Running a Malaysian Company Without an Employment Pass in 2026: The 17 February 90-in-180 Rule That Ended the Fly-In Founder, Regulation 39(b), the RM10,000-per-Head Employer Offence Under Section 55B, and Why "I'm a Director, Not an Employee" Is Not a Defence

For two years the most common way a Chinese group ran its new Malaysian subsidiary was not an Employment Pass. It was the founder flying in on the visa exemption, staying ninety days, signing what needed signing, sitting in the office, instructing the staff, and flying out before the pass expired. It worked because the pass was long enough to make it work. On 17 February 2026 that stopped being true: the visa exemption for Chinese nationals now grants 30 days per entry with a hard cap of 90 days in any rolling 180-day period. Half the year, at most, and only for purposes that do not include working. This guide sets out what the Immigration Act 1959/63 actually treats as a breach, what it costs the individual and the company, why "I am a director, not an employee" is not the defence people think it is, and how to sequence a lawful presence in Malaysia in the first twelve months — when the company is too new to have a pass and the founder is the only person who can run it.

What changed on 17 February 2026

Malaysia's visa exemption for Chinese nationals began on 1 December 2023, initially running to 31 December 2024. In April 2025 it was extended for a further five years, and at the same time the permitted stay was raised from 30 days to 90 days per entry. That eighteen-month window is the origin of the fly-in management model, and it is the reason so many groups never bothered with an Employment Pass in year one.

From 17 February 2026 the terms were tightened. A Chinese national entering under the exemption now receives a Social Visit Pass for up to 30 days, and may not exceed 90 days in total within any 180-day period. The two limits work together, and the second is the one that bites: it is not a per-entry rule that can be reset by a weekend in Singapore. It is a rolling arithmetic test on the previous 180 days.

Three operational details matter as much as the numbers. The Social Visit Pass issued on arrival cannot be extended inside Malaysia — extending means leaving and re-entering, which now consumes the rolling allowance rather than resetting it. The Malaysia Digital Arrival Card must be submitted before arrival. And the exemption covers social and business-visit purposes — tourism, meetings, conferences, signing agreements, sports competitions — while anyone entering for work or study must still hold a proper visa or pass. The exemption was never a work authorisation; what changed in February is that it is no longer long enough to be mistaken for one.

Where the line between "business visit" and "work" actually falls

There is no statutory list of permitted activities, which is why the question is answered so confidently and so wrongly in practice. The operative rule is Regulation 39(b) of the Immigration Regulations 1963: a person who without reasonable cause contravenes or fails to comply with any condition imposed in respect of, or instruction endorsed on, any pass commits an offence. A Social Visit Pass is endorsed against employment. Everything follows from that endorsement, not from a definition of "work".

The workable distinction is between representing an offshore principal and operating a Malaysian business. Attending a board meeting, negotiating and signing a contract, inspecting a site, meeting a banker, attending a trade fair, receiving training — these are visitor activities. Sitting at a desk in the subsidiary's office directing its staff, approving its purchases, managing its customers or performing a role the company would otherwise hire someone to fill is the operation of a Malaysian business, and it is what an Employment Pass exists to authorise.

What it costs — and who pays

Two things surprise foreign founders here. First, the penalties are criminal, not administrative. Second, the heavier exposure sits with the company and its officers, not with the individual whose pass was breached.

Read section 55B carefully, because it is the provision that turns an individual's convenience into a corporate problem. The minimum is RM10,000 per person, and the offence is committed by the employer. A group that has three China-based managers rotating through the Malaysian office on visitor passes is not looking at one exposure; it is looking at three. The pass breach under Regulation 39(b) carries a fine of up to RM1,000 — the employer's exposure under section 55B is up to fifty times that, per head.

The collateral damage is usually worse than the fine. An immigration record attaches to the passport and follows the individual into every subsequent application — including the Employment Pass the group will eventually need for that same person, and the Dependent Passes for their family. A company with an enforcement history has a materially harder time at the Expatriate Services Division, and licensing authorities in regulated sectors ask about it.

"I am a director, not an employee"

This is the most common defence offered, and it confuses two separate legal systems. Under the Companies Act 2016 a director is an office-holder, and a non-executive director genuinely is not an employee. Under the Immigration Act, the question is not whether there is a contract of service — it is whether the person is performing work in Malaysia, and whether the pass they hold permits it.

The distinction that survives scrutiny is between attending to governance and performing management. A non-resident director who flies in for board meetings, signs resolutions, reviews accounts and leaves is exercising an office and is properly a business visitor. A director who is in the office four days a week running operations is working, whatever the title on the resolution says. Drawing a director's fee rather than a salary does not change the analysis; if anything, a Malaysian payroll or director's-fee record against a visitor pass is the documentary trail that establishes the breach.

Note also that being a director does not solve the structural problem it is often used to solve. Malaysia requires at least one director who ordinarily resides in Malaysia under section 196(4) of the Companies Act — a factual test about where a person actually lives, which a founder capped at 90 days in 180 cannot satisfy. That requirement is a separate subject, covered in our guide to the resident director requirement and nominee arrangements.

The chicken-and-egg problem, stated honestly

The reason this situation persists is not ignorance. It is that the lawful route has a genuine gap at the start. An Employment Pass is sponsored by the Malaysian company; the company must exist, be registered with the Expatriate Services Division, and meet a paid-up capital condition before it can file anything. The founder is usually the only person who can get the company to that point — and getting it there takes months during which they have no pass.

On top of the capital condition sit the local-hiring gates that must be cleared before an Employment Pass application is accepted at all — the MyFutureJobs advertising requirement and the Jabatan Tenaga Kerja steps, set out in our guide to the three local-hiring gates that come before the Employment Pass. And from 1 June 2026 the pass itself sits in a revised salary framework: Category I at RM20,000 per month and above, Category II at RM10,000 to RM19,999, and Category III at RM5,000 to RM9,999. A founder appointing themselves to a senior post is normally a Category I application, which means the subsidiary must actually pay a RM20,000 monthly salary through a Malaysian payroll, with the tax and statutory deductions that follow.

The gap is real, but it is a matter of months, not years — and 90 days in any 180 is enough to cover it if the sequencing is deliberate rather than accidental.

The three lawful routes, and when each fits

The Professional Visit Pass is the most under-used of the three and the natural bridge for a group in its first year: the individual stays on the China parent's payroll, provides services to the Malaysian subsidiary, and holds a pass that permits what they are actually doing. It is not a substitute for an Employment Pass for a permanent country head, but it fills the gap that the 90-in-180 rule opened. The mechanics are covered in our Employment Pass and Professional Visit Pass guide.

A twelve-month sequence that stays inside the rules

The following is the pattern that works for a founder who must be present, does not yet have a pass, and is now capped at 90 days per 180.

Months 1–2 — incorporation and capital. Incorporate the Sdn. Bhd., appoint a resident director, open the bank account and fund the paid-up capital to the level the ESD will require for the intended ownership structure. Most of this is executable remotely with the company secretary; budget one trip of two to three weeks for bank account opening and lease signing. Spend the visitor days on what genuinely needs a body in the room.

Months 2–4 — ESD registration and the first local hire. Register the company with the Expatriate Services Division and clear the MyFutureJobs and labour-office steps. This period is largely documentary. If someone must be in Malaysia to set up operations, this is where a Professional Visit Pass earns its keep.

Months 4–7 — the Employment Pass file. Submit the application for the post the founder will actually hold, at the salary the category requires, with the organisation chart and job description that support it. Do not name the founder as the only expatriate on the file if the plan is to bring in a technical team later — build the structure once.

Months 7–12 — endorsement and settlement. On approval, the pass must be endorsed in the passport, after which the Dependent Passes for spouse and children can follow. From this point the founder is on a Malaysian payroll, is likely to become a Malaysian tax resident, and should plan for the exit-side obligations set out in our guide to pass cancellation and tax clearance before any eventual departure.

What to do if the model is already running

Groups that have been operating this way for a year are not in an unrecoverable position, but the fix is a sequencing exercise, not an argument. Reduce the founder's presence to genuine visitor activity immediately; the rolling cap is enforced prospectively and the current 180-day window is the one that matters. Remove the documentary indicators that describe a visitor as a manager — titles on leases, signature blocks, business cards, website listings and any Malaysian payroll or director's-fee entry that has no pass behind it. Then move whoever is genuinely running the business onto a Professional Visit Pass or an Employment Pass on a defined timetable, and hire or appoint a Malaysian-resident manager who can hold the operational role in the meantime.

The uncomfortable but accurate summary is this: Malaysia has not made it harder to run a company here. It has made it harder to run one without being here lawfully. The compliant structure costs a paid-up capital commitment and a real salary — and it is what every subsequent application, licence and bank facility will be assessed against.

ONEKEY BIZ handles the whole sequence — incorporation and paid-up capital structuring, ESD employer registration, MyFutureJobs and labour-office clearance, Professional Visit Pass and Employment Pass applications, and Dependent Passes — as one file rather than five. If you are currently running a Malaysian operation on visitor passes and want a route out before it becomes a record, see our Employment Pass and work authorisation service or talk to our team.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.