Consumer Credit Act 2025 Explained
- C.A.(M)
- 9 hours ago
- 9 min read
Consumer Credit Act 2025 Explained
The Consumer Credit Act 2025 (CCA), which came into force in Malaysia on March 1, 2026, establishes a comprehensive regulatory framework for the consumer credit industry. It aims to ensure fair, transparent, and responsible lending practices by bringing previously unregulated credit providers—such as Buy Now Pay Later (BNPL) platforms, leasing firms, factoring companies, and debt collection agencies—under federal oversight.
Key Regulatory Features
The Consumer Credit Commission (SKP): Established under the Act as the statutory regulatory and supervisory body, the Suruhanjaya Kredit Pengguna (SKP) is the competent authority responsible for overseeing non-bank credit providers. It replaced the interim "CCOB Task Force."
Scope of Regulation: The Act applies to both conventional and Islamic credit businesses. It introduces a licensing and registration regime for entities carrying out activities like moneylending, pawnbroking, hire purchase, leasing, factoring, and credit-related services (e.g., debt counselling, debt collection).
Regulatory & Supervisory Authorities (RSAs): The framework operates through a system of RSAs, including the Central Bank of Malaysia (BNM), the Securities Commission Malaysia (SC), the Ministry of Domestic Trade and Cost of Living (KPDN), the Ministry of Housing and Local Government (KPKT), and the Malaysia Co-operative Societies Commission (SKM).
Consumer Protections: The Act mandates high standards of business conduct. Credit providers are required to clearly disclose the total cost of borrowing, interest rates, payment schedules, and late charges to ensure consumers can make informed decisions. It also sets out fit-and-proper requirements for those managing these businesses.
Implementation Status
Licensing: Licensing requirements for the affected industries took effect on June 1, 2026.
Operations: The SKP has begun issuing standards to regulate specific activities, including BNPL and other consumer credit sectors, to ensure the industry develops in a sustainable and professional manner.
Complaints: The Commission is developing a one-stop Complaints Management System (CMS) to provide a centralized platform for consumers to lodge grievances against credit providers, ensuring interoperability with providers' internal handling systems.
Licensing and Registration Regime
Under the Consumer Credit Act (CCA) framework, the licensing and registration regime is structured to professionalize the non-bank credit industry by ensuring that all entities providing credit-related services operate under standardized, enforceable conduct requirements.
Licensing vs. Registration
The regulatory approach distinguishes between activities that require a License and those that require Registration based on the nature and risk profile of the business:
Licensing Regime: Entities involved in high-risk or core credit-granting activities are required to hold a license from the Suruhanjaya Kredit Pengguna (SKP). This includes:
Core Credit Providers: Such as BNPL operators, leasing and factoring companies, and hire-purchase providers.
Traditional Credit Providers: Moneylenders and pawnbrokers.
Requirement: Licensees are subject to strict financial adequacy requirements, fit-and-proper assessments of key personnel, and comprehensive annual reporting.
Registration Regime: This applies to service providers that facilitate credit but may not be the primary lenders themselves, such as:
Debt Collection Agencies: Agencies acting on behalf of creditors.
Debt Counselling Services: Firms providing guidance and restructuring advice to consumers.
Requirement: Registered entities must adhere to codes of conduct that emphasize fair treatment, professional data management, and the avoidance of coercive collection tactics.
Key Compliance Requirements
For entities operating in Malaysia, moving into compliance involves several mandatory milestones:
Fit and Proper Criteria: Directors, chief executives, and senior management must satisfy rigorous integrity and competency tests. The SKP evaluates the applicant's record to ensure that individuals running these firms are not associated with previous financial misconduct.
Conduct of Business Standards: All entities—whether licensed or registered—must implement policies that ensure transparency. This includes:
Clear Disclosure: Providing consumers with standardized "Fact Sheets" that outline the Total Cost of Credit (TCC) in a uniform format.
Responsible Lending/Provision: Evaluating a consumer’s ability to pay before extending credit or providing services.
Governance & Internal Controls: Firms are required to have robust internal systems for:
Data Protection: Handling consumer financial information in compliance with the Personal Data Protection Act (PDPA).
Complaints Handling: Establishing an internal dispute resolution mechanism that is capable of escalating unresolved issues to the SKP’s centralized system.
Operational Reporting: Licensees must provide regular statutory returns to the SKP. These reports allow the Commission to monitor industry-wide credit growth, systemic risks, and the effectiveness of current credit policies.
Regulatory & Supervisory Oversight
The oversight is split among several Regulatory and Supervisory Authorities (RSAs), ensuring that even if a business is overseen by a specific ministry (such as KPKT for moneylenders), they are still bound by the overarching standards set by the SKP. This multi-agency approach prevents "regulatory arbitrage," where firms previously sought to operate under less stringent jurisdictions.
If you are evaluating how this affects specific business structures—such as your operations in the region—the focus for your team would be verifying which of your specific client activities fall under the "License" category versus the "Registration" category to ensure that internal audit frameworks are aligned with the relevant reporting obligations.
Licensing Requirements
Under the Consumer Credit Act 2025 (CCA), which became effective on March 1, 2026, the licensing and registration requirements are managed by the Consumer Credit Commission (SKP). These requirements took effect on June 1, 2026, with a six-month transition period for industry players to apply for authorization via the CORE (Consumer Credit Commission Online Regulatory System) platform.
1. The Authorisation Hierarchy
The CCA differentiates between two types of entities, which determines whether you need a License or Registration:
Entity Type | Required Action | Examples |
Credit Business Providers | License | BNPL schemes, leasing, factoring (including Islamic equivalents). |
Credit Service Providers | Registration | Debt collection agencies, impaired loan/financing acquisition, debt counselling and management. |
Note: Entities providing Islamic financing facilities or Islamic pawnbroking must obtain a license from the Registrar of Islamic credit providers.
2. Eligibility & Financial Thresholds
To be granted a license or registration, entities must be incorporated in Malaysia under the Companies Act 2016 and meet specific financial and organizational criteria:
Financial Requirements:
Credit Businesses: Minimum shareholders' funds/total equity of RM 2 million.
Credit Service Businesses: Minimum of RM 500,000 (or RM 250,000 if accompanied by RM 250,000 in professional indemnity insurance).
Organizational Competence: Applicants must demonstrate sound business management, adequate internal controls, and "fitness and propriety" of all key personnel (controllers, directors, and senior management).
Approval Process: Applications must be submitted via the CORE System, with a processing fee of RM 2,000 per business type.
3. Key Compliance Obligations
Once authorized, entities are subject to ongoing regulatory oversight:
Data Submission: Periodic filings are mandatory, including annual audited financial statements, quarterly operational data, and monthly complaints data.
Approval for Major Changes: Prior written approval from the SKP is required for:
Changes in control (defined as holding 33% or more of voting shares).
Appointment of a Chief Executive.
Addition of new business types.
Business Conduct: All entities must adhere to strict transparency standards, including:
Clear disclosure of the Total Cost of Credit (TCC) and Effective Interest Rates.
Mandatory affordability assessments before granting credit.
Use of the "reducing balance method" for interest calculations.
4. Important Clarifications
"Credit Consumer" Scope: The authorization process applies only if your business involves a "credit consumer." A credit consumer is defined as an individual (personal/household purposes) or a Micro or Small Enterprise (MSE) obtaining credit not exceeding RM 300,000.
Non-Involvement Declaration: If your firm carries on a regulated activity but does not deal with "credit consumers" (e.g., you only serve medium/large enterprises or MSEs with facilities exceeding RM 300,000), you are not required to hold a license/registration. However, you are still obligated to submit an annual declaration to the SKP confirming your non-involvement with credit consumers.
Fees: Inaugural fees are RM 8,000 for a license and RM 5,000 for registration (with a 50% discount if approved in the second half of the calendar year). Annual fees are tiered based on your company's revenue.
Fees
To navigate the Consumer Credit Act (CCA) 2025 authorization process effectively, it is essential to distinguish between the statutory costs payable to the government and the professional fees for advisory services to ensure your firm meets the new regulatory standards.
1. Mandatory Statutory Fees (Consumer Credit Commission - SKP)
These fees are fixed by the Consumer Credit (Fees) Regulations 2026. They are non-negotiable and must be paid to the Commission via the CORE System.
Fee Category | License (Credit Business) | Registration (Credit Service) |
Application (Processing) Fee | RM 2,000 | RM 2,000 |
Inaugural Authorization Fee | RM 8,000 | RM 5,000 |
Annual Fee (Tiered) | RM 8,000 – RM 100,000 | RM 5,000 – RM 50,000 |
Pro-Tip: If your authorization is granted in the second half of the calendar year (July 1st or later), the inaugural authorization fee is reduced by 50%.
Penalty: Late payment of annual fees attracts a penalty of RM 500 per month.
2. Proposed Professional Advisory Fees (Bestar Malaysia)
Our professional fee structure is tailored to your business's complexity. We do not use "one-size-fits-all" pricing; instead, we provide a fixed-fee proposal following a formal diagnostic of your operational architecture.
Based on industry standards for corporate compliance and advisory in Malaysia, our proposed engagement structure includes:
Phase A: Regulatory Diagnostic & Gap Analysis
Objective: Confirm if your credit activities fall under the definition of "credit consumer" (MSE/Personal) and identify the specific license/registration category.
Fee: RM 3,000 – RM 5,000 (Applied as a credit toward the full project fee if you proceed).
Phase B: Authorization Project (CORE Submission)
Scope: Preparation of the CORE system application, drafting of policy manuals (Conduct of Business, Internal Audit, AML/CFT for credit providers), and "Fit and Proper" assessment preparation for your key controllers.
Fee: RM 15,000 – RM 35,000+
Complexity factors: Number of business lines (e.g., BNPL + Factoring), existing internal control maturity, and the number of key personnel requiring "Fit & Proper" vetting.
Phase C: Ongoing Compliance Retainer (Annual)
Scope: Managing periodic SKP data submissions, quarterly reporting, and internal audits to ensure continued adherence to the Conduct Standard.
Fee: RM 12,000 – RM 24,000 annually (Billed quarterly).
Why Bestar?
When you engage Bestar, you are securing more than just a filing agent; you are securing an operational infrastructure partner. Our fees cover:
Direct CORE Liaison: Handling technical submissions and clarifications with SKP officers.
Audit-Ready Documentation: Since Bestar operates with an audit-first mindset, your documentation is built to survive regulatory scrutiny on day one.
Governance Integration: We ensure your Malaysian compliance is synchronized with your regional operations (Singapore/Hong Kong/South Korea) to prevent costly duplication of effort.
Next Steps
Would you like to initiate a Regulatory Diagnostic this week to confirm your firm’s specific licensing category? This will allow us to provide a binding fixed-fee proposal for your board's approval. Please let us know your preferred time for a scoping call with our Lead Consultant.
Navigating the Consumer Credit Act: How Bestar Malaysia Simplifies Your Licensing Journey
Consumer Credit Act 2025 Explained
The enactment of the Consumer Credit Act 2025 (CCA) marks a fundamental shift in Malaysia’s financial landscape. Effective March 1, 2026, and with licensing/registration requirements mandatory as of June 1, 2026, the industry is moving from a fragmented regulatory environment to a unified, high-governance framework under the Consumer Credit Commission (SKP).
If your firm operates in credit-related sectors, the "transition period" is now in full swing. Bestar Malaysia provides the end-to-end strategic guidance required to secure your authorization, align with SKP standards, and maintain operational continuity.
Understanding Your Obligations Under the CCA
The SKP has moved beyond "business as usual." Whether you are a credit provider or a credit service provider, compliance is no longer optional—it is a prerequisite for market participation.
1. Are You Required to License or Register?
The CCA uses a "substance-over-form" approach. If your activities involve "credit consumers" (individuals or micro/small enterprises), you fall under the SKP’s mandate:
Licensing (Credit Business): Required for Buy Now Pay Later (BNPL) schemes, leasing, and factoring companies (including Islamic equivalents).
Registration (Credit Service Business): Required for debt collection agencies, debt counselling, and impaired loan/financing acquisition services.
Crucial Note: If you operate in these sectors but do not deal with credit consumers, you are still required to submit an annual declaration of non-involvement to the SKP.
2. The Compliance Pillars
Securing authorization via the CORE (Consumer Credit Commission Online Regulatory System) requires more than just an application. Bestar assists you in meeting the three critical pillars:
Financial Integrity: Meeting minimum shareholders' funds (RM 2 million for credit businesses; RM 500k for service businesses).
Organizational Competence: Demonstrating sound business management, robust internal controls, and "fit and proper" assessments for your directors, controllers, and senior management.
Operational Transparency: Establishing systems for clear disclosure of the Total Cost of Credit (TCC) and compliant complaint management.
How Bestar Malaysia Accelerates Your Compliance
At Bestar, we don’t just fill out forms—we build the infrastructure that keeps you compliant, efficient, and audit-ready.
Our Integrated Service Suite:
Authorization Strategy & CORE Filing: We navigate the CORE system for you, ensuring your application for a license or registration is accurate, timely, and aligned with SKP’s Authorisation Standards.
"Fit and Proper" Preparation: We conduct pre-application assessments of your key personnel, ensuring your leadership team meets the regulatory threshold for probity, integrity, and competence.
Regulatory Architecture: We help you overhaul your internal governance to satisfy ongoing SKP mandates, including periodic data submissions, Shariah governance (for Islamic providers), and robust complaint handling.
Corporate Restructuring: For entities needing to separate Islamic and conventional funds or adjust their shareholding structures to meet regulatory requirements, our M&A and corporate secretarial teams provide precision legal and financial support.
Why Bestar?
In the "Asian Growth Triangle," Bestar is the partner of choice for firms demanding excellence. Our approach is built on three differentiators:
Unified Authority: We consolidate your corporate secretarial, tax, and compliance needs, eliminating the communication gaps found when working with multiple specialized vendors.
Audit-Ready Precision: Our audit heritage means we understand the evidence required by regulators. We prepare your documentation so that when the SKP audits your files, your business stands on solid ground.
Regional Synergy: Leveraging our presence in Singapore, Malaysia, Hong Kong, South Korea, Vietnam, and UAE, we help you manage cross-border compliance, ensuring your Malaysian entity’s operations remain synchronized with your wider regional strategy.
Secure Your License. Protect Your Future.
Don't wait until the transition period closes. The regulatory environment in 2026 demands proactive governance.
Take the first step toward seamless compliance today:
Diagnostic Audit: Let us assess whether your business activities require licensing or registration.
Strategic Roadmap: Get a clear plan for your CORE system submission and internal governance upgrades.
Contact our corporate advisory team:
Email: admin@bestar-asia.com
Regional Hub: Bestar Asia
Direct Support: Reach out for a consultation on your compliance status and regulatory roadmap.
Bestar Malaysia | Bridging Compliance and Growth.
Comments