Crypto License in Malaysia

Since 2019, the Securities Commission of Malaysia, acting as the Malaysian regulator, has regulated crypto businesses through the Digital Asset Exchange Operator license framework. This framework is a subdivision of the Regulated Market Operator framework.

In Malaysia, cryptocurrencies are considered securities since the voting of the Capital Markets and Services Order of 2019 on Prescription of Securities & Digital Currency and Digital Token. Hence, the delegation to the Securities Commission for their supervision. This qualification also means that only crypto assets that have been duly approved by the regulator are allowed in Malaysia. Only approved cryptocurrencies recognized by the Securities Commission can be traded on licensed exchanges.

The basis for the two-levelled framework lies in the Capital Markets & Services Act 2007 and is completed by two Guidelines issued by the Securities Commission:

• Guidelines for Regulated Market Operators;
• Guidelines for Digital Asset Exchange Operators.

Compliance with Malaysian law is essential for all digital asset activities, and the framework is designed to ensure adherence to regulatory standards.

These documents specify the compliance requirements to be met by license applicants and holders. They define the measures to take on the levels of cybersecurity, AML/KYC, solvability, etc. An important requirement to note is the minimum paid-up share capital, which is 5,000,000 Malaysian Ringgit (about 1,050,000 USD). The digital asset exchange framework established by the Securities Commission Malaysia sets out the regulatory requirements for digital asset exchanges (DAXs) and aims to enhance investor protection within the Malaysian crypto market.

In 2025, the Capital Markets & Services Act was amended to clarify the definition of a digital token. According to the amendment, “digital token” means a digital representation which is recorded on a distributed digital ledger, whether cryptographically-secured or otherwise, but does not include:

• Debentures, stocks or bonds issued or proposed to be issued by any government;
• Shares in or debentures of, a body corporate or an unincorporated body;
• Units in a unit trust scheme or prescribed investments, and includes any right, option or interest in respect thereof.

The Securities Commission may also take actions, such as delisting digital assets, if it determines such measures are necessary to protect investors or the public interest.

Malaysia offers a range of crypto licenses to accommodate the diverse business models operating within the digital asset space. The primary license is the Digital Asset Exchange Operator license, which falls under the Regulated Market Operator framework. This license is essential for companies wishing to operate digital asset exchanges, allowing them to facilitate the trading of approved digital assets in a regulated environment.

In addition to the Digital Asset Exchange license, Malaysia also provides a Digital Asset Custodian license. This license is designed for businesses that focus on safeguarding digital assets on behalf of clients, and it comes with a lower minimum paid up capital requirement of RM500,000. For companies that provide broader services, such as facilitating the buying, selling, or transferring of digital assets, the Virtual Asset Service Provider (VASP) license is mandatory. The VASP license ensures that any asset service provider (VASP) operating in Malaysia adheres to strict compliance and operational standards.

The Securities Commission Malaysia (SCM) acts as the regulatory authority overseeing the issuance and ongoing compliance of these licenses. The SCM ensures that all digital asset exchanges, custodians, and VASPs maintain the required paid up capital, implement robust compliance frameworks, and operate transparently within the Malaysian digital asset space. This multi-tiered licensing approach allows Malaysia to support a variety of crypto businesses while maintaining high standards of investor protection and market integrity.

Despite the fair difficulty of the process, forming and licensing a crypto Malaysian company has several undeniable benefits:

• High-level license for ambitious blockchain technology projects in Asia;
• Jurisdiction recognized as a growing authority in the FinTech environment;
• Clear and transparent process, conducted straightforwardly;
• Secure environment with strong asset protection laws;
• Light compliance framework compared to other jurisdictions.

To establish a crypto company in Malaysia means drafting policies compliant with the local framework. Entrepreneurs must raise capital needed for incorporation, demonstrate relevant experience in the blockchain sector, and prepare a set of other documents, as necessitated by the regulator. Only those companies that set up their technical infrastructure properly, show their extensive experience in providing crypto and other services in adjacent sectors, and ensure compliance with the local laws can expect to secure the crypto license in Malaysia with minimal complications.

Companies willing to provide cryptocurrency services in Malaysia are governed by the Capital Markets and Services Act of 2007 (amended numerous times since then). This text defines how financial markets and institutions are functioning and regulated in Malaysia.

This act also positions the Securities Commission (SC) as the supervisory authority for Regulated Market Operators (RMO), entities which are provided a license to operate in the financial field. This is the case of cryptocurrency, with the Digital Asset Exchange framework (DAX), which is a subdivision of the RMO framework.

To expand on this framework, the Security Commission has issued Guidelines for Regulated Market Operators and additional Guidelines for Digital Asset Exchanges. These two texts are, in addition to the Capital Markets and Services Act, the legal framework that constitutes the cryptocurrency regulation in Malaysia.

Cryptocurrencies are defined as securities in Malaysia since an order passed in 2019, the Capital Markets and Services (Prescription of Securities) (Digital Currency and Digital Token) Order. This classification has several implications, the most important being that cryptocurrencies are strongly regulated in Malaysia. Only about a dozen digital assets are legal in Malaysia, as a cryptocurrency or a token must be validated by the SC before being legally sold and exchanged in Malaysia.

In Malaysia, the virtual registry of cryptocurrency companies is publicly available on the internet. It can be found freely on the website of the Securities Commission of Malaysia, on this page.

The registry shows the existing licensed companies, but also the previously licensed companies. It is apparent upon consulting the register that most of the companies that got their crypto license in Malaysia before 2019, and the introduction of the current framework, have ceased to work in the country.

The registry is not regularly updated and does not include detailed information on the license holding companies: only the company name and address in Malaysia are disclosed.

The process of receiving a crypto authorization in Malaysia and registering in the virtual currency registry is notorious for being one of the most complex in Asia.

There are many elements to prepare carefully, including on the financial and human levels, before beginning the process to get a VASP license in Malaysia.

In order to register a Malaysian company in the national register of cryptocurrency companies, a project must establish a company in Malaysia. It is important to note that a company registered in Labuan, a free economic zone of Malaysia, cannot apply for the Malaysia crypto license, as there is a different license in force in this region (see: Labuan crypto license).

The company must appoint a board of directors and a responsible officer and fulfill a certain number of requirements, such as holding a minimum share capital of 5.000.000 MYR (about 1.050.000 USD) and preparing certain internal procedures (audit, risk management, AML-CFT, etc).

Everything must be ready before carrying out an application to the Securities Commission. The Malaysian regulator will then assess the compliance of the project with the laws and rules in order to decide whether it will grant a crypto license or not.

The Government of Malaysia has adopted a strict position on crypto, while keeping it legal. When an order was passed in 2019, qualifying cryptocurrencies as securities, it also created the necessity for every existing crypto asset to receive approval from the Securities Commission in order to be legally sold and exchanged in Malaysia.

A notable case that shows the severity of the Malaysian regulator may be the recent ban of the famous crypto exchange Huobi in Malaysia. As it was available to Malaysian citizens and offered crypto assets that are not authorized, it was forced to close its operations in Malaysia.

The Securities Commission has laid out a certain number of requirements to be met by companies willing to engage in crypto activities in Malaysia.

Among the principal requirements for the DAX license, the following criteria must be met:

• Establish a company in Malaysia (not in Labuan);
• Have a minimum paid-up capital of at least 5.000.000 Malaysian Ringgit, plus an additional 5.000.000 in the case of a Digital Broker;
• Ensure that all the members of its board are fit and proper and have professional qualifications for their position;
• Appointment of a responsible person for compliance and contact with the Securities Commission. This role can only be fulfilled by the CEO, CFO or COO of the company;
• Draft policies and procedures pertaining to the good conduct of financial services: measures against proprietary trading, conflicts of interest, insider trading, making use of non-publicly available information, etc.

A DAX operator in Malaysia must have strong risk management processes and systems in order to prevent all sorts of risks. This includes financial risks, customer identification, legal risks, operational risks, technical risks and physical risks. All of these should be audited periodically.

A licensed crypto company in Malaysia should also establish an internal audit function.

Only crypto assets which have been validated by the SC can be provided by the DAX operator: BTC, ETH, AVAX, MATIC, BCH, XRP, LTC, SOL, LINK, UNI & ADA.

The crypto company should also establish systems and controls to maintain accurate records of all transactions. It should also take every possible measure to protect clients’ assets and data. For example, the clients’ assets shall be into segregated accounts, separate from the DAX operator accounts.

Finally, a DAX operator in Malaysia should ensure at all times sufficient liquidity for solvability. This requirement is further emphasized for companies operating a Digital Broker model.

In the process of forming a cryptocurrency business in Malaysia, a company should be set up with the licensing requirements in mind.

Though it is not difficult to create a company in Malaysia, this company is required to hold a paid-up share capital of 5,000,000 MYR, which is more than 1,000,000 USD. It should also appoint the board of directors and the responsible person before the application.

The usual incorporation process takes 1 to 2 business weeks, but the necessity to adapt the company to the needs of the DAX framework can extend the process a little bit.

For cryptocurrency companies in Malaysia, profit will be taxed on the gross income generated during the year. DAX operators can only register as Resident Companies in Malaysia, with an income tax rate of 24%. Cryptocurrency companies are subject to corporate income tax on their profits.

Malaysia has signed double taxation agreements with many countries, which help companies avoid being taxed twice on the same income in different jurisdictions. This is beneficial for international investors and businesses seeking tax efficiency.

There is no withholding tax in Malaysia, though royalties are subject to taxes (5 to 10% depending on the country).

Despite being classified as securities in Malaysia, proceeds from cryptocurrency trading (capital gains) are not subject to taxation.

Once a crypto company successfully receives the DAX license in Malaysia, it is liable to respect some obligations, according to the law.

At all times, a crypto company must ensure the fair and transparent operation of its platform. It should consistently enforce policies and procedures relative to the trading, clearing and settlement of digital assets on the platform and monitor transactions on a permanent basis.

A crypto company must always be careful with the cryptocurrency it provides in its services. Not only should they be approved by the Securities Commission, but they should also be sourced from a Virtual Asset Service Provider that is either licensed in Malaysia or compliant with the FATF guidelines on AML-CFT (this is the case for the majority of crypto licenses in the world as of 2023).

DAX operators are not allowed to provide financial assistance to investors.

Performing crypto activities in Malaysia without a license or violating the law as a licensed crypto company will lead to severe sanctions.

As it is considered a financial crime and a legal offence, a wrongdoing company will most certainly be banned, its license revoked, and the participants sanctioned with fines and possibly imprisonment for the most extreme cases.

This is another demonstration of Malaysia’s severity toward cryptocurrency and its position of stringent regulation.