BNM plans 2027 national risk assessment as recent penalties target screening and due-diligence gaps

Implications for lenders

Lenders in Malaysia that screen borrowers may need to show that sanctions databases are updated without delay after each Domestic List change, as the RM264,000 penalty concerned screening against an outdated list. Digital lenders that rely on company secretaries, agents or other professionals in onboarding may face closer attention to those links after the 2027 risk assessment.

Implications

Facts

Risk assessment: at the DNFBP Compliance Conference on 22 October, Deputy Governor Marzunisham Omar said BNM will undertake its next National Risk Assessment in 2027, with a deeper review of money laundering and terrorism financing risks in DNFBP sectors, to support more targeted policies, guidance and mitigation by sector. He cited recent joint actions against a company secretary that did not file suspicious transaction reports and against a Labuan investment bank for material customer due diligence (CDD) deficiencies and late reports, and said, "Weak due diligence, vigilance and reporting create space for criminals to operate." He also pointed to an increase in corporate mule accounts in National Fraud Portal data.

Sanctions screening: on 26 August BNM published penalties totalling RM264,000 on a licensed bank and its Islamic subsidiary, which had not updated their sanctions database without delay after the Domestic List was published, so customers were screened against outdated data. ¹ BNM said no specified entities had been onboarded. On 30 September it published a penalty of RM11,500 on a money services business that had failed to maintain a mechanism to screen customers against the Domestic and UN Security Council lists and to screen its customers. ²

Due diligence: also on 30 September, BNM published a penalty of RM22,000 on another money services business that failed to conduct CDD on a money-changing customer, which BNM attributed to inadequate oversight and a weak compliance culture. ³ All three breaches were found in on-site examinations and fall under BNM's AML/CFT/CPF and targeted financial sanctions policy document.

Analysis

Time series: BNM's annual report recorded 284 supervisory and enforcement actions in 2025, down from 326 in 2024, ⁴ with monetary penalties of RM15.9 m, down from RM18.9 m in 2024, ⁵ with anti-money laundering among the main areas of offences. The 2026 cases published so far are small in value but specific in what they test: whether screening lists are updated without delay, whether screening exists at all, and whether CDD is done on each customer. Together with the 2027 risk assessment of non-financial professions, they point to supervision of how controls work in practice across the chain of gatekeepers, not only at banks.

Counterpoints and uncertainties

The scope, timing and method of the 2027 assessment have not been published, and its findings could lead to sector guidance that differs from current practice. Penalty amounts so far are small relative to RM15.9 m imposed in 2025, so the cases may signal priorities rather than a change in enforcement intensity.