Section 17A MACC Act Adequate Procedures (TRUST), 2026 DPA Readiness & Corporate Defence Steps

Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (MACC Act 2009) introduced a form of strict corporate liability for corruption offences committed by persons associated with a commercial organisation. The only statutory defence available to the organisation is proof that it had section 17A MACC Act adequate procedures in place at the time the offence was committed. With Malaysia expected to table MACC Act amendments enabling Deferred Prosecution Agreements (DPAs) by mid-2026, the adequacy, and provability, of those procedures is now a live boardroom priority.

This guide translates the five TRUST principles published by the Prime Minister’s Department into concrete compliance steps, sets out the penalty regime and director-exposure risks, and provides a practical DPA-readiness playbook for general counsel, compliance officers and boards operating in Malaysia.

Executive Summary & Quick TRUST Checklist

Section 17A imposes corporate liability where an associated person corruptly gives, offers or promises any gratification to obtain or retain business or an advantage for the commercial organisation. The sole defence is demonstrating adequate procedures designed to prevent such conduct. The Ministerial Guidelines on Adequate Procedures, issued under Section 17A(5) of the MACC Act 2009, organise those procedures around the TRUST framework. With a proposed MACC Act amendment to introduce DPAs anticipated in 2026, organisations that can evidence a robust TRUST programme will be materially better positioned, both to defend a prosecution and to negotiate favourable DPA terms.

Quick TRUST checklist, six board-level actions:

1. T, Top-level commitment: Secure a board resolution and CEO-signed anti-corruption policy, refreshed annually.
2. R, Risk assessment: Complete a documented corruption risk assessment covering all business lines, geographies and third parties.
3. U, Undertake control measures: Implement financial controls, approval workflows and third-party due-diligence procedures proportionate to assessed risk.
4. S, Systematic review, monitoring & enforcement: Establish an independent internal-audit cycle and disciplinary framework with reporting to the audit committee.
5. T, Training & communication: Deliver role-specific anti-corruption training to all employees and associated persons, with documented attendance and comprehension testing.
6. DPA readiness: Build and maintain a remediation-plan template so the organisation can respond rapidly to an allegation and demonstrate cooperative intent to regulators.

Statutory Background, Section 17A and How It Works

Section 17A was inserted into the MACC Act 2009 by the Malaysian Anti-Corruption Commission (Amendment) Act 2018 and came into force on 1 June 2020. It creates an offence where a person associated with a commercial organisation corruptly gives, agrees to give, promises or offers any gratification to any person with intent to obtain or retain business, or to obtain or retain an advantage in the conduct of business, for the commercial organisation. The provision establishes what is effectively a form of strict liability: once the prosecution proves that the associated person committed the underlying corruption offence for the organisation’s benefit, the organisation is deemed guilty unless it can establish the adequate-procedures defence under Section 17A(4).

Section 17A(5) empowers the Prime Minister to publish guidelines on what constitutes adequate procedures. Those guidelines, formally titled Guidelines on Adequate Procedures Pursuant to Subsection (5) of Section 17A Under the Malaysian Anti-Corruption Commission Act 2009, were issued by the Prime Minister’s Department through the Governance, Integrity and Anti-Corruption Centre (GIACC) and set out the TRUST framework that remains the benchmark for compliance.

Key Statutory Terms

• Commercial organisation: A body corporate or partnership formed under Malaysian law and carrying on business in Malaysia, or a body corporate or partnership formed outside Malaysia but carrying on business (or part of a business) in Malaysia.
• Associated person: A director, partner, employee, or any person who performs services for or on behalf of the commercial organisation. The scope is deliberately wide, it captures agents, consultants, joint-venture partners and intermediaries.
• Section 46 (MACC Act 2009): Grants the MACC extraterritorial jurisdiction where an offence is committed by a Malaysian citizen outside Malaysia. For commercial organisations, this means that conduct by an overseas subsidiary’s employee can trigger Section 17A liability in Malaysia if it is attributable to the Malaysian entity.

The TRUST Principles Under Section 17A, Practical Interpretation

The Criminal Litigation, Malaysia practice area frequently involves advising boards on how to operationalise the TRUST adequate-procedures framework. Below, each principle is broken down into its practical requirements, minimum evidence and example controls.

T, Top-Level Commitment

The board and senior management must visibly champion a culture of integrity. The Prime Minister’s Department Guidelines specify that top-level commitment goes beyond a written policy, it requires leadership behaviour that is demonstrably anti-corruption.

• Board resolution formally adopting the anti-corruption policy and appointing a named compliance officer.
• CEO or Managing Director personally signing and communicating the anti-corruption statement to all employees and associated persons.
• Allocation of a ring-fenced compliance budget with annual board-level review.
• Standing agenda item at quarterly board/audit-committee meetings to discuss compliance metrics and incidents.
• KPI example: Percentage of board meetings in the fiscal year at which anti-corruption compliance was a documented agenda item (target: 100 %).

R, Risk Assessment

A documented, periodically updated corruption risk assessment forms the foundation of proportionate controls. The assessment must identify internal and external risk factors, including sectoral risk, geographic exposure, transaction types and third-party relationships.

• Maintain a corruption risk register with risk ratings (likelihood × impact), ownership and treatment plans.
• Conduct risk assessments at entity, divisional and project levels, particularly for high-risk activities such as government procurement, licensing and joint ventures.
• Engage an independent party (external auditor or specialist consultant) to validate the risk assessment at least biennially.
• Update the assessment after any material change in business operations, regulatory landscape or market entry.
• KPI example: Number of business divisions with a current (≤ 12 months) risk assessment versus total divisions (target: 100 %).

U, Undertake Control Measures

Controls must be proportionate to the risks identified. The Ministerial Guidelines emphasise both preventive controls (approval limits, segregation of duties) and detective controls (transaction monitoring, whistleblower channels).

• Implement financial-approval matrices aligned with the risk register, heightened scrutiny for transactions involving government officials or politically exposed persons.
• Mandate corruption due diligence on all third parties (agents, distributors, consultants, JV partners) before onboarding and at contract renewal.
• Establish a confidential whistleblower channel accessible to employees and external parties, with documented non-retaliation safeguards.
• Draft and enforce a gifts, hospitality and entertainment policy with monetary thresholds and mandatory pre-approval for public-sector interactions.
• KPI example: Percentage of new third-party engagements subjected to anti-corruption due diligence before contract execution (target: 100 %).

S, Systematic Review, Monitoring & Enforcement

Static policies do not constitute adequate procedures. The Guidelines require systematic, ongoing review and consistent disciplinary enforcement.

• Schedule annual internal audits of the anti-corruption programme, with findings reported directly to the audit committee.
• Conduct unannounced spot-checks on high-risk processes (e.g., procurement, tender evaluations, facilitation payments).
• Enforce a clear disciplinary procedure, with documented outcomes, for policy breaches, regardless of the seniority of the individual involved.
• Review the adequacy-procedures framework whenever there is a compliance incident, regulatory change or enforcement action in the sector.
• KPI example: Average time from detection of a policy breach to completion of the disciplinary process (target: ≤ 30 working days).

T, Training & Communication

Training must be role-specific, recurring and documented. Blanket annual e-learning alone is unlikely to satisfy the Guidelines, particularly for employees in procurement, sales and government-relations roles.

• Deliver tiered training: general awareness for all staff; advanced scenario-based workshops for high-risk functions; and board-level briefings on legal exposure.
• Extend training to associated persons (agents, distributors, joint-venture partners) proportionate to their risk profile.
• Maintain a training register with attendance records, comprehension-test scores and a refresher schedule (minimum annually).
• Communicate policy updates promptly through multiple channels, intranet, town halls, email circulars, with an acknowledgment mechanism.
• KPI example: Percentage of employees in high-risk roles who completed advanced anti-corruption training within the past 12 months (target: ≥ 95 %).

TRUST Evidence Summary Table

Section 17A MACC Act Penalty, Director Exposure & Enforcement Posture

Understanding the section 17A MACC Act penalty regime is critical for boards assessing the commercial and personal risks of non-compliance. Section 17A(2) provides that a commercial organisation found guilty is liable to a fine of not less than ten times the value of the gratification that is the subject of the offence, or one million ringgit, whichever is higher. Additionally, under Section 17A(3), where it is proved that the offence was committed with the consent or connivance of a director, controller, officer, partner or person concerned in the management of the commercial organisation, that individual is deemed to have committed the offence personally and faces the same punishment applicable to the underlying offence.

For the underlying corruption offences (e.g., giving or accepting gratification under Sections 16 and 17 of the MACC Act 2009), individuals face imprisonment of up to twenty years and a fine of not less than five times the value of the gratification or RM10,000, whichever is higher. Industry observers expect the enforcement posture of SPRM (the MACC) to intensify further through 2026 and beyond, particularly in sectors such as government procurement, construction and energy where corruption-risk indicators remain elevated.

Key penalty takeaways:

• Corporate fine floor: RM1 million or ten times the gratification, whichever is higher.
• Individual director liability: Up to 20 years’ imprisonment plus a statutory minimum fine.
• Mitigation factors: Evidence of a robust TRUST-compliant programme, voluntary self-reporting, and cooperation with SPRM during investigations.
• No sentencing discount for ignorance: The deemed-liability mechanism means a director who claims ignorance of the associated person’s conduct is not automatically exculpated.

Internal Investigations & Evidence Preservation, Immediate Steps on Detection

When a potential Section 17A offence is detected, the quality and speed of the organisation’s initial response will materially affect both the adequate-procedures defence and any future DPA negotiation. A poorly managed investigation can destroy privilege, contaminate evidence and signal non-cooperation to SPRM. The following framework is designed for general counsel and compliance teams operating within Malaysia’s criminal litigation context.

Triage & Incident-Response Timeline

Forensic & Legal-Privilege Considerations

Malaysian law recognises legal professional privilege (solicitor-client privilege and litigation privilege). To protect the integrity of the investigation and the organisation’s defence under Section 17A:

• Engage external counsel at the outset to direct the investigation, documents prepared for the dominant purpose of obtaining legal advice are more likely to attract privilege.
• Clearly mark privileged communications and investigation memoranda.
• Separate the investigation team from the organisation’s day-to-day management to avoid allegations of interference or cover-up.
• Be aware that privilege does not extend to communications made in furtherance of a crime or fraud.

Reporting Obligations and Timing

There is currently no statutory obligation under the MACC Act 2009 for a commercial organisation to self-report a suspected Section 17A offence to SPRM. However, voluntary self-reporting is widely regarded as a significant factor in demonstrating cooperation and may influence SPRM’s exercise of prosecutorial discretion. Early indications suggest that if DPA legislation is enacted, self-reporting will be a central eligibility criterion. Boards should weigh the legal, reputational and commercial consequences of self-reporting in consultation with external counsel.

DPA Readiness & Corporate Remediation Plans, 2026 MACC Act Amendment Explained

A Deferred Prosecution Agreement is a mechanism by which a prosecutor agrees to defer, and ultimately drop, criminal charges against a commercial organisation, provided the organisation fulfils specified conditions within a set period. These conditions typically include financial penalties, disgorgement of profits, admissions of fact, implementation of enhanced compliance measures, and appointment of an independent monitor. DPAs have been widely adopted in the United Kingdom (under the Crime and Courts Act 2013) and the United States (through DOJ policy), and industry observers expect Malaysia to follow suit through a proposed MACC Act amendment anticipated for tabling by mid-2026.

As at 20 July 2026, the formal text of the DPA amendment has not been gazetted. The likely practical effect, based on publicly available government consultation signals, will be to provide SPRM with a structured alternative to full prosecution, one that incentivises corporate cooperation and remediation while preserving the deterrent effect of criminal liability under Section 17A.

Expected DPA Eligibility Factors

Drawing on established international models and the existing Section 17A adequate-procedures framework, industry observers expect the following factors to influence DPA eligibility in Malaysia:

• Self-reporting: Whether the organisation voluntarily disclosed the conduct to SPRM before detection.
• Cooperation: The extent and timeliness of the organisation’s cooperation with the investigation, including provision of documents and witness access.
• Existing compliance programme: Whether the organisation had adequate procedures (TRUST) in place at the time of the offence, and whether those procedures have since been enhanced.
• Remediation: The credibility and scope of remedial measures taken post-detection, including disciplinary action against responsible individuals.
• Harm and culpability: The scale of the corruption, the seniority of individuals involved, and whether the conduct was systemic or isolated.
• Prior history: Whether the organisation has a prior record of corruption offences or regulatory findings.

Sample Remediation Timeline

• 0–3 months: Complete internal investigation; implement immediate corrective actions (suspend implicated personnel, close control gaps); engage external counsel to advise on self-reporting strategy; commission an independent gap assessment of the TRUST programme.
• 3–6 months: Deliver enhanced anti-corruption training across high-risk functions; update the corruption risk register; strengthen third-party due-diligence procedures; begin reporting compliance metrics to the board monthly.
• 6–12 months: Complete an independent audit of the remediated programme; implement technology-based monitoring tools (data analytics, transaction screening); prepare a compliance certification for submission to SPRM or an independent monitor.

How Adequate Procedures Affect DPA Outcomes, Comparison Table

Practical Compliance Programme Blueprint & Monitoring KPIs

Translating the TRUST principles into a functioning compliance programme requires clear governance architecture, defined roles and measurable outputs. The following blueprint is designed for commercial organisations of all sizes operating in Malaysia.

Governance & Roles

• Board / Audit Committee: Ultimate accountability for the anti-corruption programme. Receives quarterly compliance reports and approves the annual compliance budget.
• Chief Compliance Officer (CCO) / Integrity Officer: Day-to-day programme management, policy drafting, training coordination, incident triage and regulatory liaison.
• Business-Unit Compliance Champions: Embedded in high-risk divisions to facilitate risk assessments, monitor controls and serve as the first point of contact for compliance queries.
• Internal Audit: Conducts independent, risk-based audits of the anti-corruption programme and reports findings directly to the audit committee.

Policy Architecture

• Anti-Corruption & Anti-Bribery Policy (master policy, board-approved).
• Gifts, Hospitality & Entertainment Policy (with monetary thresholds and approval workflows).
• Third-Party Due-Diligence Standard Operating Procedure.
• Whistleblower Protection Policy (with independent channel and non-retaliation guarantee).
• Conflicts-of-Interest Declaration Procedure.
• Facilitation-Payments Prohibition Statement.

Sample Anti-Corruption Clause for Supplier Contracts

“The Supplier warrants that it has not, and shall not, directly or indirectly offer, promise, give or authorise any gratification to any person for the purpose of obtaining or retaining any business or advantage for the Company. The Supplier shall maintain adequate procedures consistent with Section 17A of the Malaysian Anti-Corruption Commission Act 2009 and shall permit the Company to audit compliance upon reasonable notice.”

Sample KPI Dashboard

Section 17A MACC Act Cases, Enforcement Examples & Lessons

Since Section 17A came into force on 1 June 2020, the MACC has pursued a combination of education, enforcement and capacity-building. While the full body of section 17A MACC Act cases adjudicated by Malaysian courts continues to develop, several enforcement patterns and public administrative findings offer important lessons for boards.

• SPRM compliance outreach programme: The MACC has conducted extensive engagement with listed companies and government-linked entities, emphasising the importance of documented adequate procedures. Organisations that failed to demonstrate even basic TRUST compliance during these engagements were flagged for enhanced monitoring.
• Enforcement focus on intermediaries and agents: Publicly reported investigations indicate that SPRM has concentrated enforcement attention on cases involving third-party intermediaries, agents, consultants and sub-contractors, who offered gratification on behalf of the commercial organisation. This reinforces the critical importance of robust third-party due diligence under the “Undertake control measures” principle.
• Red flags identified in SSM training materials: The Companies Commission of Malaysia has highlighted in its training materials several recurrent red-flag indicators, including unexplained payments to shell companies, unusually high commission rates, and the absence of any written anti-corruption policy, circumstances that would make an adequate-procedures defence extremely difficult to sustain.

Early indications suggest that the anticipated introduction of DPAs will further sharpen SPRM’s enforcement posture, giving the commission a more calibrated tool to incentivise corporate cooperation without diluting the deterrent effect of full prosecution under Section 17A.

Conclusion, Board Checklist & Next Steps for Section 17A MACC Act Adequate Procedures

The convergence of an active SPRM enforcement environment and the anticipated MACC Act amendment introducing DPAs in 2026 means that proving section 17A MACC Act adequate procedures is no longer a theoretical exercise, it is a concrete operational and legal necessity. Boards should act now to:

• Secure a current board resolution adopting or reaffirming the anti-corruption policy and appointing a named compliance officer.
• Complete or refresh a documented corruption risk assessment across all business lines, geographies and third-party relationships.
• Verify that financial controls, approval workflows and third-party due-diligence procedures are proportionate to assessed risk and consistently enforced.
• Schedule the next independent audit of the anti-corruption programme and ensure findings are reported to the audit committee.
• Deliver role-specific anti-corruption training to all high-risk employees and associated persons within the current fiscal year.
• Prepare a DPA-readiness remediation-plan template so the organisation can respond rapidly to any allegation and demonstrate cooperative intent.
• Engage experienced criminal litigation counsel in Malaysia to conduct a privilege-protected gap assessment of the current programme against the TRUST framework.

Last reviewed: 20 July 2026. Statements regarding the proposed MACC Act DPA amendment reflect publicly available government signals as at that date and are subject to change upon formal gazettement.

Sources

1. Malaysian Anti-Corruption Commission (MACC), Official Section 17A Guidance
2. Laws of Malaysia / Attorney-General’s Chambers, MACC Act 2009
3. Prime Minister’s Department / GIACC, Guidelines on Adequate Procedures (TRUST)
4. Companies Commission of Malaysia (SSM), Section 17A Training Materials
5. Bursa Malaysia, MACC Act Section 17A Adequate Procedures Best Practice Handbook
6. UNODC, Liability of Legal Persons in Malaysia (2026)