Malaysia Warns DNFBPs of Rising Corporate Mule Risks and AML Compliance Failures

Bank Negara Malaysia (BNM) has warned lawyers, accountants and other designated non-financial businesses and professions (DNFBPs) that criminal networks are increasingly exploiting legitimate corporate structures and professional services to conceal illicit funds. The warning was delivered by Deputy Governor Dato’ Marzunisham Omar at the DNFBP Compliance Conference 2026, held in Kuala Lumpur on 22 October.

The remarks highlighted the growing use of corporate mule accounts, weaknesses in customer due diligence and suspicious transaction reporting, and the importance of professional service providers acting as effective gatekeepers against financial crime.

BNM said data from Malaysia’s National Fraud Portal indicated an increase in corporate mule accounts. Criminal networks are reportedly using companies and other legitimate business entities to conceal the movement of illicit funds, making transactions appear to be connected to ordinary commercial activity.

The central bank did not provide a numerical estimate of the increase or identify specific companies involved. However, it described corporate mule activity as an emerging risk requiring greater attention from professionals involved in company formation, legal arrangements, accounting and other business services.

Marzunisham emphasised that companies, trusts and legal arrangements are essential to economic activity but can also be misused to obscure beneficial ownership, disguise the origins of criminal proceeds and create an appearance of legitimacy around unlawful activity.

Professional service providers may become involved before suspicious funds enter the financial system. A company may be incorporated, a transaction structured or a legal arrangement established using services provided by advisers who have not adequately understood the client, the purpose of the arrangement or the source of the funds involved.

BNM referred to a United Nations Office on Drugs and Crime assessment of transnational organised crime in Southeast Asia, which identified lawyers and accountants among the specialist service providers that criminal organisations may engage. The reference concerned the potential exploitation of professional services and did not suggest that these professions generally facilitate criminal activity.

The central bank stressed that effective gatekeeping requires more than collecting identification documents and completing standard onboarding procedures. Professionals are expected to understand who ultimately owns or controls a client, where funds originate and why a particular transaction or structure is being established.

The warning also addressed the risks associated with digital onboarding, virtual business relationships and cross-border service delivery. These developments can improve efficiency and accessibility, but they may also create opportunities for criminals to conceal identities, misrepresent information and establish apparently legitimate business relationships.

BNM called for a risk-based approach that takes account of customer behaviour, corporate structures and the circumstances surrounding an engagement. Professionals were encouraged to challenge inconsistencies, exercise professional scepticism and refuse to facilitate arrangements that cannot be adequately explained.

The deputy governor also highlighted two recent enforcement examples involving deficiencies in anti-money laundering controls.

In one case, BNM and the Companies Commission of Malaysia took enforcement action against a company secretary for failing to submit suspicious transaction reports concerning foreign nationals suspected of involvement in an international scam syndicate. The speech did not identify the company secretary or specify the penalty imposed.

A separate case involved a Labuan investment bank. BNM and the Labuan Financial Services Authority took enforcement action after identifying material customer due diligence deficiencies that affected the institution’s ability to assess possible links to illicit overseas activities. The case also involved delays in submitting suspicious transaction reports.

The examples illustrate the importance of applying customer due diligence effectively and submitting suspicious transaction reports without avoidable delay. BNM did not disclose the names of the entities involved, the exact enforcement measures or the amounts of any financial penalties.

The remarks follow Malaysia’s 2025 mutual evaluation by the Financial Action Task Force and the Asia/Pacific Group on Money Laundering. The assessment recognised that Malaysia has established controls to prevent criminals from becoming beneficial owners or controlling interests in many DNFBP sectors. However, it also identified weaknesses in the practical implementation of preventive measures, particularly among smaller businesses and professions.

The assessment noted that some DNFBPs face difficulties identifying ultimate beneficial owners, especially where complex ownership structures and foreign legal entities are involved. Supervisors have also identified deficiencies in internal controls and the application of enhanced due diligence and suspicious transaction reporting obligations.

BNM said it intends to conduct the next National Risk Assessment in 2027, with closer examination of money laundering and terrorism financing risks affecting DNFBPs and other non-financial businesses. The assessment is expected to support more targeted policies, regulatory guidance and mitigation measures tailored to individual sectors.

The central bank also acknowledged the role of professional bodies, including the Companies Commission of Malaysia, the Malaysian Bar Council and the Malaysian Institute of Accountants, in strengthening awareness and compliance capabilities.

The 2027 assessment is a planned exercise and does not itself introduce new legal obligations. In the meantime, DNFBPs remain subject to the AML/CFT/CPF requirements applicable to their activities, including customer due diligence, risk assessment, recordkeeping, internal controls and suspicious transaction reporting.

BNM’s message was that professionals must be able to demonstrate that their compliance procedures work in practice. Understanding the client, questioning unexplained inconsistencies and making timely reporting decisions remain central to preventing legitimate businesses and professional services from being exploited by criminal networks.

By fLEXI tEAM