Customer Due Diligence and Financial Inclusion in Malaysia: Balancing Regulatory Measures and Accessibility

Abstract

This article critically analyses the substantial inadequacies of the current Customer Due Diligence (CDD) framework in safeguarding marginalised communities from financial exclusion in Malaysia. It highlights that for vulnerable groups such as rural inhabitants, undocumented migrants, and refugees, the CDD, as currently framed and applied, only impedes access to formal financial services. While Malaysia's implementation of a risk-based approach in CDD policies complies with global standards of CDD, this article argues that these standards fall far short of effectively helping marginalised communities. In addition, there is evidence that banks are exhibiting over-cautious compliance behaviour, which resulted in banks hesitating to implement some of the CDD flexibilities introduced by the regulators. In order to address these problems and overcome the barriers, proposals for the development of new CDD strategies are analysed. These include reducing documentation requirements, widening the list of acceptable documents, and introducing entry-level accounts. The aim is to address banking access issues for marginalised communities without compromising the regulatory objectives of CDD. The article recommends that CDD regulations can better assist financial inclusion if they are tailored to the specific needs of the excluded communities by using a risk-based approach.

Introduction

The Central Bank of Malaysia Act ¹ was amended in 2009 to grant Bank Negara Malaysia (BNM), the Central Bank of Malaysia, an explicit mandate to actively promote financial inclusion in the country.² Since then, there have been extensive efforts and reforms to banking for the unbanked,³ which have arguably been fruitful.⁴ However, it remains a challenge to bring the remaining underserved segments of society, particularly the undocumented⁵ (who are mostly migrants and refugees, as well as rural communities)⁶ into formal financial services.

This article argues that the common challenge to accessing banking services among these communities is the satisfaction of the Customer Due Diligence (CDD) requirements mandated by Malaysia's anti-money laundering and countering the financing of terrorism (AML/CFT) regulations. The problem stems from the shortcomings in CDD practices that have led to the financial exclusion phenomenon in Malaysia. This article has identified two significant problems in CDD, namely (i) the ineffective implementation of the risk-based approach; and (ii) the over-cautious implementation of CDD policy practices by banks. This article argues that the solution to these problems is to ease the regulations and tailor them to the specific needs of the excluded communities by using a risk-based approach.

This article is structured as follows: the first part of the article explores the concept of financial exclusion and CDD, focusing on the Malaysian context. The second part delves deeper into how Malaysia's CDD rules contribute to the financial exclusion of vulnerable individuals, such as rural populations, undocumented migrants, and refugees. It analyses the consequences of these CDD-related barriers, including the limitations on economic opportunities and overall well-being for marginalised communities. The third part explores potential solutions to address these challenges, emphasises the importance of finding a balanced approach to CDD and financial inclusion, and concludes with a call to action to create a more inclusive financial environment in the country.

Defining Financial Exclusion and Financial Inclusion

BNM is responsible for regulating and supervising financial institutions to ensure adherence to AML/CFT regulations. Concurrently, financial inclusion stands as a significant objective in Malaysia, striving to grant access to financial services for all Malaysians, irrespective of their income level or location. Since the mid-1990s, the concepts of financial inclusion and exclusion have garnered considerable attention from academic researchers and policymakers on a global scale. Initially, the definition of financial exclusion centred around geographical factors, as described by Leyshon and Thrift, who defined it as the ‘processes that hinder the ability of economically disadvantaged individuals and marginalised social groups to access the financial system’, primarily due to limited geographical access.⁷ Over time, however, the concept has evolved into a more comprehensive understanding that encompasses additional barriers to access beyond geography.

It has been argued that regulation can affect financial exclusion, as highlighted by the assertion made by Porteous and Zollman, who contend that certain regulatory requirements, such as the insistence on specific documentation or increased compliance costs, can inadvertently lead to the exclusion of particular groups.⁸ Moreover, they suggest that banks themselves have implemented eligibility criteria that surpass regulatory mandates, resulting in the exclusion of certain segments of society, particularly those who are economically disadvantaged, such as individuals facing poverty.⁹

A good example of this is the satisfaction of customer due diligence (CDD), a rule mandated by AML/CFT regulations. CDD requires customers to be verified and identified during the account-opening process. In many countries without a compulsory identity card, some people have found it challenging to provide the types of identification that banks require to open an account. The typical identity documents accepted for opening an account are a passport, a utility bill, or a bank account statement,¹⁰ which are uncommon in low-income communities.

The corresponding concept of financial inclusion varies in its definition. While financial exclusion is commonly defined in terms of the factors that cause it, the definition of financial inclusion is usually discussed in the context of global and national visions of the desired state of financial inclusion. The World Bank, for example, envisages financial inclusion as ‘individuals and businesses hav[ing] access to useful and affordable financial products and services that meet their needs’.¹¹ In the UK, financial inclusion is defined as ‘individuals, regardless of their background or income, having access to useful and affordable financial products and services’.¹²

The types of financial services that should be considered when assessing financial exclusion are related to the concept of financial exclusion. In 2005, the World Bank identified the four main types of essential services to which individuals should have access: transaction banking, savings, credits, and insurance.¹³ It can be argued that there is a hierarchy of importance among these essential financial services, with banking accounts at the top of the ladder. While other financial products such as credits and insurance are undoubtedly important, the unavailability of a bank account has a more direct negative impact as it serves as the gateway to the provision of other financial services.¹⁴

Three conclusions can be drawn from the above. First, although the terms ‘financial exclusion’ and ‘financial inclusion’ have been defined in different contexts, they are essentially the opposite of each other and should be understood as such. Second, financial exclusion and/or financial inclusion can be defined in two tiers, ‘access’ and ‘usage’. This article focuses on the first tier of financial inclusion, access, as this denotes the potential ability to use financial services, without which there could be no usage. Third, although all basic financial services are important and play a specific role in the daily lives of individuals, it is argued that the issue of financial exclusion should first be addressed in the context of the essential financial services, specifically banking transaction accounts. Therefore, the scope of this article is limited to access to bank accounts, and financial exclusion is thus defined as barriers to opening a bank account. In line with the scope of this article, the terms ‘financially excluded’ and ‘unbanked’ will be used interchangeably to refer to individuals without a bank account.

Financial Exclusion in Malaysia

An inclusive financial system aims to provide equitable access and use of high quality, affordable, and essential financial services to all people in society, particularly those who are underserved. The objective is to promote shared prosperity and ensure that everyone has the means to effectively meet their financial needs. The goal of financial inclusion in Malaysia is to create an inclusive financial system that benefits all members of society, with a special focus on the underserved.¹⁵ Data suggests that despite Malaysia's seemingly robust position in terms of financial inclusion policy, an imperfect approach to this policy has resulted in approximately 9% to 15% of the country's adult populace being denied access to formal finance. Consequently, these individuals have ended up in groups that are underserved.¹⁶

In the context of financial inclusion, the underserved are usually referred to as those who lack access to a formal bank account,¹⁷ often including rural communities, women, and undocumented migrants.¹⁸ However, the term ‘underserved’ has not been distinctly defined in Malaysia. This ambiguity fosters the belief that the country's financial inclusion policy is meant to be all-encompassing, essentially catering to both Malaysian citizens and non-citizens. Contrary to this assumption, the authors argue that in order to achieve the financial inclusion goals set by BNM, it is essential that financial inclusion policies and initiatives are deliberately designed to serve every member of society, regardless of their Malaysian citizenship status.

However, financial inclusion policies in Malaysia frequently exclude non-Malaysians.¹⁹ A prime example is the BNM's guide to Basic Banking Services, which clearly specifies that entitlement to basic banking services is reserved for Malaysian citizens and permanent residents.²⁰ This has significant repercussions as it effectively excludes non-Malaysians, especially undocumented immigrants and refugees, from accessing banking services in the country. The rigorous customer due diligence process and identification system is also a major barrier to banking access for migrant workers and refugees, as it restricts eligibility to Malaysians only.²¹ Furthermore, there is a lack of legal instruments to incentivise or mandate banks to accept these communities as customers, which ultimately leaves it up to the banks’ discretion to decide whether or not to provide them with services.²²

The following section further elaborates on the ‘underserved communities’ and explains how they are excluded from formal finance in Malaysia. These communities are the rural communities, undocumented migrants, and refugees.

Rural Communities

The rural hinterlands of Malaysia are home to almost 23% of the Malaysian population.²³ ‘Rural communities’ here does not refer only to aborigines living in rural areas, although aboriginal settlements can certainly be considered highly isolated.²⁴ ‘Rural communities’ also connotes those living in secluded areas of Malaysia with distinct infrastructure deficits and costly transport to commute outside their vicinity.

Proximity of financial services significantly impacts customer engagement. It is crucial for effective engagement that bank branches, which serve as the initial point of contact for potential customers, are conveniently accessible to all communities. However, in Malaysia, numerous areas, especially rural regions, lack the presence of bank branches.²⁵ This poses a challenge as the nearest bank branches are often located miles away, exacerbating the problem of financial exclusion. The situation is further complicated by the lack of convenient transportation, which makes it difficult for residents to commute to the local town where the nearest bank branch is located. For example, villagers in Kampung Mat Daling in rural Pahang, Malaysia, have to travel nearly 128 kilometres to reach the nearest physical bank branch in the main town, Jerantut.²⁶ The main mode of transportation that could take villagers to the nearest town is by boat, which alone takes four to five hours.²⁷ Alternatively, villagers could rent a timber truck at a cost of RM70 per use,²⁸ the equivalent of about seven meals in Malaysia.

It is worth noting that significant development has taken place in rural Malaysia, where most areas previously lacking bank branches are now served by agent banks.²⁹ This initiative, spearheaded by the government, aims to enhance banking outreach to rural regions. Licensed financial institutions have been granted the opportunity to appoint existing businesses, including retail outlets and post offices, as their agents. These agents are now able to provide basic banking services such as cash withdrawals, money transfers, and bill payments. The agent bank initiative is widely recognised as one of the key contributors to the expansion of financial services in Malaysia, particularly in rural areas.

It is seen as an all-round solution that provides basic financial access for all parties. For retailers, agent banks increase their income through commissions gained from transactions and increased traffic to their stores. For financial institutions, setting up agent banks is a much cheaper alternative to opening a traditional bank branch.³⁰ While agent banks have traditionally been allowed to offer basic services such as cash withdrawals and bill payments, the role of account opening was only recently allowed in 2010, five years after the agent bank initiative was launched. However, even under the current regulation, agent banks are still only allowed to facilitate account opening³¹ but cannot conduct full CDD to complete the process.³² Rural communities therefore still have to commute to larger towns where bank branches are located. CDD can be seen as a significant barrier to account opening, particularly for rural communities, given the distance and lack of public transport for commuting. Thus, it is arguable that the outreach of the banking sector in Malaysia remains low, as agent banks cannot be regarded as effective bank branches due to their limitations in opening bank accounts for customers.

Undocumented Migrants

In Malaysia, migrants are typically classified into two main categories: expatriates and non-expatriates. Expatriates are highly skilled individuals who come to Malaysia to contribute professionally in technical and administrative positions. Conversely, non-expatriates, hereafter referred to as ‘foreign workers’, consist of low- or semi-skilled workers whose occupations are predominantly found in certain sectors such as domestic work, construction, and plantations. These foreign workers may be recruited legally, but many end up undocumented by overstaying their visas or absconding from their employers.³³ In addition, there are individuals who initially entered Malaysia through illicit means, but subsequently obtained legal status through government amnesty or naturalisation programmes.

The primary focus of this article is on the non-expatriate migrant population. While expatriates, usually professionals, are generally well supported by their employers and rarely face challenges with documentation or access to banking services, the same cannot be said for non-expatriates. According to the World Bank, the number of non-expatriate migrants in Malaysia was estimated to be between 2.96 million and 3.26 million at the end of 2017,³⁴ accounting for approximately 23% of the country's workforce. Of these, an estimated 1.23 to 1.46 million are undocumented.³⁵ However, there is debate about the possible undercounting of migrants in Malaysia. A tentative estimate by Lee and Khor suggests that the total number of migrants in Malaysia could be as high as 5.05 million,³⁶ of which over 2 million may be undocumented.³⁷ These migrants hail from a range of countries, with the majority originating from Indonesia, Bangladesh, and Nepal, and a smaller proportion from countries such as Vietnam, the Philippines, and India.³⁸

Migrants’ rights to possess a basic bank account in Malaysia are significantly limited, even for those who are legally employed. The most basic financial products are only available to Malaysians and permanent residents of Malaysia. As noted above, while Malaysians and permanent residents are granted the right to a basic account, migrant workers are explicitly excluded from enjoying this right.³⁹ For migrant workers with valid documents, the documentation required to open a bank account is complex and often beyond the reach of these migrant workers. The standard documents are a passport, a valid work permit, and a visa, which are regularly withheld by employers⁴⁰ to prevent absconding.⁴¹ Other documents include letters of reference from employers, who are sometimes required to be present during the account opening process. For migrant workers without valid documents, the chances of getting a bank account are limited, as they would have insufficient documents to identify and verify themselves, particularly documents that prove the legality of their stay in the country.

Refugees

The exact number of refugees in Malaysia is difficult to estimate. The United Nations High Commissioner for Refugees (UNHCR) states that as of the end of January 2023, the number of registered refugees is 183,790,⁴² with many more unregistered.⁴³ The majority of refugees in Malaysia came from Myanmar to escape from the discriminatory and inhumane treatment in their country.⁴⁴ Malaysia serves as a haven for many refugees, particularly those from Muslim countries, partly because it is itself a Muslim-majority⁴⁵ country and partly because it is one of the few countries that accepts citizens visa-free from Middle Eastern countries in conflict, such as Syria and Yemen.⁴⁶ The existence of the refugee community in Malaysia has also influenced the decision of many others to come to Malaysia because of the perceived ease of networking and settling down.⁴⁷

One of the major challenges facing refugees worldwide is the issue of identification. When fleeing their countries, refugees are often unable to carry identification documents with them. These documents may have been inadvertently left behind, lost, destroyed, or even stolen during their arduous journey.⁴⁸ In the case of Rohingyans from Myanmar, they often arrive in Malaysia without any form of identification, having been unable to obtain one from the government in their home country.⁴⁹ Similarly, Syrians have faced tremendous difficulties in replacing or applying for identity documents since the outbreak of the civil war. Compounding the issue, the so-called Islamic State has deliberately sought to destroy the passports and legal records of Syrian civilians.⁵⁰ For refugees in Malaysia, the UNHCR card becomes the primary, and in many cases the only, document available to prove their identity and legal status within the country. However, for the purpose of opening a bank account, this card is problematic for two reasons: firstly, the card is not legally recognised in Malaysia; and secondly, obtaining the card itself is a very challenging process for refugees.

On the first point, it should be noted that the UNHCR is not legally recognised in Malaysia because Malaysia has not signed the 1951 United Nations Convention Relating to the Status of Refugees or its 1967 Protocol. As a result, Malaysia is not bound to comply with any of the provisions of the Convention, including those that establish the primary responsibility of host countries to register refugees and provide identification documents to refugees who lack valid documentation.

In response to this challenge, the UNHCR has assumed full responsibility for the registration and identification of refugees in Malaysia.⁵¹ The UNHCR compiles records of the refugees’ identities and issues them with a UNHCR card, which facilitates access to services provided by the UNHCR and offers discounted health care in government hospitals.⁵² It is important to note, however, that the UNHCR card has no legal effect in Malaysia. It only signifies that the cardholder has a certain level of protection from the UNHCR and limited access to public health care services.⁵³ When it comes to opening a bank account, the UNHCR card is not considered an acceptable document for identity verification.⁵⁴ According to the Overseas Development Institute, only one bank⁵⁵ has allowed certain registered refugees to open bank accounts at specific branches on presentation of a personalised letter from the UNHCR.⁵⁶

In relation to the second point, securing a UNHCR card is a highly challenging task, largely due to the agency's limited funding. This financial constraint has significantly limited the organisation's capacity to respond effectively to the influx of refugees in the country.⁵⁷ The registration process lacks a standardised procedure.⁵⁸ The prevailing method is for refugees to send faxes or letters containing their identification details and a photograph to UNHCR, but there is no system in place to track whether their communication has been received or responded to.⁵⁹ This situation leaves refugees in a state of uncertainty. It is not that they lack identity documents, but that the existing system does not permit them to obtain them. With the its resources stretched thin, the UNHCR has exhausted its capacity to address the issue. The onus now falls upon the Malaysian government to intervene. Without its action, the prospect of this community gaining access to banking services is virtually non-existent.

Why Does Financial Inclusion Matter?

It is widely recognised that financial inclusion brings about economic advantages for individuals across the board. For migrants in particular, access to banking services offers numerous benefits, including safer alternatives to cash, improved access to credit facilities, and reduced fees for international money transfers. The overall level of financial access serves as an important indicator of the economic and social well-being of society as a whole.⁶⁰

Furthermore, extending financial inclusion to these communities aligns with the objectives of AML/CFT regulations. The Financial Action Task Force (FATF)⁶¹ has taken a keen interest in financial inclusion, believing that the pursuit of financial inclusion complements its goals of maintaining financial integrity.⁶² The underlying hypothesis is simple: by promoting financial inclusion, the scope of AML/CFT controls can be broadened, thereby strengthening financial integrity. Financial inclusion encourages greater utilisation of the formal financial system, allowing regulators to monitor a greater proportion of transactions conducted within that system. Conversely, financial exclusion is seen as a risk to financial integrity because it leads to a larger unmonitored financial sector. This lack of oversight deprives regulators of a crucial strategy in AML/CFT regulation, namely the ability to trace the movement of money.

Financial inclusion of migrant and refugee communities also represents a growth opportunity for the banking sector. Given the significant number of migrants and refugees in Malaysia, now totalling over 5 million, integrating these individuals into the formal economy could significantly boost economic growth. This is because when migrants and refugees engage with the formal financial system in their host countries, their earnings contribute to those economies and not just to their countries of origin.⁶³ These individuals could become customers for a range of financial products, including traditional offerings such as savings accounts. More importantly, they could make use of international money transfer services, offering significant potential benefits to financial service providers.⁶⁴

As detailed in the paragraphs above, financial inclusion supports financial integrity objectives by encouraging a greater number of people to transact within the formal financial system. This expansion allows regulatory bodies to monitor a greater number of transactions within the financial sector. In contrast, financial exclusion is perceived as a risk to financial integrity because it results in a larger, unmonitored financial sector. This scenario deprives regulators of a key strategy in AML/CFT regulation, namely the ability to trace the movement of money.

At this juncture, it is crucial to reiterate that financial exclusion in Malaysia is predominantly an issue among non-citizens who reside in the country without proper legal status. Given this context, critical questions arise as to why these communities need to be assisted, whether government intervention is necessary, and whether these efforts may inadvertently incentivise further illegal migration. These questions warrant careful consideration.

The substantial presence of these communities in the country exacerbates financial exclusion issues among them.⁶⁵ Integrating these groups into the banking system is not only profitable for the country, but also shields the banking system from the risks associated with informal banking practices, such as the growth of informal banks. The persistent influx of irregular migrants and refugees in Malaysia underscores the multifaceted nature of the illegal migration problem in Malaysia. The current practice of excluding these communities has not proved effective in reducing their numbers or deterring them from staying in the country. This reality necessitates a re-evaluation of existing strategies and suggests that it may be time for the government to consider a more ‘deserving approach’⁶⁶ to managing these communities.

However, it is not the contention of this article that irregular migrants should be granted rights per se, as such an attribution of rights would require a much broader evaluation, which is beyond the scope of this article. Whether the financial inclusion of these communities would trigger a surge in illegal migration in the country is another discussion that requires a broader context, which is also beyond the scope of this article. This article solely posits that given the context of banking access in Malaysia, there is a compelling case for the government to intervene and extend its support to these communities, despite their undocumented status.

Customer Due Diligence Requirements in Malaysia

The two most significant issues facing financial institutions today are money laundering and terrorist financing.⁶⁷ The magnitude of these problems has increased significantly in recent years, particularly with the rapid developments in the information, technology, and communication industry, which has increased the speed and ease with which money can move around the world.⁶⁸ In Malaysia, CDD responsibilities are encapsulated in the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Act 613) (AMLATFPUAA 2001). It comprises three obligations: to ascertain the identity of a customer, to verify the information provided by the customer, and to carry out ongoing monitoring. These obligations will be discussed in more detail below.

Ascertaining Identity

As a first step in CDD, financial institutions are required to ascertain the identity of a customer by collecting relevant identity information.⁶⁹ The primary objective of CDD is to identify the natural person who will ultimately control the account, including, in the case of corporate accounts, those who hold senior management positions within the corporate organisation.⁷⁰

The FATF Recommendations do not set out specific requirements as to what identification data should be collected or how identity should be verified. Malaysia takes a conservative view on what constitutes identity elements. It follows international guidelines, specifically the BCBS's guidelines on ‘Sound Management of Risks related to Money Laundering and Financing of Terrorism’,⁷¹ in determining the types of information to be collected. As a result, Malaysia has adopted a risk-based approach,⁷² which also means that the types of information required will vary according to the risk profile categories under which a customer falls. The procedure now is for financial institutions to have three CDD processes in place, namely simplified, standard, and enhanced CDD, so that customers are only subjected to the CDD process that corresponds to their assessed risk. Therefore, financial institutions must determine whether the customer falls into the standard-, high-, or low-risk categories before determining which CDD should be conducted on them.

The BNM guidance on implementing a risk-based approach explains the categorisation of customers based on their risk factors, which determines their risk rating and the appropriate CDD procedures to be applied.⁷³ Simply put, the guidelines imply that only Malaysian citizens with a net worth of less than RM500,000 can be classified as low-risk and thus qualify for simplified CDD. While the guidance attempts to categorise individuals from low-risk countries as ‘low-risk individuals’, it is noteworthy that it does not provide a clear definition of what constitutes a low-risk country. The illustration also states that the risk rating for individuals from Singapore is ‘medium’, noting that Singapore is neither a high-risk jurisdiction nor a neighbour of one. If a country as impregnable as Singapore⁷⁴ can be considered a ‘medium’ risk country in the context of money laundering and terrorist financing, it is unlikely that other countries can achieve a lower risk rating. Regarding high-risk customers, the guidance states that individuals with a net worth of more than RM3 million, politically exposed persons, and individuals from high-risk or sanctioned countries should be considered high-risk and subject to enhanced due diligence.

The key distinction between standard, simplified, and enhanced customer CDD depends largely on the level of information required and the specific objectives of the CDD process. The data collected through CDD is intended to enable financial institutions to familiarise themselves with their customers and to gain a basic understanding of their financial behaviour.

Standard CDD, which requires nine points of information, exemplifies this intention. Certain information, such as full name, National Registration Identity Card (NRIC) number or passport number, postal and residential address, date of birth, and nationality, is collected primarily to establish the customer's identity. Conversely, information relating to the customer's occupation, employer's name or nature of business, and the purpose of transactions is collected to provide financial institutions with a general understanding of the customer's financial behaviour.⁷⁵

Under simplified CDD, the focus appears to be merely on collecting basic customer information rather than data related to financial behaviour. As such, financial institutions are only required to collect five key pieces of information: the customer's full name, Malaysian identity card (MyKad) number or passport/reference number of other official documents, residential address, date of birth, and nationality.⁷⁶ Finally, the enhanced CDD process aims to gather more information from customers to mitigate the higher risk involved. The additional information, such as volume of assets, source of wealth, and source of funds, must be collected in addition to the nine standard CDD points of information, and is intended to enable a closer scrutiny of the account so that any anomalies in transactions can be detected promptly.⁷⁷ Further, the rules mandate that the decision on whether to resume a business relationship with a high-risk customer following enhanced CDD must be approved by senior management.⁷⁸ This places responsibility on senior management, who would have more expertise in this matter than the regular front-line bankers who would normally be in charge of CDD.

Verifying Identity

The second step of the CDD process requires the verification of all information provided during the identification stage. This includes checking the original documents and maintaining their records.⁷⁹ The significance of this process was highlighted in the case of Tele-Temps Sdn Bhd & Satu Lagi v Southern Bank Berhad.⁸⁰ In this case, a bank was found negligent for failing to verify the information provided by an individual who used two documents with different spellings of his address to open an account. Despite the discrepancies, the bank overlooked the issue, assuming it was a technical error, and proceeded to deposit RM100,000 into the account. This negligence facilitated a fraudulent scheme.

The court emphasised the bank's crucial role in verifying information, noting that even minor discrepancies, such as inconsistent spelling of addresses, can have substantial adverse consequences – in this instance, a fraud-induced loss to the appellant. The bank should have regarded the inconsistency as a potential red flag, prompting further due diligence, such as cross-checking with public databases or conducting a personal interview. Such measures could have helped to prevent the fraud.

This case is particularly relevant in the context of AML/CFT regulations, where the verification process is critical to ensuring the accuracy of customer information. Banks are therefore strongly advised to refer to the original documents when verifying a customer's identity and to keep records of these documents.

As a basic principle, the provisions of the AMLATFPUAA 2001 and the BNM guidelines indicate that the verification process should normally be completed before any business relationship is established or the transaction is completed. However, section 14A.10.5 of the guidelines allows the verification to be delayed for a period not exceeding ten working days or such other period as may be specified by BNM after the business relationship is established.⁸¹ This may be the case in certain circumstances where the money laundering/terrorist financing risks are deemed to be low and verification is not possible at the outset of a business relationship. The guidelines do not provide any further illustration of the situations in which delayed verification could be applied, so the applicability of this provision remains uncertain. Delayed verification is also allowed in relation to accounts opened at agent banks, whereby such accounts may be ‘fully verified’ at the main bank branch within two months of opening.⁸²

The most important element of the verification process is the types of documents that are acceptable to verify a customer's identity. The primary criteria for acceptable documents are their independence and reliability.⁸³ The BNM further defines an ‘[i]ndependent document’ as a document that is ‘issued or made available by an official body … even if [it is] provided to the reporting institutions by or on behalf of that person.’⁸⁴

The element of reliability in a document is closely tied to its acceptability in different contexts. For instance, BNM stipulates that a reliable document should be one that enjoys widespread recognition and acceptance by both the government and the private sector in Malaysia for identification purposes and authorisation of other services. Evidently, the documents with the highest degree of independence and reliability are those issued by the national governments, local authorities, and regulated entities in the financial and utility sectors in the country. If a document contains a photograph, this increases its reliability; however, documents without photographs may still be accepted if they are corroborated by another document.⁸⁵ The main documents that can be used for verification are specified as

identity card (or the MyKad), passport, driver's license, constituent document or any other official or private document as well as other identifying information relating to that person.⁸⁶

The BNM Guidance on Verification and CDD further adds that for foreigners, banks are advised to accept only a valid foreign passport issued by a foreign government and, where applicable, a visa to enter Malaysia.⁸⁷ It is also interesting to note that the guidance specifically mentions the situation of refugees, stating that banks should consider accepting refugees with a document, a letter, or a statement from the United Nations or its agencies, such as the UNHCR card.⁸⁸ In addition, the guidance allows CDD to be completed by way of recommendation of another ‘appropriate person’⁸⁹ who knows the individual to verify that the person is who they says they are.⁹⁰ In practice, most banks will accept the MyKad as the primary verification document for Malaysian citizens, as well as a valid passport for non-citizens. It is also common for banks to request additional⁹¹ supporting documents, such as copies of utility bills or employment letters, to verify other customer information, such as address and employment details.⁹²

Ongoing Monitoring

Ongoing monitoring of an account means that financial institutions are required to maintain CDD throughout the lifetime of a customer relationship.⁹³ This recognises that a customer who passes the initial CDD may subsequently engage in money laundering or terrorist financing. The obligation to conduct ongoing monitoring is provided for in section 16(4) of the AMLATFPUAA 2001 and is further reinforced in section 14A.13 of the BNM Policy Document 2019. The ongoing monitoring obligation requires the bank to ensure that transactions conducted by customers are consistent with the bank's knowledge of the customer. Banks must also ensure that any documents, data, or information collected as part of the CDD process are kept up to date and relevant. In line with international standards, the scope of ongoing monitoring in Malaysia must be risk-sensitive and commensurate with the level of money laundering/terrorist financing risk posed by the customer. For customers with a high-risk profile, the frequency of monitoring must be increased and specific transaction patterns must be closely monitored so that any possibility of unusual transactions can be promptly flagged.

Customer Due Diligence and Financial Exclusion in Malaysia

In Malaysia, a major cause of financial exclusion across various groups is related to the CDD policies stipulated by AML/CFT regulations. Numerous global studies have demonstrated the direct link between CDD requirements and financial exclusion.⁹⁴ This article identifies two primary issues with CDD that contribute to financial exclusion in the country: (i) the ineffective implementation of the risk-based approach, and (ii) the overly cautious implementation of CDD policy practices by banks.

Implementation of the Risk-Based Approach

The FATF Recommendations suggest that countries base their national AML/CFT rules on a process of risk identification, categorisation, and appropriate assessment.⁹⁵ In the context of financial inclusion, this means that individuals or entities that are deemed to pose a lower risk should be subject to lower levels of customer due diligence, including a lower identification threshold, flexibility in verification, and a less rigorous monitoring mechanism,⁹⁶ and vice versa.⁹⁷ Importantly, being financially excluded does not equate to posing a lower risk.⁹⁸ Hence, applying any risk-based approach (RBA) measures must necessarily be based on a holistic risk assessment at the national, institutional, and individual levels.⁹⁹ Prior to 2019, the RBA in Malaysia had not been given any statutory footing. There was no provision for RBA under the main act governing money laundering and terrorist financing activities. The provision of the RBA under BNM's Sectoral 1 Guideline¹⁰⁰ was vague and did not provide any clear policy expectations with respect to the RBA. Five years after the issuance of the Sectoral 1 Guideline, BNM issued a technical note¹⁰¹ to assist financial institutions in designing AML/CFT controls in line with the RBA strategy.

The recent issuance of the new AML/CFT policies by BNM has brought about some significant changes, particularly towards advancing the RBA in Malaysia's AML/CFT laws. Within this framework, the aforementioned three categories of due diligence are finally introduced: simplified, standard, and enhanced due diligence.¹⁰² The policy is complemented by guidance on the RBA, which clarifies the approach's understanding and policy expectations. It also provides illustrations of risk parameters and clear guidelines on how financial institutions should conduct risk scoring and risk profiling to assist them in deciding which risk categories the customer should fall into and, consequently, which CDD measures the customer should be subjected to. In Malaysia, the RBA is manifested in three policies: simplified due diligence for accounts opened at agent banks, delayed verification, and tiered accounts. However, several issues identified within these frameworks have arguably led to the financial exclusion of certain communities in the country.

Problems in Simplified Due Diligence in Malaysia

Malaysia's strategy is to minimise the amount of identification information required during the account opening process. The first issue arises from the RBA Guidance issued by BNM.¹⁰³ This guidance implicitly allows for simplified due diligence to be conducted only on Malaysian citizens with a net worth of less than RM500,000.¹⁰⁴ Consequently, this limits the accessibility of simplified due diligence relaxations to financially excluded groups, specifically undocumented individuals and refugees.

Second, the simplified CDD only applies to the identification process, not the verification process. The flexibility introduced in Malaysia has merely reduced the amount of information required from customers, but has not addressed the core issue of documentation – arguably the main obstacle CDD poses to financial inclusion in the country. There is no flexibility for financially excluded groups to present an identity document that may be more accessible to them, as these documents might not fit within the typical CDD framework. As a result, it can be argued that the lack of clear guidelines for simplified due diligence in the verification process largely overlooks the problem faced by the primary excluded groups in the country, rendering the framework ineffective.

Finally, the lack of limitations for accounts opened with simplified due diligence exacerbates the financial exclusion problem. A well-defined limitation on an account can lower the risk of misuse and can therefore be offered to certain customers who cannot fully satisfy the standard CDD process. Without such limitations, customers eligible for simplified CDD must be restricted, as granting full access to an account to a customer without sufficient information poses a high risk to banks. This means that banks have no choice but to restrict the offer of simplified due diligence to financially excluded groups. However, limitations on accounts opened with simplified CDD could also minimise the potential damage to the bank in the event of misuse. Consequently, banks would have more opportunities to address potential AML/CFT issues and extend their services to financially excluded groups.

Problems in Delayed Verification and Tiered Bank Accounts Opened at Agent Banks

This article has examined the initiatives taken by agent banks to address geography-related challenges and promote financial inclusion in the country's rural communities.¹⁰⁵ Through these initiatives, banks can designate existing businesses in rural regions as their agents and provide basic banking services like cash withdrawals, money transfers, and bill payments. Initially, the function of agent banks was limited to certain transactions, but in 2015, as mentioned above, the regulations were revised to allow agent banks to assist customers with opening bank accounts.¹⁰⁶ As per the Agent Banking Guideline Malaysia 2015, customers may request to open a bank account at an agent bank and then undergo a round of customer due diligence procedures. The CDD conducted at agent banks involves three steps: (1) collecting of identity information from customers; (2) biometrically authenticating the information via MyKad through a real-time online system; and (3) forwarding this information to the relevant main bank.¹⁰⁷ However, the account is not fully opened at the agent bank; customers are still required to be present at the main bank branch within three months of account opening to complete the CDD process.

The requirement to be present at the main bank branch within three months does not effectively eliminate the geographical constraint. Despite the significant challenges and costs, customers still have to travel the distance. It is argued that this problem is perpetuated by the adoption of a time-based tiered system for accounts opened at agent banks, rather than the FATF-recommended function-based tiered system.¹⁰⁸ The compulsory verification within the prescribed timeframe of three months of opening also means that any consideration of low-risk use of the account is disregarded, which is contrary to the main purpose of the RBA.

From a FATF perspective, adopting a tiered system based on functionality would be the appropriate RBA to apply in this situation:¹⁰⁹ The account opened with simplified due diligence would be allowed to operate within a limited set of functions and a monetary threshold. Further, CDD could be carried out if customers wish to transact beyond the threshold, where it is arguable that they may have more financial capacity to travel to the main bank. This approach would open up more opportunities for agent banks to complete simplified due diligence procedures at agent outlets without taking on too much risk, and potentially eliminates the need to travel altogether for customers with small accounts.

Over-Cautious Implementation of CDD

CDD policies in Malaysia have had a significant impact on financial inclusion through their application by banking institutions. Although the authorities have introduced certain flexibilities to promote financial inclusion, banks seem reluctant to incorporate these changes into their institutional CDD policies. This reluctance often manifests itself in an over-compliance response, where institutions go beyond the legal requirements imposed on them.¹¹⁰

In the context of AML/CFT, this over-compliance response is evident when regulators delegate discretionary powers to financial institutions, leading them to limit rather than utilise the discretion granted. For instance, even though regulations have been formulated to give banks the discretion to accept alternative documents for CDD purposes when opening accounts, some banks have opted not to exercise this flexibility.¹¹¹

Moreover, an overly cautious compliance response can be seen in the regulation's failure to implement simplified due diligence¹¹² for low-risk customers, instead continuing to apply more rigorous measures.¹¹³ The over-reporting of suspicious transactions is another example.¹¹⁴ Institutions often err on the side of caution and report transactions that are not necessarily suspicious in order to avoid the risk of penalties for non-reporting.¹¹⁵ Dhillon et al highlight this issue in Malaysia, commenting that this approach may generate more false alarms than it detects actual suspicious transactions.¹¹⁶ This not only inflates compliance costs, but also significantly hampers the efficiency of the suspicious transaction reporting scheme.¹¹⁷

In Malaysia, the most apparent evidence of over-cautious compliance is the reluctance of banks to accept the UNHCR card issued to refugees as a valid document for CDD purposes, despite the explicit approval of the BNM and despite the fact that the UN has repeatedly stated that the card has enhanced security features and has a low risk of being misused for money laundering. It also satisfies all three conditions for acceptable documents for CDD.¹¹⁸ In summary, however, the UNHCR card remains unacceptable for CDD purposes in Malaysia despite statements by government authorities to the contrary, thus denying refugees access to banking services.

Potential Solutions

The following solutions for improving financial inclusion in Malaysia are derived from the above assessment of the gaps in the country's CDD regulations. The remedy for these problems involves easing CDD regulations and adapting these rules to the specific needs of the excluded communities through a risk-based approach. This article substantiates, through detailed analysis, that the problems outlined can be translated into clear, practical recommendations for CDD regulations, which could potentially expand financial inclusion in the country.

This article makes the following recommendations:

• • reducing documentation requirements for the undocumented and refugees to only those relevant for AML/CFT purposes;

• • introducing small basic accounts for accounts opened with simplified CDD;

• • widening of the list of acceptable documents for CDD.

Reducing Documentation Requirements for the Undocumented and Refugees to Only Those Relevant for AML/CFT Purposes

In line with the RBA, it would be beneficial to revisit, and potentially relax, the current customer documentation requirements imposed on banks. If an individual is deemed low-risk for money laundering or terrorist financing, the CDD guidelines could be adjusted to reflect this. Further relaxations could take the form of reducing the amount of information required and possibly even eliminating some of the traditional documents typically collected for CDD purposes. These changes would be more in line with the objective of both achieving robust AML/CFT measures and promoting financial inclusion.

For example, it is timely to remove from the CDD practices the requirement for documentation to prove the legality of a stay. Neither the FATF nor the Basel Committee on Banking Supervision (BCBS) have mandated such documentation in any of their guiding policies.¹¹⁹ In the context of CDD objectives,¹²⁰ it is argued that proof of legality of stay does not add value to the intentions behind the implementation of CDD. Even without these documents, sufficient deterrence and monitoring can still be carried out within the account, provided that other primary information and documents are sufficiently identified and verified. As the primary objective of banks is to serve and protect the financial system, initiatives should be focused on reducing opportunities for informal transactions – not on policing illegal presence in the country. The former will require banks to accept documentation flexibilities that allow communities to enter formal, regulated finance without compromising financial stability.

While we recognise the potential risks associated with reducing CDD requirements – given that less customer information could lead to less comprehensive risk and behavioural profiles for monitoring – we also support the consideration of alternative, potentially more insightful types of information. For instance, details such as a customer's source of income and anticipated product use may be more accessible to customers and provide a clearer picture of their expected transaction profile.¹²¹

Incorporating this type of profiling into a simplified due diligence process could improve the effectiveness of transaction monitoring. Any deviation from the established profile could trigger a review of the customer's CDD and, if necessary, lead to a suspicious transaction report. This approach allows balance to be struck between financial inclusion and the robustness of AML/CTF measures.¹²²

Moreover, this approach should be complemented by the introduction of an entry-level tiered account system that restricts transactions, balances, and payments to a low threshold.¹²³ Such limitations significantly diminish the overall risk of money laundering and terrorist financing, rendering the proposed reduced CDD potentially sufficient to achieve its objectives.¹²⁴ The combination of these strategies could offer a practical solution for enhancing financial inclusion without compromising the effectiveness of AML/CTF measures.

Introduction of Entry-Level Accounts for Accounts Opened with Simplified Due Diligence

Earlier, we have explained that geography is one of the challenges rural communities face in opening a bank account. The CDD regulations effectively prohibit agent banks from completing the CDD process, forcing rural communities to travel to the main bank branch even though they have already been identified and verified at the agent bank. Justifications for not allowing agent banks to complete CDD include high susceptibility to error due to inexperience and less accountability for legal issues should they arise. As BNM does not directly regulate agent banks, the main bank bears legal responsibility for their activities.

A practical approach that could help alleviate this challenge is the establishment of ‘small accounts’. These accounts would offer a more limited range of banking services, as well as constraints on balances and transaction values when opened at agent banks. In theory, these accounts would be less risky because of the smaller range of services and lower transaction volumes.¹²⁵ Accordingly, a more streamlined customer due diligence process may adequately meet the AML/CTF objectives in relation to these types of accounts.¹²⁶

Several countries, such as India and South Africa, have adopted this strategy to address their financial inclusion challenges. In India, banks are authorised to open small savings accounts for low-income customers lacking acceptable forms of identification, using simplified CDD norms.¹²⁷ The account is subject to strict limits on the monthly aggregate of withdrawals and transfers and the balance at any point in time.¹²⁸ South Africa has adopted a similar approach, with restricted accounts capped at a maximum balance of £1,300. These accounts have a daily transaction limit of R5,000 (about £242) and a monthly transaction limit of R25,000 (about £1,211).¹²⁹ To open these accounts, banks only require a copy of the client's identification document. There is no need for additional documentation like proof of address or tax numbers.¹³⁰

Drawing from these examples, Malaysia could consider introducing a similar tiered banking system to increase financial inclusion. An ‘entry-level’ account could be designed specifically to meet the needs of the low-income population, including individuals from rural regions, the undocumented, and refugees. Assuming that the majority of those who have difficulty accessing formal financial services are in the lower income brackets, a daily transaction and bank withdrawal limit of RM500 (£100) may be practical.¹³¹ Such a limit is unlikely to cause significant hardship to these account holders, given their typical financial activities. In addition, a maximum balance limit of RM5,000 could be imposed on these accounts.

In cases where individuals need to carry out transactions in excess of these limits, provisions could be made to allow such transactions to be carried out in a bank branch. This helps to maintain the overall risk profile of the account while providing flexibility for account holders in exceptional circumstances.

To further enhance the usefulness of these accounts, a mechanism could be introduced to allow customers to apply for a higher daily transaction limit. Approval of such increases could be conditional on the customer satisfying additional AML/CFT requirements, thus providing a pathway for account holders to access more financial services as their circumstances change or improve.

Widening of the List of Acceptable Documents or Alternative Modes of Verification for CDD Purposes

The mode of identity verification can be expanded to include alternative document and non-document methods of authentication. This strategy is beneficial for the undocumented and refugees. They can use a valid, readily available document and a strong non-documentary verification to authenticate their identity. For example, a valid foreign identity card or a passport can be supported by a referral letter issued by a partner non-governmental organisation (NGO) to prove the identity of undocumented migrants or refugees. The term ‘undocumented migrants’ does not necessarily mean that they do not possess any document at all. Rather, the typical situation is that they have either unacceptable or insufficient documents to satisfy the CDD process. For example, a refugee in Malaysia will usually be provided with a UNHCR card, which is currently unacceptable to banks for CDD purposes.¹³² Combining documentary and non-documentary forms of verification may provide a solid foundation for CDD and give banks the confidence to accept these individuals as customers.

It should be noted that the combination of documentary and non-documentary forms of verification may entail the risk of fraudulent activity and abuse of process. For example, a referral letter can easily be forged. As reported by FATF, in countries that rely on a letter from, eg, the village chief to verify a customer's identity, there have been some isolated cases where these village chiefs have begun to demand money for their verification services.¹³³ Such integrity issues defeat the rationale behind offering relaxations and arguably create more challenges to financial inclusion. One way to ensure that the process is not abused is to encourage banks to partner with specific NGOs in the country and only accept letters issued by trusted, partnering NGOs. In this way, the process of issuing referral letters can be monitored to ensure confidence in their value.

For rural communities, video verification of accounts opened at agent banks may offer innovative solutions. Given that agent banks may have already performed the first level of verification, the CDD process could be further enhanced by using videoconferencing instead of a physical visit to a bank branch. Several safeguards can be put in place to address the identity fraud risks that may arise from videoconferencing. For example, videoconferencing must be held at agent banks, with the agent witnessing the entire process. The agent can also authenticate the identity documents, such as MyKad, using smart card readers, before continuing the process via videoconference with an officer from the main bank branch. The presence of the agent may be sufficient to reduce the risk of fraudulent activities during the process. The videoconference should also be recorded and retained for record purposes.

Conclusion

This article has undertaken an in-depth examination of Malaysia's CDD framework, as set out in the AML/CFT regulations, and explored its potential negative impact on financial inclusion. It focused on identifying the financially marginalised communities in Malaysia and sought to understand the root causes of their exclusion. Our arguments highlighted that rural communities, undocumented migrant workers, and refugees are the three demographic groups most susceptible to financial exclusion in the country.

While the specific reasons for exclusion may vary, a common factor of exclusion was identified across the three communities: ‘customer due diligence rules’. For rural communities, CDD made it difficult to open a bank account, as they must physically travel to complete the CDD process. Moreover, the presence of agent banks in rural areas did not ensure financial inclusion as they often lacked the legal mandate to complete the necessary CDD. In relation to undocumented individuals and refugees, Malaysia's CDD rules impose challenging documentation requirements that are not feasible for them.

This article has analysed specific issues related to Malaysia's CDD regulations that contribute significantly to financial exclusion. The RBA adopted, the article has argued, does not effectively target the financially excluded, and the implementation of simplified due diligence measures has proved ineffective in easing the CDD process. These measures do not address verification issues and only cater to selected categories of local citizens, leaving out a significant number of non-citizens who make up a large proportion of the financially excluded.

Furthermore, the lack of prescriptive rules and significant inconsistencies within the CDD regulations exacerbate the problem, as financial institutions, out of an overabundance of caution, tend to exceed legal requirements as a protective measure. For example, they may insist on implementing standard or enhanced CDD measures even when a customer is legally eligible for simplified CDD. This over-compliance inadvertently pushes potential clients towards financial exclusion.

The article has also examined the strategy of the RBA implemented in agent banking services, suggesting that the issue is not with the CDD regulations themselves, but rather with the system in which these regulations are applied. The article has identified the time-based tiered system in Malaysia as problematic, particularly as it does not alleviate the geography-related challenges faced by rural communities in accessing banking services.

This article makes three main recommendations to improve CDD systems in Malaysia:

First, the identification and documentation requirements for the excluded communities should be restructured and explicitly detailed in a revamped regulatory framework. This change would make it easier for the financially excluded groups to access banking services, thereby fostering financial inclusion without compromising security.

Second, innovative strategies such as the introduction of ‘entry-level’ accounts should be considered. These accounts, opened with simplified due diligence, would be targeted at those who are currently unable to meet standard CDD requirements. With carefully calibrated transaction and balance limits, these accounts could provide basic financial services while minimising the risk of money laundering and terrorist financing.

Third, the list of acceptable documents for identification verification could be expanded. This approach would make the CDD process more flexible and accessible to individuals who may not be in possession of the documents traditionally required.

In addition to these regulatory and procedural amendments, financial institutions could play a crucial role in enhancing financial inclusion. They could develop educational programmes to help their customers understand the significance of CDD and their own role in maintaining the integrity of the financial system. While compliance with AML/CFT regulations is critical, it is equally important to ensure that these regulations do not impede financial inclusion.

By striking a delicate balance between complying with regulatory requirements and fostering financial inclusion, financial institutions would make a meaningful contribution to Malaysia's economic growth and social development. Implementing these recommendations would enable Malaysia to enhance financial inclusion while safeguarding its financial environment from criminal activities.