Malaysian Bank Relationship Manager Jailed Seven Years and Fined RM40 Million for Fraud and Money Laundering

A former relationship manager at an international bank in Malaysia has been sentenced to seven years in prison and fined RM40 million after admitting to a scheme that defrauded eight elderly customers of more than RM1.58 million and involved the laundering of the proceeds through third-party accounts.

Kho Yung Kang, 39, appeared before the Sessions Court in Kuching and pleaded guilty to 24 charges comprising 16 counts of cheating and eight offences under Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001.

The court imposed concurrent prison sentences for the various offences, resulting in an overall seven-year custodial sentence. The case also resulted in a substantial financial penalty, with RM5 million imposed for each of the eight money laundering offences. Kho did not pay the RM40 million fine and therefore faces an additional custodial term in default.

The case centred on Kho's position of trust within the banking sector. As a relationship manager, he was responsible for assisting customers with a range of financial products and services, including investments, bonds, unit trusts, fixed deposits and domestic and international remittances.

That position gave him direct access to customers who relied on his professional advice and assistance with their finances. Prosecutors established that he exploited that trust by presenting what appeared to be an investment opportunity promising attractive returns.

Customers were persuaded to authorise transactions after being told that their funds would be placed into an investment arrangement. However, the money was not used for the stated investment purpose.

Instead, funds were transferred from customers' bank accounts into accounts belonging to third parties. The transactions were carried out through several payment mechanisms, including DuitNow, interbank transfers and cashier's orders. The money was ultimately diverted for Kho's personal benefit.

The scheme affected eight customers, all of whom were between 60 and 75 years old. Individual losses varied considerably, with several victims transferring money in multiple transactions after being persuaded to participate in the purported investment opportunity.

One 61-year-old customer transferred RM150,000 and a further RM185,000 on the same day, resulting in a loss of RM335,000.

Another victim, a 60-year-old woman, lost almost RM180,000 through two transactions. A 69-year-old customer suffered losses exceeding RM232,000 after transferring funds on three separate occasions.

Other victims included customers aged 63, 70, 72 and 74, with individual losses ranging from approximately RM91,800 to more than RM200,000. Collectively, the fraudulent transactions exceeded RM1.58 million.

The money laundering charges arose from the subsequent handling of the proceeds. Rather than the fraudulent funds remaining in the victims' accounts or being transferred directly to the defendant, the money moved through third-party accounts and other banking channels before ultimately being used for his benefit.

This element of the case is particularly significant from an anti-money laundering perspective because it demonstrates how a fraud committed through legitimate banking infrastructure can subsequently become a money laundering offence when the proceeds are transferred, concealed or otherwise dealt with in a manner designed to facilitate their use.

The case also illustrates the additional risks created when an individual involved in financial services has both a trusted relationship with customers and access to sophisticated payment infrastructure.

A relationship manager ordinarily acts as an intermediary between customers and a financial institution. Customers may therefore be less likely to question instructions relating to investments or account transactions when those instructions appear to originate from someone they know and trust professionally.

The alleged scheme exploited precisely that relationship.

Customers provided signatures and completed biometric verification believing that the associated transactions related to legitimate investments. The resulting transfers therefore had the appearance of authorised banking activity, even though the underlying purpose was allegedly fraudulent.

From a compliance standpoint, the case highlights the importance of controls that operate independently of the individual employee managing a customer relationship.

Customer instructions involving unusual transfers, new beneficiaries, substantial withdrawals or movements inconsistent with an established customer profile can create warning signs even where the customer appears to have authorised the transaction.

Financial institutions must therefore consider not only whether a transaction has been technically authorised, but also whether it is consistent with the customer's known financial circumstances, stated objectives and expected activity.

The age of the victims is another important feature of the case. Elderly customers can be particularly vulnerable to financial exploitation, especially when they have established long-standing relationships with bank employees and rely heavily on professional guidance when making investment decisions.

Effective customer protection consequently requires more than conventional transaction monitoring. Institutions may need additional safeguards where vulnerable customers are being encouraged to make unusually large transfers or move substantial savings into unfamiliar investment arrangements.

The case also demonstrates the importance of monitoring activity involving employees themselves.

A financial institution's AML controls generally focus heavily on customers and external counterparties. However, employees with access to customer accounts, payment systems and sensitive information can create an internal fraud risk that requires a separate control framework.

Employee-related financial crime can be difficult to detect because transactions may initially appear legitimate. An employee may have genuine authority to communicate with customers, initiate transactions or assist with account administration. The risk arises when those legitimate permissions are exploited for an unauthorised purpose.

Consequently, effective internal controls can include segregation of duties, transaction approval requirements, employee activity monitoring, access controls, periodic reviews of unusual staff behaviour and mechanisms allowing customers to independently confirm significant transactions.

The use of third-party accounts in the Malaysian case is also relevant to financial crime monitoring. Transfers to unrelated or newly introduced beneficiaries can be an important indicator where they are inconsistent with the customer's normal behaviour.

In fraud and money laundering investigations, authorities frequently examine the full chain of transactions rather than simply identifying the first transfer. Establishing where funds originated, which accounts received them, how quickly they moved and who ultimately benefited can help investigators reconstruct the financial flow.

For banks and other regulated financial institutions, this makes transaction monitoring and record keeping essential components of an effective AML framework.

The case was prosecuted under Malaysia's AMLA, demonstrating the potential consequences when fraudulent proceeds are subsequently dealt with as criminal property. Money laundering offences can attract substantial financial penalties in addition to imprisonment, particularly where multiple transactions or significant amounts of criminal proceeds are involved.

The sentence therefore goes beyond punishment for the underlying customer fraud. It reflects the seriousness with which Malaysian authorities and courts treat the movement and use of illicit proceeds within the financial system.

Kho's seven-year prison sentence resulted from concurrent terms imposed across the various charges. For the cheating offences, the court imposed prison sentences of between three and four years for each count together with one stroke of the cane per offence. The money laundering offences each attracted three years' imprisonment, a RM5 million fine and an additional stroke of the cane.

The aggregate sentence was seven years' imprisonment, a RM40 million fine and 24 strokes of the cane. The custodial terms for the cheating offences run concurrently from the date of Kho's remand on May 23, 2025, while the money laundering sentences commenced upon conviction.

The substantial fine is particularly notable when compared with the amount directly lost by the victims. While the fraud involved approximately RM1.58 million, the court imposed RM40 million in fines across the eight money laundering charges.

The case provides a clear warning that financial crime committed from within a regulated financial institution can expose an offender to consequences extending well beyond the value of the original fraud.

It also highlights the importance of distinguishing between customer-authorised activity and genuinely informed customer consent. A transaction can technically involve a customer's signature or biometric authentication while still being fraudulent if the customer was deceived about the nature or destination of the funds.

For banks, this distinction is increasingly important as digital payment systems make transfers faster and easier. Systems such as instant payments can allow significant sums to move rapidly between accounts, potentially reducing the time available for intervention once suspicious activity has begun.

The use of DuitNow and other electronic transfer mechanisms in this case demonstrates how established payment infrastructure can be exploited as part of an internal fraud scheme. This does not make the payment systems themselves inherently problematic; rather, it underlines the importance of combining efficient payment services with appropriate fraud detection and customer-protection controls.

The involvement of cashier's orders and interbank transfers alongside digital payments also shows that criminal schemes can span multiple channels. A monitoring system focused exclusively on one payment method may therefore fail to identify the broader pattern.

A comprehensive approach requires institutions to examine activity across accounts, payment channels, beneficiaries and customer relationships.

The case also reinforces the importance of whistleblowing and escalation mechanisms. Employees who identify unusual conduct by colleagues need secure channels through which concerns can be raised without fear of retaliation. Similarly, customers should have straightforward ways to challenge transactions and report suspected misuse of their accounts.

Where an employee is responsible for managing a customer's financial affairs, independent oversight becomes particularly important. Investment proposals, significant transfers and changes in payment instructions may warrant additional verification where the transaction carries an elevated risk.

The Malaysian case ultimately illustrates a broader challenge facing financial institutions worldwide: legitimate access to banking infrastructure can be misused by insiders to make fraudulent activity appear routine.

Strong AML controls therefore cannot rely solely on identifying suspicious customers. Institutions must also consider insider threats, employee conduct, transaction patterns, customer vulnerability and the movement of funds after an initial suspicious transaction.

For regulators, the case demonstrates the importance of combining traditional fraud enforcement with AML investigations. Recovering money from victims and prosecuting the underlying fraud are only part of the process. Tracing and disrupting the movement of criminal proceeds can provide an additional mechanism for holding offenders accountable.

For financial institutions, the lesson is equally direct. Trust-based customer relationships require strong independent controls, particularly where employees have the ability to influence investment decisions or facilitate substantial transfers.

The conviction of a banking professional for both fraud and money laundering serves as a reminder that sophisticated financial crime does not always originate outside the banking system. In some cases, the greatest vulnerability can arise when legitimate authority, customer trust and access to financial infrastructure are combined and subsequently abused.

The case is therefore likely to attract attention beyond the immediate victims and defendant. It provides a practical example of why AML frameworks must address not only external money laundering risks but also the possibility that employees can exploit legitimate banking functions to generate, move and conceal criminal proceeds.

By fLEXI tEAM