Malaysia's Digital Payments Market — The Context
Malaysia's digital payments market is expanding at a pace that few anticipated even three years ago. According to Bank Negara Malaysia's Annual Report 2025, e-payment transactions in Malaysia reached 18.4 billion in 2025 — a 25% increase from 14.7 billion in 2024 — growing at a compound annual rate of 17% since 2022 and consistently outpacing the Financial Sector Blueprint 2022–2026 target of 15% annual per capita growth.
The average Malaysian made 538 e-payment transactions during the year, up from 432 in 2024. In value terms, retail e-payment transactions reached MYR 831 billion — a 19% year-on-year increase. DuitNow QR transaction volume alone doubled to 3 billion in 2025, supported by nearly 3 million registered merchant touchpoints nationwide.
This trajectory has made Bank Negara Malaysia (BNM) merchant acquiring registration one of the most commercially significant payment licenses in Southeast Asia — and one of the most actively sought by international payment groups targeting the ASEAN growth corridor.
What Is the BNM Merchant Acquiring Registration?
A Merchant Acquiring License authorizes an institution to:
- Enable retailers and merchants to accept payment instruments — cards (Visa, Mastercard, UnionPay, JCB), QR codes (DuitNow, FPX), online payments, and digital wallets.
- Establish payment infrastructure — point-of-sale terminals, payment gateways, and virtual terminals.
- Handle the settlement of funds between the buyer and the merchant.
This registration is governed under the Financial Services Act 2013 (FSA)and is subject to supervision by Bank Negara Malaysia (BNM). BNM is Malaysia's central bank and the country's primary financial regulator. This is entirely separate from MAS (the Monetary Authority of Singapore) — which regulates Singapore's financial sector, not Malaysia's.
BNM's merchant acquiring framework is part of its broader Payment Systems Act 2003 and Financial Services Act 2013 supervisory architecture, under which BNM maintains oversight of all payment services infrastructure in Malaysia.
Who Is Already Licensed?
BNM's registered merchant acquirer list includes internationally recognized names that demonstrate the commercial significance of the Malaysian market:
- Stripe— obtained BNM registration as part of its deliberate Southeast Asian infrastructure expansion, recognizing Malaysia's scale and DuitNow integration importance.
- ShopeePay— the payments arm of Sea Group, one of Southeast Asia's largest technology companies. ShopeePay's BNM registration underpins its e-commerce payment infrastructure across Malaysia.
- TNG Digital (Touch 'n Go)— Malaysia's dominant e-wallet and highway payments operator, licensed by BNM as both an e-money issuer and merchant acquirer.
- Razer Merchant Services — the payments arm of Razer Inc., providing payment gateway and acquiring services to Malaysian and regional merchants.
- Domestic bank acquirers — Maybank, CIMB, Public Bank, RHB Bank, and other Malaysian licensed banks hold merchant acquiring authorization as part of their banking licenses. Combined, the domestic banking sector processes the majority of card-present transactions in Malaysia.
- 40+ registered acquirers in total— BNM's public registered acquirer list covers the full range from global payment groups to regional fintech operators and local payment specialists.
Regulatory Requirements for BNM Merchant Acquiring Registration
Eligible applicants: Both Malaysian-incorporated entities and foreign-controlled companies can apply. BNM assesses each application on its merits — there is no blanket restriction on foreign ownership of registered acquirers.
Fit-and-proper assessment:All directors, senior management, and significant shareholders (those holding 10%+) must satisfy BNM's fit-and-proper criteria — integrity, competence, financial soundness, and absence of regulatory history issues in any jurisdiction.
Capital adequacy: BNM sets minimum capital requirements proportionate to the scope and volume of acquiring activities proposed. High-volume acquirers processing card and QR transactions at scale face higher capital expectations than narrower-scope applicants.
Operational requirements:
- Systems and technology: BNM requires robust payment infrastructure — PCI DSS compliance (or a roadmap to compliance), settlement systems, fraud monitoring, and dispute resolution procedures.
- AML/CFT programme:a comprehensive compliance framework including merchant onboarding KYC, transaction monitoring, and STR reporting to BNM's Financial Intelligence and Enforcement Department.
- Business continuity: a documented BCP covering payment system outages and settlement disruptions.
- DuitNow integration:for QR payment acceptance, integration with BNM's DuitNow infrastructure and PayFlex framework compliance.
Ongoing supervision:BNM's Financial Stability and Payment Systems Department (FSPSD) supervises registered acquirers through periodic reporting, on-site examinations, and regulatory engagement. Annual statistical returns to BNM are mandatory.
Malaysia Merchant Acquiring vs Other ASEAN Payment Registrations
| Feature | Malaysia (BNM) | Singapore (MAS PI/MPI) | Thailand (BOT) | Indonesia (OJK) |
|---|---|---|---|---|
| Regulator | Bank Negara Malaysia | Monetary Authority of Singapore | Bank of Thailand | OJK / Bank Indonesia |
| Framework | Financial Services Act 2013 | Payment Services Act 2019 | Payment Systems Act | PBI Regulation |
| Market size | 18.4B transactions 2025 | High-value, smaller population | Growing rapidly | Largest ASEAN market |
| QR rail | DuitNow QR (3B transactions 2025) | PayNow | PromptPay | QRIS |
| Foreign applicant access | Yes | Yes (PI/MPI license) | Restricted | Complex |
| Capital requirement | Proportionate | SGD $250K (MPI) | Variable | Variable |
| Timeline | 3–6 months | 9–12 months (MPI) | 6–12 months | 12–18 months |
| Labuan complement | Yes — via Zitadelle AG | Separate | Separate | Separate |
| Best for | Malaysia + ASEAN gateway | Singapore-first, high-value | Thailand domestic | Indonesian market |
Note:MAS is Singapore's regulator. For Malaysia, the regulator is BNM. These are frequently confused — make sure any application, correspondence, or advisory engagement correctly identifies BNM for Malaysia and MAS for Singapore.
Multi-Jurisdiction Malaysian Payment Strategy
For international payment groups building Southeast Asian presence, BNM merchant acquiring registration is typically one component of a multi-jurisdiction payment licensing strategy. Malaysia's Labuan financial centre — where Zitadelle AG maintains its administration office — offers complementary financial services licenses including the Labuan Payment System Operator License and the Labuan Money Broking License, which together with BNM merchant acquiring registration can form the basis of a full Malaysian financial services platform:
- BNM merchant acquiring registration: onshore Malaysian merchant payments, DuitNow QR, and card acquiring for domestic Malaysian merchants.
- Labuan Payment System Operator License: offshore e-money issuance, cross-border remittance, and payment gateway operations for international (non-MYR) clients.
- Labuan Money Broking License: forex and digital asset operations for international clients.
Beyond Malaysia, payment groups operating across the region frequently add complementary licenses in Mauritius (FSC PIS) for African and Indian Ocean market access, or VASP structures in Costa Rica or Panama for crypto payment integration.
How Zitadelle AG Assists
Zitadelle AG advises on BNM merchant acquiring registration as part of our Malaysia financial services practice, operating from our F.T. Labuan office with established relationships across Malaysia's financial regulatory ecosystem.
Our service includes:
- Pre-application assessment — BNM eligibility review, business model analysis, and capital adequacy planning.
- Application package preparation — all required documentation including business plan, AML/CFT programme, technology infrastructure description, and fit-and-proper submissions for all key persons.
- BNM correspondence management — all regulatory queries handled and follow-up submissions coordinated.
- AML/CFT compliance framework — BNM-standard merchant onboarding KYC, transaction monitoring policy, and STR reporting procedures.
- DuitNow/PayFlex integration advisory — technical requirements for QR payment infrastructure.
- Ongoing compliance support — annual BNM statistical returns, supervisory engagement preparation, and regulatory change monitoring.
Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. BNM requirements are subject to change. Always consult qualified Malaysian legal counsel before making any payment licensing decisions. Last updated: July 2026.
Frequently Asked Questions
The merchant acquiring license in Malaysia is issued by Bank Negara Malaysia (BNM) — the country's central bank and primary financial regulator — under the Financial Services Act 2013. It authorizes institutions to enable merchants to accept payment instruments (cards, QR codes, online payments), establish payment infrastructure (point-of-sale terminals, payment gateways), and handle settlement of funds between buyers and merchants. It is not issued by MAS — the Monetary Authority of Singapore is a different regulator for a different country. BNM's registered acquirer list includes Stripe, ShopeePay, TNG Digital, Razer Merchant Services, and 40+ others.