Malaysia AML for Accountants: BNM and MIA Data and Compliance Report 2026

Accountants in Malaysia are not just advised to think about money laundering. Those who carry on certain activities are classed as reporting institutions under the country's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA), and they have to report to the regulator on how they manage the risk. The clearest recent example is the Data and Compliance Report (DCR) 2026, which Bank Negara Malaysia (BNM) and the Malaysian Institute of Accountants (MIA) announced together in a joint circular dated 30 June 2026. This guide explains who the circular applies to, what it asks firms to do, and what the rules mean for a practice in day-to-day terms. If you are a member of the Institute, our guide to MIA CPE requirements covers the separate training side.

What the Data and Compliance Report is

The DCR is a mandatory return that firms complete online. According to the joint circular, submission is mandatory and enforceable, and it is made at firm level, either as a full submission or as a declaration. After a firm submits, BNM issues a report card that highlights gaps and areas for improvement. That report card is a useful free diagnostic, so treat it as an input to your next compliance review rather than a formality.

Who has to submit

The circular applies to accountants who hold a valid practising certificate under Rule 9 of the MIA (Membership and Council) Rules 2001 and who are reporting institutions carrying on the activities listed in Paragraph 9 of the AMLA's First Schedule. It covers accountants acting in person or through a firm or company when they prepare to carry out those gazetted activities for clients. Three points are worth noting:

• Firms that provide none of the gazetted activities still have to respond. The circular says such firms must submit a declaration of non-provision status, so doing nothing is not an option.
• In-house accountants are outside the requirement. Accountants who are employees of a company are not required to submit or declare.
• The duty sits at firm level. One submission per firm, rather than one per partner or member.

The 2026 submission window

The 2026 window ran from 1 July 2026 to 30 September 2026, submitted through BNM's Dynamic Submission Portal. If your firm did not submit within the window, speak to the regulator's DCR helpdesk straight away rather than waiting. The circular says non-submission can lead to enforcement action under the AMLA, the Financial Services Act 2013 and the Islamic Financial Services Act 2013, and that it is also a breach of the MIA's professional ethics requirements in its By-Laws.

The compliance officer requirement

Firms that have to make a full DCR submission must appoint a compliance officer and notify BNM through its AML/CFT portal. In practice that means a named person who is responsible for the firm's anti-money laundering programme. If you are a small practice, the sensible approach is to give the role to one senior person, document the appointment, and make sure the rest of the team knows who it is. Our general guide to suspicious activity reporting explains how internal reporting of suspicions works.

The legal basis behind the circular

The circular cites a stack of provisions, which is useful to know when you explain the requirement to a partner or a client:

• Sections 8(3)(a), 16(6) and 25(2) of the AMLA.
• Section 143(2) of the Financial Services Act 2013 and section 155(2) of the Islamic Financial Services Act 2013.
• Paragraph 3.3(a) of BNM's policy document on anti-money laundering, counter-financing of terrorism and targeted financial sanctions for designated non-financial businesses and professions and non-bank financial institutions, which defines the gazetted activities.
• The MIA By-Laws on Professional Ethics, Conduct and Practice, paragraphs 260.5 A1 and A2, R115.1 and B150.1.

The point to take from the list is that this is not just regulator housekeeping. The same failure can be a breach of the AMLA and a breach of professional ethics, which is a double exposure for individual members.

A practical checklist for a Malaysian practice

1. Decide whether any of your services fall within the gazetted activities. If none do, file the non-provision declaration.
2. If some do, appoint and notify a compliance officer before you answer the DCR.
3. Read the information kit on the BNM AML/CFT portal so you know what the DCR asks before you start.
4. Submit through the regulator's portal within the window.
5. When the report card arrives, log each gap it identifies, assign an owner and set a date to fix it.
6. Keep the evidence. If a regulator or a professional body asks later, a dated record is your protection.

How this fits the wider picture

The DCR is one part of Malaysia's regime, which sits within the international standards set by the Financial Action Task Force. If you are new to those standards, our explainer on the FATF recommendations, mutual evaluations and lists shows how national rules like these connect to the global framework. For structured training on AML controls, take a look at our CPD courses.

What we could not confirm

We worked from the 30 June 2026 joint circular. We did not read the full text of BNM's current policy document, so this guide does not set out detailed obligations such as customer due diligence steps, record retention periods or notification deadlines. Older BNM question-and-answer guidance dates from 2020 and pre-dates the revised policy document, so we have not relied on it. The 2026 window has now closed, and the regulator may announce different dates for the next round, so check the BNM AML/CFT portal for the current cycle.

Frequently asked questions

Who issued the DCR 2026 notice?

Bank Negara Malaysia and the Malaysian Institute of Accountants issued it jointly on 30 June 2026.

Do in-house accountants have to submit?

No. The circular says employees of a company acting as accountants do not need to submit or declare.

Does a firm that provides no gazetted activities still need to respond?

Yes. It must submit a declaration of non-provision status.

What happens if a firm does not submit?

The circular says enforcement action may follow under the AMLA, the Financial Services Act 2013 and the Islamic Financial Services Act 2013, and that non-submission is also a breach of the MIA's professional ethics requirements.