Malaysia

This report analyses the implementation of the AEOI Standard in Malaysia with respect to the requirements of the AEOI Terms of Reference. It assesses both the legal frameworks put in place to implement the AEOI Standard and the effectiveness of the implementation of the AEOI Standard in practice.

The methodology used for the peer reviews and that therefore underpins this report is outlined in Chapter 2.

Overall findings

AEOI legal framework

Malaysia’s legal framework implementing the AEOI Standard is in place and is consistent with the requirements of the AEOI Terms of Reference. This includes Malaysia’s domestic legislative framework requiring Reporting Financial Institutions to conduct the due diligence and reporting procedures (CR1) and its international legal framework to exchange the information with all of Malaysia’s Interested Appropriate Partners (CR2).

Overall determination on the legal framework: In Place

Effectiveness of AEOI in practice

Malaysia’s implementation of the AEOI Standard is on track with respect to the requirements of the AEOI Terms of Reference to ensure the effectiveness of the AEOI Standard in practice. This includes ensuring Reporting Financial Institutions correctly conduct the due diligence and reporting procedures (CR1) and exchanging the information in an effective and timely manner (CR2). Malaysia is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.

Overall rating in relation to the effectiveness in practice: On Track

General context

Malaysia commenced exchanges under the AEOI Standard in 2018.

In order to provide for Reporting Financial Institutions to collect and report the information to be exchanged, Malaysia:

• enacted Sections 113A, 119B, 132B and 154(1)(c) of the Income Tax Act 1967;

• introduced the Income Tax (Automatic Exchange of Financial Account Information) Rules 2016 - P.U.(A) 355/2016 as amended in 2017 and 2020;

• introduced the Labuan Business Activity Tax (Automatic Exchange of Financial Account Information) Regulations 2018 – P.U.(A) 20/2018 (with effect from 1 July 2017) as amended in 2020; and

• issued further guidance, which is not legally binding.

Under this framework Reporting Financial Institutions were required to commence the due diligence procedures in relation to New Accounts from 1 July 2017. With respect to Preexisting Accounts, Reporting Financial Institutions were required to complete the due diligence procedures on High Value Individual Accounts by 30 June 2018 and on Lower Value Individual Accounts and Entity Accounts by 30 June 2019.

Following the initial Global Forum peer review, Malaysia amended its legislative framework to address an issue identified, which was effective from 28 August 2020.

With respect to the exchange of information under the AEOI Standard, Malaysia is a Party to the Convention on Mutual Administrative Assistance in Tax Matters and activated the associated CRS Multilateral Competent Authority Agreement in time for exchanges in 2018.

Table 1 sets out the number of Financial Institutions in Malaysia that reported information on Financial Accounts in 2021 as defined in the AEOI Standard (essentially because they maintained Financial Accounts for Account Holders, or that were related to Controlling Persons, resident in a Reportable Jurisdiction). It also sets out the number of Financial Accounts that they reported in 2021. In this regard, it should be noted that Malaysia requires the reporting of Financial Accounts based on a prescribed list of exchange partners and some accounts may be required to be reported more than once (e.g. jointly held accounts or accounts with multiple related Controlling Persons), which is reflected in the figures below. These figures provide key contextual information to the development and implementation of Malaysia’s administrative compliance strategy, which is analysed in the subsequent sections of this report.

Table 1. Number of Financial Institutions reporting and Financial Accounts reported
	Number
Financial Institutions reporting Financial Accounts in 2021	641
Financial Accounts reported in 2021	1 791 196

Table 2 sets out the number of exchange partners to which information was successfully sent by Malaysia in the past few years (including where the necessary frameworks were in place, containing an obligation on Reporting Financial Institutions to report information, but no relevant Reportable Accounts were identified). These figures provide key contextual information in relation to Malaysia’s exchanges in practice, which is also analysed in subsequent sections of this report.

Table 2. Number of exchange partners to which information was successfully sent
	2018	2019	2020	2021
Number of exchange partners to which information was successfully sent	42	64	65	69

In order to provide for the effective implementation of the AEOI Standard, in Malaysia:

• the Inland Revenue Board of Malaysia (the tax authority) has the responsibility to ensure the effective implementation of the due diligence and reporting obligations by Reporting Financial Institutions and for exchanging the information with Malaysia’s exchange partners;

• technical solutions necessary to receive and validate the information reported by Reporting Financial Institutions were put in place through an online portal; and

• the Common Transmission System (CTS) is used for the exchange of the information, along with the associated file preparation and encryption requirements.

It should be noted that the review of Malaysia’s legal frameworks implementing the AEOI Standard concluded with the determination that Malaysia’s domestic and international legal frameworks are In Place. This has been taken into account when reviewing the effectiveness of Malaysia’s implementation of the AEOI Standard in practice.

Findings and conclusions on the legal frameworks

The detailed findings and conclusions on the AEOI legal frameworks for Malaysia are below, organised per Core Requirement (CR) and then per sub-requirement (SR) as extracted from the AEOI Terms of Reference (see Annex C).

CR1 Domestic legal framework: Jurisdictions should have a domestic legislative framework in place that requires all Reporting Financial Institutions to conduct the due diligence and reporting procedures in the CRS, and that provides for the effective implementation of the CRS as set out therein.

Determination: In Place

Malaysia’s domestic legislative framework is in place and contains all of the key aspects of the CRS and its Commentary requiring Reporting Financial Institutions to conduct the due diligence and reporting procedures (SRs 1.1 – 1.3). It also provides for a framework to enforce the requirements (SR 1.4).

SR 1.1 Jurisdictions should define the scope of Reporting Financial Institutions consistently with the CRS.

Findings:

Malaysia has defined the scope of Reporting Financial Institutions in its domestic legislative framework in accordance with the CRS and its Commentary.

Recommendations:

No recommendations made.

SR 1.2 Jurisdictions should define the scope of Financial Accounts and Reportable Accounts consistently with the CRS and incorporate the due diligence procedures to identify them.

Findings:

Malaysia has defined the scope of the Financial Accounts that are required to be reported in its domestic legislative framework and incorporated the due diligence procedures that must be applied to identify them in accordance with the CRS and its Commentary.

Recommendations:

No recommendations made.

SR 1.3 Jurisdictions should incorporate the reporting requirements contained in Section I of the CRS into their domestic legislative framework.

Findings:

Malaysia has incorporated the reporting requirements in its domestic legislative framework in accordance with the CRS and its Commentary.

Recommendations:

No recommendations made.

SR 1.4 Jurisdictions should have a legislative framework in place that allows for the enforcement of the requirements of the CRS in practice.

Findings:

Malaysia has a legislative framework in place to enforce the requirements in accordance with the CRS and its Commentary.

Recommendations:

No recommendations made.

CR2 International legal framework: Jurisdictions should have exchange relationships in effect with all Interested Appropriate Partners as committed to and that provide for the exchange of information in accordance with the Model CAA.

Determination: In Place

Malaysia’s international legal framework to exchange the information is in place, is consistent with the Model CAA and its Commentary and provides for exchange with all of Malaysia’s Interested Appropriate Partners (i.e. all jurisdictions that are interested in receiving information from Malaysia and that meet the required standard in relation to confidentiality and data safeguards) (SRs 2.1 – 2.3).

SR 2.1 Jurisdictions should have exchange agreements in effect with all Interested Appropriate Partners that permit the automatic exchange of CRS information.

Findings:

Malaysia has exchange agreements that permit the automatic exchange of CRS information in effect with all its Interested Appropriate Partners.

Recommendations:

No recommendations made.

SR 2.2 Such an exchange agreement should be put in place without undue delay, following the receipt of an expression of interest from an Interested Appropriate Partner.

Findings:

Malaysia put in place its exchange agreements without undue delay.

Recommendations:

No recommendations made.

SR 2.3 Jurisdictions should ensure that the exchange agreements in effect provide for the exchange of information in accordance with the requirements of the Model CAA.

Findings:

Malaysia’s exchange agreements provide for the exchange of information in accordance with the requirements of the Model CAA.

Recommendations:

No recommendations made.

Assessed jurisdiction’s comments on the assessment of its legal frameworks

No comments made.

Findings and conclusions in relation to effectiveness in practice

The detailed findings and conclusions in relation to effectiveness in practice of AEOI for Malaysia are below, organised per Core Requirement (CR) and then per sub-requirement (SR) as extracted from the AEOI Terms of Reference (see Annex C).

CR1 Effectiveness in practice: Jurisdictions should ensure that in practice Reporting Financial Institutions correctly implement the due diligence and reporting procedures, which includes a requirement for jurisdictions to have in place an administrative framework to ensure the effective implementation of the CRS.

Rating: On Track

Malaysia’s implementation of the AEOI Standard is on track with respect to ensuring that Reporting Financial Institutions are correctly conducting the due diligence and reporting procedures and are therefore reporting complete and accurate information. This includes ensuring effectiveness in a domestic context, such as through having an effective administrative compliance framework and related procedures (SR 1.5), and collaborating with exchange partners to ensure effectiveness (SR 1.6). Malaysia is encouraged to continue its implementation process to ensure its ongoing effectiveness.

SR 1.5 Jurisdictions should ensure that in practice Reporting Financial Institutions identify the Financial Accounts they maintain, identify the Reportable Accounts among those Financial Accounts, as well as their Account Holders, and where relevant Controlling Persons, by correctly conducting the due diligence procedures and collect and report the required information with respect to each Reportable Account. This includes having in place:

• an effective administrative compliance framework to ensure the effective implementation of, and compliance with, the CRS. This framework should:

  • be based on a strategy that facilitates compliance by Reporting Financial Institutions and which is informed by a risk assessment in respect of the effective implementation of the CRS that takes into account relevant information sources (including third party sources);

  • include procedures to ensure that Financial Institutions correctly apply the definitions of Reporting Financial Institutions and Non-Reporting Financial Institutions;

  • include procedures to periodically verify Reporting Financial Institutions’ compliance, conducted by authorities that have adequate powers with respect to the reviewed Reporting Financial Institutions, with procedures to access the records they maintain; and

• effective procedures to ensure that Financial Institutions, persons or intermediaries do not circumvent the due diligence and reporting procedures;

• effective enforcement mechanisms to address non-compliance by Reporting Financial Institutions;

• strong measures to ensure that valid self-certifications are always obtained for New Accounts;

• effective procedures to ensure that each, or each type of, jurisdiction-specific Non-Reporting Financial Institution and Excluded Account continue to present a low risk of being used to evade tax; and

• effective procedures to follow up with a Reporting Financial Institution when undocumented accounts are reported in order to establish the reasons why such information is being reported.

Findings:

In order to ensure that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures, Malaysia implemented most of the requirements in accordance with expectations. However, some issues were identified. The key findings were as follows:

• Malaysia implemented an overarching strategy to ensure compliance with the AEOI Standard developed after conducting a risk assessment that took into account the information reported by Reporting Financial Institutions and feedback from exchange partners. However, Malaysia’s risk assessment could be expanded further to ensure that it has a systemic and comprehensive consideration of risk to inform its compliance strategy. Malaysia’s compliance strategy facilitates compliance and incorporates a credible approach to enforcement. Malaysia intends to keep its compliance strategy and risk assessment under review to ensure its effectiveness on an ongoing basis.

• Malaysia has worked effectively to understand its population of Financial Institutions, including relevant non-regulated entities, requiring mandatory registration and nil reporting. Malaysia utilises various relevant information sources, such as lists of regulated entities, information from financial associations and other bodies, and the Foreign Financial Institution list for FATCA purposes to conduct checks. Malaysia is taking action to ensure that Reporting Financial Institutions are classifying themselves correctly under its domestic rules and reporting information as required. Malaysia intends to keep its understanding of its Financial Institution population up to date on a routine basis.

• The institution responsible for implementing Malaysia’s compliance strategy appears to have the necessary powers and resources to discharge its functions. With respect to resourcing, Malaysia has assigned the equivalent of five full time staff to monitor and ensure compliance by Reporting Financial Institutions, which have access to IT systems and tools to conduct risk assessments. Overall, they appear to have effectively implemented the first stages of an operational plan to verify compliance with the requirements, incorporating some appropriate compliance activities.

• It appears that Malaysia effectively enforces the requirements, including through the inspection of records of Reporting Financial Institutions and the introduction of dissuasive penalties and sanctions for non-compliance, although they have not yet been applied in practice. It also appears that Malaysia is ready to take effective action to address circumvention of the requirements if such circumvention is detected, and that action is being taken to ensure self-certifications are obtained as required and to follow up on undocumented accounts.

• Malaysia will also keep its jurisdiction-specific lists of Non-Reporting Financial Institutions and Excluded Accounts under review to ensure they continue to pose a low risk of being used for tax evasion purposes.

Table 3 provides a summary of the specific activities undertaken, or that are planned to be undertaken, in relation to each of the key parts of the framework described above.

Table 3. Activities undertaken
Activity type	Activities undertaken
Communication and outreach	Malaysia has carried out substantial communication and outreach activities, such as providing guidance on its website, putting in place a dedicated email facility, sending email bulletins and organizing meetings with Financial Institutions.
Verifying that Financial Institutions are reporting as required	Malaysia has carried out some verification activities to ensure that Financial Institutions are reporting as required and identified some Financial Institutions incorrectly not reporting. It is following up these issues with a view to ensuring future compliance.
Verifying whether the information reported is complete and accurate	Malaysia has not yet conducted onsite visits, but has plans to do so in the near future. Malaysia has conducted some desk-based checks to verify whether the information being reported is complete and accurate. The Financial Institutions records are checked as part of the desk-based reviews. It accordingly identified a small number of issues with naming conventions and undocumented accounts. It followed up on these issues with a view to ensuring future compliance.
Enforcement	Following the activities mentioned above, Malaysia has not yet imposed penalties and sanctions, but has procedures in place to do so when appropriate.

In terms of the Financial Account information collected and sent by Malaysia, while the presence of the key data point of the level of undocumented accounts appeared to be in line with most other jurisdictions, it was found to include a much lower proportion of Tax Identification Numbers with respect to the individuals associated with the accounts when compared to most other jurisdictions. Furthermore, while the collection and reporting of dates of birth is generally higher across jurisdictions, Malaysia nevertheless reported a lower rate of collection of dates of birth when compared to other jurisdictions. These are key data points for exchange partners to effectively utilise the information. Follow-up discussions confirmed that Malaysia is aware of these issues and is taking steps to address them.

Feedback from Malaysia’s exchange partners indicated that, compared to what they generally experience when seeking to match information received from their exchange partners with their taxpayer database, they achieved a relatively lower level of success when seeking to match information received from Malaysia. Furthermore, 13 exchange partners highlighted issues with respect to the information received, such as names, dates of birth and addresses not being provided. Follow-up discussions confirmed that Malaysia is aware of these issues is seeking to improve the situation.

Based on these findings it was concluded that, overall, Malaysia is meeting expectations in ensuring that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures, including by having in place the required administrative compliance framework and related procedures. It was also noted that there is room for improvement with respect to risk assessment, ensuring the collection of complete self-certifications and continuing to address the issues raised by its exchange partners. Malaysia is therefore encouraged to continue its implementation process accordingly, including by addressing the recommendations made.

Recommendations:

Malaysia should expand its overarching risk assessment of the implementation of the CRS to an appropriate range of information sources to identify, assess and understand the compliance risks for all aspects of the AEOI Standard in Malaysia.

Malaysia should actively monitor and verify whether self-certifications have been obtained in all cases required by the AEOI Standard, including ensuring that the self-certifications contain all required information.

Malaysia should continue to address the issues raised by its exchange partners.

SR 1.6 Jurisdictions should collaborate on compliance and enforcement. This requires jurisdictions to:

• use all appropriate measures available under the jurisdiction’s domestic law to address errors or non-compliance notified to the jurisdiction by an exchange partner; and

• have in place effective procedures to notify an exchange partner of errors that may have led to incomplete or incorrect information reporting or non-compliance with the due diligence or reporting procedures by a Reporting Financial Institution in the jurisdiction of the exchange partner.

Findings:

In order to collaborate on compliance and enforcement, Malaysia implemented all of the requirements in relation to issues notified to them (i.e. under Section 4 of the MCAA or equivalent) in accordance with expectations. While no such notifications have yet been received, Malaysia has the necessary systems and procedures to process them as required. It also appears that Malaysia will notify its partners effectively of errors or suspected non-compliance it identifies when utilising the information received.

Based on these findings it was concluded that Malaysia is fully meeting expectations in relation to collaborating with its exchange partners to ensure that Reporting Financial Institutions correctly conduct the due diligence and reporting procedures. Malaysia is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.

Recommendations:

No recommendations made.

CR2 Effectiveness in practice: Jurisdictions should exchange the information effectively in practice, in a timely manner, including by sorting, preparing, validating and transmitting it in accordance with the AEOI Standard.

Rating: On Track

Malaysia’s implementation of the AEOI Standard is on track with respect to exchanging the information effectively in practice, including in relation to sorting, preparing and validating the information (SR 2.4), correctly transmitting the information in a timely manner (SRs 2.5 – 2.8) and providing corrections, amendments or additions to the information (SR 2.9). Malaysia has shown improvement over time and is encouraged to continue its implementation process accordingly, to ensure its ongoing effectiveness.

SR 2.4 Jurisdictions should sort, prepare and validate the information in accordance with the CRS XML Schema and the associated requirements in the CRS XML Schema User Guide and the File Error and Correction-related validations in the Status Message User Guide (i.e. the 50000 and 80000 range).

Findings:

Seven exchange partners highlighted particular issues with respect to preparation and format of the information sent by Malaysia (representing 9% of its partners). These generally related to a duplicated file reference number and CRS XML Schema validation issues. More generally, four (or 5%) of Malaysia’s exchange partners reported rejecting more than 25% of the files received, of which one reported rejecting more than 50% of files received due to the technical requirements not being met. This is a relatively high amount when compared to other jurisdictions, although it has reduced over time. It was noted that Malaysia has already successfully addressed most of the issues, including some that arose some time ago.

Figure 1. Technical issues raised by Malaysia’s exchange partners

Based on these findings it was concluded that, overall, Malaysia is meeting expectations in relation to sorting, preparing and validating the information. It was also noted that there is room for improvement with respect to validating all data for standard errors before transmission and working with exchange partners to address the issues raised. Malaysia is therefore encouraged to continue its implementation process accordingly, including by addressing the recommendations made.

Recommendations:

Malaysia should continue to work with its exchange partners to address the issues raised.

Malaysia should review its systems and procedures to sort, prepare and validate the information to ensure they meet the requirements of the AEOI Standard.

SR 2.5 Jurisdictions should agree and use, with each exchange partner, transmission methods that meet appropriate minimum standards to ensure the confidentiality and integrity of the data throughout the transmission, including its encryption to a minimum secure standard.

Findings:

In order to put in place an agreed transmission method that meets appropriate minimum standards in confidentiality, integrity of the data and encryption for use with each of its exchange partners, Malaysia linked to the CTS.

Based on these findings it was concluded that Malaysia is fully meeting expectations in relation to agreeing and using appropriate transmission methods with each of its partners. Malaysia is encouraged to continue to ensure the ongoing effectiveness of its implementation.

Recommendations:

No recommendations made.

SR 2.6 Jurisdictions should carry out all exchanges annually within nine months of the end of the calendar year to which the information relates.

Findings:

Feedback from Malaysia’s exchange partners did not raise any concerns with respect to timeliness of the exchanges by Malaysia and therefore with respect to Malaysia’s implementation of this requirement.

Based on these findings it was concluded that Malaysia is fully meeting expectations in relation to exchanging the information in a timely manner. Malaysia is encouraged to continue to ensure the ongoing effectiveness of its implementation.

Recommendations:

No recommendations made.

SR 2.7 Jurisdictions should send the information in accordance with the agreed transmission methods and encryption standards.

Findings:

Feedback from Malaysia’s exchange partners did not raise any concerns with respect to Malaysia’s use of the agreed transmission methods and therefore with Malaysia’s implementation of this requirement.

Based on these findings it was concluded that Malaysia is fully meeting expectations in relation to sending the information in accordance with the agreed transmission methods and encryption standards. Malaysia is encouraged to continue to ensure the ongoing effectiveness of its implementation.

Recommendations:

No recommendations made.

SR 2.8 Jurisdictions should have the systems in place to receive information and, once it has been received, should send a status message to the sending jurisdictions in accordance with the CRS Status Message XML Schema and the related User Guide.

Findings:

Five exchange partners highlighted delays in the sending of status messages by Malaysia, representing 5% of its partners. This represents a relatively high proportion of partners, although it has improved over time. It was noted that Malaysia appears to be successfully addressing the issues to ensure that status messages are sent in accordance with the requirements.

Based on these findings it was concluded that, overall, Malaysia is meeting expectations in relation to the receipt of information. It was also noted that there is room for improvement with respect to Malaysia’s processes to receive and acknowledge the receipt of exchanged information. Malaysia is encouraged to continue to ensure the ongoing effectiveness of its implementation, including by addressing the recommendation made.

Recommendations:

Malaysia should ensure it sends status messages to all of its exchange partners in a timely manner.

SR 2.9 Jurisdictions should respond to a notification from an exchange partner as referred to in Section 4 of the Model CAA (which may include Status Messages) in accordance with the timelines set out in the Commentary to Section 4 of the Model CAA. In all other cases, jurisdictions should send corrected, amended or additional information received from a Reporting Financial Institution as soon as possible after it has been received.

Findings:

Malaysia appears ready to respond to notifications and to provide corrected, amended or additional information in a timely manner and no such concerns were raised by Malaysia’s exchange partners and therefore with respect to Malaysia’s implementation of these requirements.

Based on these findings it was concluded that Malaysia appears to be meeting expectations in relation to responding to notifications from exchange partners and the sending of corrected, amended or additional information. Malaysia is encouraged to continue to ensure the ongoing effectiveness of its implementation.

Recommendations:

No recommendations made.

Assessed jurisdiction’s comments on the assessment of effectiveness in practice

Malaysia would like to express its appreciation to the Assessment Team for their professionalism, continuous and laborious efforts of the work done in evaluating Malaysia’s AEOI Framework in light of the prescribed international standards. Malaysia also like to extend its appreciation to the Global Forum Secretariat, the Peer Review Group and its exchange partners for their invaluable inputs and contribution to this report.

Malaysia recognises that AEOI is a game changer for an effective implementation of EOI and continue to support the collective efforts by the OECD and stakeholders around the world to improve transparency and effective exchange of information to further address the issue of tax evasion and avoidance. This is done through the adoption and the implementation of best practices, and Malaysia’s legislations are consistently being reviewed and updated to ensure they comply with the standards.

Therefore, the overall rating of “On Track” fairly reflects the continuous effort done so far and demonstrates the ability and willingness of Malaysia to reach a high level of compliance with the internationally agreed tax standards. Such compliance is also supplemented with the efforts undertaken by the Malaysia’s Financial Institutions on preparing quality submissions that meet the needs of the partners. Consequently, Malaysia acknowledges the recommendations, including to further improve on the time management of the requests exchanges and will further strengthen the mechanics according to the AEOI standards in optimising the exchange practices.

Malaysia has a longstanding commitment to the effective implementation of EOI, which is now being extended to include AEOI with our bilateral treaty partners and signatories to the MCAA on Common Reporting Standards, and is committed to maintaining a broad AEOI network with all interested and appropriate partners.