Directors Personal Liability Section 87

Directors Beware: Personal Liability for Corporate Money Laundering Offences Under Section 87

When a company commits a money laundering offence, the law presumes that the people running it did too. Directors and managers who cannot prove that they did their job properly may face the same penalties as the company, and may also be sued personally.

Introduction

A company is a separate legal person. In ordinary commercial life, that means its debts and liabilities are its own, and not those of its directors or shareholders. Many directors assume that the same protection applies when something goes wrong under the anti-money laundering law. It does not.

Section 87 of the Anti-Money Laundering, Anti-Terrorism Financing, Anti-Restricted Activity Financing and Proceeds of Unlawful Activities Act 2001 (Act 613), commonly known as AMLA, provides that where a company or other association commits an offence under the Act, the individuals who direct and manage it are deemed to have committed the same offence. They can escape liability only by proving that they did not consent to or connive at the offence and that they exercised proper diligence to prevent it. In other words, the burden shifts to the director.

This article explains how section 87 works, what a director must show to rely on the defence, how the courts have applied similar principles, and how directors can also be made personally liable in civil claims by victims. It ends with practical steps for directors, senior managers and compliance officers.

Why this matters

The penalties under AMLA are among the heaviest in Malaysian law. The main money laundering offence in section 4(1) carries imprisonment of up to 15 years and a fine of at least five times the value of the proceeds involved or RM5 million, whichever is higher. Many other offences in the Act, such as failing to comply with orders, directions or reporting obligations, carry fines of up to several million ringgit, imprisonment, or both.

Companies can commit these offences in many ways. A business may receive and move the proceeds of a fraud through its accounts, operate an unlicensed deposit-taking scheme, fail to report suspicious transactions, or ignore binding directions from a regulator. In each case, section 87 opens the door to personal prosecution of the people behind the company.

How section 87 works

Section 87 contains four subsections. Their effect is summarised below.

The four parts of section 87

Who is caught

Section 87(1) applies where the offence is committed by a body corporate, such as a company, or an association of persons, such as a society, club or partnership. It then reaches anyone who, at the time of the offence, was a director, controller, officer or partner, or was concerned in the management of its affairs.

The reach is wide. The term controller is defined in AMLA, in relation to an institution, to include the chief executive officer, a person who alone or with associates holds one third or more of the voting shares, a person with power to appoint a majority of the directors, and a person with power to make or cause decisions about the business or its administration. The phrase concerned in the management goes further still. The commentary suggests that courts are likely to take a functional approach, looking at whether the person actually had the ability to influence the conduct in question rather than at job titles. Shadow directors, controlling shareholders, heads of business lines, regional managers and compliance heads may all be within reach.

Timing matters. The question is whether the person held the relevant position at the time the offence was committed. A director who joined after the conduct ended, or who left before it began, is not caught by the deeming rule, although he may of course be liable for his own acts.

No need to convict the company first

Under section 87(2), a director can be prosecuted even if the company has not been convicted. This prevents individuals from escaping because the company has been wound up, has settled, has been dealt with on a different charge, or is otherwise not before the court. The prosecution must still prove that the company committed the offence as a matter of fact, but it does not need a conviction against the company to do so.

Section 87(3) makes clear that the company remains liable too. The company and its directors are separate persons, and each can be punished for its own liability.

Liability for agents and officers

Section 87(4) adds a separate rule. A person who would have committed an offence by doing an act personally is treated as having committed it where the act or omission was done by his agent in the course of the agent’s business, or by his officer in the course of employment. This can apply to a company as principal, or to an individual who acts through agents.

Section 88 goes in the same direction. Where a person is liable to a penalty under AMLA for an act, omission, neglect or default, he is liable to the same penalty for that of his employee acting in the course of employment, his director or controller carrying out that function, or his agent acting on his behalf. Unlike section 87, section 88 does not expressly provide a defence, and the commentary notes that disputes are likely to focus on whether the person was acting within his role.

Attempts, preparation, abetment and conspiracy

Directors should also be aware of section 86A. Anyone who attempts to commit an AMLA offence, does any act preparatory to or in furtherance of one, or abets or conspires to commit one, faces the same penalty as for the completed offence, whether or not the offence is ultimately committed. A director who approves an arrangement designed to move tainted funds may therefore be liable even if the transaction is blocked before it is completed. Section 86 also creates a general offence, with a fine of up to RM1 million, for breaching any provision of the Act, its regulations or any binding direction, circular or guideline where no other penalty is provided.

The defence: proving you did your job

The defence under section 87(1) has two parts, and both must be proved. The first is that the offence was committed without the person’s consent or connivance. The second is that he exercised such diligence to prevent the offence as he ought to have exercised, having regard to the nature of his function and the circumstances.

Consent means approving or agreeing to the conduct.

Connivance means knowingly letting the wrongdoing go ahead, for example by deliberately looking away or quietly allowing it to continue.

Diligence is judged by reference to the person’s role. More is expected of a chief executive or a head of compliance in a high-risk business than of a non-executive director, but even a non-executive director is expected to act on warning signs such as audit findings or regulator letters.

Under section 87(4), the principal must prove that the offence was committed without his knowledge or consent, and that he took all reasonable precautions to prevent it.

It is important to understand who bears the burden. The prosecution must prove that the company committed the offence and that the accused held the relevant position at the time. Once that is done, it is for the director to prove the defence. The commentary’s view is that this is a legal burden, which in the ordinary way is discharged on the balance of probabilities. Simply raising a doubt is not enough. In practical terms, a director must be able to prove the steps he took, which usually means producing documents.

The commentary also points out that claimed ignorance may not help. Knowledge may be inferred where there were repeated red flags, internal audit findings, letters from regulators or whistleblower reports that were not acted upon.

Associations and political parties

Section 87 is not limited to companies. It also applies to associations of persons, and this proved significant in CIMB Islamic Bank Bhd v Suruhanjaya Pencegahan Rasuah Malaysia & Ors [2025] MLJU 1614 (High Court, Kuala Lumpur, 9 April 2025). The bank account of Parti Pribumi Bersatu Malaysia, a political party registered under the Societies Act 1966, was frozen by the MACC in January 2023 and seized under section 50 in April 2023. In March 2023, the party’s then President was charged with money laundering offences under section 4(1)(b) read with section 87(1), in his capacity as President, in respect of RM195 million said to have been paid into that account. The charges were allegations to be tried in the criminal courts.

The party later demanded the release of the money, arguing that the seizure had expired under section 52A because the party itself had never been charged. Faced with competing demands, the bank applied to the High Court for directions. The court expressed the view that a society registered under the Societies Act has no separate legal personality and cannot be charged in its own name. Reading section 87 together with a similar deeming provision in the Societies Act, it considered that charging an office bearer in his official capacity satisfied the requirement in section 52A that the person concerned be charged within time. The court directed the bank to continue holding the money until the party’s pending judicial review applications were decided.

The decision was made in an interpleader application, and the court was careful not to decide the wider issues, which were left to the judicial review and criminal proceedings. It nonetheless illustrates two points. First, office bearers of societies, clubs, associations and political parties can be charged under section 87 for offences committed through the organisation. Second, such a charge may keep the organisation’s property frozen or seized beyond the usual time limits.

Lessons from the Genneva case

The consequences for directors are shown most clearly by the litigation arising from Genneva Malaysia Sdn Bhd, a company that sold gold to the public in 2011 and 2012. In Lim Ting Chai v Genneva Malaysia Sdn Bhd & Ors and other suits [2026] MLJU 216 (High Court, Kuala Lumpur, 23 January 2026), the court summarised what had happened in the criminal proceedings and then decided civil claims by three customers against the company and three of its directors.

The criminal proceedings

In August 2020, the High Court convicted the company and its directors of money laundering under section 4(1) of AMLA and of accepting deposits without a licence under the banking law then in force. The court found that the company’s gold business was in substance an illegal deposit-taking scheme, with the gold used as camouflage. The Court of Appeal upheld the convictions in October 2024, although it reduced the fines.

The directors had relied on a statutory defence in the banking law that is very similar to section 87 of AMLA, requiring proof that the offence was committed without their consent or connivance and that they exercised due diligence. They failed. One director described himself as a sleeping director who did not take part in management. The criminal court held that merely asserting that he had no role in the scheme was not enough, and that there was nothing to show he had done anything as a director to stop the company embarking on an unlawful venture.

The civil claims

The customers then sued the directors personally for the money and gold they had lost, totalling about RM2.34 million. Their earlier suit, filed in 2014, had been declared void by the Federal Court because the Public Prosecutor’s consent had not been obtained under section 54(3) of AMLA while the company’s assets were under seizure. They obtained consent and sued again in 2022.

The High Court found that the directors were liable for fraudulent misrepresentation, breach of constructive trust and breach of contract. Promotional materials used in talks given by a director had told the public that the business met Bank Negara Malaysia’s requirements, while in practice the company operated the very buy-back guarantee that the directors had publicly disclaimed. The court rejected the directors’ claims that they did not understand their own business. It pierced the corporate veil, finding that the directors had used the company to perpetrate fraud and had diverted customer funds through other companies they controlled. They were held jointly and severally liable with the company.

The court also rejected a limitation defence, holding that the customers could not reasonably have discovered the specific fraud until the criminal conviction in 2020. For directors, the lesson is that a criminal conviction can be used later as powerful evidence in civil claims, and that the passage of time may not protect them.

Civil liability without a prosecution

Personal exposure does not depend on a conviction. In P Ponnamal a/p Ponniah & Ors v Goh Hwan Hua & Ors [2025] MLJU 2825 (High Court, Kuala Lumpur, 9 September 2025), fifteen investors sued a company group and its controlling director after monthly returns on their investments stopped in late 2021. Bank Negara Malaysia had issued a public statement that the group was being investigated for offences including money laundering, and later announced that seven group entities had paid a total compound of RM50 million for accepting deposits without a licence and for money laundering. The group’s judicial review applications against the freezing and seizure orders were then withdrawn.

None of the defendants gave evidence. They argued that paying a compound was not an admission of guilt. The court held that, having chosen not to call evidence, they had failed to rebut the Bank Negara statements, and found that the entities had taken deposits without a licence. Bank records showed that investors’ money had been moved between the entities and to the director. The court also found that the director had assured investors in webinars that the businesses were properly licensed, and had failed to disclose the compound when it was paid. It held that he was the controlling mind of the group, that fraud had been proved, and that the corporate veil should be lifted. The director and the entities were held jointly and severally liable to repay the investors.

This outcome contrasts with Victor Peh Suan Ean v Trillion Cove Holdings Bhd (in liquidation) & Ors [2026] 2 ILJ 174, an Industrial Court case involving one of the same companies and the same managing director. There, an employee sought to make the managing director personally liable for his unpaid salary compensation. The Industrial Court refused, holding that being the managing director and controlling mind was not enough to lift the corporate veil without evidence of impropriety in the use of the company structure. The difference between the two cases lies in the evidence. Control alone does not make a director personally liable in civil proceedings. Control combined with proven fraud or misuse of the company does.

What diligence looks like in practice

Because the defence requires the director to prove his own diligence, the practical question is what evidence he will be able to produce. The commentary suggests that, particularly for higher-risk businesses such as remittance, e-money and businesses exposed to digital assets, reasonable precautions are likely to include the following.

A risk assessment covering the whole business, reviewed periodically and approved at board level.

Customer due diligence with enhanced checks for higher-risk customers, and screening against sanctions lists.

Transaction monitoring that is properly configured, with clear escalation of suspicious transactions and an independent reporting line for compliance.

Independent audit of the compliance programme, with findings tracked until they are resolved.

Role-based training for staff, managers and directors, with attendance recorded.

Oversight of agents and outsourced providers, including due diligence, contractual controls and monitoring.

Board reporting on compliance, with minutes showing that directors asked questions and challenged management.

The commentary stresses that records are crucial. Board papers, risk committee minutes, budgets approved for compliance systems, training logs, escalation records and remediation trackers are the kind of evidence that can establish the defence. Poor record-keeping can be fatal even where some controls existed in practice. Conversely, a board that approves products, relationships or business models that it knows to be doubtful, or that leaves known weaknesses unresolved, will struggle to show that it exercised proper diligence.

A practical checklist for directors

Understand the business model. The Genneva directors’ claims that they did not understand their own business were rejected. Ask how the company makes money, whether any licence is needed, and whether what is sold to customers matches what is said publicly.

Check licensing and regulatory status. If there is any doubt whether a product involves deposit-taking or another regulated activity, obtain written advice and, where appropriate, confirm the position with the regulator.

Resource the compliance function. Make sure compliance has the people, systems and independence it needs, and record the board’s decisions on this.

Act on warning signs. Respond promptly and in writing to audit findings, regulator letters and whistleblower concerns, and follow up until they are resolved.

Do not be a passive director. A director who takes no part in management is still within section 87 and still needs to show that he exercised diligence appropriate to his role.

Be careful what you tell the public. Statements about licensing and legitimacy made in marketing, webinars or talks can later found personal liability for fraud.

Keep proper records. Minutes, papers and correspondence showing challenge and oversight are the core of the statutory defence.

Take advice early. If the company is investigated, frozen or offered a compound, obtain independent legal advice on your personal position as well as the company’s.

Consider when you join and leave. Liability under section 87(1) depends on holding the position at the time of the offence. On joining, ask about any existing regulatory issues. On leaving, make sure your concerns and resignation are properly recorded.

Conclusion

Section 87 reverses the usual starting point. Where a company or association commits an offence under AMLA, the people who direct and manage it are presumed to share its guilt, and must prove that they did not consent to or connive at the offence and that they exercised proper diligence. The company does not need to be convicted first, and the organisation remains liable alongside its leaders. The same principle extends to societies and political parties through their office bearers.

The cases show that the consequences reach beyond criminal penalties. Directors who were convicted in the Genneva case were later held personally liable to repay customers, and in the I-Serve case a controlling director was held liable to investors without any prosecution at all. For directors and senior managers, the message is clear. Understanding the business, supporting a real compliance programme, acting on warning signs and keeping records of what they did are not just good governance. They may be the only defence available when things go wrong.