A regional director flies into Kuala Lumpur to meet a distributor recommended by a former colleague. The distributor knows the buyers, has sold into the sector for twenty years and asks for a commission a little above what the firm pays elsewhere in the region. A contract is signed within a month, on the group’s standard template, and the distributor is left to get on with it.
Since June 2020 that arrangement has carried a risk most head offices have not priced. Under section 17A of the Malaysian Anti-Corruption Commission Act 2009, if that distributor pays a bribe to win business for the firm, the firm itself has committed an offence. Whether anyone at head office knew is beside the point.
Below we set out what section 17A says, who it reaches, what the official guidance on adequate procedures expects, and what it changes in how an international firm selects, contracts, pays and monitors its partners in Malaysia. This is a practical view, not legal advice, and any firm with exposure should take its own.
What section 17A says
Section 17A was inserted by the MACC (Amendment) Act 2018 and came into force on 1 June 2020. It makes a commercial organisation guilty of an offence if a person associated with it corruptly gives, offers or promises any gratification to anyone, with intent to obtain or retain business, or an advantage in the conduct of business, for the organisation.
The reach is wide. A commercial organisation includes a company incorporated outside Malaysia that carries on business, or part of a business, in Malaysia. A foreign parent selling through a local distributor is squarely within it.
The penalties are set to be noticed. A fine of at least ten times the value of the gratification where it can be valued, or RM1 million, whichever is higher, or imprisonment for up to twenty years, or both. Where the organisation commits the offence, its directors, controllers, officers, partners and anyone concerned in its management are deemed to have committed it too, unless they prove it happened without their consent or connivance and that they exercised due diligence to prevent it.
The organisation has one principal defence. It must prove that it had adequate procedures in place to prevent associated persons from acting in this way. The burden sits with the company, and it is discharged with evidence, not intentions.
Who counts as an associated person
The Act treats a person as associated with the organisation if they are a director, partner or employee of it, or if they perform services for or on its behalf. The test is what the person does, not what the contract calls them.
In practice this catches most of the people an international firm relies on in Malaysia. Agents and introducers. Distributors and resellers who deal with customers for you. Consultants retained to help with a licence, a tender or a ministry relationship. Joint venture partners where they act for the venture. Customs brokers and logistics providers who deal with officials on your goods.
The arrangements that carry the most risk are often the ones a head office knows least about. A success fee paid to a consultant who “knows the ministry”. A distributor discount larger than the market requires. A local partner whose value is described in terms of who they know rather than what they do. Each may be legitimate. Each is what an investigator would ask about first.
Under section 17A the question is no longer whether you knew. It is whether you can show what you did to prevent it.
What the guidelines expect
The Act required the government to issue guidelines on adequate procedures, and the Prime Minister’s Department published them in December 2018. They rest on five principles, known by the acronym T.R.U.S.T. Top-level commitment. Risk assessment. Undertake control measures. Systematic review, monitoring and enforcement. Training and communication.
The guidelines are not a checklist, and they say so. Procedures are expected to be proportionate to the risks the organisation actually faces. A small representative arrangement does not need the compliance apparatus of a listed bank. It does need procedures that respond to the specific risks of its own partners, sector and counterparties, and a group policy translated into Bahasa Malaysia is not that.
Two points in the guidelines matter most to international firms. The first is that due diligence on associated persons is an expected control, not an optional extra. The second is that risk assessment is expected to be repeated, with a comprehensive assessment every three years and further assessments when circumstances change. A partner vetted once in 2021 and not since is a weak position to defend.
How it sits alongside home-country law
Many international firms already have an anti-bribery programme because their home jurisdiction requires one. The UK Bribery Act 2010 contains a corporate offence of failing to prevent bribery, with its own adequate procedures defence. The US Foreign Corrupt Practices Act reaches payments made through third parties where the company knew of, or deliberately ignored, the likelihood of a bribe.
It is tempting to assume that a programme built for London or Washington covers Kuala Lumpur. Often it covers the policy and misses the practice. Section 17A is enforced by the Malaysian Anti-Corruption Commission, against conduct in Malaysia, with evidence gathered here. The question will be what the firm did about this distributor, in this market, at this time. A group policy that has never been applied to the Malaysian partner will not answer it.
The sensible approach is to treat the home programme as the frame and build a Malaysian layer on top, with a local risk assessment and local records.
What changes in practice
The effect of section 17A is to move anti-corruption work out of the compliance function and into the commercial decisions about partners. The changes we would expect to see are the following.
- Selection. Partners are chosen for what they can do. Due diligence asks how they win business, who owns them, whether any owner or close relative holds public office, and which other principals they represent. The answers are written down.
- Contracting. Agreements contain anti-corruption undertakings, a right to audit, a duty to report concerns and a right to terminate if the undertakings are breached. The scope of services is specific enough that each payment can be tied to work.
- Payment. Fees and commissions are set at a level the market supports and the firm can explain. Payments go to the contracting party’s own account, against invoices that describe services. Success fees linked to government decisions get particular scrutiny.
- Monitoring. Someone senior owns each relationship, meets the partner in person, reviews what is being claimed and repeats the due diligence when ownership, scope or pricing changes.
- Training. Partners who act for the firm are told, in writing and in person, what is expected of them and how to raise a concern.
None of this is unusual. What section 17A changes is the consequence of not doing it, and the fact that the burden of showing it was done sits with the firm.
Good procedure is also good judgement
Adequate procedures are often treated as a cost of operating in Malaysia. We see them differently. A partner who cannot explain how they win business, will not accept an audit clause or wants payment routed somewhere unusual is telling you something about the relationship, whatever the law says. The procedures surface that early, before the firm has put its name to the market.
It is also how we work ourselves. We sell know-how, not access. Every client we take on is vetted, every arrangement is written down and every fee is disclosed. That is not a posture adopted for section 17A. It is the only basis on which a partnership in Malaysia holds up when someone starts asking questions about it.
A policy says what a firm intends. Section 17A asks what it did.
Hedgerow Advisory works with international companies building a presence in Malaysia. If you are selecting or reviewing a local partner and would like a second view on how the arrangement is structured, we are happy to have a confidential conversation.