Start with the service, not the label ‘forex’
This checklist is for enterprise procurement and compliance teams preparing a payment-provider review. It is not an assessment of any named firm or permission to begin collecting funds. First describe what the customer buys: an exchange transaction, a remittance, brokerage access, a trading deposit or another service. These activities need separate assessment.
Bank Negara Malaysia (BNM) publishes MSB licensee and agent resources with different money-services activities. Securities Commission Malaysia (SC) provides an Investment Checker for capital-market authorisations. Use the appropriate official source for the claimed activity; do not treat a money-changing listing as evidence of brokerage or CFD permission.
Build a six-part evidence pack
- Identity: record the full legal name, registration number, contracting entity, product URL and the relationship between any brand, group company and licensed entity.
- Authority: find the entity through the regulator’s own website. Record the register URL, licence or registration identifier, current status, exact permitted activities, restrictions and check date. Resolve mismatched names with the regulator or qualified adviser.
- Market: list incorporation jurisdiction, licensing jurisdiction, customer locations and actual collection/payout countries separately. Obtain an assessment of the proposed Malaysian activity; an offshore licence alone does not answer this question.
- Flow: draw who pays whom, for what purpose, in which currency and under whose contract. Separate customer funds, company revenue, refunds and onward remittances. Identify the proposed collection-account holder and final beneficiary; explain any third-party role.
- Authenticity: compare entity, official domain and contact details. Check relevant regulatory warnings and enforcement records. SC warns about cloned registers: enter through the official regulator domain rather than a link supplied in a sales message.
- Commercial scope: provide current or forecast monthly amount, transaction count, MYR share, average order size, required methods and intended launch date. Ask the provider to confirm the exact entity, activity, flow and channels it can accept in writing.
A hypothetical mismatch to resolve before testing
Suppose a group presents a foreign remittance licence, but the proposed contract is with a different subsidiary and the website offers leveraged trading. This is an invented example. Keep the application under review: document the entity relationship, identify the permissions relevant to the actual product and obtain a target-market assessment. Do not relabel the trading deposit as a generic digital-service purchase.
Similarly, if the proposed receiving account belongs to a third party, request a documented explanation and provider approval. Technical ability to create a payment order does not resolve a legal-entity or activity mismatch.
What remains subject to confirmation?
PAYJN must separately confirm whether it can accept the business, entity, market and payment flow. Online Banking and QR Payments are the public Malaysia method descriptions; this article does not confirm their availability for an FX-related applicant, a bank brand, direct connection, fees, limits or settlement arrangements.
A register match or absence from a warning list does not guarantee solvency, safe conduct, stable transaction volume or onboarding approval. The SC warning list is not exhaustive. Recheck material changes before launch and seek qualified advice for unresolved regulatory questions.
Frequently asked questions
Can one licence cover exchange, remittance and CFDs?
Do not assume this. Record the exact authorised activities for the actual legal entity and assess the proposed product separately.
Does a clean warning search mean the firm is safe?
No. It is one dated check, not a reliability certificate. Keep entity, activity and funds-flow review separate.
What should an initial enquiry contain?
Send public company and product URLs, your role, registration jurisdiction, target markets, required methods, forecast volume/currency/average ticket and launch timing. Include public register links; submit sensitive documents only through an agreed secure process.
Official references and next step
Official resources checked on 8 November 2026. This is an editorial preparation workflow, not a legal opinion or verification of an individual licensee.
Prepare a Malaysia business review
Share your company/product URL, business model and role, registration jurisdiction, actual payment markets, methods, current or forecast monthly volume, currency, average order size and launch plan. A contact click or prepared enquiry is not a received application.
Prepare a Malaysia business review