Most foreign-invested companies in Malaysia think export control is somebody else's problem — a defence-industry issue, or something their freight forwarder ticks off. Then a shipment of GPUs is held at KLIA, or a customer asks for a Strategic Trade Permit number that the company has never heard of, and the exposure becomes visible all at once. The Strategic Trade Act 2010 [Act 708] controls the export, transhipment, transit and brokering of two very different things: items on a published list, and — under the catch-all in section 12 — items on no list at all, once you know or ought to suspect where they are going. Since 14 July 2025, MITI Directive No. 1/2025 has used that catch-all to bring advanced AI chips inside the regime, which matters enormously in a country that assembles, tests and transships a large share of the world's semiconductors. This guide sets out what the Act actually controls, which lists and directives are live as at August 2026 (one of them was rescinded in May), the four permit types and how to get registered, the 30-day notification that has no shortcut, and the penalty structure — with the instrument numbers, so every figure can be checked against the gazette.
1. What the Strategic Trade Act 2010 actually controls
Act 708 came into force on 1 January 2011 and was amended by the Strategic Trade (Amendment) Act 2017 [Act A1537] with effect from 8 September 2017. Its architecture is simple, and it is worth internalising because almost every compliance failure comes from misreading one of the four limbs.
The Act regulates activities, not merely goods leaving the country. Four distinct activities each carry their own permit or registration requirement, and a company can be caught by one without ever being caught by the others.
| Regulated activity | What it covers | Common misconception |
|---|---|---|
| Export | Sending a controlled item out of Malaysia, including intangible transfer of controlled technology or software by email, cloud upload or remote access | "We only shipped a sample" — value is irrelevant; the classification is what matters |
| Transhipment | Goods arriving in Malaysia and leaving on a different conveyance, typically through a port or airport | "It never cleared customs, so it never entered Malaysia" — transhipment is separately controlled |
| Transit | Goods passing through Malaysia on the same conveyance to a destination outside Malaysia | "We are not the exporter or the importer" — the person bringing the goods in transit is the regulated person |
| Brokering | Arranging or negotiating a transaction in controlled items between two other countries, from Malaysia | "The goods never touched Malaysia" — brokering needs a registration, and the goods need never arrive |
Two features surprise people. First, intangible technology transfer counts: sending controlled design files or providing remote access to controlled software is an export. Second, brokering is registered, not permitted — a separate regime, with registration valid for one year, that catches trading and sourcing offices arranging third-country deals from a Kuala Lumpur desk.
2. The two lists — and the catch-all that ignores both
Whether you need a permit is decided by three questions asked in order: is the item listed, is the end-user listed, and — if the answer to both is no — do you know or have reasonable grounds to suspect what the item will be used for?
The item list. Strategic items are prescribed under the Strategic Trade (Strategic Items) Order 2010 [P.U.(A) 485/2010], which splits into a military list and a dual-use list. The list is refreshed periodically to track the international control regimes; the current edition is the Strategic Trade (Strategic Items) List 2025, given effect by P.U.(A) 144/2025 with effect from 2 June 2025, replacing the 2023 list. Companies that pre-registered against the older list were required to resubmit their pre-registration applications from 19 May 2025, with MITI undertaking to process them within five working days.
The end-user list. The Strategic Trade (Restricted End-Users and Prohibited End-Users) Order 2010 [P.U.(A) 484/2010] names parties to whom supply is restricted or prohibited outright. Supply to a restricted end-user is possible only under a special permit; supply to a prohibited end-user is not permissible at all. Separately, the Strategic Trade (United Nations Security Council Resolutions) Regulations 2010 [P.U.(A) 481/2010] carry the UN sanctions layer, with associated delisting and unfreezing regulations from 2014 [P.U.(A) 289/2014 and 290/2014].
The catch-all. Section 12 is the provision that catches unprepared companies. It lets the Minister direct that unlisted items become subject to control where there is knowledge, or reasonable grounds to suspect, that they are or may be intended for a restricted activity — meaning any activity supporting the development, production, handling, use, maintenance, storage, stockpiling or proliferation of weapons of mass destruction and their delivery systems. An item that appears on no list, has no ECCN in your ERP and has shipped to the same customer for three years can become controlled by directive, effective immediately.
The catch-all also operates on knowledge alone. Even without a directive, a person who knows or has reasonable grounds to suspect that unlisted goods are destined for a restricted activity is required to notify and obtain a permit. This is why export-control counsel focus so heavily on red flags — a customer with no technical use for the item, a mismatch between the stated end-use and the quantity, reluctance to give end-use information, routing through an unrelated third country. Documented red-flag screening is the difference between "without knowledge" and "with knowledge" when penalties are assessed.
3. Directive 1/2025: the AI chip rule
On 14 July 2025, MITI issued Directive No. 1/2025 under section 12, with immediate effect, bringing the export, transhipment and transit of advanced AI chips under control. It is the most commercially significant use of the catch-all to date, and it landed without a transition period.
The controlled items are set out in Annex I of the Directive by reference to US export control classification numbers, covering high-performance integrated circuits, the computers and electronic assemblies containing them, and associated information-security items:
| Annex I category | Classifications | What this captures in practice |
|---|---|---|
| Category 3 — Electronics | 3A001.u, 3U090 | High-performance integrated circuits: GPUs, TPUs, neural processing units and AI accelerators meeting the stated performance parameters |
| Category 4 — Computers | 4A003.u, 4A004.u, 4A005.u, 4U090 | Servers, accelerator cards, blades and electronic assemblies incorporating those chips — the rack, not just the die |
| Category 5 — Telecom & information security | 5A002.u, 5A004.u, 5U992 | Information-security systems and equipment meeting the specified thresholds |
Category 4 is the limb most often missed. A company that never buys a loose GPU but imports and re-exports fully built AI servers is squarely within scope, because the assembly incorporating the controlled chip is itself listed.
The operative obligation has two stages. First, a person intending to export, tranship or bring in transit advanced AI chips must notify the Strategic Trade Secretariat (STS) at MITI at least 30 days in advance where they know, or have reasonable grounds to suspect, that the chips are intended or likely to be used for a restricted activity. Notification is made by submitting the AI Chip Assessment (AICA) form to the STS. Second, if MITI decides the movement may proceed, it proceeds under a Strategic Trade Permit — the notification is not itself an approval.
A permit application must be accompanied by two documents that are outside the applicant's control and are the usual cause of delay: a re-export licence from the country of origin (for US-origin chips, the relevant US authorisation) and an export control classification issued by the manufacturer. Neither can be produced on a week's notice, which is why the 30 days is a floor rather than a realistic timeline.
Read the media statement and the Directive together — they are not identical. MITI's accompanying media statement announced that the export, transhipment and transit of high-performance AI chips of United States origin are subject to a Strategic Trade Permit with immediate effect, which reads as a blanket permit requirement. The Directive itself frames the notification duty more narrowly — triggered by knowledge or reasonable suspicion of a restricted activity — and, notably, is not expressly limited to US-origin chips. The prudent reading, and the one advisers have converged on, is the union of the two: treat US-origin advanced AI chips as permit-required regardless of end use, and treat any Annex I item as notification-triggering once a red flag appears. Do not build a compliance policy on the narrower of the two readings.
4. Which directives are actually live in August 2026
This is where stale advice does real damage. Directives are issued and rescinded, and a compliance memo written in late 2025 is now partly wrong. As at the date of this guide:
| Directive | Issued | Status | Obligation |
|---|---|---|---|
| Directive No. 1/2025 — advanced AI chips | 14 July 2025 | In force | 30-day prior notification to STS via the AICA form; permit required for the movement |
| Directive No. 2/2025 — unlisted nuclear- and/or missile-usable items | 12 August 2025 | Rescinded with effect from 7 May 2026 | Controls on export, transit and transhipment of the covered unlisted items cease to have effect |
| Directive on ball bearings | 6 December 2024 | In force | 30-day prior notification for HS 8482.10, 8482.20, 8482.30 and 8482.50 where intended for a restricted activity |
The rescission of Directive 2/2025 is genuinely good news for industrial exporters who were caught by an unlisted-items sweep — but it changes nothing about Directive 1/2025, and it does not touch the section 12 knowledge-based duty, which operates independently of any directive. Rescinding a directive removes a standing control; it does not license a shipment you know is heading somewhere it should not.
5. The permit map: four types, plus registration and ICP
The Strategic Trade Regulations 2010 [P.U.(A) 482/2010], as amended — most recently by the Strategic Trade (Amendment) Regulation 2025 [P.U.(A) 421/2025] — set out the permit architecture. There are four permit types, and choosing the right one is a materially different compliance burden.
| Permit type | Use case | Notes |
|---|---|---|
| Single-use permit | One export, transit or transhipment to one destination | MITI's guidance states a validity of six months. The default for first-time and occasional exporters |
| Multiple-use permit | Repeat shipments of various items over a period | Available to companies holding approved ICP status |
| Bulk permit | Repeat shipments of the same item | Available to companies holding approved ICP status |
| Special permit | A single movement to a restricted end-user | The only route to a restricted end-user; prohibited end-users cannot be supplied at all |
Two changes have altered the practical picture and are worth building into your calendar:
- From 3 December 2025, companies holding approved Internal Compliance Programme (ICP) status may apply for multiple-use and bulk permits. ICP status is approved by the STS and rests on a documented compliance framework — screening procedures, classification records, trained personnel, management accountability and audit. For a company shipping regularly, ICP is the difference between a permit application per shipment and a permit covering a programme.
- For any STA permit approved from 1 January 2026 onwards, the Delivery Verification Statement (Form 6) must be submitted exclusively through the ePermit STA system. Paper and email routes are closed for these permits. The DVS is the post-shipment confirmation that the goods reached the declared consignee, and a missing DVS is a live compliance defect that surfaces at your next application.
Alongside permits, brokers must obtain registration before brokering controlled items — including unlisted items, where notified or where they hold the relevant knowledge. Broker registration runs for one year and is subject to suspension or revocation. And across the regime, all permit and registration records must be kept for at least six years, which is longer than many companies' default document-retention policy and should be aligned deliberately.
6. How the process actually runs
The sequence below is the one that works; compressing it is where companies get into trouble.
- Classify before you quote. Obtain the manufacturer's export control classification for every item in the catalogue and map it against the Strategic Items List 2025. Classification is a technical determination, not a commercial one — and your customer's assurance is not a classification.
- Screen the end-user and end-use. Check the restricted and prohibited end-user lists and the UNSCR layer, and run red-flag screening on the transaction. Record the result even when it is clean — the record is the evidence.
- Register with the STS. Companies pre-register through the ePermit STA system; brokers register separately. Pre-registration against the 2025 list is processed within five working days.
- Notify where required. For Annex I AI chips and ball bearings within the directives' scope, file the notification — the AICA form for AI chips — at least 30 days ahead. Start assembling the origin-country re-export licence and the manufacturer classification in parallel, not after.
- Apply for the permit. Single-use unless you hold ICP status; special permit for a restricted end-user.
- Ship, then close the loop. Submit the DVS (Form 6) through ePermit STA for permits approved from 1 January 2026, and file the documentation into a six-year retention set.
7. Penalties — and why the "knowledge" question decides everything
The STA's penalty structure turns on whether the person acted with knowledge. The difference is not marginal:
| Circumstance | Individual | Body corporate |
|---|---|---|
| Acting with knowledge that the items were for a restricted activity | Fine up to RM10 million, or imprisonment up to 10 years, or both | Fine up to RM20 million |
| Acting without knowledge | Fine up to RM5 million, or imprisonment up to 5 years, or both | Fine up to RM10 million |
Offences involving listed strategic items and confirmed WMD end-use sit at the top of the Act's range and are treated far more severely again. There is a compounding route — the Strategic Trade (Compounding of Offences) Regulations 2022 [P.U.(A) 154/2022], in force from 1 June 2022 — but compounding is a discretion exercised by the authorities, not an entitlement, and it is not available for the gravest offences.
Note what the table implies operationally. The company's exposure is financial; the individual's exposure includes prison. And "without knowledge" is not a safe harbour that arrives by default — it is a finding, and the evidence for it is your screening file, your classification records and your training log. A company with no ICP, no red-flag procedure and no retained records is not obviously in the lower row.
8. A working scenario: a China-invested electronics subsidiary
A Chinese group sets up a Malaysian subsidiary to assemble AI servers for regional customers, taking a factory lot in an industrial park and importing accelerator cards and boards. The plan is to sell into Southeast Asia and to ship some finished units onward to a related company outside Malaysia. Where does the Act bite?
The inbound leg is an import — the STA controls export, transhipment, transit and brokering, so the import itself is a customs and duty question rather than an STA permit question. The outbound leg is the exposure. Finished AI servers incorporating Annex I chips fall within Category 4, so every onward shipment out of Malaysia is an export of a controlled assembly. If any customer or destination raises a red flag, the 30-day AICA notification is engaged before the shipment can be planned, and the permit application will require the origin-country re-export licence and the manufacturer classification for the chips inside the units.
The related-party shipment is not a softer case. Shipping to an affiliate does not remove the export, and an intra-group transfer to a jurisdiction of concern is precisely the pattern that attracts scrutiny. If the group also arranges chip purchases between two other countries from its Kuala Lumpur office, that is brokering, and it needs its own registration.
Sequenced properly, this is manageable: classify at the product-design stage, register with the STS during company setup rather than at first order, budget 30 days plus document lead time into customer commitments, and pursue ICP status once shipment volume justifies it. Sequenced badly, the first the company hears of it is a held shipment and a customer whose delivery date has passed. The same discipline applies to the wider trade-documentation stack — rules of origin and certificates of origin for preferential tariff treatment, and RMCD customs and AEO status on the clearance side.
9. The mistakes that cost the most
- Assuming the freight forwarder owns this. The regulated person is the exporter, the transhipper, the person bringing goods in transit, or the broker. A forwarder can file, but the offence and the penalty attach to the principal.
- Treating "not on the list" as "not controlled". Section 12 and the directives exist precisely to control unlisted items. The AI chip regime is the proof.
- Missing Category 4. Companies screen for loose chips and ignore the servers, cards and assemblies that contain them.
- Forgetting intangible transfer. Emailing controlled technical data or granting remote access to controlled software is an export, with no shipment to trigger anyone's attention.
- Working from a rescinded directive — or missing a live one. Directive 2/2025 ceased to have effect on 7 May 2026; Directive 1/2025 did not. Check the STS notices before relying on a memo.
- Treating 30 days as the total lead time. The notification period runs in parallel with obtaining an origin-country re-export licence and a manufacturer classification — documents that routinely take longer than the notice period itself.
- Under-retaining records. Six years, minimum, for permits and registrations.
- Ignoring ICP until it is urgent. ICP status unlocks multiple-use and bulk permits and evidences the diligence that decides the penalty band — but it is approved on the strength of a programme that takes time to build.
10. What to do now
If your Malaysian entity touches electronics, semiconductors, precision components, servers, or any onward movement of goods through Malaysian ports and airports, three steps are worth taking before the next shipment rather than after it. First, classify the catalogue against the Strategic Items List 2025 and Annex I of Directive 1/2025, and get manufacturer classifications on file. Second, stand up screening and records — restricted and prohibited end-user checks, red-flag procedures, and a six-year retention set — because these determine which penalty row you sit in. Third, register with the STS through ePermit STA, and decide whether your shipping pattern justifies pursuing ICP status for multiple-use and bulk permits.
Export control sits at the intersection of trade documentation, customs and corporate compliance, and it is easiest to build correctly at setup rather than to retrofit under pressure. If you are establishing or expanding a manufacturing or trading operation in Malaysia, our team can help align the trade-certification and documentation layer — including certificates of origin and trade certifications — with the licensing, customs and corporate structure around it. Talk to us before your first controlled shipment, not after it is held.
Frequently asked questions
Our product is not on the Strategic Items List. Do we still need a permit?
Possibly yes. Section 12 of the Strategic Trade Act 2010 is a catch-all: it allows unlisted items to be controlled where there is knowledge, or reasonable grounds to suspect, that they are or may be intended for a restricted activity — meaning any activity supporting the development, production, handling, use, maintenance, storage, stockpiling or proliferation of weapons of mass destruction and their delivery systems. That control can arrive in two ways. It can be imposed by directive, as MITI did on 14 July 2025 with Directive No. 1/2025 for advanced AI chips and on 6 December 2024 for certain ball bearings. Or it can be triggered by your own knowledge alone, with no directive involved, if a red flag on the transaction gives you reasonable grounds to suspect the end use. "Not on the list" is therefore never a complete answer — the second question is always what you know or ought to suspect about where the goods are going.
We only import chips and re-export finished servers. Are the assembled units controlled?
Yes, and this is the single most commonly missed limb of Directive 1/2025. Annex I of the Directive covers three categories, and Category 4 — classifications 4A003.u, 4A004.u, 4A005.u and 4U090 — captures computers and electronic assemblies incorporating the controlled integrated circuits. In plain terms, the rack is controlled, not just the die. A company that never buys a loose accelerator but builds and ships AI servers is exporting a controlled assembly on every outbound movement. Category 3 (3A001.u, 3U090) covers the high-performance integrated circuits themselves — GPUs, TPUs, neural processing units and AI accelerators meeting the stated performance parameters — and Category 5 (5A002.u, 5A004.u, 5U992) covers information-security systems and equipment meeting the specified thresholds. Screen your bill of materials against all three, not just the first.
Is the 30-day notification the whole lead time we need to plan for?
No — treat 30 days as a floor, not a schedule. The notification itself is filed with the Strategic Trade Secretariat at MITI using the AI Chip Assessment (AICA) form at least 30 days before the intended export, transhipment or transit. But notification is not approval: if MITI decides the movement may proceed, it must still proceed under a Strategic Trade Permit. And the permit application must be accompanied by two documents that are outside your control — a re-export licence from the country of origin (for US-origin chips, the relevant US authorisation) and an export control classification issued by the manufacturer. Neither is produced on a week's notice, and both routinely take longer than the notification period itself. Start assembling them in parallel with the notification, not after it, and build the combined lead time into customer delivery commitments before you sign them.
Directive 2/2025 was rescinded. Does that mean the AI chip controls are being relaxed too?
No. The two are separate instruments with separate scopes. Directive No. 2/2025, issued on 12 August 2025, imposed controls on the export, transit and transhipment of unlisted nuclear- and/or missile-usable items; those controls were rescinded with effect from 7 May 2026 and cease to have effect. Directive No. 1/2025 on advanced AI chips, issued on 14 July 2025, remains in force, as does the ball bearings directive of 6 December 2024. More importantly, rescinding a directive removes a standing control — it does not touch the section 12 knowledge-based duty, which operates independently of any directive. So even for the items formerly covered by Directive 2/2025, if you know or have reasonable grounds to suspect a restricted end use, the notification and permit obligations still apply. This is exactly why compliance memos need a review date: the directive register changes, and a policy written in late 2025 is now partly wrong.
What is ICP status, and is it worth applying for?
An Internal Compliance Programme (ICP) is a documented export-control framework — classification records, end-user and red-flag screening procedures, trained personnel, management accountability and internal audit — approved by the Strategic Trade Secretariat. It is worth applying for once your shipping pattern is regular, for two reasons. First, efficiency: with effect from 3 December 2025, companies holding approved ICP status may apply for multiple-use and bulk permits, which is the difference between a permit application per shipment and a permit covering a programme. Second, and less obvious, evidence: the STA's penalty structure turns on whether you acted with knowledge, and the gap is large — up to RM10 million or 10 years' imprisonment for an individual acting with knowledge, against up to RM5 million or 5 years without. "Without knowledge" is a finding, not a default, and your screening file, classification records and training log are the evidence for it. Note also that permit and registration records must be kept for at least six years, which is longer than many companies' standard retention policy.
Related services
We handle the process described in this article end-to-end.
- Certificate of Origin (COO)Preferential & non-preferential COO applications for exporters.
- MyIPO Trademark ApplicationRegister your trademark in Malaysia under the Trademarks Act 2019.
- MOH Food Handling Course RegistrationKKM-accredited food handler training — mandatory for F&B staff.
Sources & references
This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.