On 20 November 2025, Bank Negara Malaysia (BNM) imposed an Administrative Monetary Penalty (AMP)^[1] of RM560,000 on MBSB Bank Berhad (MBSB Bank) for failing to comply with the requirement to submit a suspicious transaction report (STR)^[2] despite the transactions fitting its internal criteria (“red flags”). 

As a reporting institution (RI), MBSB Bank is required to submit an STR to BNM when a customer’s transaction or attempted transaction fits its established “red flags” to detect suspicious transactions.^[3] This mitigates the risk of RIs from being used as channels for money laundering and terrorism financing (ML/TF), and other serious crime activities. Additionally, the STR submitted provides BNM and other law enforcement agencies with valuable information and/or intelligence on potential criminal activities to support financial crime investigations.

Despite fitting its “red flags”, BNM discovered that MBSB Bank had failed to submit an STR on unusually large cash withdrawals. This failure was due to inadequate staff awareness of STR-related requirements.

MBSB Bank has taken appropriate steps to strengthen its overall AML/CFT risk preventive measures.

In deciding the AMP to be imposed, relevant aggravating and mitigating factors were considered. This includes the severity of the breach and MBSB Bank’s:

1. lack of reasonable care in ensuring compliance with STR-related requirement;
2. current controls to ensure compliance with the requirements; and
3. past compliance record.

On 3 December 2025, MBSB Bank paid RM560,000 for the AMP imposed by BNM.

BNM requires all RIs to maintain a high level of commitment in ensuring compliance with AML/CFT/CPF requirements. BNM will not hesitate to take appropriate supervisory and enforcement actions should any RI fail to meet legal and/or regulatory requirements.

The enforcement action taken against MBSB Bank is in line with the approach and processes outlined in the published Enforcement Approach.

^[1] BNM imposed the AMP pursuant to section 245(3)(b)(i) of the Islamic Financial Services Act 2013 (IFSA).

^[2] This requirement is set out under section 58(1)(a) of the IFSA, read together with paragraph 22.3.2 of the Anti-Money Laundering, Countering Financing of Terrorism, Countering Proliferation Financing and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT/CPF and TFS for FIs PD).

^[3] Under paragraph 22.3.2 of the AML/CFT/CPF and TFS for FIs PD, RIs must consider submitting an STR when any of its customer’s transactions or attempted transactions fits the RI’s list of “red flags”.