Malaysia Payments

Malaysia sits in an interesting position within Southeast Asian payments: mature enough that most infrastructure works reliably, dynamic enough that the mix is still shifting. DuitNow is displacing FPX for e-commerce checkout. Touch ‘n Go has evolved from a highway toll card into a fully-fledged financial services wallet. Card penetration at 55% is the second-highest in SEA after Singapore. For operators building regional coverage, Malaysia is typically the third or fourth market entered — slightly more complex than Singapore but with substantially more volume.

DuitNow — Malaysia’s Real-Time Rail

DuitNow is operated by PayNet (Payments Network Malaysia), the industry-owned payment infrastructure company mandated by Bank Negara Malaysia. It operates on an alias system supporting mobile number, NRIC (national ID), business registration number, army/police ID, and passport number. Registration is done through any participating bank app — all major Malaysian banks are connected.

DuitNow QR is the unified merchant QR standard. A single DuitNow QR code at a merchant accepts payment from any participating bank or wallet app. The Singapore–Malaysia QR cross-border linkage is live, allowing DuitNow QR to accept payment from Singapore PayNow users and vice versa — a commercially meaningful corridor given tourism volumes and the Johor-Singapore daily commuter population.

DuitNow Online Banking/Wallets (DOBW) is the e-commerce checkout variant, allowing customers to authenticate and push payments directly from their banking app to a merchant, bypassing the card network entirely. DOBW is growing as a checkout option and will increasingly challenge FPX as the default online banking payment method.

MDR for DuitNow is near-zero for merchants. The commercial case for operators adding DuitNow alongside cards is clear: shift cost of acceptance, especially for high-frequency or mid-ticket categories.

FPX — The Online Banking Anchor

Financial Process Exchange (FPX) has been Malaysia’s dominant online banking payment method for e-commerce since the mid-2000s. The mechanism is straightforward: customer selects their bank at checkout, authenticates via the bank’s online banking platform, and the funds push directly to the merchant. FPX is not a real-time rail in the BI-FAST or UPI sense — it is a push-payment mechanism with near-real-time fund movement and a well-established dispute process.

FPX remains important for several reasons. It supports higher transaction values than DuitNow’s standard retail limits. It is deeply embedded in enterprise and government payment flows. And consumer familiarity with FPX is extremely high — it has been the de facto alternative to card checkout for two decades. Operators should not decommission FPX support simply because DuitNow DOBW exists; the two serve overlapping but not identical use cases and consumer preferences vary.

E-Wallet Landscape

Touch ‘n Go eWallet (TNG Digital — Axiata and Ant Group joint venture) is Malaysia’s dominant third-party wallet. Its competitive moat comes from a unique combination: physical transit infrastructure (highway RFID tolling and LRT/MRT transit via the physical TNG card and NFC on phones), merchant QR acceptance, and a growing financial services layer including GoPlus+ (savings), insurance products, and tabung (savings goals). No other Malaysian wallet combines transit utility with financial services depth at this scale.

ShopeePay has grown rapidly through Shopee’s e-commerce dominance and aggressive cashback campaigns. GrabPay Malaysia operates through the Grab super-app ecosystem. MAE (Maybank) functions as Maybank’s wallet and payment app with strong adoption among Malaysia’s largest bank’s customer base. BigPay (AirAsia Capital / Capital A) targets the travel and remittance segment.

All Malaysian wallets link to DuitNow for funding and interbank transfers. Unlike Indonesia, Malaysian wallets do not hold substantial proprietary float for domestic use — the architecture is closer to Singapore’s PayNow-linked model. Wallet loyalty programs and cashback are the primary competitive differentiators.

Card Market

Malaysia’s card market is the most developed in Southeast Asia after Singapore. Card penetration at 55% reflects a broad middle class with high banking inclusion. Visa and Mastercard hold dominant share. CIMB, Maybank, Public Bank, and RHB are the major card issuers. Contactless NFC is widely deployed at POS and consumer adoption is strong — tapping is the default behaviour at most physical merchants.

3DS2 is well-deployed by Malaysian issuers. Card-not-present authentication is mature, and approval rates on properly authenticated transactions are high. Installment plans via credit card are common for electronics, furniture, and travel — 0% for 6, 12, or 24 months is a standard issuer offering that operators in those categories should surface at checkout.

MDR for credit cards at 1.5–2.0% is among the most competitive in SEA, reflecting a more developed acquiring market than Indonesia or the Philippines.

BNPL

Malaysia’s BNPL market reached USD 1.84B in 2026, forecast to reach USD 4.55B by 2031. As of H1 2025, SPayLater (Shopee/Sea) commands 56.5% of active user share, followed by Atome at 26.5% and Grab PayLater at 8.3% — a heavily consolidated market with 6.5M active account holders. Average transaction values are below RM 100, indicating high-frequency, low-ticket usage across e-commerce and lifestyle categories.

Malaysia’s Consumer Credit Bill passed in July 2025 and introduces a licensing requirement for BNPL operators; implementation timelines have not been confirmed as of mid-2026. Merchant discount rates are in line with regional norms at 3–6%. For operators targeting Malaysian consumers, SPayLater integration is effectively mandatory given its market dominance; Atome covers the non-Shopee retail footprint. The incoming licensing regime will require BNPL partners to hold valid Consumer Credit Act licences once enforcement is activated — operators should confirm partner compliance status before launch.

Crypto and Digital Assets

The Securities Commission Malaysia (SC) classifies crypto assets as securities and regulates them under the Capital Markets and Services Act. Licensed exchanges include Luno, Tokenize, and MX Global — all restricted to investment and trading activities. Crypto adoption in Malaysia is primarily investment-driven; it is not a mainstream retail payment rail, and crypto payments at POS are uncommon across merchant categories.

Operators should not build crypto payment acceptance into Malaysia deployments. There is no active stablecoin framework or CBDC pilot relevant to merchant payments as of mid-2026. The SC’s securities classification means any crypto payment integration would require engagement with a licensed intermediary and carries regulatory complexity disproportionate to current consumer demand. Monitor for any SC guidance on payment-specific use cases, but no integration action is warranted at this stage.

Regulatory Environment

BNM’s licensing framework under the Financial Services Act 2013 and Payment Services Act 2019 provides clear licence categories. Payment instrument issuers (e-money, stored value) and operators (payment gateways, switching) each have defined licence types. BNM’s Financial Technology Regulatory Sandbox is well-established and actively used — international operators can apply and receive structured regulatory support during a defined test period.

The Open Banking Malaysia initiative is driving API standardisation across the financial sector. BNM has published open API standards for account information and payment initiation, and participation is expanding.

eKYC guidelines are mature. BNM-regulated entities can use digital identity verification for remote onboarding, and the standards are clear. AML/CFT obligations fall under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act (AMLA).

One structural point foreign operators must flag: the Bumiputera equity requirement (30% Bumiputera ownership) applies to certain licensed financial service entities. Legal advice on business structure and ownership before applying for a PIIO or e-money licence is essential for foreign principals.

Fraud Landscape

Malaysia’s fraud rates are moderate within SEA — better than the Philippines or Vietnam, comparable to Thailand. The dominant threat is not card fraud but Macau scam variants: phone scammers impersonating police, tax officials, or courier companies coerce victims into transferring money via DuitNow or bank transfer. Absolute scam loss volumes have risen despite relatively stable fraud rates, reflecting the growing digital transaction base.

Mule account networks are a secondary issue — money laundering through recruited account holders is an active enforcement focus for BNM and PDRM (Royal Malaysian Police). Banks have introduced enhanced monitoring on new accounts receiving large inbound transfers.

BNM and commercial banks are transitioning from SMS OTP to Secure2u (app-based transaction signing) as the primary authentication method, which should reduce OTP interception fraud over time.

Practical Notes for Operators

PSPs. iPay88 and Revenue Monster are strong domestic options with broad local payment method coverage. 2C2P has solid Malaysia infrastructure within its regional stack. Curlec (now part of Razorpay) specialises in direct debit and recurring billing — important for subscription businesses. Stripe Malaysia is available with good developer experience. Adyen supports Malaysia for enterprise merchants.

Settlement. Card acquiring settles T+1. DuitNow and FPX settle near-instantly or same-day depending on integration model.

Tax. Sales and Service Tax (SST) at 8% applies to digital services. Foreign digital service providers generating above MYR 500,000 in annual B2C revenue from Malaysian customers must register for SST.

Entity. A local entity (Sdn. Bhd.) is recommended for full PIIO licensing but partnership models with licensed local entities are common for market entry. Legal counsel on Bumiputera requirements is advisable before structuring.

Language. Bahasa Malaysia localisation is expected for consumer-facing products. English is broadly accepted in B2B, corporate, and developer contexts — Malaysia has higher English proficiency than most SEA markets.