Regulatory AlertsMalaysia: lending & credit regulation
Partially regulatedLending regulated by BNM; P2P by SC; BNPL/Microfinance largely unregulated
- Lead regulator
- Bank Negara Malaysia (BNM)
- Also involved
- Securities Commission (P2P) · Ministry of Finance (Policy)
- Core law
- Financial Services Act 2013 (FSA)
- Entry capital
- RM 100m (Bank)
- Approval timeline
- 6-12 months (Banking); 3-6 months (P2P)
- Customer assets
- Segregated accounts required for licensed entities
- Data protection
- PDPA 2010 · Personal Data Protection Department
- Sandbox
- Yes - BNM Regulatory Sandbox
Traditional lending is strictly regulated by BNM under the FSA 2013, requiring banking or merchant bank licenses. Peer-to-Peer (P2P) financing is a distinct, regulated sector supervised by the Securities Commission (SC). Consumer credit products like BNPL and microfinance generally operate in a regulatory gap, falling outside specific statutory licensing regimes unless they involve licensed financial institutions.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Consumer lending | LicenceBanking License / Merchant Bank License Requires full banking license; no specific consumer lending license exists. | RM 100m | 6-12 months | Bank Negara Malaysia |
| SME / commercial lending | LicenceBanking License / Merchant Bank License Commercial lending is a banking business; requires full license. | RM 100m | 6-12 months | Bank Negara Malaysia |
| Microfinance | Uncertainverify with regulator No specific microfinance license; often operates under general business or NGO frameworks. | — | — | — |
| Buy-now-pay-later | Unregulated BNPL is not currently subject to specific licensing; BNM monitoring ongoing. | — | — | — |
| P2P lending platform | LicenceRecognized Market Operator (P2P)[1] Must register as RMO under SC P2P Framework; strict risk disclosure required. | — | 3-6 months | Securities Commission Malaysia |
| Credit bureau / scoring | Uncertainverify with regulator Credit bureaus are regulated by BNM; pure scoring tech is less clear. | — | — | — |
| Debt collection | Uncertainverify with regulator No specific license; subject to general consumer protection and debt recovery laws. | — | — | — |
New — what changed recently
- 2024-02-05SC P2P Framework Updates — Securities Commission reinforced risk disclosure and business continuity obligations for P2P platforms.[1]
Market-entry checklist
- 1Secure BNM Banking LicenseApply for a full banking or merchant bank license with RM 100m capital for traditional lending.
- 2Register with SC for P2PApply for Recognized Market Operator status under the SC P2P Financing Framework.
- 3Implement AML/CFT ComplianceAdhere to BNM's AML/CFT policy documents for all financial activities.
- 4Register Business EntityRegister with SSM (Suruhanjaya Syarikat Malaysia) as a private limited company.
- 5Ensure Data Privacy ComplianceComply with the Personal Data Protection Act 2010 for handling customer data.