Anti-Money Laundering for Real Estate Agents in Malaysia: AMLA 2001, BNM Policy, and Your CDD Obligations

TL;DR. Malaysian real estate agents are reporting institutions under AMLA 2001 First Schedule s.3. The Bank Negara Malaysia AML/CFT/CPF/TFS Policy Document for DNFBPs (effective 6 February 2024) sets out CDD, STR filing, and record-keeping obligations in detail. Being a reporting institution does not mean declining high-risk clients. It means knowing which clients require enhanced due diligence, how to document that decision, and when to file a Suspicious Transaction Report with BNM’s Financial Intelligence and Enforcement Department (FIED) by the next working day.

Key Takeaways

• Estate agents are reporting institutions under AMLA 2001 First Schedule s.3. CDD applies to every client, not just suspicious ones.
• Malaysia’s beneficial ownership threshold is 20% (Companies Act 2016, amended 2024), not the 25% used in EU and UK frameworks.
• STR must be filed via goAML by the next working day after suspicion is established.
• Records must be kept for 6 years from when the relationship ends or transaction completes.
• The AMLA (Amendment) Act 2025 (Act A1761), in force from 1 March 2026, introduced mandatory sentencing and personal liability for individual officers under ss.83A-83E.

How did estate agents become reporting institutions in Malaysia?

Malaysia’s property market recorded MYR 232.3 billion in total transaction value across 420,545 transactions in 2024, an 18% increase from MYR 196.8 billion in 2023 (NAPIC, Q1 2025 Property Market Snapshot, 2025). A market of this scale attracts illicit funds. The Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001) responded by designating registered estate agents as reporting institutions.

The statutory designation. AMLA 2001 First Schedule s.3 lists registered estate agents as reporting institutions. This designation, formalised for the real estate sector on 1 January 2020 through the 2014 and 2020 amendments, places estate agents alongside banks and insurers as entities legally obligated to conduct customer due diligence, keep records, and file suspicious transaction reports. The obligation attaches to the transaction itself, not just to clients who look suspicious.

What FATF has to do with it. Malaysia is a member of the Asia/Pacific Group on Money Laundering (APG), an associate of the Financial Action Task Force (FATF). FATF Recommendations 22 and 23 require member countries to apply AML obligations to designated non-financial businesses and professions (DNFBPs), a category that includes real estate agents. FATF real estate typologies and Recommendations 22-23 Malaysia’s December 2025 FATF mutual evaluation rated all 40 Recommendations as “largely compliant” or “compliant” (FATF/APG, Mutual Evaluation Report Malaysia 2025, December 2025). A residual finding was that smaller DNFBPs, including estate agents, have less developed risk awareness than the banking sector.

The December 2025 FATF evaluation noted the gap specifically in DNFBP risk awareness. For estate agents, this means enforcement attention is now directed here. The “I didn’t know” defence will not survive scrutiny in a post-evaluation environment.

What does BNM’s AML/CFT Policy Document actually require?

The primary operational document for estate agents is the BNM AML/CFT/CPF/TFS Policy Document for Designated Non-Financial Businesses and Professions and Non-Bank Financial Institutions (DNFBPs and NBFIs), which came into effect on 6 February 2024 (Bank Negara Malaysia, 2024). This revision added countering proliferation financing (CPF) and targeted financial sanctions (TFS) obligations that were not in the 2019 version.

CDD tiers. The Policy Document establishes three tiers of customer due diligence. Simplified CDD applies only when the customer is a listed company, a government entity, or a BNM-supervised financial institution, and the specific transaction is documented as low-risk. Standard CDD applies to every other client by default. Enhanced CDD applies when a higher-risk indicator is present: the client is a PEP, the corporate structure is opaque, or source of funds cannot be explained through standard documentation.

When CDD must be conducted. Verification must be completed before or at the commencement of the business relationship. An estate agent cannot defer identity checks to the point of signing the sale and purchase agreement. If CDD cannot be completed, the relationship cannot be established.

Ongoing monitoring. The obligation does not end at onboarding. The Policy Document requires periodic review of existing clients and heightened scrutiny of transactions that appear inconsistent with the client’s known profile. For PEP clients, the minimum review frequency is every two years.

Record-keeping period: 6 years. All CDD documents, transaction records, risk assessments, and STR files must be retained for a minimum of 6 years from the date the business relationship ends or the transaction is completed (ICLG Malaysia AML Guide, 2025; MIA guidance, 2024). This aligns with the RPGT (Real Property Gains Tax) retention period, so a properly maintained client file satisfies both obligations simultaneously.

What is BOVAEP’s role, and why does it matter for AML compliance?

BOVAEP (Board of Valuers, Appraisers, Estate Agents and Property Managers), accessible at lpeph.gov.my, is the licensing authority for registered estate agents under the Valuers, Appraisers, Estate Agents and Property Managers Act 1981 (Act 242). Operating as a registered estate agent without a BOVAEP licence is a criminal offence. BOVAEP’s Notification 23/2025 formalised its on-site examination programme, specifically covering AML compliance.

Two separate penalty tracks. An AML failure by an estate agent triggers consequences on two independent tracks. The first is BNM enforcement under AMLA 2001: criminal prosecution, fines, and imprisonment. The second is BOVAEP disciplinary action under Act 242: reprimand, suspension of registration, or cancellation of the practising licence. A single compliance failure can produce both outcomes simultaneously.

No standalone BOVAEP AML circular. BOVAEP has not published a dedicated AML circular as of the date of this article. The primary guidance document is BNM’s DNFBP Policy Document. BOVAEP’s role in AML is supervisory: it conducts on-site examinations and can refer persistent non-compliers to BNM. An agent whose licence is suspended for an AML-related reason cannot legally transact while suspended, compounding the commercial impact of non-compliance.

Practitioners in the sector report that BOVAEP on-site examinations ask for client files and CDD records directly. An agent who keeps no written records has no defence, even if the underlying transactions were legitimate.

How do you conduct CDD for an individual buyer?

Standard CDD for an individual buyer follows a fixed checklist. Collecting these documents is not optional: each item corresponds to a requirement in the BNM DNFBP Policy Document 2024. The practical standard is to collect everything before the buyer signs a letter of offer or intent.

PEP categories in Malaysia. Under BNM’s definition, a PEP is any current or former senior public official, immediate family member, or close associate of that official. This includes serving and former ministers, members of parliament, senior military officers, judges, heads of state-owned enterprises, and senior officials in international organisations. If there is any doubt, treat the buyer as a PEP and apply Enhanced CDD.

Source of funds vs source of wealth. These are different obligations. Source of funds means: where did the money for this specific purchase come from? Source of wealth means: how did the client accumulate their overall assets? For standard buyers, source of funds documentation is sufficient. For PEPs, both are required.

How do you verify a corporate buyer? The SSM workflow

Corporate buyer CDD is the most demanding scenario in a property transaction. The beneficial ownership threshold under Malaysia’s Companies Act 2016 (amended 2024) is 20%: any natural person holding 20% or more of shares or voting rights must be identified and verified (DFDL Malaysia, 2024). This is lower than the 25% threshold used in EU and UK frameworks. Additionally, any person exercising significant influence or control over the company, even if their shareholding falls below 20%, must also be identified.

Malaysia company search, SSM MyData costs and document types

Step 1: Confirm the company exists and is active. Search the company registration number on SSM MyData at mydata.ssm.com.my. The company status must show as “Active.” If the status is “Struck Off” or “Dissolved,” the transaction cannot proceed: the entity has no legal standing to hold property.

For a first-pass status check, BusinessDataGuide’s Malaysia harness queries SSM directly, returning the company name, registration number, entity type, registration status, and director list. For director-level data, SSM MyData (mydata.ssm.com.my) sells individual company profiles at MYR 5 to MYR 25 per document. For beneficial ownership, the e-BOS system holds verified BO data but is restricted to BNM and law enforcement. The estate agent must request BO disclosure from the company in writing, supported by the company’s BO register extract or a statutory declaration.

For Singapore-registered corporate buyers transacting in Malaysia, the same AMLA CDD obligations apply. BusinessDataGuide’s Singapore harness queries ACRA directly, returning the UEN, entity type, registration status, director list, and shareholding data for companies with 20 or fewer shareholders. For companies with more than 20 shareholders, supplementary BO disclosure must still be requested from the buyer.

Step 2: Identify all directors. Purchase the company profile with directorship detail (MYR 10) or the particulars-of-directors document (MYR 25.40) from SSM MyData. Record every director’s full name, identity card or passport number, nationality, and address.

Step 3: Identify ultimate beneficial owners. The e-BOS (Electronic Beneficial Ownership System), launched 1 April 2024, is not publicly accessible. Access is restricted to BNM, law enforcement, and the beneficial owner themselves (BNM, 2024). The estate agent cannot search e-BOS. Instead, the agent must write to the company requesting BO disclosure, supported by the company’s own BO register extract or a statutory declaration from a director. If the company is held by another company, trace that layer too, until a natural person is identified. An unresolved ownership chain is not an acceptable outcome: if the chain cannot be traced, the transaction cannot proceed.

Step 4: Apply individual CDD to each BO. Every natural person identified as a beneficial owner is subject to the same individual CDD requirements: full name, identity document, address, nationality, and source of funds for the purchase.

Step 5: Screen all persons and the company against sanctions and PEP lists. Screen the company name, all directors, and all BOs against the UN Security Council Consolidated List and the Malaysia Ministry of Home Affairs (MOHA) domestic sanctions list at moha.gov.my. Any sanctions match is a hard stop.

Step 6: Obtain source of funds for the purchase. For corporate buyers, the source of funds must trace to the company’s legitimate business activities. Request the most recent audited financial statements. A company purchasing property with funds that bear no relationship to its declared business activity is a red flag.

Step 7: Apply Enhanced CDD if warranted. Enhanced CDD is mandatory if the ownership structure is complex or opaque, if the parent entity is registered in a FATF high-risk jurisdiction, if nominee directors are present, or if any director or BO is a PEP.

Step 8: Document and retain everything. Every document collected in Steps 1 through 7 must be kept for 6 years from the date the business relationship ends or the transaction completes.

What are the four risk types, and how do you respond to each?

The BNM DNFBP Policy Document does not require an estate agent to decline every high-risk client. It requires proportionate controls. Most risk types have a documented compliance path that allows the transaction to proceed. Only one type is a hard block.

The AMLA 2001 framework does not require an estate agent to decline every high-risk client. It requires proportionate controls. The hard block is a sanctioned party. Every other risk type has a compliance path.

No practitioner source aimed at estate agents addresses the CPF (Countering Proliferation Financing) dimension of the 2024 BNM DNFBP Policy Document. The revised document requires screening against proliferation-financing-related designations, meaning entities connected to weapons of mass destruction programmes. This is separate from the standard sanctions screening. For most residential transactions this will not surface. For commercial property transactions involving corporate buyers with foreign-connected structures, the CPF layer is now a formal obligation.

How do you file a Suspicious Transaction Report?

The STR filing obligation under Section 14 of AMLA 2001 is suspicion-based, with no monetary threshold. A transaction does not have to be completed for the STR obligation to apply: proposed and attempted transactions are covered. Filing an STR in good faith does not expose the agent to civil or criminal liability for the information disclosed (MIA Accountants Today, 2023).

The deadline is the next working day from the date suspicion is established, not the transaction date (MIA Accountants Today, 2023). If a client makes a suspicious inquiry on a Thursday afternoon and the agent’s suspicion crystalises that day, the STR is due by close of business Friday.

Step-by-step STR process:

1. Identify the suspicion. The frontline agent identifies a transaction that is unusual, lacks clear economic rationale, involves a client whose investment is inconsistent with their known income, or involves any indicator listed in Section 14 of AMLA 2001 (including structuring, secrecy about beneficial ownership, or a PEP declining to provide source of wealth documentation).

2. Do not tip off the client. Section 14A of AMLA 2001 makes it a criminal offence to disclose to a client, or any third party, that a suspicion has been formed or that an STR has been or may be filed. Do not tell the client that you have concerns. Do not delay the transaction in a way that signals something is wrong. If in doubt, take no action visible to the client until the Compliance Officer decides.

3. Record the suspicion internally. The frontline agent logs the suspicion in writing: date, client identity, nature of the transaction, and the specific facts that gave rise to the concern. This internal record is separate from the STR itself and must be retained for 6 years.

4. Refer to the Compliance Officer (MLRO). The internal suspicion report goes to the firm’s designated Compliance Officer or Money Laundering Reporting Officer (MLRO). The Compliance Officer evaluates the report and decides whether the suspicion meets the threshold for an external STR.

5. File via goAML. If the Compliance Officer decides to file, the STR is submitted through the goAML online system (BNM’s primary STR channel, adopted from 2020). Backup contact: fied@bnm.gov.my (Financial Intelligence and Enforcement Department, Bank Negara Malaysia).

6. Receive and retain the acknowledgement. goAML generates an acknowledgement on submission. Retain this as part of the STR file.

7. Retain the full STR file for 6 years. The complete file, covering the internal suspicion log, the Compliance Officer’s decision record, the STR as filed, and the goAML acknowledgement, must be kept for 6 years from the date of filing.

What are the record-keeping requirements?

Record-keeping obligations under the BNM DNFBP Policy Document 2024 and AMLA 2001 require retention for 6 years from the date the business relationship ends or the transaction is completed (ICLG Malaysia, 2025). The 6-year period is longer than the 5 years cited in some older practitioner guides.

The RPGT (Real Property Gains Tax) and CKHT (Cukai Keuntungan Harta Tanah) record-keeping requirements align with AMLA’s 6-year retention period. An agent maintaining RPGT records for 6 years from the transaction date is simultaneously satisfying the AMLA record-keeping obligation for the same transaction, provided the CDD identity and source-of-funds documents are also retained in the same file. This overlap is not noted in any of the major practitioner sources aimed at estate agents.

What to keep. The complete retention set for each client includes: identity verification documents (MyKad copy or passport copy); CDD records (all Standard or Enhanced CDD documents collected); risk assessment notes (the written record of why the client was categorised as standard or enhanced risk); transaction records (offer letters, agreements, settlement details); any source of funds or source of wealth declarations; STR-related records where applicable (internal log, Compliance Officer decision, filed STR, goAML acknowledgement); and any ongoing monitoring notes.

Format. The BNM DNFBP Policy Document permits records to be kept in electronic format provided the records are complete, accurate, and accessible for BNM examination on request.

Practical minimum for standard-risk clients. A digital client folder containing a scanned MyKad or passport, the executed sale and purchase agreement, a brief typed note recording the basis for the standard-risk categorisation, and the source of funds declaration satisfies the formal requirement for a standard-risk individual buyer.

What are the penalties for non-compliance?

Penalties operate on two tracks: AMLA criminal penalties and BOVAEP professional sanctions. They are independent and can be imposed simultaneously for the same failure.

The penalties apply to individuals (the agent), not only to the firm. The AMLA (Amendment) Act 2025 (Act A1761), which came into effect on 1 March 2026, introduced individual officer liability under ss.83A-83E. A compliance failure that was previously attributable only to the firm is now also attributable personally to the directors and compliance officers who allowed it.

The 2025 Amendment is in force now. The AMLA (Amendment) Act 2025 (Act A1761) came into effect on 1 March 2026. References in older practitioner guides to this amendment as “pending” are superseded. Mandatory sentencing for ML convictions, the new proliferation financing offence under s.66H, and individual officer liability under ss.83A-83E are all current law.

A note on enforcement trajectory. Malaysia’s December 2025 FATF mutual evaluation identified translating ML investigations into prosecutions as a key residual gap. Regulatory pressure to close this gap will fall partly on the DNFBP sector. For estate agents, the compliance baseline has effectively raised, not lowered, since 2020.

Singapore estate agent AML obligations for comparison

Frequently asked questions

Does CDD apply to every client, or only clients who look suspicious?

CDD applies to every client, without exception (BNM DNFBP Policy Document 2024, 2024). The risk-based approach determines the level of CDD (simplified, standard, or enhanced), but every client requires at minimum standard CDD before the business relationship begins. Waiting until a client appears suspicious before collecting documents is a compliance failure.

What if a client refuses to provide source of funds documentation?

Refusal to provide source of funds or source of wealth documentation when required is itself a suspicious indicator under AMLA 2001 s.14. The agent cannot proceed with the transaction. If the refusal, combined with other known facts about the client, gives the agent reasonable grounds to suspect money laundering or terrorism financing, an STR must be filed with FIED by the next working day. The agent must not tell the client that a report is being filed.

Can the same MyKad copy collected for RPGT satisfy AMLA record-keeping?

Yes. A MyKad copy collected and retained for RPGT purposes satisfies AMLA’s identity document retention requirement for the same transaction, provided it is stored in a file that also contains the CDD risk-assessment note and source-of-funds documentation. The 6-year retention period applies to both, and the clocks run from the same date: the date the business relationship ends or the transaction completes. Maintaining one organised file per transaction satisfies both obligations simultaneously.

Does the AMLA (Amendment) Act 2025 change anything for practising agents?

Yes. From 1 March 2026, compliance failures can be prosecuted against individual agents and officers personally, not only against the firm (AMLA (Amendment) Act 2025, ss.83A-83E). The money laundering penalty at s.4(1) is now mandatory, not discretionary: a conviction results in imprisonment plus a fine of at least 5 times the proceeds value or MYR 5 million, whichever is higher. The new proliferation financing offence at s.66H carries the same maximum penalty as money laundering itself. These are not incremental changes: they materially raise the personal exposure of every registered agent.

What is the difference between an STR and a CTR?

An STR (Suspicious Transaction Report) is filed whenever an agent has reasonable grounds to suspect money laundering or terrorism financing. There is no monetary threshold. A CTR (Cash Transaction Report) applies to physical cash transactions above MYR 25,000 per day, effective 1 January 2019, down from the earlier MYR 50,000 threshold (MIA Accountants Today, 2023). The STR obligation is the primary reporting obligation for estate agents as DNFBPs. Both reports are filed with FIED, via goAML or fied@bnm.gov.my.

CDD workflow and documentation checklist

Citation capsules

Section 1 - Market scale and reporting institution status. Malaysia recorded MYR 232.3 billion in total property transaction value across 420,545 transactions in 2024, an 18% increase from 2023 (NAPIC, Q1 2025 Property Market Snapshot, 2025). Registered estate agents are designated reporting institutions under AMLA 2001 First Schedule s.3, with mandatory AML/CFT compliance effective 1 January 2020. The obligation applies to every transaction, not only to clients who present obvious red flags.

Section 5 - Beneficial ownership threshold. Malaysia’s beneficial ownership threshold is 20% of shares or voting rights, lower than the 25% threshold used in EU and UK frameworks (Companies Act 2016, amended 2024; DFDL Malaysia, 2024). The e-BOS system, launched 1 April 2024, is not publicly accessible: estate agents must request BO disclosure from the company in writing, supported by a statutory declaration or BO register extract.

Section 7 - STR deadline. Malaysia’s STR filing obligation is suspicion-based with no monetary threshold (AMLA 2001 s.14). The filing deadline is the next working day from the date suspicion is established, not the date the transaction completes (MIA Accountants Today, 2023). The obligation covers proposed and attempted transactions, not only completed ones. STRs are submitted via the goAML system or to fied@bnm.gov.my.

Section 9 - 2025 Amendment penalties. The AMLA (Amendment) Act 2025 (Act A1761), in force from 1 March 2026, changed the s.4(1) money laundering penalty from discretionary to mandatory: imprisonment plus a fine of at least 5 times the proceeds value or MYR 5 million, whichever is higher. Individual officer liability was introduced under ss.83A-83E, making personal prosecution of compliance officers and directors possible alongside entity prosecution.