Malaysia's digital payments market is expanding at a pace that few anticipated even three years ago. According to Bank Negara Malaysia's Annual Report 2025, e-payment transactions in Malaysia reached 18.4 billion in 2025 — a 25% increase from 14.7 billion in 2024 — growing at a compound annual rate of 17% since 2022 and consistently outpacing the Financial Sector Blueprint 2022–2026 target of 15% annual per capita growth. The average Malaysian made 538 e-payment transactions during the year, up from 432 in 2024. In value terms, retail e-payment transactions reached RM 831 billion, a 19% year-on-year increase. DuitNow QR transaction volume alone doubled to 3 billion in 2025, supported by nearly 3 million registered touchpoints nationwide.
This trajectory has made Bank Negara Malaysia (BNM) merchant acquiring registration one of the most commercially significant payment licenses in Southeast Asia. For fintech companies, payment processors, and international payment groups looking to participate directly in Malaysia's merchant payment infrastructure, the BNM merchant acquiring registration — governed by Section 17 of the Financial Services Act 2013 (FSA) — is the required authorization. This article covers who currently holds that registration, what the regulatory framework requires, and what has changed in the 2024–2026 period.
The Regulatory Framework: Financial Services Act 2013 and BNM's Policy Document
Merchant acquiring in Malaysia is regulated at two levels. The statutory foundation is Section 17 of the FSA 2013, which requires any person intending to provide merchant acquiring services to be registered with BNM before commencing operations. Merchant acquiring services are defined as enabling merchants to accept payment instruments — cards, QR codes, online payments — for the sale of goods or services, and ensuring the settlement of funds from buyers to merchants in a timely manner.
The operational detail sits in BNM's Policy Document on Merchant Acquiring Services, issued in September 2021 and effective from March 2022 for bank acquirers and September 2023 for non-bank acquirers (specifically the minimum capital funds provisions under paragraph 9). The Policy Document covers: governance and board oversight responsibilities; operational risk management including settlement risk, financial risk, fraud risk, and technology and cyber risk; IT security requirements; merchant onboarding due diligence standards; and minimum capital requirements for non-bank acquirers.
In April 2025, BNM issued a new Policy Document on Transfers of Business with updated FAQs that clarified that the transfer of a licensed person's merchant acquiring business — even where that acquiring business is not the primary licensed activity — falls within the scope of BNM's transfer of business framework. This is a relevant consideration for groups looking to acquire or restructure existing registered acquirer entities in Malaysia.
Who Is Currently Registered: BNM's Merchant Acquirer List
BNM publishes its list of registered merchant acquirers on its official regulatees page. As of the most recent published list, registered non-bank merchant acquirers in Malaysia include a diverse cross-section of global and regional payment players:
- Global payment networks and processors: Stripe Payments Malaysia Sdn. Bhd., FIS Worldpay (Malaysia) Sdn. Bhd., Global Payments Card Processing Malaysia Sdn. Bhd., First Data Merchant Solutions (Malaysia) Sdn. Bhd., Omise Payment Malaysia Sdn. Bhd.
- Regional and local acquirers: GHL Cardpay Sdn. Bhd., GHL ePayments Sdn. Bhd., ManagePay Services Sdn. Bhd., MobilityOne Sdn. Bhd., Revenue Monster Sdn. Bhd., Revenue Harvest Sdn. Bhd., Revenue Solution Sdn. Bhd., Interbase Resources Sdn. Bhd.
- E-wallet and digital payment operators: TNG Digital Sdn. Bhd. (Touch 'n Go), ShopeePay Malaysia Sdn. Bhd., Gkash Sdn. Bhd., GPay Network (M) Sdn. Bhd., KiplePay Sdn. Bhd., Presto Pay Sdn. Bhd.
- Cross-border and specialist acquirers: Ksher Malaysia Sdn. Bhd., Sinopay (Malaysia) Sdn. Bhd., Merchantrade Asia Sdn. Bhd., Nomu Pay Malaysia Sdn. Bhd. (formerly Wirecard Payment Solutions Malaysia), OxPay (M) Sdn. Bhd. (formerly MC Payment (M) Sdn. Bhd.)
- Gateway and infrastructure providers: Razer Merchant Services Sdn. Bhd. (formerly MOLPay), I-Serve Payment Gateway Sdn. Bhd., Simplepay Gateway Sdn. Bhd., Mobi Asia Sdn. Bhd., Mobiedge E-Commerce Sdn. Bhd.
- Telecoms and mobility: U Mobile Sdn. Bhd.
Bank acquirers (Maybank, CIMB, Public Bank, RHB, Hong Leong, and others) are separately listed under BNM's licensed financial institutions register and operate under the full bank licensing framework rather than the standalone merchant acquiring registration.
The breadth of the current registered acquirer base reflects the maturity of Malaysia's payment ecosystem. Notable is the presence of Stripe Payments Malaysia Sdn. Bhd. and FIS Worldpay (Malaysia) Sdn. Bhd.— global tier-1 processors that chose Malaysia as their Southeast Asian point of registration — alongside homegrown operators like GHL (one of the largest POS terminal deployers in ASEAN) and Razer Merchant Services, which rebranded from MOLPay after acquisition by Razer's fintech arm.
What the Merchant Acquiring Registration Authorizes
A BNM merchant acquiring registration authorizes the holder to provide merchant acquiring services in Malaysia, which includes: enabling retailers and merchants to accept payment instruments (debit and credit cards, QR codes, online banking, e-money, contactless); establishing payment infrastructure such as point-of-sale terminals and payment gateways; and handling the settlement of funds between buyers and merchants. The registration does not authorize the issuance of payment instruments (cards, e-money) — that requires a separate BNM approval under Section 11 of the FSA — nor does it authorize operation of a payment system under Section 11.
This scoping distinction matters in practice. A payment gateway company that routes transactions but does not hold the settlement relationship with merchants may fall outside the definition and not require registration. A company that directly contracts with merchants, holds settlement funds, and is responsible for disbursing proceeds to merchants is almost certainly within scope. BNM recommends that prospective applicants assess their business model carefully before submission and contact BNMLINK for clarification if needed.
2025–2026 Context: Why Malaysia Now
The commercial case for BNM merchant acquiring registration has strengthened significantly in the 2024–2026 period, driven by four concurrent trends:
DuitNow QR dominance
DuitNow QR has become the dominant retail payment rail with 3 billion transactions in 2025 — double the 2024 figure — and nearly 3 million registered merchant touchpoints. Curlec by Razorpay became the first new PayNet member since 2019 after gaining merchant acquiring registration.
Cross-border payment linkages
Malaysia–Cambodia Phase 2 went live in 2025. Malaysia is also a participant in Project Nexus — the BIS Innovation Hub initiative connecting instant payment systems across Malaysia, Singapore, Thailand, India, and the Philippines.
RENTAS+ upgrade
In 2025, Malaysia launched RENTAS+, an upgraded core settlement platform providing near real-time processing on a 24/7 basis. This materially improves settlement certainty and reduces overnight settlement risk for high-volume acquirers.
ISO 20022 adoption
Malaysia became the first country to fully adopt the ISO 20022 messaging standard for cross-border payments, completing the transition ahead of the global SWIFT deadline. This positions Malaysian-registered acquirers for more complex payment flows.
Application Requirements and Process
The BNM merchant acquiring registration application is submitted to Bank Negara Malaysia using the prescribed application form. Key requirements include:
- Incorporation in Malaysia — the applicant must be a Malaysian-incorporated entity. Foreign groups typically incorporate a Malaysian subsidiary for this purpose.
- Fit and proper assessment — all directors and senior management must meet BNM's fit and proper criteria, including relevant expertise, clean financial history, and absence of regulatory or criminal sanctions.
- Business plan — a credible, detailed business plan covering the acquiring model, target merchants, payment instruments supported, settlement arrangements, risk management framework, and projected transaction volumes.
- Governance and risk framework documentation — board composition and oversight structure, operational risk management policies, IT security framework, fraud prevention measures, and merchant onboarding due diligence procedures.
- Minimum capital — non-bank acquirers must meet the minimum capital funds requirement in paragraph 9 of the Policy Document, which came into full effect on 15 September 2023.
- IT and cybersecurity readiness — BNM assesses the applicant's technology infrastructure and cybersecurity posture as part of the review. Given BNM's April 2025 MOU with the Bank of Thailand on cybersecurity cooperation and the launch of the National Fraud Portal, cyber risk governance is an area of active regulatory focus.
BNM does not publish a fixed processing timeline. In practice, well-prepared applications with complete documentation typically take several months. Incomplete applications or those with inadequate risk framework documentation are the primary driver of delays and resubmissions.
Malaysia as ASEAN Payment Hub: The Licensing Strategy Dimension
For international payment groups building Southeast Asian presence, BNM merchant acquiring registration is typically one component of a multi-jurisdiction payment licensing strategy. Malaysia's Labuan financial centre — where Zitadelle AG maintains its administrative office — offers a complementary suite of financial services licenses including the Labuan Money Broking License and the Labuan Digital Bank framework, which together with BNM registration can form the basis of a full Malaysian financial services platform. The Malaysia foreign investor licensing landscape has continued to attract significant inbound interest from European, Indian, and Chinese payment groups targeting ASEAN growth.
Beyond Malaysia, payment groups operating across the region frequently add complementary licenses in Mauritius for African and Indian Ocean market access, or VASP registrations in jurisdictions such as Costa Rica and Panama for crypto payment integration. Zitadelle AG advises on multi-jurisdiction payment licensing strategies and manages the full application process across all relevant jurisdictions.
Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. BNM registration requirements, capital obligations, and policy documents are subject to change. Verify current requirements directly with Bank Negara Malaysia at bnm.gov.my before making any filing decisions. The registered merchant acquirer list reflects publicly available BNM data and may not reflect the most current registration status of all entities. Last updated: April 2026.
Frequently Asked Questions
Merchant acquiring services in Malaysia are governed by Section 17 of the Financial Services Act 2013 (FSA). Any person intending to provide merchant acquiring services must be registered with Bank Negara Malaysia (BNM) before commencing operations. BNM's Policy Document on Merchant Acquiring Services (issued September 2021) sets out the detailed governance, operational risk, and IT requirements for registered acquirers.