Malaysia 2026 Criminal Law Reforms: What Companies and Directors Must Do Now on MACC, AML, Whistleblowing and AI Offences

Last updated: 12 May 2026

Malaysia corporate criminal liability is entering a new era. The Criminal Law Reform Committee convened in 2026 has placed a suite of far-reaching proposals on the table, from dedicated AI and deepfake offences to a structural separation of the Attorney General’s advisory and prosecutorial functions, and every one of them has direct consequences for how companies, directors and compliance teams manage regulatory risk. At the same time, existing enforcement under the Malaysian Anti-Corruption Commission Act 2009 (MACC Act), anti-money laundering legislation and whistleblower protection statutes continues to intensify, with regulatory enforcement in Malaysia now extending well beyond traditional bribery cases into financial crime, digital misconduct and corporate governance failures.

This guide provides a practical, step-by-step compliance playbook designed for in-house counsel, company directors and risk teams that need to act now, before the reforms are finalised and penalties crystallise.

Top 5 Actions to Take Now

• Audit your anti-corruption programme. Pressure-test existing adequate-procedures defences under Section 17A of the MACC Act against the expanded liability scenarios flagged by the Reform Committee.
• Update AML/CFT controls. Review suspicious-transaction reporting workflows, beneficial-ownership records and PEP screening against Bank Negara Malaysia’s current guidance.
• Strengthen whistleblower channels. Ensure anonymous reporting mechanisms, retaliation safeguards and evidence-preservation protocols meet the standards the proposed reforms will demand.
• Prepare for AI and deepfake offences. Assess corporate exposure to manipulated digital evidence, synthetic-media misuse and AI-generated communications that could attract new criminal penalties.
• Rehearse your investigation response. Have a documented, board-approved protocol ready for the first 72 hours after a MACC, Customs, IRB or police inquiry, including privilege management and regulator-notification decision trees.

What the 2026 Criminal Law Reform Committee Proposes, Quick Legal Summary

The Criminal Law Reform Committee was constituted with a broad mandate to modernise Malaysia’s criminal-law framework for the digital economy and to address long-standing structural concerns within the prosecution service. Industry observers expect the committee’s recommendations, once gazetted, to represent the most significant overhaul of corporate-facing criminal law since Section 17A of the MACC Act came into force on 1 June 2020. Below is a summary of the headline proposals and their business impact.

Background and Timeline of Consultation

Summary of Draft Provisions with Business Impact

The proposals that carry the most immediate weight for Malaysia corporate criminal liability fall into four clusters. Each requires a different operational response from affected entities.

• New AI and deepfake offences. The committee has flagged the creation of specific criminal provisions targeting the use of AI-generated content to fabricate evidence, impersonate persons or defraud institutions. For companies, this means digital-communications policies, HR investigation procedures and marketing approvals will all need to account for the risk that synthetic media created or used within the organisation could attract criminal sanction.
• Separation of advisory and prosecutorial roles. A proposed structural reform would delineate the Attorney General’s advisory function from the public-prosecution function. The likely practical effect will be greater prosecutorial independence, which industry observers expect to translate into more aggressive pursuit of corporate offences, particularly in the anti-corruption and financial-crime space, free from perceptions of executive interference.
• Expanded misconduct and office-holder offences. Draft measures contemplate broadening the categories of misconduct that attract criminal liability for directors, officers and persons connected with the management of a commercial organisation. Early indications suggest these provisions are designed to close gaps where existing law relies on civil remedies or regulatory sanctions that have proved insufficient deterrents.
• Revised corporate-liability doctrines and penalties. Proposals include refinements to the attribution of criminal intent to legal persons and potential increases in maximum fines. Companies that rely on the existing adequate-procedures defence under the MACC Act should anticipate that the evidentiary threshold for that defence may be raised.

MACC, Bribery and Malaysia Corporate Criminal Liability, Compliance Adjustments

MACC Act compliance is the single most critical area of exposure for Malaysian companies and their directors. Section 17A of the MACC Act introduced corporate liability for corruption offences committed by persons associated with a commercial organisation, shifting the burden to the organisation to prove it had adequate procedures in place to prevent the offence. The 2026 reform proposals signal that this burden is likely to become heavier.

How Corporate Liability Currently Works in Malaysia

Under Section 17A, a commercial organisation commits an offence if a person associated with it, including employees, agents, subsidiaries and joint-venture partners, corruptly gives, agrees to give or offers any gratification to obtain or retain business or an advantage for the organisation. The organisation is presumed liable unless it can demonstrate that it had adequate procedures in place to prevent the conduct. “Adequate procedures” are assessed against guidelines issued by the Prime Minister’s Office, which emphasise top-level commitment, risk assessment, internal controls, due diligence and periodic review. Conviction carries a fine of not less than ten times the value of the gratification or RM 1 million (whichever is higher), or imprisonment of up to twenty years, or both.

For a commercial organisation, the fine provision is the primary sanction; however, individual officers can face imprisonment.

The practical challenge for many companies is demonstrating that their procedures are not merely documented but genuinely implemented and effective. Regulatory enforcement in Malaysia has shown that paper-only compliance programmes do not satisfy the evidentiary standard. The Reform Committee’s proposals are widely expected to tighten the definition of “adequate procedures” further, requiring demonstrable testing, monitoring data and independent audits.

Director Liability and Criminal Exposure, Best-Practice Governance

Director liability in Malaysia already extends beyond the corporate veil in corruption matters. Under the MACC Act, directors and senior officers who consent to, connive in or fail to exercise due diligence to prevent a corruption offence can face personal criminal liability. The 2026 proposals, if enacted, would expand the categories of director-level offences and potentially lower the threshold of culpable knowledge required.

Director-level duties, governance checklist:

• Ensure the board has formally adopted an anti-corruption policy aligned with the adequate-procedures guidelines.
• Commission an independent review of the organisation’s bribery-risk register at least annually.
• Require compliance-function reports at every board meeting, with documented board discussion.
• Mandate personal conflict-of-interest declarations from all directors and key management personnel on a quarterly basis.
• Include anti-corruption KPIs in senior management performance evaluations.
• Ensure all third-party engagements (agents, intermediaries, lobbyists) undergo documented integrity due diligence before appointment.

MACC Response Protocol

When MACC initiates contact, whether through a formal notice, a dawn raid or an informal request for documents, the organisation’s first steps are decisive. Disclosure obligations in Malaysia require careful navigation to avoid obstruction charges while preserving legal professional privilege.

• Activate the crisis-response team. Notify external legal counsel immediately. Do not allow employees to respond to MACC officers without legal guidance.
• Preserve all evidence. Issue a litigation-hold notice across all relevant departments. Disable auto-delete functions on email servers and messaging platforms.
• Document everything. Maintain a contemporaneous log of all interactions with MACC officers, including names, times, documents requested and documents provided.
• Assess privilege. Identify documents and communications covered by legal professional privilege and flag them before production. Malaysian law recognises solicitor–client privilege, but it does not extend to communications made in furtherance of a crime or fraud.
• Brief the board. The chair and independent directors should be informed within 24 hours. If the investigation involves a director, consider appointing an independent committee to manage the response.

AML Malaysia, Financial Crime Obligations and What to Change Now

Anti-money laundering and counter-financing of terrorism (AML/CFT) obligations intersect directly with Malaysia corporate criminal liability. Under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), both reporting institutions and their officers face criminal penalties for failures in suspicious-transaction reporting, customer due diligence and record-keeping. Bank Negara Malaysia (BNM) is the primary supervisor for financial institutions, while other designated regulators oversee reporting obligations for non-financial sectors.

Reporting Obligations and Timelines

Integrating AML with Corporate Investigations

A common compliance gap is the disconnect between AML monitoring and internal-investigation functions. When transaction-monitoring systems flag suspicious activity, the escalation pathway should lead directly to both the compliance officer and external legal counsel, not only to the line manager. Companies should ensure that STR filing decisions are documented with legal reasoning, that filing timelines are tracked against BNM deadlines, and that the investigation file is maintained under privilege where possible. AML Malaysia obligations also require that compliance officers have direct, unimpeded access to the board for escalation of material concerns, without requiring approval from the CEO or CFO.

The 2026 reform proposals are expected to reinforce this reporting independence with potential criminal penalties for senior officers who obstruct internal AML escalation.

Whistleblower Protection Malaysia, Disclosure Obligations and Witness Protection

Whistleblower protection in Malaysia is primarily governed by the Whistleblower Protection Act 2010, which provides legal protections against detrimental action for persons who disclose improper conduct to enforcement agencies. The 2026 reform proposals are expected to widen the scope of protected disclosures and strengthen the penalties for retaliatory action, reflecting international best practice endorsed by the UNODC in its guidance on liability of legal persons.

Disclosure Obligations, Internal vs Regulator vs Public

Companies must understand the three tiers of disclosure and the legal implications of each:

• Internal disclosure. Reports made through the organisation’s own whistleblower channel. These should be investigated promptly and confidentially. The organisation is not obliged to notify a regulator at this stage unless the matter involves a reportable offence (e.g., corruption, money laundering).
• Regulatory disclosure. Reports made to MACC, BNM, the Securities Commission or other enforcement agencies. Whistleblower protection under the 2010 Act applies when the disclosure is made to an enforcement agency. The organisation must not take detrimental action against the whistleblower.
• Public disclosure. Disclosure to the media or the public is not generally protected under the 2010 Act unless the whistleblower has first made a disclosure to an enforcement agency and no action has been taken within a reasonable period. Companies should ensure their policies clearly explain this hierarchy to employees.

Whistleblower Policy Checklist and Quick Template Items

Every organisation subject to Malaysia corporate criminal liability risk should maintain a whistleblower policy that includes the following elements:

• A clearly designated, independent receiving officer (not the CEO or CFO) for internal reports.
• An anonymous reporting channel, either a dedicated hotline, secure online portal or both.
• Written commitments that the organisation will not take detrimental action against a whistleblower.
• A documented investigation process with defined timelines (e.g., acknowledgment within 48 hours, preliminary assessment within 14 days).
• Evidence-preservation protocols triggered immediately upon receipt of a complaint.
• Escalation criteria specifying when a matter must be reported to an external enforcement agency.
• Annual review of the policy by the board, with sign-off recorded in board minutes.

Deepfake Offences Malaysia, AI, Digital Evidence and Business Impact

Among the most widely discussed proposals from the 2026 Criminal Law Reform Committee are new criminal provisions targeting the creation, distribution and use of AI-generated deepfakes and digitally manipulated evidence. While the precise statutory language remains under consultation, early indications suggest that the offences will cover the fabrication or material alteration of audio, video or documentary evidence by means of artificial intelligence, as well as the use of synthetic media to impersonate a person for the purpose of fraud, defamation or interference with legal proceedings.

Example Scenarios

• Deepfake impersonation in business communications. An employee uses AI to generate a synthetic video of a company director authorising a payment. Under the proposed provisions, both the individual and the organisation could face criminal liability if the organisation failed to implement safeguards.
• Tampered evidence in internal investigations. During a corporate investigation, a party uses AI tools to alter electronic records. The proposed offences would make this a stand-alone criminal act, separate from existing evidence-tampering provisions, with enhanced penalties reflecting the technological sophistication involved.

Technical and Process Mitigations

Boards should be asking the following questions now:

• Does the organisation have an AI-governance policy that covers the use of generative AI tools by employees?
• Are there technical controls (metadata verification, blockchain audit trails, digital watermarking) in place to detect manipulated media?
• Is the e-discovery and forensic-investigation capability of the organisation sufficient to authenticate digital evidence?
• Have employees received training on identifying deepfakes and reporting suspected synthetic media?
• Does the organisation’s code of conduct explicitly prohibit the creation or use of deepfakes for any business purpose without authorisation?

If the Company Is Investigated, Step-by-Step Checklist for Corporate Investigations Malaysia

When MACC, Royal Malaysia Customs, the Inland Revenue Board (IRB) or the Royal Malaysia Police initiates a corporate investigation, the quality of the organisation’s response in the first hours determines its legal exposure for months or years to come. Below is a time-ordered checklist that compliance teams and directors should rehearse before an investigation materialises.

Key privilege considerations: In Malaysia, legal professional privilege protects communications between a client and an advocate and solicitor made for the purpose of obtaining or giving legal advice. Privilege does not protect documents or communications created in furtherance of a criminal purpose. Companies should ensure that all internal-investigation interviews are conducted under the supervision of external counsel, with clear privilege markers on all communications. If the investigation involves potential self-reporting to MACC, the decision to disclose should be made by the board on legal advice, balancing the benefits of cooperation (potential mitigation of penalties) against the risks of premature disclosure.

Preserving evidence integrity is paramount. Any destruction, alteration or concealment of documents after the organisation becomes aware of an investigation, or reasonably suspects one, can constitute obstruction of justice and compound the organisation’s criminal exposure significantly.

Compliance Playbook and Templates

Operationalising the guidance in this article requires documented, board-approved tools that compliance teams can deploy immediately. The following resources support effective Malaysia corporate criminal liability management:

• MACC Response Checklist. A step-by-step protocol covering dawn-raid response, evidence preservation, privilege assessment and regulator communication, designed for printing and posting in the General Counsel’s office and reception areas.
• AML Quick Audit Template. A structured self-assessment covering KYC procedures, transaction-monitoring rules, STR filing records, beneficial-ownership registers and staff-training logs, aligned with BNM’s current guidance.
• Whistleblower Policy Template. A board-ready policy document incorporating anonymous-reporting channels, retaliation safeguards, investigation timelines and escalation criteria, consistent with the Whistleblower Protection Act 2010 and anticipated 2026 reforms.
• Board Escalation Memo Template. A standardised memo format for compliance officers to brief the board on material regulatory risks, investigation developments and disclosure decisions, with built-in privilege markings and approval workflows.

Organisations seeking tailored versions of these templates, adapted to their sector, size and risk profile, should engage specialist white-collar and compliance counsel with experience in Malaysian regulatory enforcement. Find lawyers in Malaysia through the Global Law Experts directory.

Conclusion and Next Steps

The 2026 reform proposals represent a step-change in Malaysia corporate criminal liability. Companies that wait for final legislation before updating their compliance frameworks risk being caught unprepared, with inadequate defences, untested investigation protocols and exposure to new categories of offence that did not exist when their current policies were written. The priority roadmap for boards and compliance teams is clear: audit existing anti-corruption adequate procedures against the incoming standards; stress-test AML controls and reporting workflows; formalise whistleblower channels with proper safeguards; address AI and deepfake risks before the new offences commence; and rehearse investigation-response protocols so that the first 72 hours of any regulatory inquiry are managed with precision.

Regulatory enforcement in Malaysia is intensifying across every relevant agency, and the organisations that act now will be in the strongest position to defend themselves, and their directors, when the new framework takes effect.

Sources

1. Malaysian Anti-Corruption Commission (MACC)
2. Bank Negara Malaysia
3. Attorney General’s Chambers (AGC) Malaysia
4. Skrine, Corporate Criminal Liability Alert
5. Ropes & Gray, Corporate Criminal Liability for Corruption in Malaysia
6. UNODC, Liability of Legal Persons
7. IJIE (Universiti Malaya), Corporate Criminal Liability
8. TRACE International, Corporate Criminal Liability in Malaysia