Overview of Cryptocurrency Asset Regulation Series (12): Malaysia, Exchanges, Custody, and Token Issuance

On October 20, 2026, Bank Negara Malaysia announced the launch of SSDS+, which supports the issuance, custody, and safekeeping of tokenized bonds and Islamic bonds, and connects with RENTAS+ to handle the corresponding central bank currency payment settlements. The development of digital assets in Malaysia is advancing along two paths: the public investment market and financial infrastructure.

For businesses preparing to enter the local market, it is essential to clarify which path their operations fall under. Operating a digital asset trading platform, providing asset custody for clients, and financing through tokens correspond to different entry and ongoing regulatory requirements; tokenization projects in banking and bond markets must also consider existing financial business regulations.

This regulatory map is based on official documents verifiable as of October 24, 2026, focusing on the local market's regulatory authorities, exchanges, issuance and custody rules, and addressing issues related to cross-border entry, taxation, and Islamic finance that need to be considered together.

▌ I. Securities Regulatory System as the Main Entry Point

The Securities Commission Malaysia, abbreviated as SC, is the main regulatory authority for local digital asset capital market activities. Its legal framework is based on the Capital Markets and Services Act 2007, or CMSA, and is further clarified through securities designation orders and specific business guidelines that define the applicable scope and operational requirements.

The Capital Markets and Services (Securities Designation) (Digital Currency and Digital Token) Order 2019, or P.U.(A)12/2019, is the starting point for understanding this framework. Digital currencies and digital tokens that meet the conditions specified in the order are subject to securities regulation. The assessment must consider the trading method, expected returns, holder rights, and project arrangements, and cannot conclude solely based on the use of the terms "coin" or "token".

At the business level, digital asset exchanges are commonly referred to as DAX, with their main regulations outlined in Chapter 15 of the Recognized Market Guidelines. Operators apply for recognized market operator registration under Section 34 of the CMSA. Initial exchange offerings, or IEO platforms, and digital asset custodians, or DACs, are subject to the relevant sections of the Digital Asset Guidelines.

Bank Negara Malaysia (BNM) is responsible for matters related to currency, banking, payments, and foreign exchange within its jurisdiction. If digital asset activities involve fiat accounts, payment services, or regulated financial institutions, these requirements must be incorporated into the design. Section 3.01 of the Digital Asset Guidelines explicitly requires reading in conjunction with relevant laws managed by BNM regarding payments and foreign exchange.

The Labuan Financial Services Authority (Labuan FSA) has its own regulatory framework for its international business financial center. Licenses obtained in Labuan should be used according to the licensee's subject, business scope, and client restrictions. When operating for local Malaysian clients, it is also necessary to verify local market rules and specific approved scopes.

Additionally, taxation is handled by the Inland Revenue Board of Malaysia (LHDN) and other relevant authorities. Projects intending to use Islamic finance compliance labels must also pay attention to the relevant resolutions of the SC's Shariah Advisory Council. After clarifying the business map, decisions can be made regarding the applicant entity, partner banks, client scope, and product structure, which typically reduces the cost of preparing duplicate materials.

This diagram focuses on the Malaysian local market; specific products must also verify other applicable rules.

▌ II. Exchange Entry and Capital Requirements

On May 20, 2026, the SC revised the Recognized Market Guidelines, further specifying the financial capabilities, asset protection, token assessment, and governance arrangements for DAX. Businesses preparing to establish new platforms should directly calculate their capital and operational conditions based on this version.

Section 15.03 requires DAX operators to be registered locally, with a minimum paid-up capital of 15 million ringgit. Additionally, operators must maintain a certain scale of shareholder funds: the benchmark for the general model is 5 million ringgit, while the Direct Trade model is 7 million ringgit, compared with 25% of annual operating expenses, taking the higher amount.

Annual operating expenses are calculated on a rolling 12-month basis, so as the platform scales up and human and technological investments increase, the amount of funds that need to be maintained may change. In addition to the initial capital contribution, businesses must also consider their ability to supplement funds after business growth.

Section 15.04 further stipulates that the minimum shareholder funds mentioned above must be maintained in cash or liquid assets, with digital assets excluded, and held separately from operational accounts. This allows the platform to use more readily available resources to meet ongoing operational needs and facilitates regulatory checks on whether financial buffers genuinely exist.

For existing DAX, the guidelines provide a transition period to meet the new financial requirements of Section 15.03, lasting until May 20, 2028. During this period, applicable existing minimum financial requirements must still be adhered to. Businesses should confirm the contents covered by the transition arrangements item by item, with other operational obligations executed according to their respective provisions.

Shareholder and governance structures are equally important. Section 15.06 requires that at least one institutional company among the shareholders holds no less than 5% and has representation on the board. Therefore, application materials need to explain actual control, the role of institutional shareholders, the suitability of directors and executives, and how business decision-making and risk management are divided.

From a business preparation perspective, companies can first create a complete business description: who the clients are, what trading model the platform adopts, where the revenue comes from, who provides technology and custody, and how funds flow in and out. This description should then be aligned with capital calculations, organizational structure, and compliance systems to avoid different materials describing different businesses.

Sections 15.03---15.04 of the Recognized Market Guidelines; models and transition conditions are detailed in the text.

▌ III. How to Safeguard Client Assets

Whether the trading platform can protect client assets is a crucial part of Malaysia's new rules. Sections 15.34 to 15.39 of the Recognized Market Guidelines connect fund accounts, hot and cold wallets, independent verification, custody arrangements, and daily reconciliations.

First, client fiat funds must be deposited into a dedicated trust account at a licensed financial institution in Malaysia and managed by an independent registered trustee. Client digital assets must also be separated from the platform's own inventory, and relevant records should be accurate and continuously updated to identify each client's asset rights.

Second, Section 15.35(g) requires calculating the ratio of hot and cold wallets daily based on the total value of client digital assets, maintaining an 80:20 offline to online storage arrangement. Offline storage reduces exposure from continuous connectivity, while online storage is used for handling daily transactions and withdrawals. For online assets, the platform should implement internal controls, insurance, collateral, bank guarantees, or other recognized safeguards commensurate with the risks.

Section 15.36 requires rebalancing the hot and cold wallet ratio at the end of each quarter; if the ratio deviates by more than 10% from the specified section, immediate adjustments must be made. An example given in the guidelines is that if the ratio changes from 80:20 to 69:31, it triggers immediate rebalancing. Asset price changes and client withdrawals can affect this ratio, and the backend needs to obtain balances and valuations daily, executing timely actions upon identifying triggering situations.

For assets that account for 10% of the total value of client digital assets, or where the total amount held by clients of that currency exceeds 10 million ringgit, the guidelines also require setting up dedicated offline wallets. The platform must commission an independent third party to verify the asset holdings of each wallet at least annually and publicly disclose the results as required.

When the custody scale is large, organizational arrangements will also change. Section 15.37 stipulates that if the total value of client digital assets under custody exceeds 500 million ringgit, the DAX must appoint an independent digital asset custodian registered with the SC. The guidelines allow for the establishment of independent entities to perform this function, emphasizing their decision-making independence and conflict of interest management.

DAX that meet the specified criteria and are within the defined range can provide custody themselves while complying with Sections 27 and 28 of the Digital Asset Guidelines. Businesses need to assess their technical controls, personnel permissions, emergency recovery, and third-party collaborations accordingly, rather than waiting until they approach the threshold to start looking for custody solutions.

For multinational groups, these provisions also imply that local operations should have actual control and response capabilities. The guidelines require local DAX to maintain direct access to wallets, avoiding reliance on overseas affiliated entities for critical decisions. In the event of failures or internal disputes within the group, the operational and recovery mechanisms for local client assets need to continue functioning.

Based on Sections 15.34---15.39 of the Recognized Market Guidelines.

▌ IV. Token Listing and Market Operations

What digital assets the platform can trade requires corresponding assessments. Sections 15.20 to 15.29 of the Recognized Market Guidelines stipulate the assessment process, record-keeping, restricted assets, and ongoing monitoring. Operators should establish their own review capabilities and retain sufficient basis for listing decisions.

The assessment content needs to consider asset characteristics, project circumstances, technical and security factors, trading history, and market risks. Section 15.21 includes specific listing conditions; among them, for assets subject to these conditions, they must have been traded for at least one year at virtual asset service providers that meet the specified conditions, with corresponding exceptions set. Businesses should verify each item according to the complete text to avoid deciding on listings based solely on project popularity.

Section 15.24 explicitly restricts privacy tokens from trading on the platform. For digital assets listed separately in the guidelines as restricted, Sections 15.25 to 15.27 set higher risk management and procedural requirements. When product teams prepare to expand the range of currencies, compliance, technical, and operational teams need to participate in the assessment simultaneously.

After listing, the platform must continue to monitor for security vulnerabilities, significant project changes, or liquidity anomalies. Clients need to be able to see important information in a timely manner, and the platform should have arrangements for suspending, restricting, or halting trading, explaining how such measures affect client asset withdrawals and pending orders.

Market fairness is also an ongoing task. The platform and its affiliates may involve proprietary assets, business collaborations, or other interests; Sections 15.10 to 15.12 require identifying and managing conflicts of interest. Section 15.13 also prohibits providing direct or indirect financing support to facilitate investor trading; specific product designs should be verified against the provisions of the guidelines.

In terms of technical systems, Sections 15.14 to 15.19 address operational risks, business continuity, system testing, and internal audits. For platforms operating around the clock, backup environments, recovery drills, and incident communication need to align with actual personnel arrangements. Who handles customer complaints, abnormal orders, and security alerts should also be clarified before listing.

Wee Hong / CC BY-SA 4.0 · Original image unchanged

Original image: https://commons.wikimedia.org/wiki/File:Bank_Negara_Malaysia_(230715-0916).jpg

License: https://creativecommons.org/licenses/by-sa/4.0/

▌ 5. Token Financing Organized According to IEO Rules

When companies wish to raise funds through token financing, they should read Sections B and C of the "Digital Asset Guidelines." An IEO can be understood as a token issuance organized and reviewed by a registered platform, where the issuing company and the platform each bear their own responsibilities.

Paragraph 6.02 requires that the issuer be a qualified Malaysian registered company or limited liability partnership, primarily conducting business locally. The types of relevant companies are also subject to exclusion restrictions in the provisions. Paragraph 6.03 stipulates that the minimum paid-up capital and ongoing shareholder funds for applicable company issuers is 500,000 ringgit, while limited liability partnerships are subject to corresponding minimum capital requirements.

The scale of financing is also linked to the issuer's capital base. Paragraph 19.01 states that the amount that can be raised within any consecutive 12 months is calculated at 20 times the shareholder funds or partnership capital, with a cap of 100 million ringgit. The actual amount a company can raise needs to consider both of these limits simultaneously.

On the investor side, Paragraph 19.05 distinguishes between professional investors, angel investors, and retail investors. The investment limit for retail investors in a single issuer is 2,000 ringgit, with a total not exceeding 20,000 ringgit within 12 months; angel investors are subject to a 12-month limit of 500,000 ringgit, while professional investors are handled according to relevant category regulations.

The issuance process also includes a cooling-off period and refund arrangements. Paragraphs 19.06 to 19.09 stipulate that the cooling-off period applicable to investors is at least six working days from the end of the issuance, and this cooling-off right does not apply to the issuer's employees. If investors withdraw during this period, the IEO operator must refund the investment amount and specified fees within six working days of receiving the notice. The fundraising page should clearly state the start date, notification entry, and refund arrangements.

There is an alternative handling path for failed fundraising. If the target amount or minimum fundraising amount is not reached, refunds should be processed according to Paragraphs 19.03 to 19.04. The backend needs to separately record the issuance closure, withdrawal notice, and refund receipt dates, so customer service can explain to investors how their funds are being processed according to which rule.

The IEO operator itself must meet entry, governance, and review requirements, with Paragraph 14.01 stipulating a minimum paid-up capital of 5 million ringgit. The platform is responsible for understanding the project, verifying issuance materials, and managing the issuance process, while the issuer needs to clearly explain the use of funds, project implementation, holder rights, and major risks.

If the token itself has characteristics of bonds, fund shares, or other existing securities, Paragraph 3.02 indicates that relevant issuance requirements should also be followed. When designing tokens, companies can first write the rights obtained by investors in plain language, then determine which set of legal systems applies, which is more conducive to advancement than first determining the technical form and then supplementing legal explanations.

The currency unit is ringgit; the issuance scale is calculated according to consecutive 12 months and Paragraph 19.01.

▌ 6. Independent Custody, Anti-Money Laundering, and Cross-Border Operations

Custody, storage, or holding of digital assets for others falls under the business concerns of Section D of the "Digital Asset Guidelines." Paragraph 23.01 designates the relevant services as capital market services under Section 76A of the CMSA, with specific registration paths determined by the entity's identity and business arrangements.

Paragraph 24.01 stipulates that the minimum paid-up capital and ongoing shareholder funds for digital asset custodians is 500,000 ringgit, and the SC may impose additional requirements based on the nature and risk of the business. Chapters 27 and 28 outline specific obligations regarding client assets, operational control, and security arrangements, and the application materials should explain who can initiate, approve, execute, and restore asset operations.

Platforms and custody businesses must also verify applicable anti-money laundering, counter-terrorism financing, and sanctions requirements. Customer identity, beneficial ownership, business purpose, and handling of unusual transactions must all be implemented in actual processes. For inter-institutional digital asset transfers, applicable information transmission requirements and counterparty cooperation capabilities should also be assessed.

Overseas platforms providing services to local customers should pay special attention to the SC's judgments and enforcement regarding market operations. The ability for the website to be accessed and for customers to open accounts independently only indicates that it can be used technically. If a company plans to actively market, solicit, or organize local business, it should first determine the corresponding entry path and verify the official registration list and restrictions.

Group technology outsourcing also requires advance planning. Where customer data is stored, whether overseas personnel can access it, whether regulators can obtain records, and how to recover after a supplier interruption can all affect local operations. Writing these issues into service contracts and emergency plans can reduce repeated adjustments after application and launch.

▌ 7. Taxation and New Developments in Tokenized Finance

The Malaysian Ministry of Finance has clarified that income generated from activities such as digital currency trading, mining, and exchange should be handled in accordance with Section 4 of the Income Tax Act 1967 and tax guidelines. The LHDN's tax guidelines for digital currency trading further focus on the nature of operations, transaction facts, and record-keeping, requiring companies to judge income and costs based on actual business.

Factors such as transaction frequency, holding purpose, organizational method, and profit activities are typically considered when making judgments. Platform service income, ongoing operational transactions, and individual occasional disposals have different factual backgrounds, and tax treatment should be based on these factual foundations. Companies should maintain transaction records, expenses, and valuation data from the establishment stage, which is beneficial for subsequent reporting and verification.

Islamic finance is another noteworthy feature of the local market. The SC's Shariah Advisory Council has issued relevant resolutions regarding digital assets, and whether products can adopt corresponding compliance expressions needs to be considered in conjunction with specific assets and business arrangements. Issuance and marketing materials should explain the basis for the review adopted to avoid expanding the recognition of one item to all businesses.

The SSDS+ launched this week reflects progress in financial infrastructure. BNM stated that the platform uses cloud and distributed ledger technology to handle the transfer and ownership records of tokenized securities; RENTAS+ processes corresponding payments, supporting all-day service. Bonds and Islamic bonds thus gain new digital issuance and custody methods.

For teams preparing to land, work can be organized into three phases: first determine the business scope and legal path, then prepare capital, personnel, technology, and partner institutions, and finally verify customer account opening, transactions, custody, complaints, and exit processes item by item. Regulatory materials, contracts, and systems should be compiled according to the same set of business facts, making subsequent communication easier to maintain consistency.

This article is intended for legal, policy, and industry research exchange, aiming to provide an objective analysis of digital finance, stablecoins, digital assets, and related regulatory dynamics. It does not constitute any form of investment advice, legal opinion, tax opinion, or other professional advice, nor does it constitute a recommendation, promotion, or solicitation of any financial product, digital asset, or business project. The regulatory rules, market data, and institutional information mentioned in the text are primarily sourced from public materials and may be adjusted due to changes in laws and regulations, regulatory policies, market environments, and project progress. Readers are advised to independently judge based on the latest publicly available information and comply with applicable laws and regulations in their respective countries or regions. The author and publishing platform do not bear any responsibility for any investment, trading, or other business decisions made based on reliance on the content of this article.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.