Accepting Payments in Malaysia: When You Need Bank Negara Approval

A founder adds a wallet so customers can top up and pay faster. Somebody mentions a BNM licence and the feature dies in a meeting. Another founder ships the same thing and is fine. The difference is a gazette order most people have never read.

The default: you are not regulated

If you sell goods or services and accept cards, FPX or a wallet through a gateway, the gateway or acquiring bank holds the authorisation, not you. You are a merchant. The perimeter starts when you hold other people’s money rather than merely being paid.

What actually needs approval

Section 8(1)(b) of the Financial Services Act 2013 requires BNM approval under s.11 for any business in Division 1 of Part 1 of Schedule 1. For payments that is two things: operating a payment system — enabling fund transfers between banking accounts, or payment instrument network operation — and issuing a designated payment instrument. The penalty under s.8(3) is up to 10 years, a RM50 million fine, or both.

Designated payment instruments are prescribed by P.U.(A) 202/2013 as amended by P.U.(A) 82/2016: charge card, credit card, debit card and electronic money. Under s.2, e-money stores funds electronically in exchange for funds paid to the issuer and can be used to pay any person. Hence the trap: a top-up wallet is e-money.

Merchant acquiring services sit in Part 2 of Schedule 1 as a registered business under s.17, penalty up to 8 years or RM25 million. P.U.(A) 468/2024 now requires the applicant to be a company incorporated under the Companies Act 2016 — an instrument BNM’s Gazette Order page omits.

The capital numbers

Schedule 1 to P.U.(A) 204/2013 as substituted by P.U.(A) 403/2022, in operation 30 December 2023, sets minimum capital funds of RM1,000,000 or 8% of outstanding e-money liabilities, whichever is higher, for a standard issuer — and RM5,000,000 or 8% for an eligible issuer.

An eligible issuer is one BNM categorises under paragraph 2A for having 500,000 active users over six consecutive months, or a 5% market share of Malaysian e-money transaction volume, value or outstanding liabilities.

The exemption that changes the answer

Here is the instrument almost nobody cites. The Financial Services (Limited Purpose Electronic Money) (Exemption) Order 2024, P.U.(A) 463/2024, made under s.263 and in operation 2 January 2025, exempts four categories of limited purpose e-money from s.8(1)(b) and s.11 altogether.

Category	Scope
1 — goods or services	Usable solely at a single premises or single business chain under a single brand in Malaysia
2 — rewards	Funded by a person under an arrangement with the issuer, spendable only with someone other than that funder, held separately
3 — refunds	Used to return funds to users, by the issuer or for another person under an arrangement with it
4 — telco digital goods	Issued by a telco for low-value digital goods (music, video, software, games, ringtones) consumed via a telecommunication device

Category 1 is the closed-loop case most founders need, and it carries hard numbers: a purse limit not exceeding RM500 per user, and daily average outstanding liabilities and average monthly transaction value each not exceeding RM1,000,000 per issuer for a given year.

The exemption is conditional. Every category requires PDPA 2010 compliance, clear and prominent disclosure that the business is not subject to approved-issuer requirements, a complaints and dispute resolution mechanism, and a facility to move stored funds to the user’s bank account. Category 1 adds two annual filings: a notification and undertaking that the criteria are met, and externally audited statistics on liabilities, users and transaction volume and value.

It ceases on failure of a condition, conviction for a fraud-related offence, or BNM suspicion of one — with 30 days notice to show cause in the first and third.

Common mistakes

Assuming stored value is safe because it is small. It is safe because of P.U.(A) 463/2024, and only within its categories and limits. Cross RM500 per user, or open the wallet to merchants outside your own brand, and Category 1 stops applying.

Calling it points. The definition turns on storing funds paid to you and being spendable. The label is irrelevant.

Confusing approval with registration. Payment systems and e-money need s.11 approval; merchant acquiring needs s.17 registration.

Assuming remittance is covered here. Cross-border transfer is licensed separately under the Money Services Business Act 2011.

What’s next

Answer one question first: does your product hold customer funds that can later be spent with someone else? If not, you are a merchant and the gateway carries the licence. If yes, work through P.U.(A) 463/2024 category by category, testing the RM500 and RM1 million thresholds against your projections rather than today’s numbers. Outside the exemption the route is an application under s.9. Where the answer is unclear — marketplaces holding funds between buyer and seller are the usual hard case — put the facts to BNM before you build.