THE Finance Ministry has affirmed that the practice of bulk bank account openings is legally permissible under national banking laws, provided that institutions observe stringent due diligence, customer verification, and data privacy standards.
The clarification follows a parliamentary intervention by Suhaizan Kaiat, MP for Pulai, who raised concerns in the Dewan Rakyat’s Special Chamber about accounts being opened in bulk—often without the individual knowledge or consent of intended account holders.
“Bulk account opening, or ‘open now, verify later’, as it is sometimes known, presents serious risks if not properly regulated,” Suhaizan said. He questioned whether such practices were consistent with Malaysian law, particularly the Personal Data Protection Act 2010 (PDPA).
In response, Deputy Finance Minister Lim Hui Ying told the lower house today that the practice is “common and legitimate” when conducted under controlled conditions, noting its use across both public and private sectors.
“These include corporate payroll processing, student financial disbursements by universities, and government-led welfare or pension programmes.
“This method facilitates faster and more systematic account creation for large groups, such as new employees or students. However, consent must be obtained, and the customer must complete the full Know Your Customer (KYC) process before any account can be activated,” Lim said.
Delayed verification only under specific, low-risk conditions
Lim added while delayed customer verification is occasionally permitted, it is strictly limited to low-risk scenarios and must be completed within ten working days.
“To manage risk during this window, transaction types and amounts must be capped. Full customer verification is mandatory before unrestricted access is granted,” she said.
Safeguards in place to protect public interest
The government outlined a series of safeguards designed to prevent misuse, particularly the risk of fraudulent or “mule” accounts being created.
These include MyKad-based identity checks, biometric verification, real-time validation, and continual transaction monitoring.
Lim added: “Accounts that do not pass the KYC or customer due diligence process are suspended or terminated. Financial institutions are also obligated to report suspicious transactions.”
Institutions must verify not only the account holder’s identity, but also those acting on their behalf, and must identify beneficial owners where applicable. Information must be obtained from trusted, independent sources.
“These measures are essential to ensure that accounts are not opened under false identities or misused for money laundering, terrorism financing, or other criminal purposes,” the Ministry said.
Regulatory enforcement remains robust
Bank Negara Malaysia (BNM) is tasked with overseeing compliance. Lim stressed that any failure to meet regulatory requirements—particularly where it leads to fraud—will result in decisive enforcement.
“BNM will not hesitate to act. Offending institutions may face prosecution, financial penalties, administrative sanctions, or official reprimands,” Lim warned. - October 14, 2025
