MBRS 2.0: Filing Annual Returns and Financial Statements to SSM in XBRL

For twenty years a set of Malaysian financial statements went to SSM as a signed PDF. Nobody read the numbers. They sat in a document store, retrievable but inert.

MBRS 2.0 ended that. Every figure you lodge is now tagged against a published taxonomy, validated on submission, and machine-readable the moment it lands. The practical consequence is not that filing got harder — it is that filing got strict. A rounding difference between your statement of financial position and your statement of changes in equity used to be invisible. Now it fails validation, at four in the afternoon on the deadline day, and the deadline does not move.

What MBRS 2.0 actually is

MBRS is SSM’s digital lodgement platform for three families of submission:

• Annual Return (AR) under the Companies Act 2016 and the Companies Act 1965
• Financial Statements and Reports (FS), prepared under MFRS for entities applying the full standards or MPERS for private entities
• Exemption Applications (EA) relating to financial statements and annual returns, plus rectification applications and exempt private company certificates

Version 2.0 is a rebuild, not a patch. It carries a revised SSM Taxonomy (SSMxT), a rebuilt preparation tool, and — the part that changed everyone’s workflow — a mandatory scope that no longer treats XBRL as optional for the companies that used to file on paper or as a PDF attachment.

Which filings became mandatory, and when

SSM announced the phased mandatory implementation on 26 November 2024. Three phases, three dates, three different scopes. Most vendor content collapses these into a single “MBRS 2.0 is mandatory from 2025” line, which is wrong in both directions — some filings were mandatory earlier, some later.

Phase	Effective	Scope
Phase 1	1 December 2024	Companies Act 2016: annual returns, unaudited financial statements, exempt private company certificates, rectification applications, and extension applications relating to them
Phase 2	1 March 2025	Companies Act 1965: annual returns, financial statements, exempt private company certificates. Also statutory declarations and home-country financial statements for foreign companies, plus rectification of audited financial statements
Phase 3	1 June 2025	Companies Act 2016: audited financial statements, related rectification applications, and extension and exemption applications for audited statements

The implementation reaches companies registered under either the 1965 or the 2016 Act, regulated financial institutions, and foreign companies operating in Malaysia.

That last category matters. Historically the banking, financial and insurance sector sat outside XBRL lodgement. Under the announced scope it does not. Before you rely on any residual exemption for a Bank Negara or Securities Commission regulated entity, check the current SSM MBRS FAQ — this is one of the few points in the framework that has moved more than once.

The two tools, and why people confuse them

MBRS 2.0 splits preparation from submission. This trips up first-time filers constantly.

mTool is an offline preparation tool. You install it locally, choose the filing type and the applicable taxonomy, key or map your data, and generate a validated XBRL instance document. Nothing about mTool touches SSM’s servers. It is where the work happens and where the errors surface.

mPortal is the online submission portal, reached through SSM4U. You upload the XBRL file produced by mTool, pay the prescribed fee, and receive the lodgement acknowledgement. mPortal is where the clock stops.

Two consequences follow. First, a file that validates in mTool can still be rejected at mPortal for a company-level reason — wrong financial year, a filing already on record, a company status that blocks the submission. Second, mTool and taxonomy versions are updated without fanfare. Preparing a filing in a stale mTool build is a common and entirely avoidable rejection.

Who is allowed to lodge

Submission through mPortal is made by a lodger. A lodger must hold an active practising certificate issued under section 241 of the Companies Act 2016 and be registered with a digital certificate through SSM’s PKI arrangement.

A maker role exists for staff who prepare and upload the XBRL file, but the lodgement itself is the lodger’s act. Separate roles exist for liquidators and official receivers filing for companies in winding up or dissolved status.

A director cannot lodge. This is the same structural point SSM applies to extension of time applications, which SSM has stated must be made by the company secretary rather than by a director. If your company secretary’s practising certificate has lapsed, you do not have a filing channel — and you will discover that on the day you try to use it.

MBRS 2.0 did not move a single statutory deadline

This is the single most important thing to understand, and the point on which vendor marketing is most misleading.

The Companies Act 2016 sets the clocks. MBRS 2.0 sets the format. They are independent.

• Annual return: within 30 days of the anniversary of the incorporation date, under s.68(1). Not required in the calendar year of incorporation, under s.68(2).
• Circulation of financial statements: within six months of financial year end for a private company, under s.258(1)(a). At least 21 days before the AGM for a public company, under s.258(1)(b).
• Lodgement of financial statements: within 30 days from circulation for a private company, under s.259(1)(a). Within 30 days from the AGM for a public company, under s.259(1)(b).

Those two financial statement deadlines are sequential, not parallel. The lodgement clock does not start until circulation happens. Circulating early shortens your total runway rather than extending it — a point worked through in full in the companion page on circulating and lodging financial statements.

The filing-type matrix

What you lodge depends on what kind of company you are and whether the accounts were audited.

Situation	What goes to SSM	Statutory basis
Private company, audited accounts	Audited financial statements and reports	s.259(1)(a)
Private company, audit-exempt under PD 10/2024	Unaudited financial statements, directors’ report, statement by directors, statutory declaration, plus the audit exemption certificate	s.258, s.259, PD 10/2024 paras 15–19
Exempt private company electing the certificate route	A certificate as to EPC status signed by a director, the auditor and the secretary, in lieu of s.259(1)(a)	s.260(1)
Public company	Audited financial statements, within 30 days of the AGM	s.259(1)(b)
Foreign company	Home-country financial statements and statutory declaration	Phase 2 scope
Any company	Annual return	s.68(1)

Note the trap in row three. An exempt private company that opts to lodge the s.260 certificate is expressly excluded from audit exemption under paragraph 12(a) of Practice Directive 10/2024. You cannot take the EPC certificate route and skip the audit. Choose one.

What XBRL changes about preparation

Tagging is not data entry with extra steps. Three things behave differently once the figures are structured.

Internal consistency is enforced. In a PDF, a total that disagreed with the sum of its components by one ringgit was a typo nobody found. In XBRL it is a validation failure that blocks submission. The most common cause is a set of accounts assembled across several spreadsheets and never cross-footed.

The taxonomy dictates the line items, not your chart of accounts. SSMxT defines the elements available. A company with idiosyncratic account names has to map them to taxonomy concepts, and that mapping decision is a judgement — the same balance can be tagged correctly in more than one way, and the choice should be made once and applied consistently across years so the filings remain comparable.

Comparatives matter more. Because the prior year is tagged too, a restatement or a reclassification is now visible in the data rather than buried in a note. Where the presentation of the comparative changes, expect to explain it rather than quietly re-present it.

The practical effect is that the work moves earlier. Preparation that used to happen in the last week before lodgement now has to happen before the file can be validated at all, which is precisely why the seven-day extension lead time is so often missed — by the time a company knows the file will not validate, the window to ask for more time has already shut.

Fees

Lodgement fees are prescribed in the Companies Regulations 2017 and published in SSM’s Table of Fees. As at the date of this page:

Filing	Fee
Annual return, private company (s.68)	RM150
Annual return, public company (s.68)	RM500
Financial statements, private company, audited (s.259)	RM50
Financial statements, private company, non-audited (s.259)	RM20
Financial statements, public company, audited (s.259)	RM200
Certificate relating to exempt private company (s.260)	RM200
Application for extension of time for lodgement of financial statements (s.259)	RM100
Application for extension of time to hold an AGM (s.340)	RM100

What happens when you miss the date

Two separate consequences run in parallel, and they are routinely conflated.

The late lodgement penalty is administrative, charged at the counter under paragraph 17 of Practice Directive 1/2017 (revised 1 October 2024):

Delay	Private company	Public or foreign company
More than 7 days, not more than 3 months	RM50	RM150
More than 3 months, not more than 6 months	RM100	RM250
More than 6 months, not more than 12 months	RM150	RM300
More than 12 months	RM200	RM500

The statutory offence is separate and far larger. Under s.259(3), every officer who contravenes the lodgement duty is liable on conviction to a fine not exceeding RM50,000, plus up to RM1,000 for each day the offence continues. Under s.68(9) the annual return carries the same exposure for the company and every officer. Under s.258(3) the circulation failure carries up to RM50,000 plus up to RM500 a day.

The administrative penalty is what you pay. The statutory fine is what you risk. Most guides quote only the first and leave readers with the impression that chronic non-filing costs RM200 a year.

The waivers — and why they no longer help

SSM ran three temporary penalty waivers around the MBRS 2.0 rollout. They are frequently cited as if still live. They are not.

1. Phase 3 implementation waiver — announced 28 May 2025, waiving late lodgement fees under Practice Directive 1/2017 for audited financial statements lodged via MBRS 2.0. It ran to 30 September 2025. Annual returns were not covered.
2. Extension of that waiver — announced 26 September 2025, extending the same audited-financial-statements waiver from 1 October 2025 to 30 November 2025. Again, annual returns were not covered.
3. Peak period waiver — notice issued 3 February 2026, covering both annual returns and financial statements and reports submitted through MBRS 2.0 between 31 January 2026 and 31 March 2026, for delays of more than seven days up to three months.

The distinction in scope matters. If you are reconciling an old penalty assessment, a 2025 annual return filed late was never within a waiver; a 2026 one filed in February might have been.

Every one of these waivers removed the fee. None of them extended a statutory deadline, and none touched the s.68 or s.259 offence.

Preparing a filing without drama

1. Confirm the deadline first, from the incorporation anniversary or the circulation date — not from the calendar year.
2. Check the mTool build and taxonomy version against the SSM MBRS page before you start keying. Rebuilding a filing because the taxonomy moved is a waste of a week.
3. Reconcile the financial statements to themselves before tagging. XBRL validation catches internal inconsistencies that a PDF never surfaced.
4. Prepare in mTool, validate, and fix in mTool. Do not treat mPortal as a validation step.
5. Confirm the lodger’s practising certificate is active and the digital certificate has not expired. Both lapse quietly.
6. Submit through mPortal, pay, and keep the acknowledgement. The acknowledgement, not the mTool file, is your evidence of compliance.
7. If you will miss the date, apply for an extension before it lapses — see applying for an extension of time. After the deadline passes there is nothing to extend.

Common mistakes

• Treating validation failure as an excuse. It is not. The clock runs on the statutory date, not on the date your file finally passed.
• Assuming MBRS 2.0 moved the deadline. It moved the format. Circulation under s.258 and lodgement under s.259 are unchanged.
• Filing under a stale taxonomy or mTool build, then having to rebuild the instance document from scratch.
• Assuming the penalty waivers are still open. All three closed; the last expired on 31 March 2026.
• Quoting only the Practice Directive 1/2017 penalty and ignoring the s.259(3) exposure of up to RM50,000 on every officer, plus a daily continuing fine.
• Discovering on deadline day that the secretary’s practising certificate has lapsed, which removes the lodgement channel entirely.
• Taking the s.260 exempt private company certificate route while also claiming audit exemption. Practice Directive 10/2024 paragraph 12(a) excludes that combination.

What’s next

Work backwards from your financial year end and fix the circulation date deliberately, because it is the circulation date — not the year end — that sets the lodgement deadline. If the audit will not be finished in time, the extension application has to be lodged with SSM before the original period expires, and for a private company at least seven days before it.