Malaysia
Payments

Malaysia combines bank-transfer and QR services with cards and wallets. Choose the payment route by customer access, channel and merchant operations. A consumer survey, wallet user count and checkout transaction share have different denominators; this guide does not combine them into a market-share pie.

DuitNow — Malaysia's Real-Time Rail

DuitNow is operated by PayNet (Payments Network Malaysia), the industry-owned payment infrastructure company mandated by Bank Negara Malaysia. It operates on an alias system supporting mobile number, NRIC (national ID), business registration number, army/police ID, and passport number. Registration is done through any participating bank app — all major Malaysian banks are connected.

DuitNow QR is the unified merchant QR standard. A single DuitNow QR code at a merchant accepts payment from any participating bank or wallet app. The Singapore–Malaysia QR cross-border linkage is live, allowing DuitNow QR to accept payment from Singapore PayNow users and vice versa — a commercially meaningful corridor given tourism volumes and the Johor-Singapore daily commuter population.

DuitNow Online Banking/Wallets (DOBW) is the e-commerce checkout variant, allowing customers to authenticate and push payments directly from their banking app to a merchant, bypassing the card network entirely. DOBW is growing as a checkout option and will increasingly challenge FPX as the default online banking payment method.

PayNet's merchant FAQ says DuitNow QR fees vary by bank, wallet or acquirer and receipt timing is subject to provider terms. Ask which tariff, waiver and expiry date apply to the actual merchant account. Consumer-transfer fees are a different product from merchant QR acceptance.

FPX — The Online Banking Anchor

Financial Process Exchange (FPX) has been Malaysia's dominant online banking payment method for e-commerce since the mid-2000s. The mechanism is straightforward: customer selects their bank at checkout, authenticates via the bank's online banking platform, and the funds push directly to the merchant. FPX is not a real-time rail in the BI-FAST or UPI sense — it is a push-payment mechanism with near-real-time fund movement and a well-established dispute process.

FPX remains important for several reasons. It supports higher transaction values than DuitNow's standard retail limits. It is deeply embedded in enterprise and government payment flows. And consumer familiarity with FPX is extremely high — it has been the de facto alternative to card checkout for two decades. Operators should not decommission FPX support simply because DuitNow DOBW exists; the two serve overlapping but not identical use cases and consumer preferences vary.

E-Wallet Landscape

Touch 'n Go eWallet, ShopeePay, GrabPay, MAE and BigPay are distinct products. Do not infer their ownership, funds-holding model or DuitNow capability from a generic wallet label. Check the contracting entity's current BNM scope and the product terms.

A wallet may provide stored value, bank-linked funding or other services under different arrangements. Ask where the customer and merchant balances sit, which provider initiates the payment and how the merchant receives funds. Consumer app features do not establish the merchant's payout or refund service.

Card Market

Malaysia's card market is the most developed in Southeast Asia after Singapore. Card penetration reflects a broad middle class with high banking inclusion. Visa and Mastercard hold dominant share. CIMB, Maybank, Public Bank, and RHB are the major card issuers. Contactless NFC is widely deployed at POS and consumer adoption is strong — tapping is the default behaviour at most physical merchants.

3DS2 is well-deployed by Malaysian issuers. Card-not-present authentication is mature, and approval rates on properly authenticated transactions are high. Installment plans via credit card are common for electronics, furniture, and travel — 0% for 6, 12, or 24 months is a standard issuer offering that operators in those categories should surface at checkout.

Card acceptance costs are among the more competitive in SEA, reflecting a more developed acquiring market than Indonesia or the Philippines.

BNPL

Malaysia's BNPL market reached USD 1.84B in 2026, forecast to reach USD 4.55B by 2031. As of H1 2025, SPayLater (Shopee/Sea) commands 56.5% of active user share, followed by Atome at 26.5% and Grab PayLater at 8.3% — a heavily consolidated market with 6.5M active account holders. Average transaction values are below RM 100, indicating high-frequency, low-ticket usage across e-commerce and lifestyle categories.

Malaysia's Consumer Credit Bill passed the Dewan Rakyat in July 2025 and is now in force as the Consumer Credit Act 2025 (Act 873), effective 1 March 2026, with the Consumer Credit Commission established under it. Licensing and registration for credit providers including BNPL operators became mandatory from 1 June 2026, with a transition window for existing operators running to around the end of 2026 — so operators are inside that window now rather than waiting for a timeline. Merchant discount rates are in line with regional norms at 3–6%. For operators targeting Malaysian consumers, SPayLater integration is effectively mandatory given its market dominance; Atome covers the non-Shopee retail footprint. The incoming licensing regime will require BNPL partners to hold valid Consumer Credit Act licences once enforcement is activated — operators should confirm partner compliance status before launch.

Crypto and Digital Assets

The Securities Commission Malaysia (SC) classifies crypto assets as securities and regulates them under the Capital Markets and Services Act. Licensed exchanges include Luno, Tokenize, and MX Global — all restricted to investment and trading activities. Crypto adoption in Malaysia is primarily investment-driven; it is not a mainstream retail payment rail, and crypto payments at POS are uncommon across merchant categories.

Operators should not build crypto payment acceptance into Malaysia deployments. There is no active stablecoin framework or CBDC pilot relevant to merchant payments as of mid-2026. The SC's securities classification means any crypto payment integration would require engagement with a licensed intermediary and carries regulatory complexity disproportionate to current consumer demand. Monitor for any SC guidance on payment-specific use cases, but no integration action is warranted at this stage.

Regulatory Environment

Malaysia's Financial Services Act 2013 and Islamic Financial Services Act 2013 are relevant to its financial-services framework; do not confuse them with Singapore's Payment Services Act. The permission required depends on the actual payment-system, acquiring, e-money or other activity.

Before choosing an entity or integration, obtain the counterparty's exact legal name, register/approval record, permitted product and funds-flow responsibilities. No blanket 100% foreign-ownership entitlement or standard 9–15-month licensing duration is established here.

Compare two proposals without confusing the rail and the product

For a hypothetical MYR invoice, ask each provider to show the customer initiation, authenticated confirmation, merchant account credit and payout. A DuitNow QR logo indicates a payment method; it does not specify the provider's merchant fee, refund handling or payout schedule. Compare those fields and the same transaction profile before selecting an integration.

Fraud Landscape

Malaysia's fraud rates are moderate within SEA — better than the Philippines or Vietnam, comparable to Thailand. The dominant threat is not card fraud but Macau scam variants: phone scammers impersonating police, tax officials, or courier companies coerce victims into transferring money via DuitNow or bank transfer. Absolute scam loss volumes have risen despite relatively stable fraud rates, reflecting the growing digital transaction base.

Mule account networks are a secondary issue — money laundering through recruited account holders is an active enforcement focus for BNM and PDRM (Royal Malaysian Police). Banks have introduced enhanced monitoring on new accounts receiving large inbound transfers.

BNM and commercial banks are transitioning from SMS OTP to Secure2u (app-based transaction signing) as the primary authentication method, which should reduce OTP interception fraud over time.

Practical Notes for Operators

PSPs. iPay88 and Revenue Monster are strong domestic options with broad local payment method coverage. 2C2P has solid Malaysia infrastructure within its regional stack. Curlec (now part of Razorpay) specialises in direct debit and recurring billing — important for subscription businesses. Stripe Malaysia is available with good developer experience. Adyen supports Malaysia for enterprise merchants.

Settlement: distinguish the customer's payment confirmation, the merchant's available provider balance and external bank payout. Request the schedule, cutoffs, charges and exception handling for the contracted card, FPX or DuitNow product.

Tax. Sales and Service Tax (SST) at 8% applies to digital services. Foreign digital service providers generating above MYR 500,000 in annual B2C revenue from Malaysian customers must register for SST.

Entity: identify whether the business is a merchant or itself providing regulated payment services. Confirm the actual authorisation and ownership conditions with BNM and counsel; a provider partnership does not automatically authorise every activity.

Language. Bahasa Malaysia localisation is expected for consumer-facing products. English is broadly accepted in B2B, corporate, and developer contexts — Malaysia has higher English proficiency than most SEA markets.