Malaysia's 2025 FATF mutual evaluation rated all 40 Recommendations compliant or largely compliant, with substantial effectiveness on six of eleven Immediate Outcomes and moderate on five. The gaps sit in outcomes that depend on what reporting institutions deliver: preventive measures, legal persons, and the prosecutions that suspicious transaction reports are meant to support.
BNM reports that Malaysia was placed in the top follow-up category. The FATF's published summary does not state the category, so that point rests on BNM's own statements. The ratings and recommended actions below come from the FATF's report page, and the 2026 developments come from BNM publications.
This guide is for CCOs and AML heads at BNM-regulated institutions, and for regional teams who want to read what a strong evaluation still asks of the private sector.
What did the FATF find in Malaysia?
Strong technical compliance, with 24 Recommendations compliant and 16 largely compliant, and effectiveness that is substantial in six outcomes and moderate in five.
The FATF's report page, dated 11 December 2025, records the on-site visit in February 2025. No Recommendation was rated partially compliant or non-compliant, and no Immediate Outcome was rated low. The evaluation rated substantial effectiveness on risk and policy, supervision, financial intelligence, terrorist financing, and the two sanctions outcomes. It rated moderate effectiveness on international cooperation, preventive measures, legal persons and arrangements, money laundering investigation and prosecution, and confiscation. A strong technical score and a moderate effectiveness score together say that the rules are in place and the results are still being proved.
Which findings matter most to a reporting institution?
The moderate ratings on preventive measures, legal persons and prosecutions, because each depends on the quality of what institutions file and keep.
Preventive measures is the outcome that tests whether banks and other reporting institutions apply due diligence and monitoring effectively. Legal persons and arrangements tests whether the ownership behind a company can be found. Prosecutions test whether a suspicious transaction report becomes evidence that survives scrutiny. The FATF's examples of priority actions include strengthening international cooperation, improving the sanctions framework and demonstrating a sustained increase in money laundering prosecutions and convictions. Malaysia received a roadmap of Key Recommended Actions to complete within three years and will report progress to the FATF and APG. An institution's filings, case files and beneficial ownership records are the raw material for each of those actions.
What did BNM say about the result?
That the result reflects strong technical compliance and improved effectiveness, and that national strategies and action plans will follow.
In its 11 December 2025 statement, BNM said Malaysia achieved regular follow-up status, the top category in the evaluation process, and described the result as a whole-of-nation commitment. The National Coordination Committee will develop and implement national strategies and action plans to address the report's risks and recommendations. The statement does not set out new obligations for reporting institutions. It does note that financial institutions and virtual asset service providers have improved their understanding of risk and their preventive measures, a finding an institution should expect to defend at its next review.
What has changed in 2026?
New AMLA amendments, a recalibrated national roadmap, and a supervisory review of transaction monitoring and sanctions screening systems.
BNM's 2025 annual report states that the 2025 amendments to the AMLA 2001 took effect on 1 March 2026, aligning the law with the latest FATF standards and addressing difficulties in freezing, seizing and forfeiting illicit proceeds. It adds that the national roadmap for 2024 to 2026 will be recalibrated to match the evaluation's recommended actions. BNM also reports that it completed a thematic review of banks' transaction monitoring and sanctions screening systems and will share the findings with the sector. For a bank, that review is the clearest signal of where supervisory attention sits: the quality of the systems, not only the existence of a policy. Our guides to transaction monitoring and to rules-based versus AI monitoring cover the design questions such a review raises.
What is BNM signalling on STRs, mules and enforcement?
That reporting volumes are rising, that mule accounts are being prosecuted, and that late or missing reports draw action.
The annual report states that suspicious transaction reports rose to more than 430,000 in 2025 from about 342,000 the year before, and that there were 969 convictions of mule account holders in 2025. At BNM's DNFBP conference on 22 October 2026, the Deputy Governor described enforcement action against a company secretary for failing to submit reports and against a Labuan investment bank over delayed reports and customer due diligence deficiencies. He also said the next national risk assessment is planned for 2027. These signals point the same way as the evaluation. Volume is not the target. Timely, well-evidenced reports that support a prosecution are, and our guide to mule detection scenarios shows the patterns behind them.
What should a reporting institution do before the 2027 risk assessment?
Make filings prosecution-ready, test monitoring and screening against the supervisory review, and evidence beneficial ownership work.
Three actions follow from the findings. First, audit a sample of recent suspicious transaction reports for narrative quality, supporting evidence and timeliness, because the evaluation's gap is in prosecutions. The Philippine clocks, set out in our STR versus CTR guide, are a useful contrast for a regional team. Second, test whether monitoring and sanctions screening would stand up to a thematic review, with documented scenarios, tuning and a record of alert decisions. Third, check that beneficial ownership is captured and refreshed for legal-person customers, given the moderate rating on legal persons. The same exercise helps a Philippine team preparing for its own 2027 evaluation, as the APG 2027 guide describes.
How does Fyscal ARCX support evidence-ready controls?
Fyscal ARCX keeps the screening, monitoring, case and reporting record in one place, so that an institution can show an examiner how a decision was reached. A compliance team defines its own scenarios and tests them against historical data before activation, one case per customer holds the alert, evidence and approver with a timestamp, and Regulatory Reporting prepares and tracks the suspicious transaction filing. Named parties are screened against sanctions, PEP and watchlists, with the review recorded in the same case.