MYschema world-payments-v1trajectory: not recorded
Last updated · 14 modules · 64 sourced
findings · 118 sources in the cumulative register
14Modulesbaseline.modules[]
64Findingsmodules[].findings[]
33Tier-1 sourcesrun_metadata.t1_source_count
Confidence mix(sums to 14 rendered modules; click to filter)
Jurisdiction brief
Lead Signal
Malaysia's Bank Negara Malaysia (BNM) has completed a broad-based tightening of the country's single-regulator payments architecture, moving simultaneously on operational resilience, customer-fund safeguarding and settlement infrastructure. The revised Policy Document on Electronic Money took effect 31 January 2025, replacing the 2022 version and imposing mandatory trust-account or segregated-deposit safeguarding on non-bank e-money issuers, alongside tightened governance, cybersecurity and a three-year exit-strategy requirement; minimum capital now runs from RM100,000 for small schemes to RM5 million or 8% of outstanding e-money liabilities for large schemes. That safeguarding upgrade sits alongside the Risk Management in Technology (RMiT) policy document issued 28 November 2025, which imposes a 120-minute per-incident and four-hour cumulative annual downtime tolerance on critical systems, a one-hour incident-notification window to BNM, and binds banks, insurers, payment system operators and e-money issuers alike; stand-in-processing and capacity obligations become binding by 30 September 2027. At the same time, PayNet's RENTAS+ enhancement, launched October 2025, made Malaysia's real-time gross settlement system the first in ASEAN to offer continuous 24/7 settlement, now clearing DuitNow retail payments on a gross basis. The combined effect is a coordinated compliance-cost escalation for banks and non-banks together, run in parallel with a step-change in settlement-finality infrastructure — though non-bank participants in PayNet's Real-time Retail Payments Platform still have no direct RENTAS access and must settle through settlement banks, leaving a structural tiering between bank and non-bank market participants intact even as the rails around them modernise.
Other Developments
Malaysia's card-scheme economics remain governed by the Payment Cards Framework issued 19 August 2022, which caps credit-card interchange at 0.6% and domestic debit interchange at the lesser of 0.1% or RM0.37 plus 0.001%, bans surcharging and minimum-purchase practices, and is subject to review every three years from 1 January 2023 — placing the first review window in early 2026; a BNM document dated 28 July 2025 referencing an "Adjustment to the Debit Card Interchange Fee Ceiling" suggests a revision may already be underway, though its content remains unverified. Enforcement activity has been active and administrative in character rather than litigation-driven: BNM fined Alipay Malaysia (AIMY Merchant Services) RM340,000 in July 2025 for a sanctions-database failure, and imposed more than RM7 million in penalties on Bank Islam, Bank Rakyat and Bank Simpanan Nasional the same month for RMiT and sanctions-screening breaches, following an earlier May 2023 action against TNG Digital. On consumer protection, Malaysia has no statutory mandatory reimbursement scheme for authorised-push-payment fraud victims comparable to the UK model; redress instead runs through a fair-redress expectation on banks, the National Scam Response Centre, and the Financial Markets Ombudsman Service created 1 January 2025 from the merger of the Ombudsman for Financial Services and SIDREC, with a new Complaints Handling policy document entering force 1 April 2026. On digital money, Malaysia still has no finalised payment-stablecoin licensing regime; routing remains activity-dependent between BNM payment-instrument licensing and Securities Commission oversight under the Capital Markets and Services Act, while BNM's Digital Asset Innovation Hub, launched June 2025, is said to be evaluating more than 30 ringgit-stablecoin project submissions. Commercially, the non-bank-dominated e-wallet segment continues to attract capital: Touch 'n Go's TNG Digital, Malaysia's most-funded fintech at roughly USD 168 million cumulative, raised a further USD 75 million from strategic investors targeting first full-year profitability in 2025, while Axiata's Boost is reportedly in talks with a new shareholder for its e-wallet/digital-bank business, a deal still pending BNM regulatory approval. Underlying all of this is a market that processed 18.4 billion e-payment transactions in 2025, up 25% year-on-year, across a base of roughly 47 non-bank e-money issuers against about 6 bank issuers, reshaped further by the five digital-bank licences BNM awarded in 2022 to consortia including Boost-RHB, GXS Bank-Kuok Brothers, Sea-YTL, AEON-MoneyLion and KAF Investment Bank.
Cross-Monitor Connections
Malaysia's anti-money-laundering and counter-financing-of-terrorism regime, supervised by BNM's Financial Intelligence and Enforcement Department under the Anti-Money Laundering Act 2001, was strengthened in December 2024 with counter-proliferation-financing provisions ahead of the country's 2025 FATF mutual evaluation, and requires e-money issuers and payment institutions to screen new and existing customers against domestic and UN sanctions lists. That AML/CFT surface, sourced here from the Sentinel feed, carries payments-context relevance only — the underlying illicit-finance and sanctions-evasion analysis is routed to the Financial Intelligence Monitor rather than assessed independently within this brief.
Outlook
Several forward markers will shape Malaysia's payments landscape through 2026 and beyond. The Complaints Handling policy document enters full force 1 April 2026, formalising a consumer-redress escalation pathway through the Financial Markets Ombudsman Service and BNMLINK for all financial service providers including eligible e-money issuers. The Payment Cards Framework's first three-year interchange review falls due in early 2026, with the unverified July 2025 BNM debit-ceiling document a live variable for merchant and acquirer cost structures. RMiT's stand-in-processing and capacity obligations bind by 30 September 2027, extending prescriptive operational-resilience requirements across the sector. Malaysia's 2025 FATF mutual evaluation outcome, expected through 2026, will help determine the intensity of forward AML/CFT supervision on payment institutions. And BNM's Digital Asset Innovation Hub pilot outcomes will be the key signal for whether Malaysia moves toward a finalised payment-stablecoin licensing framework, with reserve expectations already converging on 1:1 fiat backing ahead of any formal rulebook.
trust tier: ai_unverified
Regulatory Status
Malaysia operates a single-regulator payments regime under Bank Negara Malaysia, spanning licensing and market access (W1a), conduct and safeguarding (W1b), operational resilience (W3), scheme compliance (W4), payment corridors (W5), industry structure (W6), enforcement (W7), merchant acquiring (W8), product innovation (W9), consumer protection (W10), AML/CFT (W11), settlement access (W12) and commercial activity (W13). The current cycle establishes this as a full baseline: BNM is tightening operational resilience via the RMiT policy document (issued 28 November 2025, prescriptive downtime and incident-notification rules) and customer-fund safeguarding via the revised e-money Policy Document (effective 31 January 2025, mandatory trust-account safeguarding for non-bank issuers), while simultaneously expanding settlement infrastructure and cross-border reach — RENTAS+ (October 2025) made Malaysia's RTGS system the first in ASEAN to run 24/7, and DuitNow's ASEAN Regional Payment Connectivity linkages now cover Thailand, Indonesia, Singapore and other corridors. BNM's enforcement posture is administrative and active, with July 2025 penalties totalling more than RM7 million across banks and non-bank PSPs for sanctions-screening and RMiT breaches. Two notable regulatory gaps persist relative to UK/EU peers: Malaysia has neither a finalised payment-stablecoin licensing framework (routing remains activity-dependent between BNM and the Securities Commission) nor a statutory mandatory reimbursement scheme for authorised-push-payment fraud, relying instead on a fair-redress expectation and the Financial Markets Ombudsman Service created 1 January 2025. Structurally, non-bank PSPs remain excluded from direct access to RENTAS, Malaysia's sole large-value settlement system, and must settle via settlement banks — a bank/non-bank access asymmetry that recurs across the licensing, safeguarding and settlement modules alike. Commercially, the market is non-bank-dominated (roughly 47 non-bank versus 6 bank e-money issuers) and growing rapidly (18.4 billion e-payment transactions in 2025, up 25% year-on-year), with continued capital inflows into leading e-wallets such as TNG Digital.
Outlook
Several forward markers converge on 2026–2027. The Complaints Handling policy document reaches full force 1 April 2026; the Payment Cards Framework's first three-year interchange review falls due in early 2026, with a July 2025 BNM document suggesting a debit-ceiling adjustment may already be pending verification; Malaysia's 2025 FATF mutual evaluation outcome, expected through 2026, will shape AML/CFT supervisory intensity; and RMiT's stand-in-processing obligations bind by 30 September 2027. BNM's Digital Asset Innovation Hub pilot outcomes remain the key signal for whether a finalised payment-stablecoin framework emerges. Taken together, Malaysia's trajectory is one of parallel tightening (resilience, safeguarding, enforcement) and expansion (settlement infrastructure, cross-border connectivity), with the bank/non-bank access asymmetry in settlement and licensing the most durable structural feature to monitor across future cycles.
14 of 14 modules
Signal
Density
Selections OR within a group, AND across groups. Press / to search.
BNM regulates payment activity via FSA 2013 and MSBA 2011; the 31 January 2025 revised e-money Policy Document formally carves limited-purpose e-money issuers out of BNM's purview per the 2024 Exemption Orders; BNM continues active new-entrant licence processing (e.g. SunRate, April 2026).
Movement — NEWE-money exemption orders and continued new-entrant licensing establishedFirst-cycle capture of MY payments-licensing baseline.
Standing sub-brief264 words · last cycle wpm-2026-08-05
Licensing, Authorisation & Market Access
Malaysia operates a single-regulator payments regime under Bank Negara Malaysia (BNM), with market access governed by the Financial Services Act 2013 (FSA) and its Islamic-finance counterpart, the Islamic Financial Services Act 2013 (IFSA). There is no separate electronic-money-institution licence of the kind seen in the UK or EU; instead, operators route through three FSA mechanisms: payment-system-operator (PSO) approval under section 11, designated payment-instrument approval under section 11 for e-money and card schemes, and merchant-acquiring registration under section 17. The FSA repealed and consolidated the former Payment Systems Act 2003, with deemed continuity preserved for approvals granted under the earlier regime. Both bank and non-bank entities are authorisable under this framework, and local incorporation or presence is generally required for market entry. This single-regulator, non-EMI-regime architecture is the foundational market-access fact for any payments operator assessing entry into Malaysia: rather than a licence taxonomy split by activity type, BNM applies a unified approval process spanning payment-system operation, e-money issuance and merchant acquiring, with prudential and conduct obligations attached to each approval type rather than to a standalone licence class.
Outlook
No near-term change to the core FSA/IFSA market-access architecture is signalled; the framework is treated as an established baseline. Continuity of prior approvals under the repealed Payment Systems Act 2003 remains structurally significant for any entity that entered the market before the FSA consolidation. Market-access conditions should instead be read alongside the parallel tightening documented in conduct/safeguarding (W1b) and operational resilience (W3), which raise the ongoing compliance burden attached to holding a BNM approval without altering the entry route itself.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Licensing, Authorisation & Market Access
Bank Negara Malaysia's regulatory-perimeter clarification for electronic money took effect on 31 January 2025 through a revised e-money Policy Document and accompanying FAQ, formally exempting limited-purpose e-money issuers from BNM's purview under two 2024 Exemption Orders, P.U.A 463/2024 and its Islamic-finance equivalent P.U.A 461/2024. This is a genuine perimeter-narrowing event rather than a mere clarification of existing practice: the Financial Services (Limited Purpose Electronic Money) (Exemption) Order 2024 supersedes the prior full-scope supervisory treatment that had applied to limited-purpose issuers, meaning a defined category of e-money issuer now sits outside BNM's direct licensing perimeter entirely.
At the same time, BNM's licence-processing channel for new payments entrants remains active: SunRate's licence approval, reported 28 April 2026, illustrates continued throughput for new entrants even as the regulator narrows its supervisory scope at the margins. This is a single T3-sourced report without primary BNM licence-register confirmation this cycle, so it is best read as an illustrative data point on continued market access rather than a confirmed count of new licensees.
Read together, these two developments describe a liberalising market-access posture this cycle: BNM is simultaneously narrowing which e-money issuers require its direct oversight and continuing to process new licence applications. The distinction between bank and non-bank payment institution treatment is central to reading this correctly: the e-money exemption orders apply specifically to non-bank e-money issuers operating limited-purpose models, and do not alter BNM's supervisory posture toward bank-issued e-money or full-purpose non-bank e-money issuers, which remain within the standard licensing perimeter.
Outlook
Further BNM licence-processing activity for new payments entrants is expected through the remainder of 2026 via the existing sandbox and standard application channels. Primary-source confirmation of the SunRate approval, and of the practical operating impact of the two 2024 Exemption Orders on the limited-purpose e-money issuer population, are the most valuable confirmations to seek next cycle.
BNM's Technology Requirements Policy Document (TR PD) — a four-tier technology-governance framework for payment regulatees — was issued March 2026 (substantive effect 12 March 2027), overlapping the existing RMiT regime and newly capturing licensed money-services businesses.
Movement — NEWTR PD technology-governance framework establishedFirst-cycle capture of MY technology-conduct baseline.
Standing sub-brief320 words · last cycle wpm-2026-08-05
Conduct, Safeguarding & Promotions
The live conduct-and-safeguarding story in Malaysia is the revised Policy Document on Electronic Money, effective 31 January 2025, which replaced the 2022-vintage PD and materially raised the bar for non-bank e-money issuers. Large-scheme issuers must now hold customer funds in a Trustee Act 1949 trust account maintained with a licensed institution; small-scheme issuers must use a separated or dedicated deposit account managed on trust-like terms; and Shariah-compliant e-money issuers use a qard structure within a Shariah-compliant trust or dedicated deposit account. The revised PD also tightens governance and cybersecurity expectations and introduces a three-year exit-strategy requirement for issuers. Minimum capital is tiered at RM100,000 for small-scheme issuers and RM5 million, or 8% of outstanding e-money liabilities, for large-scheme issuers. Because Malaysia has no FSCS-style deposit-protection scheme extending to non-bank e-money balances, this trust/segregation mechanism is the primary consumer-fund protection in the wallet-dominated Malaysian market — a market where non-bank issuers outnumber bank issuers by roughly eight to one. Confidence in this reading was upgraded to Confirmed following verification that the revised PD is in force via a Bank Negara Malaysia primary source. On the conduct side, BNM issued a Policy Document on Complaints Handling on 28 March 2025, superseding 2009-vintage guidelines. It applies to financial service providers including eligible e-money issuers and establishes an escalation pathway to the Financial Markets Ombudsman Service or BNMLINK. Most of the document enters force on 1 April 2026, though Paragraph 12 took effect immediately on issuance (28 March 2025).
Outlook
The Complaints Handling PD's full entry into force on 1 April 2026 is the near-term marker to track for conduct compliance across all financial service providers, including e-money issuers. Beyond that date, the safeguarding regime established by the 2025 e-money PD is expected to remain the standing baseline; further tightening would most plausibly come via governance or cybersecurity guidance rather than a change to the core trust-account safeguarding mechanism itself.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Conduct, Safeguarding & Financial Promotions
Bank Negara Malaysia's Technology Requirements Policy Document (TR PD) took effect in March 2026, with its substantive obligations becoming effective 12 March 2027. The TR PD introduces a four-tier proportional technology-governance structure that overlaps the existing Risk Management in Technology (RMiT) framework, and it extends coverage beyond RMiT's traditional bank-centric scope to capture e-money issuers, merchant acquirers, licensed money-services businesses and PayNet itself. This is the clearest conduct-and-safeguarding-adjacent development of the cycle: extending technology-governance obligations to non-bank payment institutions and the domestic scheme operator alongside banks addresses a proportionality gap between bank-grade and non-bank-grade technology oversight that has been a structural feature of Malaysia's payments-conduct regime.
The TR PD's tiering structure is explicitly proportional rather than uniform: entities already captured under RMiT sit in Tier 1, larger regulatees crossing defined annual transaction-value or volume thresholds face fuller Tier 2 obligations, smaller entities fall under a lighter Tier 3, and non-digital money changers sit in Tier 4. This tiering approach means the practical conduct burden on any individual payment institution depends heavily on its transaction scale, and a merchant acquirer or e-money issuer should not assume uniform treatment with its bank counterparts under the new framework.
Sourcing for the TR PD itself is a single Tier 4 advisory-firm article, with no primary Bank Negara Malaysia policy-document URL captured this cycle; this is recorded as an explicit sourcing gap and the finding should be treated as reported rather than fully confirmed pending primary-source retrieval.
Outlook
Primary-source confirmation of the TR PD from Bank Negara Malaysia directly is the priority research item for this module next cycle, together with market clarity on tier-applicability boundaries, which advisory-firm commentary suggests remains an active point of confusion among regulatees ahead of the March 2027 effective date. Payment institutions should expect a 90-day gap-analysis and remediation-plan submission requirement following licence-approval issuance once the framework is confirmed.
Malaysia has NO finalised payment-stablecoin framework in force as of mid-2026. Crypto/digital assets that exhibit investment characteristics are classified as securities and regulated by the Securities Commission Malaysia (SC) under the Capital Markets and Services Act 2007 and the 2019 Prescription Order; BNM retains monetary/financial-stability and AML oversight, and does not recognise crypto as legal tender. Stablecoins are not yet specifically regulated; routing is activity-dependent (payment-use may trigger BNM payment-instrument licensing, trading/custody falls to SC). BNM launched a Digital Asset Innovation Hub (DAIH) in June 2025 and is evaluating ringgit-pegged stablecoin pilots; reserve expectations are converging on 1:1 fiat backing. A CBDC remains exploratory (Project Dunbar).
Open gap — wpm-int-3Stablecoin framework status is a negative (absence) claim supported only by T3 sources; no T1/T2 source confirms either a finalised payment-stablecoin regime OR its definitive absence. DAIH pilot outcomes and any BNM consultation (e.g. a CP) should be tracked for the first material W2 development.Emerging-market digital-money framework under-indexed; only vendor/law-firm T3 sources available.
Horizon · 2026 (±multi_year)BNM payment-stablecoin framework / DAIH pilot outcomesproposed · T3
Standing sub-brief235 words · last cycle wpm-2026-06-24
Stablecoins & Digital Money
Malaysia has no finalised payment-stablecoin licensing regime in force as of mid-2026. Regulatory routing is activity-dependent: stablecoin use for payment purposes may trigger BNM payment-instrument licensing, while exchange, custody and trading activity falls to the Securities Commission under the Capital Markets and Services Act 2007 and the 2019 Prescription of Securities (Digital Currency and Digital Token) Order. Reserve expectations are converging on 1:1 fiat backing even in the absence of a codified rulebook. BNM's Digital Asset Innovation Hub, launched June 2025, is evaluating a reported 30-plus ringgit-stablecoin project submissions, and BNM is separately exploring central bank digital currency questions through Project Dunbar. This is an absence-of-framework finding rather than a confirmed negative; no Tier-1 or Tier-2 source has yet announced either a finalised regime or a definitive decision not to regulate, so the Assessed confidence tier reflects genuine calibration rather than under-research. For operators considering a ringgit-pegged stablecoin, the practical consequence is market-access uncertainty pending the outcome of BNM's DAIH pilot programme.
Outlook
The DAIH pilot outcomes are the single clearest forward signal for Malaysia's stablecoin trajectory; a move toward a finalised licensing framework, if it comes, is most likely to be shaped by the pilot's findings on reserve backing, redemption and issuer eligibility. Absent a firm framework, activity-dependent routing between BNM and the Securities Commission will remain the default, and issuers should expect the current uncertainty to persist through 2026.
No periodic updates recorded against this sub-brief.
Operational resilience is governed by BNM's Risk Management in Technology (RMiT) policy document, the Malaysian analogue to DORA/FCA op-res. RMiT was first issued 2019/2020, updated 1 June 2023, and substantially revised effective 28 November 2025. It applies to banks, insurers/takaful, DFIs, payment system operators and approved e-money issuers under the FSA/IFSA/DFIA, covering governance, cybersecurity, third-party/cloud risk, identity controls and incident management. The 2025 revision imposes prescriptive operational-resilience obligations (e.g. critical-system maximum tolerable downtime of 120 minutes per incident / 4 hours cumulative annual) and mandatory rapid incident notification to BNM (within 1 hour of detection).
Standing sub-brief244 words · last cycle wpm-2026-06-24
Operational Resilience & Critical Infrastructure
BNM's Risk Management in Technology (RMiT) policy document, issued 28 November 2025, is a substantial revision of the 2019/2020 framework (as further updated 1 June 2023) and functions as Malaysia's DORA-analogue. It applies to banks, insurers and takaful operators, development financial institutions, payment system operators and approved e-money issuers. The policy sets prescriptive tolerances: critical systems face a maximum tolerable downtime of 120 minutes per incident and four hours cumulative annually; incidents must be notified to BNM within one hour of detection, with a full report due within 14 days and a post-incident review within 30 days. Stand-in-processing and capacity obligations do not bind immediately — firms have until 30 September 2027 to comply. The regime also requires dual reporting to the National Cyber Security Agency under the Cyber Security Act 2024. A November 2024 exposure draft signalled BNM's intent to extend equivalent resilience standards to non-bank merchant acquirers, a scope expansion that would bring RMiT-style obligations to a wider non-bank population than the current in-force text covers.
Outlook
The binding date for stand-in-processing and capacity obligations, 30 September 2027, is the key compliance deadline institutions across the sector — banks, PSOs and e-money issuers alike — need to plan against. Separately, the fate of the November 2024 exposure draft extending RMiT-equivalent resilience duties to non-bank merchant acquirers is worth tracking, as its finalisation would materially widen the population of non-bank entities subject to prescriptive downtime and incident-notification rules.
No periodic updates recorded against this sub-brief.
Card-scheme economics are regulated domestically by BNM's Payment Cards Framework (PCF) policy document (issued 19 August 2022, interchange ceilings effective 1 January 2023), which superseded the 2014 Payment Card Reform Framework (PCRF). The PCF lowered interchange ceilings (credit capped at 0.6%; domestic debit at the lesser of 0.1% or RM0.37 + 0.001%), subject to review every three years from 1 January 2023. Surcharging and minimum-purchase-amount practices on debit/credit card transactions are prohibited, with a cardholder complaint mechanism. Visa/Mastercard/JCB operate as international schemes; the domestic debit scheme MyDebit is operated by PayNet.
Open gap — wpm-int-1PCF interchange fee ceiling three-year review (first window early 2026): a BNM document dated 28 July 2025 titled 'Adjustment to the Debit Card Interchange Fee Ceiling' suggests a review/adjustment may have occurred, but the content was not accessible. The current standing position cites only the original 2023 ceilings — needs verification of any 2025/2026 adjustment before the W4 caps are treated as current.Possible live interchange-ceiling adjustment unverified due to inaccessible BNM PDF (Challenger f-004, verify_before_publish).
Standing sub-brief235 words · last cycle wpm-2026-06-24
Scheme & Network Compliance
Card-scheme economics in Malaysia are set by BNM's Payment Cards Framework (PCF), issued 19 August 2022 and superseding the 2014 Payment Card Reform Framework. Interchange ceilings took effect 1 January 2023: credit-card interchange is capped at 0.6%, and domestic debit interchange at the lesser of 0.1% or RM0.37 plus 0.001%. The PCF also prohibits surcharging and minimum-purchase practices and requires a cardholder complaint mechanism. International schemes Visa, Mastercard and JCB operate alongside MyDebit, the domestic debit scheme operated by PayNet. The interchange ceilings are subject to review every three years from 1 January 2023, placing the first scheduled review window in early 2026. A BNM document dated 28 July 2025 and titled "Adjustment to the Debit Card Interchange Fee Ceiling" suggests this review may already have produced a change to the debit ceiling, but its content was not accessible during this research cycle and the adjustment remains unverified — the current standing position therefore still cites the original 2023 ceilings pending confirmation.
Outlook
Verification of the 28 July 2025 BNM debit-interchange document is the immediate priority for this module; until confirmed, the three-yearly review cycle should be treated as a live variable for merchant and acquirer cost structures rather than a settled matter. If the ceiling has moved, downstream effects on acquirer and merchant economics would be the first material scheme-compliance change recorded for Malaysia since the 2023 ceilings took effect.
No periodic updates recorded against this sub-brief.
Sources and findings (4)
T1BNM Payment Card Reform Framework (interchange ceilings, 3-yr review from 1 Jan 2023) (bnm.gov.my)
Malaysia's principal domestic instant rail is DuitNow, operating on PayNet's Real-time Retail Payments Platform (RPP, live December 2018) on ISO 20022, with DuitNow QR providing a unified interoperable national QR standard. Cross-border corridors are built on QR-linkage and real-time-transfer interoperability under the ASEAN Regional Payment Connectivity (RPC) framework signed November 2022 by Indonesia, Malaysia, Philippines, Singapore and Thailand. Live linkages include DuitNow–PromptPay (Thailand), DuitNow–QRIS (Indonesia), DuitNow–NETS / PayNow (Singapore), plus China, Cambodia and others; the PayNow–DuitNow real-time fund-transfer link (Nov 2023) was notable for non-bank participation.
Standing sub-brief178 words · last cycle wpm-2026-06-24
Payment Corridor Dynamics
Malaysia's domestic instant-payments rail, DuitNow, runs on PayNet's Real-time Retail Payments Platform (RPP), live since December 2018 and built on ISO 20022 messaging, with DuitNow QR serving as the unified national QR standard. Malaysia has become one of the more active participants in ASEAN's Regional Payment Connectivity initiative, signed November 2022, with multiple live cross-border QR and real-time transfer linkages: DuitNow–PromptPay with Thailand, DuitNow–QRIS with Indonesia, and a DuitNow–NETS/PayNow real-time transfer link with Singapore established November 2023 that notably includes non-bank participation (subject to transaction limits). Further linkages extend to China and Cambodia, among others. This multi-corridor cross-border QR network is a genuine differentiator for remittance and travel-payment flows and aligns with the G20's cross-border payments roadmap.
Outlook
The MY–SG DuitNow–PayNow link's inclusion of non-bank participation is worth continued tracking as a template for how non-bank PSPs might gain broader cross-border settlement access elsewhere in the network. Further corridor expansion — additional ASEAN or extra-regional links — is the most likely next development in this module, building on the RPC framework signed in November 2022.
No periodic updates recorded against this sub-brief.
Malaysia's payments market is a bank/non-bank hybrid centred on PayNet (national payments utility, BNM the single largest shareholder alongside 11 financial institutions). The e-wallet segment is led by TNG Digital (Touch 'n Go), Boost, ShopeePay, GrabPay and BigPay; the regulatee population shows non-bank EMIs far outnumbering bank EMIs (~47–48 non-bank vs ~6 bank). The market is rapidly growing (18.4 billion e-payment transactions in 2025, +25% YoY) and is being reshaped by five digital banks licensed by BNM in 2022 (Boost-RHB, GXBank, SeaMoney-YTL, AEON, KAF). Digital payments hold roughly half the fintech market by service proposition.
Open gap — wpm-int-2Digital-bank consortium attribution: the W6 finding labelled one 2022 conventional licence holder as a 'Grab-Singtel-Kuok consortium' separate from the GXS Bank consortium; per BNM's 29 Apr 2022 announcement the licence was awarded to the GXS Bank-Kuok Brothers consortium (GXS being the Grab-Singtel entity), with Islamic licences to AEON-MoneyLion and KAF Investment Bank. Corrected in claim notes/cycle_delta (Challenger f-005).no under-indexing note recorded
Standing sub-brief237 words · last cycle wpm-2026-06-24
Industry Structure & Commercial Dynamics
Malaysia's payments market is a bank/non-bank hybrid centred on PayNet, in which BNM is the single largest shareholder alongside eleven financial institutions. The e-wallet segment is led by TNG Digital, Boost, ShopeePay, GrabPay and BigPay, and non-bank e-money issuers (approximately 47) far outnumber bank e-money issuers (approximately 6). The market processed 18.4 billion e-payment transactions in 2025, up 25% year-on-year, with retail e-payment value of RM831 billion and a 17% compound annual growth rate since 2022. BNM awarded five digital-bank licences in 2022: on the conventional (FSA) side, to Boost-RHB, GXS Bank-Kuok Brothers, and Sea-YTL; on the Islamic (IFSA) side, to AEON-MoneyLion and KAF Investment Bank. (An earlier characterisation of one conventional licensee as a "Grab-Singtel-Kuok consortium" has been corrected: GXS Bank is the Grab-Singtel entity, and its licence was awarded jointly with Kuok Brothers.) Digital payments account for roughly 50.7% of Malaysia's fintech market in 2025. Taken together, this is a non-bank-dominated, rapidly growing market being reshaped by the 2022 digital-bank cohort.
Outlook
The performance of the five 2022 digital-bank licensees, and the extent to which they draw volume away from incumbent e-wallets, is the key structural variable to track in this module. Continued high transaction-volume growth (25% YoY in 2025) suggests the non-bank-dominated structure of the market is unlikely to reverse in the near term, though further consolidation among e-wallets (see W13) could shift the competitive balance among non-bank players.
No periodic updates recorded against this sub-brief.
Payments-relevant legal action in Malaysia is dominated by BNM administrative enforcement (compound/monetary penalties) rather than landmark civil litigation, focused on AML/CFT/sanctions-screening and operational-resilience (RMiT) breaches. Notable actions include the May 2023 penalty on TNG Digital (sanctions-screening lapse), the July 2025 RM340,000 fine on Alipay Malaysia (AIMY Merchant Services) for failing to update its sanctions database, and July 2025 penalties totalling over RM7 million on Bank Islam, Bank Rakyat and BSN for RMiT/availability and sanctions-screening breaches. The AMLA was amended in December 2024 to strengthen supervision and enforcement.
Standing sub-brief178 words · last cycle wpm-2026-06-24
Legal & Litigation
Malaysia's payments-enforcement landscape is dominated by BNM administrative penalties rather than landmark civil litigation, with recent actions concentrated on sanctions-screening and RMiT-related operational-resilience breaches. TNG Digital was penalised in May 2023 over sanctions-screening failures. In July 2025, BNM fined Alipay Malaysia (operating as AIMY Merchant Services) RM340,000 for a sanctions-database failure, and in the same month imposed penalties totalling more than RM7 million on three banks — Bank Islam (RM3.445 million), Bank Rakyat (RM2.85 million) and Bank Simpanan Nasional (RM995,000) — for RMiT and sanctions-screening breaches. The Anti-Money Laundering Act was amended in December 2024. Enforcement activity spans both bank and non-bank PSPs, indicating BNM's administrative posture is applied consistently across the industry rather than concentrated on one segment.
Outlook
The consistency of BNM's July 2025 enforcement wave — hitting both a non-bank PSP (Alipay/AIMY) and three banks within the same month — suggests sanctions-screening and RMiT compliance will remain the two leading enforcement themes through 2026. Any further administrative penalties are likely to continue this dual focus rather than shift toward new enforcement categories.
No periodic updates recorded against this sub-brief.
Merchant acquiring is a registered (not licensed) activity under section 17 FSA 2013, with BNM's Policy Document on Merchant Acquiring Services (issued 15 September 2021) setting governance, operational-risk, IT-management, minimum-capital (non-bank) and merchant-onboarding/recruitment requirements. The PD took effect for bank acquirers from 15 March 2022 and for non-bank acquirers (minimum capital) from 15 September 2023. The registered acquirer base is broad — including TNG Digital, GHL, ShopeePay, Razer Merchant Services, Stripe and FIS Worldpay — and the November 2024 RMiT exposure draft would extend resilience standards to non-bank merchant acquirers.
Standing sub-brief166 words · last cycle wpm-2026-06-24
Merchant Acquiring & Risk
Merchant acquiring in Malaysia is a registered, not licensed, activity under section 17 of the FSA 2013. BNM's Policy Document on Merchant Acquiring Services, issued 15 September 2021, sets governance, operational-risk, IT and merchant-onboarding requirements, alongside minimum-capital requirements for non-bank acquirers; the requirements became effective for bank acquirers from 15 March 2022 and for non-bank capital requirements from 15 September 2023. The registered base is broad, including TNG Digital, GHL, ShopeePay, Razer, Stripe and FIS Worldpay among more than 40 registered acquirers. A November 2024 RMiT exposure draft would extend operational-resilience standards to non-bank merchant acquirers, which are not currently within RMiT's in-force scope.
Outlook
The registration (rather than licensing) model keeps entry friction relatively low for global acquirers such as Stripe and Worldpay, but the pending RMiT exposure draft is the key variable that would raise ongoing resilience-compliance costs specifically for non-bank acquirers if finalised. Its progress should be tracked alongside the main RMiT stand-in-processing deadline of 30 September 2027 (W3).
No periodic updates recorded against this sub-brief.
DuitNow remains MY's core instant-payments rail; 2026 developments include cross-border QR interoperability expansion (2.5x growth to 29.7m transactions in 2025) and deepened Project Nexus multilateral integration via a PayNet-NETS joint venture appointed Nexus Technical Operator (Feb 2026).
Movement — NEWDuitNow cross-border interoperability and Project Nexus involvement establishedFirst-cycle capture of MY instant-payments rail baseline.
Standing sub-brief172 words · last cycle wpm-2026-08-05
Product Innovation & Market Development
BNM's product-development agenda runs through the Financial Sector Blueprint 2022–2026, PayNet's RPP modernisation programme, and the Interoperable Credit Transfer Framework (ICTF), which gives banks and eligible non-bank e-money issuers fair, open access to shared payments infrastructure. Live build-out includes DuitNow QR, Request-to-Pay, e-mandates/AutoDebit, cross-border QR expansion and tap-to-phone acceptance (via Soft Space). Sandbox activity is running at both BNM (the Digital Asset Innovation Hub, launched June 2025) and the Securities Commission (a digital-asset/tokenisation sandbox, 2025), alongside CBDC-exploratory work through Project Dunbar and tokenised-deposit pilots. The ICTF's open-access mandate is a distinct market-access lever for non-bank EMIs, separate from the specific product launches tracked in W13.
Outlook
Continued build-out of Request-to-Pay and e-mandate functionality on the RPP rail is the most concrete near-term product development to track, alongside further cross-border QR expansion beyond the current Thailand, Indonesia and Singapore linkages. The BNM and Securities Commission sandbox programmes are the mechanisms most likely to produce the next generation of regulated product innovation, including any eventual stablecoin or tokenised-deposit pilots.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Product Innovation & Market Development
Malaysia's instant-payments infrastructure deepened its regional and cross-border reach this cycle on two fronts. DuitNow QR, operated by PayNet, is now interoperable with Thailand's PromptPay, Singapore's NETS, Indonesia's QRIS, Chinese payment networks, and, as of 2025, Cambodia's Bakong, and cross-border QR transaction volume grew 2.5 times to 29.7 million transactions in 2025. Separately, a PayNet-NETS joint venture was appointed Nexus Technical Operator by Nexus Global Payments in February 2026, formalising Malaysia's role as a founding member of Project Nexus alongside India, the Philippines, Singapore and Thailand, with Bank Indonesia joining in 2026 as the scheme's sixth member.
These two developments are structurally connected: DuitNow's bilateral QR interoperability agreements and Malaysia's Project Nexus participation both extend the same underlying domestic instant-payments rail outward, but they operate through different technical models — QR interoperability is a bilateral, scheme-to-scheme linkage model, while Project Nexus is a multilateral hub-and-spoke interlinkage architecture designed to let any participating country's instant-payment system reach any other participant's system through common infrastructure operated by the appointed Technical Operator. Malaysia now has meaningful exposure to both models simultaneously, and the PayNet-NETS joint venture's appointment as Technical Operator gives Malaysia direct operational influence over the multilateral rail rather than participation as a connecting member only.
The 2.5-times growth in cross-border QR transaction volume is a genuine product-adoption signal, though it should be read as a single-year comparison rather than an established multi-year trend given the sourcing available this cycle.
Outlook
Bank Indonesia's 2026 addition to Project Nexus as a sixth member will be a useful comparator for whether the interlinkage model scales smoothly as membership grows, and the PayNet-NETS joint venture's early performance as Technical Operator is worth tracking as the first indicator of Malaysia's execution capacity in that operational role. Continued DuitNow QR interoperability expansion to additional ASEAN or wider Asia-Pacific corridors would be the next logical development to watch for.
Consumer protection rests on BNM's conduct framework (Fair Treatment of Financial Consumers; Complaints Handling PD of March 2025, effective April 2026) with redress via the Financial Markets Ombudsman Service (FMOS) — created 1 January 2025 by merging the Ombudsman for Financial Services (OFS) and SIDREC — and BNMLINK. Malaysia has NO statutory mandatory APP-fraud reimbursement scheme equivalent to the UK PSR model; instead BNM requires banks to ensure fair redress for unauthorised-transaction victims who took protective steps and did not act fraudulently, coordinated via the National Scam Response Centre / PDRM / MCMC anti-scam framework.
Standing sub-brief201 words · last cycle wpm-2026-06-24
Consumer Protection & APP Fraud
Malaysia has no statutory mandatory reimbursement scheme for authorised-push-payment fraud victims equivalent to the UK's PSR-mandated model. Instead, BNM requires banks to ensure fair redress for victims of unauthorised transactions who took reasonable protective steps and did not act fraudulently, with case coordination running through the National Scam Response Centre alongside the police (PDRM) and the communications regulator (MCMC). Redress channels were consolidated on 1 January 2025 with the creation of the Financial Markets Ombudsman Service (FMOS) from the merger of the Ombudsman for Financial Services and SIDREC, alongside the BNMLINK channel. The Complaints Handling policy document, issued 28 March 2025, enters full force 1 April 2026 and formalises the FMOS/BNMLINK escalation pathway for financial service providers. The absence of a mandatory APP-reimbursement liability model materially lowers PSP consumer-fraud liability exposure in Malaysia relative to jurisdictions with statutory reimbursement mandates.
Outlook
The Complaints Handling PD's 1 April 2026 full entry into force is the near-term marker for this module. Beyond that, whether BNM moves toward a more UK-style mandatory reimbursement liability model — rather than the current fair-redress expectation — is the key open question, though no such proposal is currently signalled in the available record.
No periodic updates recorded against this sub-brief.
[SENTINEL-FED] Sentinel.gi payments-context position: Malaysia's AML/CFT regime rests on the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), supervised by BNM's Financial Intelligence & Enforcement Department (FIED). Payments-context posture: stringent sanctions/PEP screening and CDD obligations on EMIs and payment institutions, active administrative enforcement (TNG Digital 2023; Alipay/AIMY 2025), AMLA strengthened December 2024 ahead of the 2025 FATF mutual evaluation, with CPF (counter-proliferation-financing) provisions added. No original FIM analysis performed here.
Standing sub-brief172 words · last cycle wpm-2026-06-24
AML/CFT & Financial Crime
[Sentinel-sourced] Malaysia's AML/CFT regime rests on the Anti-Money Laundering Act 2001, supervised by BNM's Financial Intelligence and Enforcement Department (FIED). In the payments context, this translates into stringent sanctions and PEP-screening and customer-due-diligence obligations on e-money issuers and payment institutions: reporting institutions, including e-money issuers, must screen both new and existing customers against the Domestic List and UN sanctions lists. The AMLA was strengthened in December 2024 with counter-proliferation-financing provisions, timed ahead of Malaysia's 2025 FATF mutual evaluation. This intelligence is attributed to the Sentinel.gi feed; the payments-context sanctions-screening and CDD posture described here is carried as the relevant EMI/PSP compliance-cost signal, and readers seeking the underlying illicit-finance and sanctions-evasion analysis should refer to the Financial Intelligence Monitor, to which this material has been cross-referenced.
Outlook
Malaysia's 2025 FATF mutual evaluation outcome, expected through 2026, is the principal forward variable shaping AML/CFT supervisory intensity on EMIs and PSPs. Continued sanctions-screening enforcement (see W7) suggests BNM is treating this as an active compliance priority ahead of the evaluation result.
No periodic updates recorded against this sub-brief.
T?FIM (sentinel.gi) per-JID baseline profile — Malaysia — Malaysia operates under the AMLA 2001 (Act 613), supervised by Bank Negara Malaysia, the Securities Commission and the Labuan FSA, coordinated via the National Coordination Committee to Counter Money Laundering. FATF's Dec 2025 MER rates Malaysia compliant on 24 Recommendations and largely compliant on 16, citing a sound legal/supervisory architecture but persistent weaknesses converting investigations into prosecutions, dissuasive sanctions, and BO/TCSP oversight in Labuan.
Foreign PSPs are gaining direct domestic-rail access: Wise connected directly to PayNet in mid-2026, its ninth global and fifth APAC direct domestic-system connection.
Movement — NEWWise direct PayNet connection establishedFirst-cycle capture of MY correspondent/direct-access baseline.
Open gap — wpm-int-4Non-bank settlement-access and tiered RENTAS access dynamics rely on a 2021 World Bank case study; current (2026) non-bank participation thresholds and any RENTAS+ direct-access changes for PSPs are not confirmed and should be refreshed.Non-bank PSP settlement access is an under-indexed access dynamic; primary data dated 2021.
Standing sub-brief215 words · last cycle wpm-2026-08-05
Correspondent Banking, Settlement & Access
The analytical spine of this module is Malaysia's bank/non-bank settlement-access asymmetry. RENTAS, operated by PayNet since July 1999, is Malaysia's only large-value payment system, settling high-value ringgit interbank funds and scripless securities with finality across BNM's books; it supports payment-versus-payment settlement through a ringgit–USD CHATS link with Hong Kong established November 2006, and foreign-currency settlement via Onshore Settlement Institutions. Non-bank participants in PayNet's Real-time Retail Payments Platform have no direct access to RENTAS and must settle through settlement banks — a structural constraint on non-bank market participants that persists even as the settlement rails around them are modernised. That modernisation arrived in October 2025 with the launch of RENTAS+, the first ASEAN RTGS system to offer round-the-clock (24/7) gross settlement, which now settles DuitNow retail transactions on a gross basis with an automated liquidity facility.
Outlook
The tiered non-bank settlement-access model — under which non-bank PSPs settle via settlement banks rather than directly through RENTAS — is the structural dynamic most worth tracking in this module; whether RENTAS+ or future settlement-infrastructure upgrades extend any form of direct or semi-direct access to non-bank participants would be a material change to Malaysia's settlement-access architecture. Absent that, RENTAS+'s 24/7 gross-settlement capability for DuitNow retail flows remains the leading settlement-finality development in the market.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Correspondent Banking, Settlement & Access
Wise connected directly to PayNet this cycle, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is the clearest correspondent-banking-access development of the cycle and should be read against this module's central analytical spine: the structural asymmetry between bank and non-bank access to domestic payment rails. A direct PayNet connection allows Wise, a non-bank payment institution, to settle DuitNow QR transactions without routing through a correspondent bank intermediary, reducing both cost and settlement-time exposure to intermediary-bank risk that non-bank PSPs have historically had to absorb when accessing domestic rails indirectly.
The significance of this connection is best understood by its place in a sequence: it is explicitly Wise's ninth global and fifth Asia-Pacific direct domestic connection, indicating this is part of a deliberate, scaling strategy by a major non-bank PSP to secure direct rail access across multiple jurisdictions rather than an isolated Malaysia-specific event. For Malaysia specifically, it demonstrates that PayNet's direct-connection model is open to non-bank PSPs meeting its access criteria, which is itself informative for other non-bank payment institutions evaluating whether direct domestic-rail access is a realistic alternative to correspondent-bank-intermediated access in Malaysia.
Outlook
Whether other major non-bank PSPs follow Wise's path to direct PayNet connection is the key development to watch in this module next cycle, as is whether PayNet's access criteria evolve as its direct-connection non-bank population grows. This connection also bears watching alongside the Technology Requirements Policy Document reported elsewhere this cycle, since PayNet itself is named as newly captured under that framework's technology-governance obligations.
Trailing-12-month commercial activity (run date 2026-06-24) centres on capital injections into e-wallet/digital-banking players and merchant-acquiring/cross-border product expansion. TNG Digital secured ~USD 75 million from strategic investors and targeted first full-year profitability in 2025; Axiata's Boost was reportedly in talks with a potential new shareholder (regulatory approval pending). Funding leaders include TNG Digital (~USD 168m cumulative), BigPay (~RM475m) and Boost (~RM308m). RENTAS+ (Oct 2025) and continued cross-border QR linkages are the principal product releases.
Movement — NEWSunRate licence approval and Wise-PayNet launch recordedFirst-cycle capture of MY commercial-intelligence events.
Open gap — wpm-int-5W13 commercial-event data (TNG Digital USD75m, Boost shareholder talks, BigPay/Boost cumulative funding) rests on T3 trade-press/aggregator sources (mordorintelligence, fintechnews.my, tracxn); deal values and round stages are not corroborated by primary filings, and Boost's shareholder change is rumoured/pending regulatory approval.Private-company commercial signals under-indexed; values unverified against primary sources.
Standing sub-brief175 words · last cycle wpm-2026-08-05
Three discrete commercial events are recorded for Malaysia this cycle. TNG Digital (Touch 'n Go) raised USD 75 million from strategic investors in 2025, targeting first full-year profitability the same year; the round brings TNG Digital's cumulative funding to roughly USD 168 million, making it Malaysia's most-funded fintech as of October 2025. Axiata's Boost Holdings is reportedly in talks with a potential new shareholder; the amount involved is not publicly disclosed, and the investment still requires regulatory approval. Separately, PayNet launched RENTAS+ in October 2025 — an in-house, cloud-based enhancement enabling continuous 24/7 interbank settlement and the first such round-the-clock RTGS capability in ASEAN, now settling DuitNow retail paymentson a gross basis (also recorded as a structural settlement development under W12).
Outlook
The completion status of the Boost/Axiata shareholder talks — currently rumoured and pending regulatory approval — is the clearest near-term event to track in this module. TNG Digital's stated target of first full-year profitability in 2025 is a second marker worth monitoring for confirmation in subsequent reporting.
Periodic update · new data 2026-08-11 · run wpm-2026-08-05
Commercial Intelligence & Fintech
This cycle's discrete commercial event is Wise's direct connection to PayNet, announced 30 July 2026, enabling DuitNow QR payments and marking Wise's ninth global and fifth Asia-Pacific direct domestic payment-system connection. This is a product-launch and market-access event specific to Wise and PayNet rather than a structural industry-wide trend, and it is treated here as a discrete commercial development distinct from the broader correspondent-banking-access analysis this same event supports under this cycle's W12 reading.
No merger, acquisition, or funding-round event was identified for Malaysia this cycle. SunRate's reported BNM licence approval on 28 April 2026 is a market-access event more than a commercial-intelligence event in the M&A/investment/product-launch sense this module tracks, and is addressed under this cycle's W1a licensing reading rather than duplicated here.
Outlook
Continued monitoring for disclosed M&A, investment, or product-launch activity among Malaysia-licensed payment institutions is warranted next cycle, particularly given the active licence-processing and technology-governance developments recorded elsewhere this cycle that may prompt commercial responses from incumbent and new-entrant PSPs alike.
Filters combine as OR inside a group and AND across
groups.
Editorial metadata
Provenance only. Nothing below gates publication or affects the render.
Editorial metadata for Malaysia
Field
Value
trust.lawyer_review.status
never_reviewed
trust.lawyer_review.reviewer
not recorded
trust.content_source
ai_generated
Provenance and declared absence
Disclosure model: module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is.
Sentinel-fed modules receive no special rendering treatment. sentinel_feed is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page.
Family taxonomy is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning.