Suspicious Transaction Reports

Suspicious Transaction Reports: What Reporting Institutions, Including Law Firms, Must Know

Banks are not the only businesses that must watch for dirty money. Goldsmiths, real estate agents, accountants and lawyers can also be required to report suspicious transactions. Here is what the law expects of them.

Introduction

When people think about money laundering, they usually picture banks. But criminals also try to clean their money by buying gold and jewellery, purchasing property, setting up companies or channelling funds through a professional’s client account. For this reason, Malaysian law places a group of businesses and professionals in the front line of the fight against financial crime. These are known as “reporting institutions”.

Their most important duty is to report suspicious transactions to Bank Negara Malaysia by filing a suspicious transaction report, or STR. These duties are set out in Part IV of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (Act 613), commonly known as AMLA or AMLATFPUAA 2001, together with the policy documents issued by Bank Negara and the Securities Commission. This article explains, in plain language, who must report, what must be reported, how the reporting process is kept confidential, what protection the law gives to those who report, and the special position of law firms.

Who are “reporting institutions”?

A reporting institution is any person or business that carries on an activity listed in the First Schedule to AMLA, including its branches and subsidiaries outside Malaysia. They fall into two broad groups.

The first group is financial institutions. These include commercial and Islamic banks, investment banks, insurers and takaful operators, money changers and remittance companies, e-money issuers, stockbrokers, fund managers, development financial institutions, moneylenders and credit card issuers.

The second group is non-financial businesses and professions, often called DNFBPs. These include lawyers, accountants, company secretaries, notaries public, registered real estate agents, dealers in precious metals and precious stones such as goldsmiths and jewellers, pawnbrokers, casinos and trust companies. Anyone working in these fields should check whether their business activities fall within the First Schedule.

The list is not fixed. The Minister of Finance may, on Bank Negara’s recommendation, extend the definition of “financial institution” to new types of regulated business as financial services change.

The need to get this right is real. In its 2025 assessment of Malaysia, the Financial Action Task Force (FATF) and the Asia/Pacific Group on Money Laundering found that larger financial institutions generally understand and apply their obligations well. However, the assessors found that smaller reporting institutions and some non-financial businesses and professions still lag behind, particularly in suspicious transaction reporting, and recommended improvements in higher-risk sectors.

The core duties at a glance

Reporting suspicious transactions is only one part of a wider system of duties under Part IV of AMLA. Without proper customer checks and records, suspicious activity cannot be spotted or reconstructed later. The main duties are summarised below. Importantly, most of these offences can be committed not only by the business itself but also by its directors, officers and employees personally.

Main duties of reporting institutions under Part IV of AMLA

What must be reported?

Section 14 requires a reporting institution to report promptly to Bank Negara in two broad situations.

Threshold reports

The first is when a transaction exceeds an amount specified by Bank Negara. The best-known example is the cash threshold report (CTR) for cash transactions of RM25,000 or more in a single day. Bank Negara’s policy document for non-financial businesses makes clear that deposits and withdrawals on the same day are added together and cannot be set off against each other. For example, a RM20,000 cash deposit and a RM10,000 cash withdrawal on the same day must be reported. A threshold report is routine. It is not an accusation, and filing one does not remove the separate duty to file an STR if the transaction is also suspicious.

Suspicious transaction reports

The second situation is where the identity of the person, the transaction itself or any other circumstance gives any officer or employee “reason to suspect” that the transaction involves the proceeds of crime or the tools used to commit an offence. The same duty applies where there is reason to suspect a link to terrorism or to the financing of restricted activities.

Three features of the STR duty are worth stressing. First, there is no minimum amount. A small transaction can be just as suspicious as a large one. Second, the duty covers attempted and proposed transactions, not only completed ones. A customer who walks away when asked for identification may still warrant a report. Third, the report must be made promptly. Bank Negara’s policy document for financial institutions expects an STR to be submitted by the next working day after suspicion is established, and internal reviews should not be used as a reason to delay filing.

What does “reason to suspect” mean?

“Reason to suspect” is a low threshold. It is lower than a reasonable belief, and far lower than proof. A reporting institution does not need to prove that a crime has been committed, or even that it is more likely than not, before filing an STR. The duty arises as soon as the relevant officer or employee has reason to suspect. Working out whether a crime actually took place is the job of the authorities and, ultimately, the courts.

The test combines what the particular employee actually noticed with what a reasonable person in the same position would have suspected. In practice, suspicion should be based on specific facts that the employee can point to, often called “red flags”. Common examples include:

Unusual transactions. Transactions with no clear purpose, a dormant account that suddenly becomes very active, or funds moved in and withdrawn almost immediately.

Large or structured cash. Large cash payments, or many small cash deposits that together add up to a large sum, including deposits into several accounts on the same day.

Mismatch with the customer’s profile. Transactions or investments that do not match the customer’s known income, occupation or business, or funds whose source is unclear.

Unusual account movements. Payments to unrelated third parties, frequent transfers to offshore centres, or a customer allowing money to be moved from their account to someone else’s.

Suspicious behaviour. Customers who are reluctant to prove their identity, who share an address with unrelated customers, or who show unusual concern about secrecy.

High-risk locations. Money coming from or going to jurisdictions known for drug trafficking, secrecy or weak anti-money laundering controls.

Staff behaviour. An employee who always handles the same customer’s transactions or seems unusually close to a particular customer.

Because regulators often look back at decisions with hindsight, institutions should record the facts that gave rise to suspicion, the time suspicion was formed and, just as importantly, the reasons for any decision not to file a report.

How is an STR filed?

Reports go to the Financial Intelligence and Enforcement Department of Bank Negara Malaysia. Under Bank Negara’s policy documents, the institution’s Compliance Officer is responsible for submitting STRs, usually through Bank Negara’s Financial Intelligence System (FINS) portal, or by the specified form where the institution does not yet have access. The Compliance Officer must have independent discretion to decide whether to report, and the reporting process must be kept secure and confidential.

An STR generally describes the person carrying out the transaction, the account holder or recipient, the details of the transaction such as the product and amount involved, why it appears suspicious, and any other information that may help the authorities. Institutions must also provide further information if Bank Negara asks for it, and may update a report or file a new one if fresh suspicion arises.

Behind the reporting duty sits the compliance programme required by section 19. Every reporting institution must have internal policies and controls, procedures to ensure staff integrity, ongoing training, a compliance officer at management level and an independent audit function. Smaller non-financial businesses may adopt simplified measures, but they cannot ignore the core requirements.

Keep it confidential: the rule against tipping-off

An STR is only useful if the person being reported does not find out. If a suspect is alerted, money can be moved, evidence destroyed and investigations ruined. AMLA therefore makes it a serious offence to reveal that a report is being made or has been made.

Under section 14A, anyone who knows or has reason to suspect that a reporting institution is making or has made a report, and discloses this to another person, commits an offence punishable by a fine of up to RM3 million, imprisonment of up to five years, or both. The offence also catches the person who receives such a leak and then records it or passes it on.

There are limited exceptions. Disclosure is permitted when carried out as part of a person’s duties under AMLA, when informing a related Malaysian financial services company of the risks of dealing with a particular customer, when made to the institution’s supervisory authority, or with the written authorisation of Bank Negara.

A separate offence under section 35 covers tipping-off about an investigation. It is an offence to disclose information likely to prejudice an investigation, or a planned investigation, under AMLA.

In practice, front-line staff must never tell a customer, directly or by hint, that a report has been filed. Where a transaction has to be paused, staff should use neutral wording such as “we are carrying out standard reviews”. Knowledge of STRs should be limited to those who genuinely need to know.

Protection for those who report

The law recognises that businesses and their staff may hesitate to report their own customers for fear of being sued or disciplined. It therefore provides strong protection.

Secrecy obligations are overridden. Under section 20, the duties in Part IV apply regardless of any secrecy obligation or restriction on disclosure, whether imposed by law or by contract. Banking secrecy and confidentiality clauses cannot be used as a reason not to report. This override only allows disclosure to the authorities through the channels the Act provides. It is not permission to discuss a case with customers or outsiders.

Immunity from legal action. Under section 24, no civil, criminal or disciplinary proceedings may be brought against a person for disclosing or supplying information in connection with a report, including for the way the disclosure was made or its consequences. The only exception is where the information was disclosed in bad faith. An honest report that turns out to be mistaken remains protected.

A due diligence defence. Section 24 also provides a defence to a person charged with an offence under Part IV if he can show that he took all reasonable steps and exercised all due diligence to avoid committing it. Good policies, training records and audit trails are therefore not just paperwork. They may be a business’s best defence.

The special position of law firms

Lawyers are listed among the non-financial professions covered by AMLA, so law firms carrying on the relevant activities have the same core duties as other reporting institutions. However, their position is more delicate because of the confidential relationship between lawyer and client. Several provisions deserve attention.

Legal professional privilege

Section 20 overrides “secrecy” and restrictions on disclosure, but it does not expressly mention legal professional privilege. Courts usually require clear words before they will treat a statute as removing privilege. There is therefore a respectable argument that genuinely privileged advice and litigation material remain protected, while ordinary transactional information held by a law firm, such as client identity documents and client account ledgers, can be disclosed.

Advice to clients and tipping-off

Section 35 contains an important exception for lawyers. An advocate and solicitor, or his employee, does not commit the tipping-off offence when disclosing information to a client in the course of giving legal advice, or to any person in connection with legal proceedings. This protection disappears, however, if the disclosure is made with a view to furthering an illegal purpose. Advising a client on his rights and obligations is protected. Helping a client move assets or destroy evidence is not.

Examinations and court orders

Under section 26, a Bank Negara examiner may require documents or information from persons connected with a reporting institution, expressly including its advocates and solicitors. A person who complies is protected from liability for breaching confidentiality, although the section does not expressly remove privilege.

Separately, under section 47, a High Court judge may, in an investigation into money laundering, terrorism financing or restricted activity financing, order a lawyer to disclose information available to him about any transaction or dealing relating to property that may be seized under AMLA. The lawyer need not disclose privileged information or communications that came to his knowledge for the purpose of pending proceedings. The protection for ordinary legal advice given outside litigation is less clear, and this remains an open question for the courts.

Practical steps for law firms

Law firms should keep proper customer due diligence files, maintain careful file notes showing that their advice was confined to lawful purposes, separate privileged material from ordinary transactional records, and keep a privilege log so that any order or examiner’s request can be answered without disclosing more than is required. Instructions that suggest a client wants to evade the law or conceal assets should be declined and, where appropriate, reported.

What the courts have said

K Malah a/p Kathirvaloo v Rezzmai Precious Metal Sdn Bhd & Ors [2024] MLJU 1450

K Malah a/p Kathirvaloo v Rezzmai Precious Metal Sdn Bhd & Ors [2024] MLJU 1450 (High Court, Shah Alam, 14 June 2024) shows how customer due diligence can protect a non-financial business.

A woman’s 21-year-old daughter took the family jewellery without permission and handed it to two strangers, believing she was helping a man she had befriended online but never met. The next day, the pair sold the jewellery to a goldsmith company in Selangor for RM64,500. The mother sued the goldsmith and its directors, arguing that they had failed to carry out proper due diligence under AMLA and had wrongfully dealt with her property.

The court rejected the claim. The director who dealt with the sellers had asked for identification, recorded the details and issued an official receipt. The sellers explained that the jewellery belonged to their family and that they needed money because of financial difficulties, and nothing about them appeared unusual. The court held that the goldsmith had carried out sufficient customer due diligence, had no reason to suspect wrongdoing, and was a genuine purchaser in good faith. The real wrongdoers were the daughter, the online contact and the two sellers, who had already been convicted.

The court also considered Bank Negara’s suggested “Notice to Customers”, which dealers in precious metals and stones may display to inform customers that identity checks are required for transactions of RM50,000 and above. Because the policy document says dealers “may” display the notice, the court held that it is optional, and the goldsmith’s failure to display it did not mean it had breached its obligations.

The lessons for reporting institutions are practical. Non-financial businesses such as goldsmiths are reporting institutions with real duties. Sensible identity checks, proper records and a genuine assessment of whether anything seems suspicious can protect a business from liability when it turns out to have been dealing with stolen property. The case also shows the difference between mandatory legal duties and optional administrative tools. It should be noted that the case concerned customer due diligence, and no suspicious transaction report was in issue.

Mohd Ismail bin Syed Merah v Public Prosecutor [2022] 3 MLJ 786

Mohd Ismail bin Syed Merah v Public Prosecutor and other appeals [2022] 3 MLJ 786 (Court of Appeal, 22 March 2022) shows both the kind of pattern that should trigger an STR and why the reporting threshold is so much lower than the standard used in court.

A senior police officer in Batu Pahat, whose monthly salary was between RM6,000 and RM8,000, received regular payments of RM3,000 from illegal gambling operators, left in his letterbox, so that no action would be taken against them. Investigators later found about RM1.27 million in cash, together with Indonesian rupiah, in bags and boxes in his bedroom. He had also paid large sums in cash into takaful and investment plans, including a single payment of nearly RM1 million, and had used a third party’s bank accounts to deal with a further sum of almost RM530,000.

The Court of Appeal upheld his conviction on eight money laundering charges and increased his sentence, imposing a fine of at least RM5 million on each charge. On the law, the court confirmed that the existence of the underlying unlawful activity needs to be proved only on a balance of probabilities, while the money laundering offence itself must still be proved beyond reasonable doubt. The court also held that knowledge could be inferred from the surrounding facts, and that a person who fails without reasonable excuse to take reasonable steps to check where money came from can be caught.

For reporting institutions, the facts read like a checklist of red flags: large cash payments far beyond the customer’s known income, lump-sum investments paid in cash, and the use of another person’s bank accounts. The case also underlines an important point about thresholds. Even in court, the underlying crime only needs to be shown on a balance of probabilities. A reporting institution needs far less. It needs only a reason to suspect, and it is never required to prove anything before filing an STR.

Public Prosecutor v Sim Sai Hoon [2020] MLJU 386

Public Prosecutor v Sim Sai Hoon [2020] MLJU 386 (High Court, Kuala Lumpur, 26 April 2020) was not about STRs, but it illustrates why timing matters.

The respondent had received a cheque for RM1.2 million in December 2012 from an account belonging to a former Prime Minister, which the court accepted contained proceeds of unlawful activity. By July 2016, the respondent’s account was already overdrawn, and it was only frozen in June 2018. The Public Prosecutor applied to forfeit the RM41,261.64 remaining in the account. The court refused. The money received in 2012 had been completely spent long before the account was frozen, so the remaining balance was not the subject matter of the money laundering offence. The money was ordered to be returned.

The lesson drawn in the commentary is that money moves quickly. Once dirty money has been spent or moved, the authorities may be unable to recover it, even where they can show that it was once received. Although the court did not discuss reporting, the case illustrates why the law insists that suspicious transactions be reported promptly, so that the authorities have a chance to act before the funds disappear.

A practical checklist for reporting institutions

Know whether you are covered. Check whether your business activities fall within the First Schedule to AMLA.

Appoint a compliance officer. Make sure a suitably senior person is responsible for AML compliance and for filing STRs.

Know your customers. Identify and verify customers, anyone acting for them and the real owners behind companies, and keep the information up to date.

Set clear red flags. Train staff to recognise suspicious transactions relevant to your business, and to escalate them without delay.

Report promptly. Do not wait for proof or let internal reviews delay a report once suspicion has formed.

Keep it confidential. Limit knowledge of reports to those who need to know, and never tell a customer that a report has been made.

Keep records for at least six years. Records should be complete enough to reconstruct any transaction.

Document your decisions. Record why a report was, or was not, made. This is your evidence of due diligence.

Law firms: protect privilege properly. Separate privileged material from transactional records, keep file notes and privilege logs, and decline instructions that suggest an illegal purpose.

Conclusion

Suspicious transaction reporting is the early warning system of Malaysia’s anti-money laundering regime. It relies on banks, goldsmiths, real estate agents, accountants, lawyers and many others to notice when something does not look right and to tell the authorities promptly and quietly. The threshold is deliberately low. A reporting institution does not need proof, only a reason to suspect.

In return, the law protects those who report in good faith, overrides secrecy obligations that might otherwise stand in the way, and offers a defence to those who can show they took all reasonable steps. For law firms, the duties must be balanced against legal professional privilege, and some questions remain for the courts to settle. For every reporting institution, however, the message is the same. Know your customer, keep proper records, report suspicion without delay and keep the report confidential.