About Grace S. Nathan Advocates & Solicitors
Grace S. Nathan Advocates & Solicitors is a Malaysian law firm specialising in fintech regulation, financial crime defence, and corporate compliance. Led by its founder, the firm has carved a distinct niche advising fintech startups, digital banking applicants, e-wallet operators, and compliance teams navigating Malaysia’s complex and fast-evolving regulatory landscape. The firm’s core practice areas encompass BNM and Securities Commission licensing, anti-money laundering policy implementation, capital markets offences, crowdfunding platform compliance, and regulatory defence in enforcement proceedings. With a client base spanning founders, investors, and institutional compliance officers, the firm is recognised as a trusted legal partner at the intersection of law and financial technology.
Why Fintech Licensing in Malaysia Is More Urgent Than Ever
Malaysia’s fintech sector has grown substantially over the past decade, driven by the expansion of e-wallet adoption, digital bank approvals, and the Securities Commission’s push to expand equity crowdfunding and P2P financing platforms. Bank Negara Malaysia (BNM) and the Securities Commission (SC) have correspondingly tightened their regulatory expectations.
The cost of non-compliance has never been higher. Operating a lending or payment business without the correct licence exposes founders to criminal liability, platform shutdowns, investor due diligence failures, and reputational damage that no startup can afford. Understanding exactly which licence your business requires — and building a robust compliance framework before regulators come knocking — is not optional. It is existential.
What Is a Money Lending License in Malaysia?
Under the Moneylenders Act 1951, any business or individual that carries on the practice of lending money at interest to the public must obtain a money lending licence. This applies regardless of whether the lending is conducted through physical branches, mobile applications, or digital platforms.
Many fintech founders assume that because their platform operates digitally, or because they structure their product as a ‘fee’ rather than ‘interest’, they fall outside the Act’s scope. This assumption is frequently incorrect and has led to regulatory action against multiple Malaysian fintech operators in recent years.
Who issues the money lending licence?
A common misconception is that Bank Negara Malaysia issues money lending licences. It does not. Moneylending licences in Malaysia are issued by the Ministry of Housing and Local Government (or its authorised state bodies) under the Moneylenders Act 1951. BNM, by contrast, regulates payment services, e-money issuance, remittance, and digital banking under the Financial Services Act 2013 (FSA) and the Islamic Financial Services Act 2013 (IFSA).
When do you need a BNM licence instead?
If your business model involves any of the following, a BNM licence or approval — rather than or in addition to a moneylending licence — is required:
- Issuing e-money or operating a digital wallet (e-wallet licence from BNM)
- Providing remittance or money transfer services
- Offering payment system services or acquiring services
- Operating as a digital bank under BNM’s digital banking framework
Key BNM Licences for Fintech Businesses
E-Wallet Licence Malaysia
An e-wallet licence in Malaysia is required under the Payment Systems Policy Document issued by BNM. Businesses that issue stored value to consumers — whether in a mobile app, digital card, or closed-loop retail environment — must obtain this approval. The application process involves demonstrating adequate technical infrastructure, minimum capital thresholds, anti-money laundering/counter-terrorism financing (AML/CFT) controls, and consumer protection mechanisms. Approval timelines are typically six to twelve months depending on application quality and regulator workload.
Payment Service Provider (PSP) Licence
Under BNM’s Licensing Framework for Payment Service Providers, businesses facilitating payment transactions — including merchant acquiring, payment aggregation, or cross-border remittance — require specific PSP licensing tiers. The categorisation depends on transaction volume, float size, and the nature of the service.
Crowdfunding Licence Malaysia
If your platform facilitates equity crowdfunding (ECF) or peer-to-peer (P2P) financing, a crowdfunding licence issued by the Securities Commission Malaysia is required. Licensed ECF and P2P platforms are subject to ongoing obligations including investor disclosure requirements, issuer vetting, and annual regulatory reporting. The SC maintains a public register of all approved platforms, and operating an unlicensed platform constitutes a serious offence under the Capital Markets and Services Act 2007 (CMSA).
Anti-Money Laundering Compliance Malaysia: What Every Fintech Must Know
Malaysia’s Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA) imposes comprehensive obligations on reporting institutions — a category that includes all licensed fintech operators, e-wallet providers, P2P platforms, and digital banks.
Core AML obligations under AMLA and BNM guidelines
- Customer Due Diligence (CDD): Verifying the identity of customers at onboarding and on an ongoing basis, including enhanced due diligence for politically exposed persons (PEPs) and high-risk customers
- Transaction Monitoring: Implementing automated systems to detect unusual or suspicious transaction patterns in real time
- Suspicious Transaction Reporting (STR): Filing STRs with the Financial Intelligence and Enforcement Department (FIED) within the legally prescribed timeframe
- Sanctions Screening: Checking customers and counterparties against BNM’s designated list and international sanctions regimes
- Record-Keeping: Maintaining transaction records and identity documents for a minimum of six years from the date of the transaction
The Consequences of Inadequate AML Compliance
The consequences of inadequate AML controls extend beyond regulatory fines. Fintech companies that fail BNM examinations risk licence suspension, mandatory remediation orders, public enforcement notices, and in egregious cases, criminal prosecution of individual directors and compliance officers. International correspondent banks and payment partners increasingly conduct their own AML due diligence on Malaysian counterparts, meaning poor compliance programmes can also cut off vital financial infrastructure.
Regulatory Risk Areas Fintech Founders Most Commonly Underestimate
Risk 1: Operating without the correct licence. Fintech founders who launch before completing licensing often assume a grace period exists. Malaysian regulators have shown they will act swiftly when unlicensed activity is detected, including interim injunctions and public notices.
Risk 2: Misclassifying a lending product as ‘investment’ or ‘fee-based’. Revenue structuring does not change the legal character of a product. If value is transferred with an expectation of return, regulators will look through the labelling to the economic substance.
Risk 3: Inadequate AML documentation. Even where an AML policy exists on paper, BNM inspections frequently reveal that policies are not operationalised — staff are untrained, monitoring tools are absent, and STRs have never been filed. Documentation without implementation offers no regulatory protection
How Grace S. Nathan Advocates & Solicitors Can Help
The firm provides end-to-end legal support across the full regulatory lifecycle of a fintech business in Malaysia, including:
- Pre-launch licensing assessment to identify all licences required for your specific business model
- Preparation and submission of BNM and SC licence applications
- AML/CFT policy drafting, audit, and implementation support
- Liaison with BNM and SC officers during the application and post-approval phases
- Regulatory defence in enforcement actions, including appeals and negotiation with regulators
- Investor due diligence support — corporate records review, compliance risk assessment, and formal legal opinions
Frequently Asked Questions
1. Does a digital lending app always need a money lending licence?
Not always — but the threshold for needing one is lower than most founders assume. If your app charges any form of fee, spread, or return on money lent to consumers, it almost certainly falls within the Act’s scope. The safest approach is a formal legal assessment before launch, not after.
2. How long does it take to get a BNM e-wallet licence?
BNM does not publish fixed timelines, but most applicants experience an assessment period of six to eighteen months from initial submission to approval, depending on application completeness and the volume of queries raised by regulators. Early engagement with legal counsel to ensure the application is comprehensive significantly reduces processing time.
3. What is the difference between ECF and P2P financing under the SC?
Equity crowdfunding (ECF) platforms facilitate investment in the shares of unlisted companies. P2P financing platforms facilitate loans between investors and business borrowers. Both require SC licences, but the ongoing obligations, capital requirements, and investor protection rules differ. A legal advisor familiar with both frameworks is essential when structuring a new platform.
Final Word
For fintech founders and compliance teams operating in Malaysia, regulatory compliance is not a back-office concern — it is a core business function. The licensing landscape managed by BNM and the SC is designed to protect consumers and maintain financial system integrity, but its complexity creates real risk for those navigating it without specialist guidance.
For expert legal advice on money lending licences, BNM licensing, AML compliance, and fintech regulation in Malaysia, contact Grace S. Nathan Advocates & Solicitors.
