Introduction
The Central Bank of Malaysia Act Footnote 1 was amended in 2009 to grant Bank Negara Malaysia (BNM), the Central Bank of Malaysia, an explicit mandate to actively promote financial inclusion in the country.Footnote 2 Since then, there have been extensive efforts and reforms to banking for the unbanked,Footnote 3 which have arguably been fruitful.Footnote 4 However, it remains a challenge to bring the remaining underserved segments of society, particularly the undocumentedFootnote 5 (who are mostly migrants and refugees, as well as rural communities)Footnote 6 into formal financial services.
This article argues that the common challenge to accessing banking services among these communities is the satisfaction of the Customer Due Diligence (CDD) requirements mandated by Malaysia's anti-money laundering and countering the financing of terrorism (AML/CFT) regulations. The problem stems from the shortcomings in CDD practices that have led to the financial exclusion phenomenon in Malaysia. This article has identified two significant problems in CDD, namely (i) the ineffective implementation of the risk-based approach; and (ii) the over-cautious implementation of CDD policy practices by banks. This article argues that the solution to these problems is to ease the regulations and tailor them to the specific needs of the excluded communities by using a risk-based approach.
This article is structured as follows: the first part of the article explores the concept of financial exclusion and CDD, focusing on the Malaysian context. The second part delves deeper into how Malaysia's CDD rules contribute to the financial exclusion of vulnerable individuals, such as rural populations, undocumented migrants, and refugees. It analyses the consequences of these CDD-related barriers, including the limitations on economic opportunities and overall well-being for marginalised communities. The third part explores potential solutions to address these challenges, emphasises the importance of finding a balanced approach to CDD and financial inclusion, and concludes with a call to action to create a more inclusive financial environment in the country.
Defining Financial Exclusion and Financial Inclusion
BNM is responsible for regulating and supervising financial institutions to ensure adherence to AML/CFT regulations. Concurrently, financial inclusion stands as a significant objective in Malaysia, striving to grant access to financial services for all Malaysians, irrespective of their income level or location. Since the mid-1990s, the concepts of financial inclusion and exclusion have garnered considerable attention from academic researchers and policymakers on a global scale. Initially, the definition of financial exclusion centred around geographical factors, as described by Leyshon and Thrift, who defined it as the ‘processes that hinder the ability of economically disadvantaged individuals and marginalised social groups to access the financial system’, primarily due to limited geographical access.Footnote 7 Over time, however, the concept has evolved into a more comprehensive understanding that encompasses additional barriers to access beyond geography.
It has been argued that regulation can affect financial exclusion, as highlighted by the assertion made by Porteous and Zollman, who contend that certain regulatory requirements, such as the insistence on specific documentation or increased compliance costs, can inadvertently lead to the exclusion of particular groups.Footnote 8 Moreover, they suggest that banks themselves have implemented eligibility criteria that surpass regulatory mandates, resulting in the exclusion of certain segments of society, particularly those who are economically disadvantaged, such as individuals facing poverty.Footnote 9
A good example of this is the satisfaction of customer due diligence (CDD), a rule mandated by AML/CFT regulations. CDD requires customers to be verified and identified during the account-opening process. In many countries without a compulsory identity card, some people have found it challenging to provide the types of identification that banks require to open an account. The typical identity documents accepted for opening an account are a passport, a utility bill, or a bank account statement,Footnote 10 which are uncommon in low-income communities.
The corresponding concept of financial inclusion varies in its definition. While financial exclusion is commonly defined in terms of the factors that cause it, the definition of financial inclusion is usually discussed in the context of global and national visions of the desired state of financial inclusion. The World Bank, for example, envisages financial inclusion as ‘individuals and businesses hav[ing] access to useful and affordable financial products and services that meet their needs’.Footnote 11 In the UK, financial inclusion is defined as ‘individuals, regardless of their background or income, having access to useful and affordable financial products and services’.Footnote 12
The types of financial services that should be considered when assessing financial exclusion are related to the concept of financial exclusion. In 2005, the World Bank identified the four main types of essential services to which individuals should have access: transaction banking, savings, credits, and insurance.Footnote 13 It can be argued that there is a hierarchy of importance among these essential financial services, with banking accounts at the top of the ladder. While other financial products such as credits and insurance are undoubtedly important, the unavailability of a bank account has a more direct negative impact as it serves as the gateway to the provision of other financial services.Footnote 14
Three conclusions can be drawn from the above. First, although the terms ‘financial exclusion’ and ‘financial inclusion’ have been defined in different contexts, they are essentially the opposite of each other and should be understood as such. Second, financial exclusion and/or financial inclusion can be defined in two tiers, ‘access’ and ‘usage’. This article focuses on the first tier of financial inclusion, access, as this denotes the potential ability to use financial services, without which there could be no usage. Third, although all basic financial services are important and play a specific role in the daily lives of individuals, it is argued that the issue of financial exclusion should first be addressed in the context of the essential financial services, specifically banking transaction accounts. Therefore, the scope of this article is limited to access to bank accounts, and financial exclusion is thus defined as barriers to opening a bank account. In line with the scope of this article, the terms ‘financially excluded’ and ‘unbanked’ will be used interchangeably to refer to individuals without a bank account.
Financial Exclusion in Malaysia
An inclusive financial system aims to provide equitable access and use of high quality, affordable, and essential financial services to all people in society, particularly those who are underserved. The objective is to promote shared prosperity and ensure that everyone has the means to effectively meet their financial needs. The goal of financial inclusion in Malaysia is to create an inclusive financial system that benefits all members of society, with a special focus on the underserved.Footnote 15 Data suggests that despite Malaysia's seemingly robust position in terms of financial inclusion policy, an imperfect approach to this policy has resulted in approximately 9% to 15% of the country's adult populace being denied access to formal finance. Consequently, these individuals have ended up in groups that are underserved.Footnote 16
In the context of financial inclusion, the underserved are usually referred to as those who lack access to a formal bank account,Footnote 17 often including rural communities, women, and undocumented migrants.Footnote 18 However, the term ‘underserved’ has not been distinctly defined in Malaysia. This ambiguity fosters the belief that the country's financial inclusion policy is meant to be all-encompassing, essentially catering to both Malaysian citizens and non-citizens. Contrary to this assumption, the authors argue that in order to achieve the financial inclusion goals set by BNM, it is essential that financial inclusion policies and initiatives are deliberately designed to serve every member of society, regardless of their Malaysian citizenship status.
However, financial inclusion policies in Malaysia frequently exclude non-Malaysians.Footnote 19 A prime example is the BNM's guide to Basic Banking Services, which clearly specifies that entitlement to basic banking services is reserved for Malaysian citizens and permanent residents.Footnote 20 This has significant repercussions as it effectively excludes non-Malaysians, especially undocumented immigrants and refugees, from accessing banking services in the country. The rigorous customer due diligence process and identification system is also a major barrier to banking access for migrant workers and refugees, as it restricts eligibility to Malaysians only.Footnote 21 Furthermore, there is a lack of legal instruments to incentivise or mandate banks to accept these communities as customers, which ultimately leaves it up to the banks’ discretion to decide whether or not to provide them with services.Footnote 22
The following section further elaborates on the ‘underserved communities’ and explains how they are excluded from formal finance in Malaysia. These communities are the rural communities, undocumented migrants, and refugees.
Rural Communities
The rural hinterlands of Malaysia are home to almost 23% of the Malaysian population.Footnote 23 ‘Rural communities’ here does not refer only to aborigines living in rural areas, although aboriginal settlements can certainly be considered highly isolated.Footnote 24 ‘Rural communities’ also connotes those living in secluded areas of Malaysia with distinct infrastructure deficits and costly transport to commute outside their vicinity.
Proximity of financial services significantly impacts customer engagement. It is crucial for effective engagement that bank branches, which serve as the initial point of contact for potential customers, are conveniently accessible to all communities. However, in Malaysia, numerous areas, especially rural regions, lack the presence of bank branches.Footnote 25 This poses a challenge as the nearest bank branches are often located miles away, exacerbating the problem of financial exclusion. The situation is further complicated by the lack of convenient transportation, which makes it difficult for residents to commute to the local town where the nearest bank branch is located. For example, villagers in Kampung Mat Daling in rural Pahang, Malaysia, have to travel nearly 128 kilometres to reach the nearest physical bank branch in the main town, Jerantut.Footnote 26 The main mode of transportation that could take villagers to the nearest town is by boat, which alone takes four to five hours.Footnote 27 Alternatively, villagers could rent a timber truck at a cost of RM70 per use,Footnote 28 the equivalent of about seven meals in Malaysia.
It is worth noting that significant development has taken place in rural Malaysia, where most areas previously lacking bank branches are now served by agent banks.Footnote 29 This initiative, spearheaded by the government, aims to enhance banking outreach to rural regions. Licensed financial institutions have been granted the opportunity to appoint existing businesses, including retail outlets and post offices, as their agents. These agents are now able to provide basic banking services such as cash withdrawals, money transfers, and bill payments. The agent bank initiative is widely recognised as one of the key contributors to the expansion of financial services in Malaysia, particularly in rural areas.
It is seen as an all-round solution that provides basic financial access for all parties. For retailers, agent banks increase their income through commissions gained from transactions and increased traffic to their stores. For financial institutions, setting up agent banks is a much cheaper alternative to opening a traditional bank branch.Footnote 30 While agent banks have traditionally been allowed to offer basic services such as cash withdrawals and bill payments, the role of account opening was only recently allowed in 2010, five years after the agent bank initiative was launched. However, even under the current regulation, agent banks are still only allowed to facilitate account openingFootnote 31 but cannot conduct full CDD to complete the process.Footnote 32 Rural communities therefore still have to commute to larger towns where bank branches are located. CDD can be seen as a significant barrier to account opening, particularly for rural communities, given the distance and lack of public transport for commuting. Thus, it is arguable that the outreach of the banking sector in Malaysia remains low, as agent banks cannot be regarded as effective bank branches due to their limitations in opening bank accounts for customers.
Undocumented Migrants
In Malaysia, migrants are typically classified into two main categories: expatriates and non-expatriates. Expatriates are highly skilled individuals who come to Malaysia to contribute professionally in technical and administrative positions. Conversely, non-expatriates, hereafter referred to as ‘foreign workers’, consist of low- or semi-skilled workers whose occupations are predominantly found in certain sectors such as domestic work, construction, and plantations. These foreign workers may be recruited legally, but many end up undocumented by overstaying their visas or absconding from their employers.Footnote 33 In addition, there are individuals who initially entered Malaysia through illicit means, but subsequently obtained legal status through government amnesty or naturalisation programmes.
The primary focus of this article is on the non-expatriate migrant population. While expatriates, usually professionals, are generally well supported by their employers and rarely face challenges with documentation or access to banking services, the same cannot be said for non-expatriates. According to the World Bank, the number of non-expatriate migrants in Malaysia was estimated to be between 2.96 million and 3.26 million at the end of 2017,Footnote 34 accounting for approximately 23% of the country's workforce. Of these, an estimated 1.23 to 1.46 million are undocumented.Footnote 35 However, there is debate about the possible undercounting of migrants in Malaysia. A tentative estimate by Lee and Khor suggests that the total number of migrants in Malaysia could be as high as 5.05 million,Footnote 36 of which over 2 million may be undocumented.Footnote 37 These migrants hail from a range of countries, with the majority originating from Indonesia, Bangladesh, and Nepal, and a smaller proportion from countries such as Vietnam, the Philippines, and India.Footnote 38
Migrants’ rights to possess a basic bank account in Malaysia are significantly limited, even for those who are legally employed. The most basic financial products are only available to Malaysians and permanent residents of Malaysia. As noted above, while Malaysians and permanent residents are granted the right to a basic account, migrant workers are explicitly excluded from enjoying this right.Footnote 39 For migrant workers with valid documents, the documentation required to open a bank account is complex and often beyond the reach of these migrant workers. The standard documents are a passport, a valid work permit, and a visa, which are regularly withheld by employersFootnote 40 to prevent absconding.Footnote 41 Other documents include letters of reference from employers, who are sometimes required to be present during the account opening process. For migrant workers without valid documents, the chances of getting a bank account are limited, as they would have insufficient documents to identify and verify themselves, particularly documents that prove the legality of their stay in the country.
Refugees
The exact number of refugees in Malaysia is difficult to estimate. The United Nations High Commissioner for Refugees (UNHCR) states that as of the end of January 2023, the number of registered refugees is 183,790,Footnote 42 with many more unregistered.Footnote 43 The majority of refugees in Malaysia came from Myanmar to escape from the discriminatory and inhumane treatment in their country.Footnote 44 Malaysia serves as a haven for many refugees, particularly those from Muslim countries, partly because it is itself a Muslim-majorityFootnote 45 country and partly because it is one of the few countries that accepts citizens visa-free from Middle Eastern countries in conflict, such as Syria and Yemen.Footnote 46 The existence of the refugee community in Malaysia has also influenced the decision of many others to come to Malaysia because of the perceived ease of networking and settling down.Footnote 47
One of the major challenges facing refugees worldwide is the issue of identification. When fleeing their countries, refugees are often unable to carry identification documents with them. These documents may have been inadvertently left behind, lost, destroyed, or even stolen during their arduous journey.Footnote 48 In the case of Rohingyans from Myanmar, they often arrive in Malaysia without any form of identification, having been unable to obtain one from the government in their home country.Footnote 49 Similarly, Syrians have faced tremendous difficulties in replacing or applying for identity documents since the outbreak of the civil war. Compounding the issue, the so-called Islamic State has deliberately sought to destroy the passports and legal records of Syrian civilians.Footnote 50 For refugees in Malaysia, the UNHCR card becomes the primary, and in many cases the only, document available to prove their identity and legal status within the country. However, for the purpose of opening a bank account, this card is problematic for two reasons: firstly, the card is not legally recognised in Malaysia; and secondly, obtaining the card itself is a very challenging process for refugees.
On the first point, it should be noted that the UNHCR is not legally recognised in Malaysia because Malaysia has not signed the 1951 United Nations Convention Relating to the Status of Refugees or its 1967 Protocol. As a result, Malaysia is not bound to comply with any of the provisions of the Convention, including those that establish the primary responsibility of host countries to register refugees and provide identification documents to refugees who lack valid documentation.
In response to this challenge, the UNHCR has assumed full responsibility for the registration and identification of refugees in Malaysia.Footnote 51 The UNHCR compiles records of the refugees’ identities and issues them with a UNHCR card, which facilitates access to services provided by the UNHCR and offers discounted health care in government hospitals.Footnote 52 It is important to note, however, that the UNHCR card has no legal effect in Malaysia. It only signifies that the cardholder has a certain level of protection from the UNHCR and limited access to public health care services.Footnote 53 When it comes to opening a bank account, the UNHCR card is not considered an acceptable document for identity verification.Footnote 54 According to the Overseas Development Institute, only one bankFootnote 55 has allowed certain registered refugees to open bank accounts at specific branches on presentation of a personalised letter from the UNHCR.Footnote 56
In relation to the second point, securing a UNHCR card is a highly challenging task, largely due to the agency's limited funding. This financial constraint has significantly limited the organisation's capacity to respond effectively to the influx of refugees in the country.Footnote 57 The registration process lacks a standardised procedure.Footnote 58 The prevailing method is for refugees to send faxes or letters containing their identification details and a photograph to UNHCR, but there is no system in place to track whether their communication has been received or responded to.Footnote 59 This situation leaves refugees in a state of uncertainty. It is not that they lack identity documents, but that the existing system does not permit them to obtain them. With the its resources stretched thin, the UNHCR has exhausted its capacity to address the issue. The onus now falls upon the Malaysian government to intervene. Without its action, the prospect of this community gaining access to banking services is virtually non-existent.
Why Does Financial Inclusion Matter?
It is widely recognised that financial inclusion brings about economic advantages for individuals across the board. For migrants in particular, access to banking services offers numerous benefits, including safer alternatives to cash, improved access to credit facilities, and reduced fees for international money transfers. The overall level of financial access serves as an important indicator of the economic and social well-being of society as a whole.Footnote 60
Furthermore, extending financial inclusion to these communities aligns with the objectives of AML/CFT regulations. The Financial Action Task Force (FATF)Footnote 61 has taken a keen interest in financial inclusion, believing that the pursuit of financial inclusion complements its goals of maintaining financial integrity.Footnote 62 The underlying hypothesis is simple: by promoting financial inclusion, the scope of AML/CFT controls can be broadened, thereby strengthening financial integrity. Financial inclusion encourages greater utilisation of the formal financial system, allowing regulators to monitor a greater proportion of transactions conducted within that system. Conversely, financial exclusion is seen as a risk to financial integrity because it leads to a larger unmonitored financial sector. This lack of oversight deprives regulators of a crucial strategy in AML/CFT regulation, namely the ability to trace the movement of money.
Financial inclusion of migrant and refugee communities also represents a growth opportunity for the banking sector. Given the significant number of migrants and refugees in Malaysia, now totalling over 5 million, integrating these individuals into the formal economy could significantly boost economic growth. This is because when migrants and refugees engage with the formal financial system in their host countries, their earnings contribute to those economies and not just to their countries of origin.Footnote 63 These individuals could become customers for a range of financial products, including traditional offerings such as savings accounts. More importantly, they could make use of international money transfer services, offering significant potential benefits to financial service providers.Footnote 64
As detailed in the paragraphs above, financial inclusion supports financial integrity objectives by encouraging a greater number of people to transact within the formal financial system. This expansion allows regulatory bodies to monitor a greater number of transactions within the financial sector. In contrast, financial exclusion is perceived as a risk to financial integrity because it results in a larger, unmonitored financial sector. This scenario deprives regulators of a key strategy in AML/CFT regulation, namely the ability to trace the movement of money.
At this juncture, it is crucial to reiterate that financial exclusion in Malaysia is predominantly an issue among non-citizens who reside in the country without proper legal status. Given this context, critical questions arise as to why these communities need to be assisted, whether government intervention is necessary, and whether these efforts may inadvertently incentivise further illegal migration. These questions warrant careful consideration.
The substantial presence of these communities in the country exacerbates financial exclusion issues among them.Footnote 65 Integrating these groups into the banking system is not only profitable for the country, but also shields the banking system from the risks associated with informal banking practices, such as the growth of informal banks. The persistent influx of irregular migrants and refugees in Malaysia underscores the multifaceted nature of the illegal migration problem in Malaysia. The current practice of excluding these communities has not proved effective in reducing their numbers or deterring them from staying in the country. This reality necessitates a re-evaluation of existing strategies and suggests that it may be time for the government to consider a more ‘deserving approach’Footnote 66 to managing these communities.
However, it is not the contention of this article that irregular migrants should be granted rights per se, as such an attribution of rights would require a much broader evaluation, which is beyond the scope of this article. Whether the financial inclusion of these communities would trigger a surge in illegal migration in the country is another discussion that requires a broader context, which is also beyond the scope of this article. This article solely posits that given the context of banking access in Malaysia, there is a compelling case for the government to intervene and extend its support to these communities, despite their undocumented status.
Customer Due Diligence Requirements in Malaysia
The two most significant issues facing financial institutions today are money laundering and terrorist financing.Footnote 67 The magnitude of these problems has increased significantly in recent years, particularly with the rapid developments in the information, technology, and communication industry, which has increased the speed and ease with which money can move around the world.Footnote 68 In Malaysia, CDD responsibilities are encapsulated in the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Act 613) (AMLATFPUAA 2001). It comprises three obligations: to ascertain the identity of a customer, to verify the information provided by the customer, and to carry out ongoing monitoring. These obligations will be discussed in more detail below.
Ascertaining Identity
As a first step in CDD, financial institutions are required to ascertain the identity of a customer by collecting relevant identity information.Footnote 69 The primary objective of CDD is to identify the natural person who will ultimately control the account, including, in the case of corporate accounts, those who hold senior management positions within the corporate organisation.Footnote 70
The FATF Recommendations do not set out specific requirements as to what identification data should be collected or how identity should be verified. Malaysia takes a conservative view on what constitutes identity elements. It follows international guidelines, specifically the BCBS's guidelines on ‘Sound Management of Risks related to Money Laundering and Financing of Terrorism’,Footnote 71 in determining the types of information to be collected. As a result, Malaysia has adopted a risk-based approach,Footnote 72 which also means that the types of information required will vary according to the risk profile categories under which a customer falls. The procedure now is for financial institutions to have three CDD processes in place, namely simplified, standard, and enhanced CDD, so that customers are only subjected to the CDD process that corresponds to their assessed risk. Therefore, financial institutions must determine whether the customer falls into the standard-, high-, or low-risk categories before determining which CDD should be conducted on them.
The BNM guidance on implementing a risk-based approach explains the categorisation of customers based on their risk factors, which determines their risk rating and the appropriate CDD procedures to be applied.Footnote 73 Simply put, the guidelines imply that only Malaysian citizens with a net worth of less than RM500,000 can be classified as low-risk and thus qualify for simplified CDD. While the guidance attempts to categorise individuals from low-risk countries as ‘low-risk individuals’, it is noteworthy that it does not provide a clear definition of what constitutes a low-risk country. The illustration also states that the risk rating for individuals from Singapore is ‘medium’, noting that Singapore is neither a high-risk jurisdiction nor a neighbour of one. If a country as impregnable as SingaporeFootnote 74 can be considered a ‘medium’ risk country in the context of money laundering and terrorist financing, it is unlikely that other countries can achieve a lower risk rating. Regarding high-risk customers, the guidance states that individuals with a net worth of more than RM3 million, politically exposed persons, and individuals from high-risk or sanctioned countries should be considered high-risk and subject to enhanced due diligence.
The key distinction between standard, simplified, and enhanced customer CDD depends largely on the level of information required and the specific objectives of the CDD process. The data collected through CDD is intended to enable financial institutions to familiarise themselves with their customers and to gain a basic understanding of their financial behaviour.
Standard CDD, which requires nine points of information, exemplifies this intention. Certain information, such as full name, National Registration Identity Card (NRIC) number or passport number, postal and residential address, date of birth, and nationality, is collected primarily to establish the customer's identity. Conversely, information relating to the customer's occupation, employer's name or nature of business, and the purpose of transactions is collected to provide financial institutions with a general understanding of the customer's financial behaviour.Footnote 75
Under simplified CDD, the focus appears to be merely on collecting basic customer information rather than data related to financial behaviour. As such, financial institutions are only required to collect five key pieces of information: the customer's full name, Malaysian identity card (MyKad) number or passport/reference number of other official documents, residential address, date of birth, and nationality.Footnote 76 Finally, the enhanced CDD process aims to gather more information from customers to mitigate the higher risk involved. The additional information, such as volume of assets, source of wealth, and source of funds, must be collected in addition to the nine standard CDD points of information, and is intended to enable a closer scrutiny of the account so that any anomalies in transactions can be detected promptly.Footnote 77 Further, the rules mandate that the decision on whether to resume a business relationship with a high-risk customer following enhanced CDD must be approved by senior management.Footnote 78 This places responsibility on senior management, who would have more expertise in this matter than the regular front-line bankers who would normally be in charge of CDD.
Verifying Identity
The second step of the CDD process requires the verification of all information provided during the identification stage. This includes checking the original documents and maintaining their records.Footnote 79 The significance of this process was highlighted in the case of Tele-Temps Sdn Bhd & Satu Lagi v Southern Bank Berhad.Footnote 80 In this case, a bank was found negligent for failing to verify the information provided by an individual who used two documents with different spellings of his address to open an account. Despite the discrepancies, the bank overlooked the issue, assuming it was a technical error, and proceeded to deposit RM100,000 into the account. This negligence facilitated a fraudulent scheme.
The court emphasised the bank's crucial role in verifying information, noting that even minor discrepancies, such as inconsistent spelling of addresses, can have substantial adverse consequences – in this instance, a fraud-induced loss to the appellant. The bank should have regarded the inconsistency as a potential red flag, prompting further due diligence, such as cross-checking with public databases or conducting a personal interview. Such measures could have helped to prevent the fraud.
This case is particularly relevant in the context of AML/CFT regulations, where the verification process is critical to ensuring the accuracy of customer information. Banks are therefore strongly advised to refer to the original documents when verifying a customer's identity and to keep records of these documents.
As a basic principle, the provisions of the AMLATFPUAA 2001 and the BNM guidelines indicate that the verification process should normally be completed before any business relationship is established or the transaction is completed. However, section 14A.10.5 of the guidelines allows the verification to be delayed for a period not exceeding ten working days or such other period as may be specified by BNM after the business relationship is established.Footnote 81 This may be the case in certain circumstances where the money laundering/terrorist financing risks are deemed to be low and verification is not possible at the outset of a business relationship. The guidelines do not provide any further illustration of the situations in which delayed verification could be applied, so the applicability of this provision remains uncertain. Delayed verification is also allowed in relation to accounts opened at agent banks, whereby such accounts may be ‘fully verified’ at the main bank branch within two months of opening.Footnote 82
The most important element of the verification process is the types of documents that are acceptable to verify a customer's identity. The primary criteria for acceptable documents are their independence and reliability.Footnote 83 The BNM further defines an ‘[i]ndependent document’ as a document that is ‘issued or made available by an official body … even if [it is] provided to the reporting institutions by or on behalf of that person.’Footnote 84
The element of reliability in a document is closely tied to its acceptability in different contexts. For instance, BNM stipulates that a reliable document should be one that enjoys widespread recognition and acceptance by both the government and the private sector in Malaysia for identification purposes and authorisation of other services. Evidently, the documents with the highest degree of independence and reliability are those issued by the national governments, local authorities, and regulated entities in the financial and utility sectors in the country. If a document contains a photograph, this increases its reliability; however, documents without photographs may still be accepted if they are corroborated by another document.Footnote 85 The main documents that can be used for verification are specified as
identity card (or the MyKad), passport, driver's license, constituent document or any other official or private document as well as other identifying information relating to that person.Footnote 86
The BNM Guidance on Verification and CDD further adds that for foreigners, banks are advised to accept only a valid foreign passport issued by a foreign government and, where applicable, a visa to enter Malaysia.Footnote 87 It is also interesting to note that the guidance specifically mentions the situation of refugees, stating that banks should consider accepting refugees with a document, a letter, or a statement from the United Nations or its agencies, such as the UNHCR card.Footnote 88 In addition, the guidance allows CDD to be completed by way of recommendation of another ‘appropriate person’Footnote 89 who knows the individual to verify that the person is who they says they are.Footnote 90 In practice, most banks will accept the MyKad as the primary verification document for Malaysian citizens, as well as a valid passport for non-citizens. It is also common for banks to request additionalFootnote 91 supporting documents, such as copies of utility bills or employment letters, to verify other customer information, such as address and employment details.Footnote 92
Ongoing Monitoring
Ongoing monitoring of an account means that financial institutions are required to maintain CDD throughout the lifetime of a customer relationship.Footnote 93 This recognises that a customer who passes the initial CDD may subsequently engage in money laundering or terrorist financing. The obligation to conduct ongoing monitoring is provided for in section 16(4) of the AMLATFPUAA 2001 and is further reinforced in section 14A.13 of the BNM Policy Document 2019. The ongoing monitoring obligation requires the bank to ensure that transactions conducted by customers are consistent with the bank's knowledge of the customer. Banks must also ensure that any documents, data, or information collected as part of the CDD process are kept up to date and relevant. In line with international standards, the scope of ongoing monitoring in Malaysia must be risk-sensitive and commensurate with the level of money laundering/terrorist financing risk posed by the customer. For customers with a high-risk profile, the frequency of monitoring must be increased and specific transaction patterns must be closely monitored so that any possibility of unusual transactions can be promptly flagged.
Customer Due Diligence and Financial Exclusion in Malaysia
In Malaysia, a major cause of financial exclusion across various groups is related to the CDD policies stipulated by AML/CFT regulations. Numerous global studies have demonstrated the direct link between CDD requirements and financial exclusion.Footnote 94 This article identifies two primary issues with CDD that contribute to financial exclusion in the country: (i) the ineffective implementation of the risk-based approach, and (ii) the overly cautious implementation of CDD policy practices by banks.
Implementation of the Risk-Based Approach
The FATF Recommendations suggest that countries base their national AML/CFT rules on a process of risk identification, categorisation, and appropriate assessment.Footnote 95 In the context of financial inclusion, this means that individuals or entities that are deemed to pose a lower risk should be subject to lower levels of customer due diligence, including a lower identification threshold, flexibility in verification, and a less rigorous monitoring mechanism,Footnote 96 and vice versa.Footnote 97 Importantly, being financially excluded does not equate to posing a lower risk.Footnote 98 Hence, applying any risk-based approach (RBA) measures must necessarily be based on a holistic risk assessment at the national, institutional, and individual levels.Footnote 99 Prior to 2019, the RBA in Malaysia had not been given any statutory footing. There was no provision for RBA under the main act governing money laundering and terrorist financing activities. The provision of the RBA under BNM's Sectoral 1 GuidelineFootnote 100 was vague and did not provide any clear policy expectations with respect to the RBA. Five years after the issuance of the Sectoral 1 Guideline, BNM issued a technical noteFootnote 101 to assist financial institutions in designing AML/CFT controls in line with the RBA strategy.
The recent issuance of the new AML/CFT policies by BNM has brought about some significant changes, particularly towards advancing the RBA in Malaysia's AML/CFT laws. Within this framework, the aforementioned three categories of due diligence are finally introduced: simplified, standard, and enhanced due diligence.Footnote 102 The policy is complemented by guidance on the RBA, which clarifies the approach's understanding and policy expectations. It also provides illustrations of risk parameters and clear guidelines on how financial institutions should conduct risk scoring and risk profiling to assist them in deciding which risk categories the customer should fall into and, consequently, which CDD measures the customer should be subjected to. In Malaysia, the RBA is manifested in three policies: simplified due diligence for accounts opened at agent banks, delayed verification, and tiered accounts. However, several issues identified within these frameworks have arguably led to the financial exclusion of certain communities in the country.
Problems in Simplified Due Diligence in Malaysia
Malaysia's strategy is to minimise the amount of identification information required during the account opening process. The first issue arises from the RBA Guidance issued by BNM.Footnote 103 This guidance implicitly allows for simplified due diligence to be conducted only on Malaysian citizens with a net worth of less than RM500,000.Footnote 104 Consequently, this limits the accessibility of simplified due diligence relaxations to financially excluded groups, specifically undocumented individuals and refugees.
Second, the simplified CDD only applies to the identification process, not the verification process. The flexibility introduced in Malaysia has merely reduced the amount of information required from customers, but has not addressed the core issue of documentation – arguably the main obstacle CDD poses to financial inclusion in the country. There is no flexibility for financially excluded groups to present an identity document that may be more accessible to them, as these documents might not fit within the typical CDD framework. As a result, it can be argued that the lack of clear guidelines for simplified due diligence in the verification process largely overlooks the problem faced by the primary excluded groups in the country, rendering the framework ineffective.
Finally, the lack of limitations for accounts opened with simplified due diligence exacerbates the financial exclusion problem. A well-defined limitation on an account can lower the risk of misuse and can therefore be offered to certain customers who cannot fully satisfy the standard CDD process. Without such limitations, customers eligible for simplified CDD must be restricted, as granting full access to an account to a customer without sufficient information poses a high risk to banks. This means that banks have no choice but to restrict the offer of simplified due diligence to financially excluded groups. However, limitations on accounts opened with simplified CDD could also minimise the potential damage to the bank in the event of misuse. Consequently, banks would have more opportunities to address potential AML/CFT issues and extend their services to financially excluded groups.
Problems in Delayed Verification and Tiered Bank Accounts Opened at Agent Banks
This article has examined the initiatives taken by agent banks to address geography-related challenges and promote financial inclusion in the country's rural communities.Footnote 105 Through these initiatives, banks can designate existing businesses in rural regions as their agents and provide basic banking services like cash withdrawals, money transfers, and bill payments. Initially, the function of agent banks was limited to certain transactions, but in 2015, as mentioned above, the regulations were revised to allow agent banks to assist customers with opening bank accounts.Footnote 106 As per the Agent Banking Guideline Malaysia 2015, customers may request to open a bank account at an agent bank and then undergo a round of customer due diligence procedures. The CDD conducted at agent banks involves three steps: (1) collecting of identity information from customers; (2) biometrically authenticating the information via MyKad through a real-time online system; and (3) forwarding this information to the relevant main bank.Footnote 107 However, the account is not fully opened at the agent bank; customers are still required to be present at the main bank branch within three months of account opening to complete the CDD process.
The requirement to be present at the main bank branch within three months does not effectively eliminate the geographical constraint. Despite the significant challenges and costs, customers still have to travel the distance. It is argued that this problem is perpetuated by the adoption of a time-based tiered system for accounts opened at agent banks, rather than the FATF-recommended function-based tiered system.Footnote 108 The compulsory verification within the prescribed timeframe of three months of opening also means that any consideration of low-risk use of the account is disregarded, which is contrary to the main purpose of the RBA.
From a FATF perspective, adopting a tiered system based on functionality would be the appropriate RBA to apply in this situation:Footnote 109 The account opened with simplified due diligence would be allowed to operate within a limited set of functions and a monetary threshold. Further, CDD could be carried out if customers wish to transact beyond the threshold, where it is arguable that they may have more financial capacity to travel to the main bank. This approach would open up more opportunities for agent banks to complete simplified due diligence procedures at agent outlets without taking on too much risk, and potentially eliminates the need to travel altogether for customers with small accounts.
Over-Cautious Implementation of CDD
CDD policies in Malaysia have had a significant impact on financial inclusion through their application by banking institutions. Although the authorities have introduced certain flexibilities to promote financial inclusion, banks seem reluctant to incorporate these changes into their institutional CDD policies. This reluctance often manifests itself in an over-compliance response, where institutions go beyond the legal requirements imposed on them.Footnote 110
In the context of AML/CFT, this over-compliance response is evident when regulators delegate discretionary powers to financial institutions, leading them to limit rather than utilise the discretion granted. For instance, even though regulations have been formulated to give banks the discretion to accept alternative documents for CDD purposes when opening accounts, some banks have opted not to exercise this flexibility.Footnote 111
Moreover, an overly cautious compliance response can be seen in the regulation's failure to implement simplified due diligenceFootnote 112 for low-risk customers, instead continuing to apply more rigorous measures.Footnote 113 The over-reporting of suspicious transactions is another example.Footnote 114 Institutions often err on the side of caution and report transactions that are not necessarily suspicious in order to avoid the risk of penalties for non-reporting.Footnote 115 Dhillon et al highlight this issue in Malaysia, commenting that this approach may generate more false alarms than it detects actual suspicious transactions.Footnote 116 This not only inflates compliance costs, but also significantly hampers the efficiency of the suspicious transaction reporting scheme.Footnote 117
In Malaysia, the most apparent evidence of over-cautious compliance is the reluctance of banks to accept the UNHCR card issued to refugees as a valid document for CDD purposes, despite the explicit approval of the BNM and despite the fact that the UN has repeatedly stated that the card has enhanced security features and has a low risk of being misused for money laundering. It also satisfies all three conditions for acceptable documents for CDD.Footnote 118 In summary, however, the UNHCR card remains unacceptable for CDD purposes in Malaysia despite statements by government authorities to the contrary, thus denying refugees access to banking services.
Potential Solutions
The following solutions for improving financial inclusion in Malaysia are derived from the above assessment of the gaps in the country's CDD regulations. The remedy for these problems involves easing CDD regulations and adapting these rules to the specific needs of the excluded communities through a risk-based approach. This article substantiates, through detailed analysis, that the problems outlined can be translated into clear, practical recommendations for CDD regulations, which could potentially expand financial inclusion in the country.
This article makes the following recommendations:
• reducing documentation requirements for the undocumented and refugees to only those relevant for AML/CFT purposes;
• introducing small basic accounts for accounts opened with simplified CDD;
• widening of the list of acceptable documents for CDD.
Reducing Documentation Requirements for the Undocumented and Refugees to Only Those Relevant for AML/CFT Purposes
In line with the RBA, it would be beneficial to revisit, and potentially relax, the current customer documentation requirements imposed on banks. If an individual is deemed low-risk for money laundering or terrorist financing, the CDD guidelines could be adjusted to reflect this. Further relaxations could take the form of reducing the amount of information required and possibly even eliminating some of the traditional documents typically collected for CDD purposes. These changes would be more in line with the objective of both achieving robust AML/CFT measures and promoting financial inclusion.
For example, it is timely to remove from the CDD practices the requirement for documentation to prove the legality of a stay. Neither the FATF nor the Basel Committee on Banking Supervision (BCBS) have mandated such documentation in any of their guiding policies.Footnote 119 In the context of CDD objectives,Footnote 120 it is argued that proof of legality of stay does not add value to the intentions behind the implementation of CDD. Even without these documents, sufficient deterrence and monitoring can still be carried out within the account, provided that other primary information and documents are sufficiently identified and verified. As the primary objective of banks is to serve and protect the financial system, initiatives should be focused on reducing opportunities for informal transactions – not on policing illegal presence in the country. The former will require banks to accept documentation flexibilities that allow communities to enter formal, regulated finance without compromising financial stability.
While we recognise the potential risks associated with reducing CDD requirements – given that less customer information could lead to less comprehensive risk and behavioural profiles for monitoring – we also support the consideration of alternative, potentially more insightful types of information. For instance, details such as a customer's source of income and anticipated product use may be more accessible to customers and provide a clearer picture of their expected transaction profile.Footnote 121
Incorporating this type of profiling into a simplified due diligence process could improve the effectiveness of transaction monitoring. Any deviation from the established profile could trigger a review of the customer's CDD and, if necessary, lead to a suspicious transaction report. This approach allows balance to be struck between financial inclusion and the robustness of AML/CTF measures.Footnote 122
Moreover, this approach should be complemented by the introduction of an entry-level tiered account system that restricts transactions, balances, and payments to a low threshold.Footnote 123 Such limitations significantly diminish the overall risk of money laundering and terrorist financing, rendering the proposed reduced CDD potentially sufficient to achieve its objectives.Footnote 124 The combination of these strategies could offer a practical solution for enhancing financial inclusion without compromising the effectiveness of AML/CTF measures.
Introduction of Entry-Level Accounts for Accounts Opened with Simplified Due Diligence
Earlier, we have explained that geography is one of the challenges rural communities face in opening a bank account. The CDD regulations effectively prohibit agent banks from completing the CDD process, forcing rural communities to travel to the main bank branch even though they have already been identified and verified at the agent bank. Justifications for not allowing agent banks to complete CDD include high susceptibility to error due to inexperience and less accountability for legal issues should they arise. As BNM does not directly regulate agent banks, the main bank bears legal responsibility for their activities.
A practical approach that could help alleviate this challenge is the establishment of ‘small accounts’. These accounts would offer a more limited range of banking services, as well as constraints on balances and transaction values when opened at agent banks. In theory, these accounts would be less risky because of the smaller range of services and lower transaction volumes.Footnote 125 Accordingly, a more streamlined customer due diligence process may adequately meet the AML/CTF objectives in relation to these types of accounts.Footnote 126
Several countries, such as India and South Africa, have adopted this strategy to address their financial inclusion challenges. In India, banks are authorised to open small savings accounts for low-income customers lacking acceptable forms of identification, using simplified CDD norms.Footnote 127 The account is subject to strict limits on the monthly aggregate of withdrawals and transfers and the balance at any point in time.Footnote 128 South Africa has adopted a similar approach, with restricted accounts capped at a maximum balance of £1,300. These accounts have a daily transaction limit of R5,000 (about £242) and a monthly transaction limit of R25,000 (about £1,211).Footnote 129 To open these accounts, banks only require a copy of the client's identification document. There is no need for additional documentation like proof of address or tax numbers.Footnote 130
Drawing from these examples, Malaysia could consider introducing a similar tiered banking system to increase financial inclusion. An ‘entry-level’ account could be designed specifically to meet the needs of the low-income population, including individuals from rural regions, the undocumented, and refugees. Assuming that the majority of those who have difficulty accessing formal financial services are in the lower income brackets, a daily transaction and bank withdrawal limit of RM500 (£100) may be practical.Footnote 131 Such a limit is unlikely to cause significant hardship to these account holders, given their typical financial activities. In addition, a maximum balance limit of RM5,000 could be imposed on these accounts.
In cases where individuals need to carry out transactions in excess of these limits, provisions could be made to allow such transactions to be carried out in a bank branch. This helps to maintain the overall risk profile of the account while providing flexibility for account holders in exceptional circumstances.
To further enhance the usefulness of these accounts, a mechanism could be introduced to allow customers to apply for a higher daily transaction limit. Approval of such increases could be conditional on the customer satisfying additional AML/CFT requirements, thus providing a pathway for account holders to access more financial services as their circumstances change or improve.
Widening of the List of Acceptable Documents or Alternative Modes of Verification for CDD Purposes
The mode of identity verification can be expanded to include alternative document and non-document methods of authentication. This strategy is beneficial for the undocumented and refugees. They can use a valid, readily available document and a strong non-documentary verification to authenticate their identity. For example, a valid foreign identity card or a passport can be supported by a referral letter issued by a partner non-governmental organisation (NGO) to prove the identity of undocumented migrants or refugees. The term ‘undocumented migrants’ does not necessarily mean that they do not possess any document at all. Rather, the typical situation is that they have either unacceptable or insufficient documents to satisfy the CDD process. For example, a refugee in Malaysia will usually be provided with a UNHCR card, which is currently unacceptable to banks for CDD purposes.Footnote 132 Combining documentary and non-documentary forms of verification may provide a solid foundation for CDD and give banks the confidence to accept these individuals as customers.
It should be noted that the combination of documentary and non-documentary forms of verification may entail the risk of fraudulent activity and abuse of process. For example, a referral letter can easily be forged. As reported by FATF, in countries that rely on a letter from, eg, the village chief to verify a customer's identity, there have been some isolated cases where these village chiefs have begun to demand money for their verification services.Footnote 133 Such integrity issues defeat the rationale behind offering relaxations and arguably create more challenges to financial inclusion. One way to ensure that the process is not abused is to encourage banks to partner with specific NGOs in the country and only accept letters issued by trusted, partnering NGOs. In this way, the process of issuing referral letters can be monitored to ensure confidence in their value.
For rural communities, video verification of accounts opened at agent banks may offer innovative solutions. Given that agent banks may have already performed the first level of verification, the CDD process could be further enhanced by using videoconferencing instead of a physical visit to a bank branch. Several safeguards can be put in place to address the identity fraud risks that may arise from videoconferencing. For example, videoconferencing must be held at agent banks, with the agent witnessing the entire process. The agent can also authenticate the identity documents, such as MyKad, using smart card readers, before continuing the process via videoconference with an officer from the main bank branch. The presence of the agent may be sufficient to reduce the risk of fraudulent activities during the process. The videoconference should also be recorded and retained for record purposes.
Conclusion
This article has undertaken an in-depth examination of Malaysia's CDD framework, as set out in the AML/CFT regulations, and explored its potential negative impact on financial inclusion. It focused on identifying the financially marginalised communities in Malaysia and sought to understand the root causes of their exclusion. Our arguments highlighted that rural communities, undocumented migrant workers, and refugees are the three demographic groups most susceptible to financial exclusion in the country.
While the specific reasons for exclusion may vary, a common factor of exclusion was identified across the three communities: ‘customer due diligence rules’. For rural communities, CDD made it difficult to open a bank account, as they must physically travel to complete the CDD process. Moreover, the presence of agent banks in rural areas did not ensure financial inclusion as they often lacked the legal mandate to complete the necessary CDD. In relation to undocumented individuals and refugees, Malaysia's CDD rules impose challenging documentation requirements that are not feasible for them.
This article has analysed specific issues related to Malaysia's CDD regulations that contribute significantly to financial exclusion. The RBA adopted, the article has argued, does not effectively target the financially excluded, and the implementation of simplified due diligence measures has proved ineffective in easing the CDD process. These measures do not address verification issues and only cater to selected categories of local citizens, leaving out a significant number of non-citizens who make up a large proportion of the financially excluded.
Furthermore, the lack of prescriptive rules and significant inconsistencies within the CDD regulations exacerbate the problem, as financial institutions, out of an overabundance of caution, tend to exceed legal requirements as a protective measure. For example, they may insist on implementing standard or enhanced CDD measures even when a customer is legally eligible for simplified CDD. This over-compliance inadvertently pushes potential clients towards financial exclusion.
The article has also examined the strategy of the RBA implemented in agent banking services, suggesting that the issue is not with the CDD regulations themselves, but rather with the system in which these regulations are applied. The article has identified the time-based tiered system in Malaysia as problematic, particularly as it does not alleviate the geography-related challenges faced by rural communities in accessing banking services.
This article makes three main recommendations to improve CDD systems in Malaysia:
First, the identification and documentation requirements for the excluded communities should be restructured and explicitly detailed in a revamped regulatory framework. This change would make it easier for the financially excluded groups to access banking services, thereby fostering financial inclusion without compromising security.
Second, innovative strategies such as the introduction of ‘entry-level’ accounts should be considered. These accounts, opened with simplified due diligence, would be targeted at those who are currently unable to meet standard CDD requirements. With carefully calibrated transaction and balance limits, these accounts could provide basic financial services while minimising the risk of money laundering and terrorist financing.
Third, the list of acceptable documents for identification verification could be expanded. This approach would make the CDD process more flexible and accessible to individuals who may not be in possession of the documents traditionally required.
In addition to these regulatory and procedural amendments, financial institutions could play a crucial role in enhancing financial inclusion. They could develop educational programmes to help their customers understand the significance of CDD and their own role in maintaining the integrity of the financial system. While compliance with AML/CFT regulations is critical, it is equally important to ensure that these regulations do not impede financial inclusion.
By striking a delicate balance between complying with regulatory requirements and fostering financial inclusion, financial institutions would make a meaningful contribution to Malaysia's economic growth and social development. Implementing these recommendations would enable Malaysia to enhance financial inclusion while safeguarding its financial environment from criminal activities.
Acknowledgements
The authors would like to take this opportunity to acknowledge the extremely useful comments made on earlier drafts of this piece by Andrew Campbell, James Griffin, and two anonymous reviewers.
Annex: CDD Requirements for Banks in Malaysia
Open access
