Corporate Liability for Corruption: MACC Act Section 17A and Adequate Procedures

A junior sales agent pays a kickback to win a contract, and never tells the board. Under Malaysian law since 2020, that act can expose the company itself to prosecution — and the directors alongside it. That is the reach of Section 17A of the Malaysian Anti-Corruption Commission Act 2009.

For decades, prosecuting a company for corruption meant proving that a “directing mind” at the top had authorised the bribe. Section 17A changes that position. It introduces a corporate offence modelled on the UK Bribery Act, and it shifts the usual burden of proof onto the organisation.

What does Section 17A actually make illegal?

Section 17A was inserted by the Malaysian Anti-Corruption Commission (Amendment) Act 2018 and came into force on 1 June 2020.

Under s.17A(1), a commercial organisation commits an offence if a person associated with it corruptly gives, offers or promises any gratification with the intent to obtain or retain business, or a business advantage, for that organisation. The bribe flows outward — from the organisation’s people to a third party — for the organisation’s benefit.

The offence does not require the board, the CEO or any senior manager to have known about the bribe. If the associated person did it for the organisation’s benefit, the organisation can be held liable.

A “commercial organisation” is defined broadly under s.17A(8): companies incorporated under the Companies Act 2016, partnerships and limited liability partnerships, and — importantly — any foreign company or partnership that carries on a business or part of a business in Malaysia.

Who counts as an “associated person”?

This is where the risk widens beyond the payroll. Under s.17A(6), an associated person is:

a director, partner or employee of the commercial organisation, or a person who performs services for or on behalf of the commercial organisation.

That last limb is deliberately wide. It can capture agents, distributors, contractors, consultants and other third parties acting for the company. In practice, third-party intermediaries are where much bribery risk sits — which is why third-party due diligence is a central part of any credible compliance programme.

How severe are the penalties?

Section 17A is a serious criminal offence, not a minor regulatory one. On conviction under s.17A(2), a commercial organisation faces:

Element	What the law provides
Effective date	1 June 2020 (MACC (Amendment) Act 2018)
Fine	Not less than 10 times the value of the gratification, or RM1 million, whichever is higher
Imprisonment	Up to 20 years
Combination	A fine or imprisonment or both
Only defence	”Adequate procedures” under s.17A(4)

The “ten times or RM1 million, whichever is higher” floor means the fine scales with the size of the bribe and has no ceiling tied to it — a large corrupt gain can produce a very large minimum fine.

Why are directors personally exposed?

Section 17A(3) creates personal exposure at board level. Where a commercial organisation is found to have committed the offence, every person who was a director, controller, officer or partner, or who was concerned in the management of its affairs at the time is deemed to have committed the same offence.

The deeming is rebuttable, but the burden is on the individual. To escape liability, that person must prove two things:

1. the offence was committed without their consent or connivance; and
2. they exercised due diligence to prevent the offence, having regard to the nature of their function and the circumstances.

In other words, “I didn’t know” is not enough on its own. A director must be able to point to what they actually did to prevent corruption — governance, oversight and documented diligence — not merely to their ignorance of a specific act.

What is the “adequate procedures” defence?

Section 17A reverses the ordinary presumption for this offence. Once the prosecution proves the corrupt act by an associated person for the organisation’s benefit, the organisation is presumed liable. The only statutory way out is s.17A(4): the organisation must prove, on the balance of probabilities, that it had in place adequate procedures designed to prevent associated persons from engaging in that conduct.

The Act does not define “adequate procedures”. To fill the gap, the Governance, Integrity and Anti-Corruption Centre (GIACC) under the Prime Minister’s Department issued the Guidelines on Adequate Procedures, made pursuant to s.17A(5). The Guidelines set out five principles, remembered by the acronym T.R.U.S.T.

What are the five T.R.U.S.T. principles?

Principle	Focus	In practice
T — Top-Level Commitment	The board and senior management own anti-corruption.	Approve the anti-bribery policy, allocate resources, model integrity, review compliance reporting.
R — Risk Assessment	Identify where corruption risk actually sits.	Periodic, documented assessment of internal and external risks — sectors, geographies, third parties, transactions.
U — Undertake Control Measures	Put proportionate controls in place.	Policies on gifts, hospitality and facilitation payments; third-party due diligence; financial controls; whistleblowing channels.
S — Systematic Review, Monitoring and Enforcement	Test that controls work and act when they don’t.	Regular audits, monitoring, investigation of breaches and consistent disciplinary action.
T — Training and Communication	Make everyone understand the rules.	Internal and external communication of policy, plus role-appropriate training for staff and relevant third parties.

The Guidelines are not a safe harbour — following them does not guarantee acquittal — but they are the reference framework a court is likely to weigh when judging whether procedures were “adequate” for a particular organisation’s size and risk profile. Procedures must be proportionate: what is adequate for a multinational differs from what is adequate for a small firm.

Where does the company secretary fit in?

Section 17A makes anti-corruption a governance obligation with personal exposure for those in the boardroom. The company secretary is often the person who operationalises that obligation: ensuring the anti-bribery policy is board-approved and minuted, that risk assessments are scheduled and recorded, that the diligence trail exists, and that training and policy reviews actually happen and are documented.

Because the director’s defence under s.17A(3) turns on evidence of due diligence, and the organisation’s defence under s.17A(4) turns on evidence of adequate procedures, documentation does much of the evidential work. Well-kept minutes, dated policies, risk registers and training records are the raw material from which either defence is built.

What’s next

If your organisation carries on business in Malaysia, treat Section 17A as a live risk, not a future one — it has been in force since June 2020.

• Map your associated persons. List not just employees but every agent, distributor and contractor who acts for you, and rank them by corruption risk.
• Run a documented risk assessment. The “R” in T.R.U.S.T. is the foundation of everything else; without it, controls look arbitrary.
• Get the board on the record. Ensure top-level commitment is minuted and that directors can each show the due diligence that s.17A(3) requires of them.
• Build the evidence trail. Dated policies, gift and hospitality logs, due-diligence files, training attendance and audit reports are the material a s.17A(4) defence is built from.

For the exact statutory wording, consult the Malaysian Anti-Corruption Commission Act 2009 and the GIACC Guidelines on Adequate Procedures directly, and take professional legal advice tailored to your organisation’s size and risk profile — this article is general information, not legal advice.