Malaysia: Bank Negara Malaysia issues Exposure Draft of Merchant Acquiring Services Policy Document

Bank Negara Malaysia to tighten regulations and supervision over certain merchant acquirers

In brief

Bank Negara Malaysia (the Malaysian Central Bank) ("BNM") had, on 17 July 2020, issued an exposure draft of the Merchant Acquiring Services policy document ("MAS Exposure Draft").

The MAS Exposure Draft is intended to apply to Qualified Acquirers (defined below) and not third party acquirers and payment facilitators. BNM is looking to tighten regulation and supervision over Qualified Acquirers and align the regulatory regime that applies to Qualified Acquirers with licensed financial institutions. Qualified Acquirers should undertake a gap analysis on their existing operations to take immediate steps to close the gaps.


Key takeaways 

  • The requirements under the MAS Exposure Draft apply only to BNM-registered merchant acquirers ("Qualified Acquirers") who:
  1. enter into a contract with merchant(s), which results in a transfer of funds to the merchant(s) by: (i) conducting or being responsible for fund settlement; or (ii) issuing fund settlement instructions;
  2. facilitate the merchant's acceptance of payment instruments; and
  3. are direct participants of payment instrument network(s) to provide merchant acquiring services.
  • The MAS Exposure Draft has a material impact on Qualified Acquirers, as they would:
  1. be subject to potentially increased liabilities to merchants as they will be liable to provide fund settlement to merchants if the issuer, third party acquirer / payment facilitator or any parties involved in the handling of funds, fails to fulfil its settlement obligations;
  2. have to ensure that they have adequate capital, and monitor / assess the suitability and fitness and propriety of its shareholders and key responsible persons; and
  3. have to implement or materially enhance among others, its existing merchant acquisition and monitoring system, settlement system, outsourcing procedures, IT systems, data protection mechanisms, recruitment and reporting procedures.
  • The requirements under the MAS Exposure Draft are generally similar to those imposed on licensed banks and/or approved operators of payment system. They will also inevitably affect other participants in the payment chain and persons who deal with Qualified Acquirers (including outsourced parties), as back-to-back obligations will be passed on by the Qualified Acquirers to ensure compliance with the relevant standards and requirements of the MAS Exposure Draft.
  • There is no transition period for Qualified Acquirers. Accordingly, Qualified Acquirers will have to comply with the requirements under the policy document when it comes into force. They need to immediately undertake a gap analysis to begin planning for compliance with the final policy document.

For further information and to discuss what this development might mean for you, please get in touch with us. 

In more detail 

The key requirements and standards that BNM is proposing to introduce are set out below.

  1. Fit and Proper Criteria for Key Responsible Person 
  • The Exposure Draft has introduced the concept of key responsible persons ("KRP"). KRPs of Qualified Acquirers must fulfil similar fit and proper criteria imposed on licensed financial institutions on an ongoing basis, based on factors relating to: (i) probity, personal integrity and reputation; (ii) competency and capability; and (iii) financial integrity. Where the KRP no longer fulfils the fit and proper criteria, Qualified Acquirers must take immediate steps to remove the KRP.
  • Qualified Acquirers must therefore put in place policies and procedures to periodically assess the fitness and propriety of its existing and future KRPs.
  1. Shareholder Suitability Requirements
  • Qualified Acquirers must ensure that its shareholder, i.e., a person that holds an aggregate interest of 5% or more in its shares: (i) fulfils shareholder suitability requirements relating to, among others, honesty, integrity, good reputation, adequate control of financial risks and sound financial position on an ongoing basis; and (ii) shall not act in a manner that would be detrimental to the safety and soundness of the Qualified Acquirer.
  • While there is no positive reporting obligations on shareholder suitability under the MAS Exposure Draft, BNM retains wide discretion to require Qualified Acquirers to submit documents or information to facilitate BNM's ongoing assessment of shareholder suitability.   
  1. Minimum Capital Requirements for Non-Bank Qualified Acquirers
  • Small non-bank Qualified Acquirers will be required to maintain a minimum shareholders' funds of RM 300,000, whereas large non-bank Qualified Acquirers will be required to maintain a minimum shareholders' funds of RM 1,000,000. BNM has indicated that it is considering a one-year grace period for existing non-bank Qualified Acquirers to comply with the capital requirement. Qualified Acquirers falling under the prescribed thresholds need to consider if they need to rationalise their business or make capital calls to meet the increased capital amount.
  1. Settlement Risk Management
  • Qualified Acquirers must deposit funds received for settlement to merchants separate from their own funds in a dedicated deposit account with licensed banks, and ensure timely and complete fund settlement to merchants.
  • Where settlement to small and medium enterprise (SME) merchants takes more than two (2) working days upon receiving the funds from payment instrument network / issuer or upon delivery of products / services (whichever later), Qualified Acquirers must either: (i) secure a bank guarantee from a licensed bank on such amounts; or (ii) place the settlement funds in a trust account with licensed banks.
  • Qualified Acquirers are liable to provide funds settlement to merchants in the event that the issuer, the third party acquirer / payment facilitator or any parties involved in the handling of such funds, fails to fulfill its settlement obligations.
  • Overall, the settlement related requirements and restrictions will lead to increased liabiliy and opreational costs on Qualified Acquirers.
  1. Dealings with Merchants and Third Party Acquirer / Payment Facilitators
  • Stricter requirements are imposed on Qualified Acquirers when dealing with merchants and other contracting parties. They are required to, among others:
  1. conduct proper due diligence when onboarding merchants;
  2. include certain prescribed provisions in merchant agreements such as: (i) to ensure all merchants maintain compliance with applicable security requirements and established security standards; and (ii) to implement appropriate rules and procedures on liability management and chargeback;
  3. periodically monitor its merchants and other contracting parties that may expose merchants to payment and/or settlement risk, to ensure that these parties comply with the requirements under the MAS Exposure Draft; and
  4. implement a clear and robust dispute resolution procedures with merchants.
  • Qualified Acquires must implement a gap analysis on the proposed requirements against their current business operations to future proof against the new requirements.  
  1. Outsourcing Arrangements
  • While BNM's approval is generally not required for Qualified Acquirers to enter into outsourcing arrangements, Qualified Acquirers will need to comply with stricter corporate governance, administrative and operational requirements. Qualified Acquirers must perform appropriate due diligence on the outsourced parties, obtain Board approval to outsource its functions, establish a comprehensive outsourcing agreement with certain provisions prescribed by BNM and obtain a written undertaking from the outsourced parties to comply with secrecy / data privacy obligations imposed by BNM.
  • Outsourcing agreements with IT related third party service provider must also contain provisions for disaster recovery and backup capability, IT system availability and oblige the service provider to provide sufficient notice to the Qualified Acquirer before undertaking any changes that may impact the IT systems of the Qualified Acquirer.  Qualified Acquirers are allowed to use cloud services but must conduct comprehensive risk assessments based on criteria prescribed by BNM. Unlike the Risk Management in Technology policy document issued by BNM, prior approval or consultation with BNM is not required for the use of public cloud, however the risk assessment must be documented and made available for BNM's review upon request.
  • Qualified Acquirers should review and conduct a gap analysis on the proposed requirements against their existing outsourcing procedures, arrangements and contracts so that they have a checklist of new measures.

* * * * *

LOGO Malaysia_Wong & Partners_KualaLumpur

This client alert was issued by Wong & Partners, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner or equivalent in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Contact Information

Copyright © 2023 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.