Sandbox: Understanding Regulations - Bank Negara Malaysia

Breadcrumb

Sandbox Regulations Intro

The principal objective of Bank Negara Malaysia is to promote monetary and financial stability conducive to the sustainable growth of the Malaysian economy. BNM also plays a key role in promoting a progressive and inclusive financial system, and in preventing criminal abuse of financial services. BNM derives its mandates and powers from the Central Bank of Malaysia Act 2009 and other laws that it administers.

The legislations specify the activities and businesses that fall under its scope. These "regulated activities and entities" in turn have certain requirements within which it must operate. It is the responsibility of the operators to comprehensively assess the potential legal implications of the services they intend to offer vis-à-vis regulations administered by BNM and other regulators.

Sandbox Regulations & Laws

Legislation and Regulations

BNM is vested with legal powers under various legislations to discharge its mandate and carry out its functions.

For more information, please visit our Legislation page.

Sandbox Regulation Approach

Scope of Regulated Entities and Activities

Proportionality is a key guiding principle in the Bank’s approach to certain regulations, which aims to strike a balance between achieving policy objectives to safeguard public interest and minimising regulatory burden for financial service providers.
A risk-proportionate design takes into account various factors that affect the degree of potential risk, such as the complexity and scale of operations, the types of potential risks, as well as the maturity of industry players to appropriately manage risks.
Accordingly, the Bank practices three gatekeeping regimes – license, approval and registration, which have differentiated levels of regulatory requirements.

Licence Required

Approval Required

Registration Required

Is My Business Regulated?

How do I know if my business is regulated?
(A guidance sample)

The information in this section seeks to provide interested applicants with a general example on how the applicability of regulations may be determined. Applicants are responsible to comprehensively assess the potential legal implications of the services they intend to offer vis-à-vis regulations administered by the Bank or other regulators such as the Securities Commission. It is common practice to engage an appropriate legal consultant to conduct such an assessment where an applicant is not well positioned to do so.
Applicants are reminded that a biased interpretation of the Bank’s regulations causing non-compliance may result in potential enforcement actions.
Applicants in need of guidance or broad advice concerning legal and compliance matters may also consider participating in Fintech Association of Malaysia's Sandbox Pre-Screening and Mentorship Programme. When in doubt, applicants may contact the Bank at [email protected] or Fintech Association of Malaysia at [email protected]

Step 1: Determine applicable scope of regulated activity or entity

Example:

An applicant intends to provide a mobile application based electronic payment service for the purpose of facilitating retail transactions. The e-payment service seeks to enable the use of ringgit as a means of payment to merchants that are registered with the applicant. The applicant has a total shareholders’ funds of RM1 million at the time of application.

What is the potential scope of regulated activity or entity that may be applicable?

In this example, the applicant may need to assess its business model against the Bank's regulations for issuance of e-money and merchant acquiring activities.

Step 2: Identify definition of regulated activity or entity under the legislation or guidelines

Example:

In this example, the applicant would need to appropriately identify the definition of electronic money and merchant acquiring, by referring to the guidelines published by the Bank relating to payment services. The guidelines may be obtained from here.

Does the business model fit the definition of the regulated activity or entity?

If yes, proceed to the next step
If no, reconsider if there are other potential scope of regulated activity or entity that may be applicable
If unsure, seek appropriate independent legal consultation or obtain guidance by participating in the Fintech Booster Program. If you are unable to obtain a clear answer, you may submit an inquiry to [email protected]

Step 3: Read through the regulatory requirements and identify requirements that may be a challenge for you to comply with.

Does the proposed business model face a challenge in satisfying the requirement?

In this example, an e-money issuer who is intending to operate on a large scale (definition provided in the guidelines) are required to maintain, at all times, minimum shareholders’ funds unimpaired by losses of RM5 million or 8% of their outstanding e-money liabilities, whichever is higher. The applicant currently only has a total shareholders’ fund of RM1 million and faces significant difficulty in obtaining further funding. Hence, they have identified it as a regulatory impediment.

Step 4: Think about how the regulatory impediment affects the value proposition of your business model and consider your next steps

The applicant conducts an assessment and can think of several next steps:

Scenario 1 – Applicant is able to satisfy requirement:
The applicant manages to obtain additional funding of RM20 million and has no issues with the earlier impediment identified

Scenario 2 – Applicant makes a change in business model:
The applicant reconsiders the business model and decides to partner with an existing e-money issuer

Scenario 3 – Applicant applies to the Regulatory Sandbox:
The applicant did not manage to find a solution to comply with the regulatory requirements and submits an application to the Regulatory Sandbox

Step 5: Propose mitigation measures or safeguards to address the underlying risks associated with a regulatory requirement

Regulatory requirements are imposed to address a particular risk associated with a business model. If an applicant faces a challenge in complying with a regulatory requirement, it may also suggest alternative risk mitigation measures that could address such risks in a proportionate manner. This would significantly contribute toward enhancing the quality of an application.