth itself raises the capital floor.

The shareholder and board requirements foreign applicants do not plan for

Three requirements in Chapter 15 have nothing to do with money and are, in our experience, the ones that derail foreign-controlled applications.

An Institutional Corporation must sit on your cap table. Paragraph 15.06 requires a DAX operator's shareholders to include at least one Institutional Corporation holding at least 5%, and that shareholder must have a representative on the board. "Institutional Corporation" is defined widely — it includes licensed or registered persons, exchanges and clearing houses, Labuan bank and insurance licensees, superannuation and provident funds, venture capital and private equity funds, government-linked funds, and, importantly for foreign groups, a corporation licensed or approved to carry on regulated activity by a regulator outside Malaysia performing functions corresponding to the SC's. A foreign-licensed exchange or asset manager can therefore fill this seat — but a founder-only cap table cannot. This has to be solved before the application, not during it.

Every director must complete the CMDP. Paragraph 15.07 requires all board members to complete the Capital Market Director Programme within six months of appointment or of SC approval to commence operations, whichever is later. For a board of overseas-based directors, this is a scheduling constraint with a hard deadline.

The responsible person needs five years. Paragraph 15.09 requires the appointed responsible person to have a minimum of five years of relevant experience in regulated activities, regulated financial services or digital asset business, with appropriate qualifications. Combined with the requirement that a change in controller or shareholders needs the SC's prior approval or at least 14 days' notice, the practical message is that the SC regulates who operates the platform as tightly as it regulates the platform.

Client assets: the 80:20 rule, the trust account and the RM500 million line

Chapter 15's client asset protection provisions are the operational heart of the revised regime, and several widely circulated summaries state them incorrectly. The adopted text does not impose a "90% cold wallet" rule.

The RM500 million custodian threshold is a growth trigger with a structural answer: the guidance permits a DAX operator to establish a separate entity to act as the Digital Asset Custodian, provided that entity is genuinely independent and able to make decisions without being influenced or directed by the exchange, with its own conflict-of-interest policies. Planning that entity at RM400 million of assets under custody is considerably cheaper than building it at RM501 million.

The listing liberalisation — and the two lists that limit it

The headline benefit of the May 2026 revision is that a DAX operator no longer needs the SC to approve each digital asset individually. Instead, paragraph 15.21 puts the assessment on the operator, against minimum criteria: the asset must represent identifiable rights, benefits or utility; it must (other than nascent utility tokens and IEO tokens) have traded for at least one year on a VASP complying with FATF Recommendations; it must have sufficient liquidity, be well distributed and not over-concentrated, have widely available information, a sound underlying ledger, viable and sustainable economics, and compliance with the legal frameworks of every jurisdiction the project operates in. A security audit of the protocol, network and application is required, the decision must be made by the board or senior management, and the entire assessment must be documented and retained.

Two lists constrain that freedom. Privacy tokens are prohibited outright — paragraph 15.24 bars any digital token intended to enhance user anonymity and transaction confidentiality. And five categories are Restricted Digital Assets, permitted only with enhanced policies addressing their specific risks:

Tokenised securities are not "digital assets" — and this trips up RWA projects

This is the single most common structural error we see in tokenisation proposals, and the Guidelines address it explicitly. The guidance to paragraph 15.01 states that "digital assets" do not include tokenised securities — tokenised shares, tokenised debentures, tokenised funds. A DAX operator may facilitate trading only of digital tokens and digital currencies, such as bitcoin and utility tokens.

The consequence: a platform that wants to offer or trade tokenised securities must be registered according to the underlying security of the token. A platform for share tokens must register as an ECF operator, not as a DAX. A real-world-asset tokenisation venture that has budgeted RM15 million for a DAX registration and built an exchange-style order book may find that its actual regulatory home is equity crowdfunding, with a RM5 million paid-up requirement and an entirely different obligation set — issuer due diligence, disclosure, trust accounts and offer limits. Getting this wrong does not merely cost the application fee; it costs the product design.

Serving Malaysians from offshore: where the perimeter really sits

Foreign operators frequently ask whether they can serve Malaysian users from an offshore entity without touching the SC. The regulatory answer has been tightening steadily, and 2026 made the practical answer clear.

As at 20 July 2026 the SC's register listed five registered digital asset exchanges: HATA Digital Sdn Bhd, Luno Malaysia Sdn Bhd, MX Global Sdn Bhd, SINEGY DAX Sdn Bhd and Kinetic DAX Sdn Bhd. Everything else is outside the perimeter. The SC states that entities it has not approved must cease all activities immediately and return all monies and assets collected from investors. Alongside the May 2026 revision the SC disclosed administrative action against four unregistered digital asset exchanges, and from 14 April 2026 it has worked with technology firms including Google to restrict unregistered DAX operators from advertising to Malaysians through social media and online channels. Enforcement is now distribution-level, not merely notice-level: an unregistered platform can find its acquisition channel closed before any prosecution is filed.

Two further points matter for structuring. A Labuan entity does not solve this — Labuan's own capital markets regime is administered by Labuan FSA for Labuan business, and it does not authorise carrying on a CMSA regulated activity in Malaysia; see our note on what Labuan does and does not give you. And every SC-authorised entity is a reporting institution for anti-money-laundering purposes, which means the customer due diligence, beneficial ownership and suspicious-transaction obligations described in our guide to AMLA and corporate account opening apply from day one, not after launch.

A decision sequence

In practice, the order in which you answer these questions determines whether an application is viable:

1. Classify the activity, not the product. Is it a Schedule 2 regulated activity (CMSL), a recognised market (RMO), or neither? A single business often has both — an exchange that also manages client portfolios needs both authorisations.
2. Test the token's legal nature. If the instrument is a tokenised security, the DAX route is closed and the ECF route opens. Resolve this before any technical build.
3. Size the capital against the highest applicable requirement, then add the ongoing test — 25% of rolling operating expenses for a DAX, continuing minimum financial requirements for a CMSL.
4. Solve the cap table. For a DAX, secure the ≥5% Institutional Corporation and its board representative. Remember that a change in controller needs the SC's prior approval, so late fixes are slow fixes.
5. Consult the SC before applying. Paragraph 2.04A of the Guidelines makes pre-application consultation mandatory for RMO applicants, with sufficient information for a meaningful discussion. Where another sectorial regulator is involved, a no-objection or approval letter from that regulator must accompany the application.
6. Build the local substance in parallel — incorporation, resident director, licensed company secretary, audited accounts, compliance officer, AML framework and the trust account relationship — because the SC assesses an operating company, not a plan.

Malaysia's capital markets regime is genuinely open to foreign participation: the Guidelines require local incorporation, not local ownership, and a foreign-licensed regulated entity can itself satisfy the Institutional Corporation requirement. But the thresholds are set at institutional scale deliberately, and the 2026 revisions moved them upward. If you are weighing a Malaysian licence application, our regulatory and licensing consultants can map your activity to the correct authorisation, model the capital and ongoing financial tests, and prepare the pre-application consultation with the SC. Talk to us before the technical build locks in a structure the licence cannot accommodate.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.