Legal Traps in Internal Probes

Investigating Staff Without Tipping Them Off: Legal Traps in Internal Probes

A practical guide for Malaysian employers, directors and HR teams on running an internal investigation into bribery, fraud or money laundering without breaking the MACC Act or AMLA

Introduction

Your finance manager spots something odd. A supplier’s invoices have crept up by 30% over the past year, the same procurement executive approves every one of them, and that executive has just bought a new car. The managing director’s first reaction is to call the executive into the boardroom tomorrow morning and demand an explanation.

That reaction is understandable, but it may be the worst first move. If the executive is guilty, a confrontation gives him time to delete emails, warn the supplier and agree on a story. If the authorities are already looking into the matter, a careless conversation could amount to tipping off, which is a criminal offence. And if someone in the company later “tidies up” the paperwork, the company may find itself facing charges that have nothing to do with the original wrongdoing.

This guide explains the legal traps that Malaysian companies face when they investigate their own staff under the Malaysian Anti-Corruption Commission Act 2009 (MACC Act) and the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA). It sets out a step-by-step approach to running an internal investigation safely, and looks at what the Malaysian courts have said.

Why an internal probe can land the company in trouble

Since 1 June 2020, a commercial organisation commits an offence under section 17A of the MACC Act if a person associated with it gives or offers a bribe to obtain or keep business or an advantage for it. The fine is at least ten times the value of the bribe or RM1 million, whichever is higher, and directors and managers may be deemed personally liable. The only defence is to prove that the company had adequate procedures in place to prevent such conduct.

The Government’s Guidelines on Adequate Procedures are built around five principles known as T.R.U.S.T.: Top-level commitment, Risk assessment, Undertake control measures, Systematic review, monitoring and enforcement, and Training and communication. Looking into red flags, investigating complaints and acting on what you find fall squarely within the fourth principle. A company that ignores warning signs will struggle to prove adequate procedures.

So companies should investigate. The difficulty is that the same laws that expect companies to act also punish certain conduct during an investigation. The table below summarises the main traps.

Trap 1: Tipping off the suspect

What section 35 of AMLA says

Section 35 of AMLA creates two offences. The first catches anyone who is aware, or has grounds to suspect, that an AMLA investigation is under way or about to start, and who then reveals something that could harm it. The second catches anyone who is aware, or has grounds to suspect, that a report has been made to an investigating officer, and who then reveals something that could harm whatever investigation follows from that report.

The offence applies to “any person”, not only banks. The penalty is a fine of up to RM3 million, jail of up to five years, or both. “Reason to suspect” is a lower bar than actual knowledge. It covers someone who saw enough warning signs that a reasonable person would have realised what was happening.

Importantly, the disclosure does not have to be made to the suspect. A remark to a colleague, a supplier, a family member or the media can be enough if it is likely to find its way back and harm the investigation. Commentary on the provision points out that disclosures within an organisation can also be caught, for example where an internal email reaches a team that deals directly with the suspect.

Does it matter if the probe is about bribery, not money laundering?

Yes. Bribery and other offences under the MACC Act are listed as “serious offences” under AMLA, and the MACC is an “enforcement agency” that can use AMLA’s investigation powers. The High Court confirmed this in Adam Rosly bin Abdullah v Public Prosecutor, discussed below. In practice, an MACC or police investigation into bribery, fraud or false claims may run alongside an AMLA investigation into where the money went, so the tipping-off rule can come into play even when the company thinks it is dealing with a simple corruption matter.

Extra rules for banks and other reporting institutions

If your business is a reporting institution under AMLA, such as a bank, insurer, money services business or one of the other businesses and professions listed in the First Schedule to AMLA, section 14A also applies. It is an offence to disclose that a suspicious transaction report has been or will be lodged with the authorities. A person who receives such a disclosure and then records it or passes it on also commits an offence. The penalty is the same as for tipping off. Only limited exceptions apply, such as disclosures made in the course of duties under AMLA, to the institution’s supervisory authority, or with the written permission of the competent authority.

When does the danger begin?

Before anyone has reported the matter and before any authority is involved, there is usually no investigation to tip off. But that can change quickly. Once the company lodges a report with the MACC or the police, once an investigating officer calls, or once you have reason to suspect that the authorities are looking into the matter, every conversation about the case needs care.

This is why the order of steps matters. Secure the evidence first. If a report has already been made, or the authorities are already involved, speak to your lawyer and, where appropriate, the investigating officer before you confront, suspend or interview the suspect, so that your actions do not undermine their work.

The lawyer exception and the defences

Section 35 does not stop a lawyer from discussing the matter with a client when giving legal advice, or with others in connection with legal proceedings. However, this protection is lost if the information is shared to further an illegal purpose, such as helping someone move money or hide evidence. It is also a defence to prove that you had no idea the disclosure could harm the investigation, or that you had lawful authority or a reasonable excuse. These defences are narrow, so do not rely on them as a plan.

Trap 2: Losing or “tidying up” evidence

Destroying evidence is an offence

Under section 34 of AMLA, it is an offence to break or destroy anything, before or after a search, to prevent it from being detained or secured by an investigating officer. It is also an offence to hide documents that an investigating officer requires, or to refuse to give documents that you have the power to give. The penalty is a fine of up to RM3 million, jail of up to five years, or both, with an extra daily fine while the offence continues. Section 48 of the MACC Act similarly makes it an offence to destroy anything to prevent its seizure, to conceal documents from MACC officers, or to obstruct them.

For a company, the practical risk is not only deliberate destruction by the suspect. Routine IT clean-ups, automatic email deletion, the reissuing of laptops and the shredding of old files can all wipe out evidence. Once you suspect wrongdoing, issue a document hold, suspend automatic deletion, and take secure copies of the relevant devices and accounts. Where possible, do this quietly and before the suspect is aware of the investigation.

Never create, alter or backdate documents

When a company discovers gaps in its records, there is a temptation to fill them: to prepare a missing agreement, to issue a voucher for a payment made months ago, or to “correct” a board minute. Do not do this. Section 89 of AMLA makes it an offence, with intent to deceive, to make a false entry in, alter, conceal or destroy a document that is to be produced under AMLA, or to use a document that is false or misleading. Giving an investigating officer information that is false or misleading in a material particular is a separate offence under section 32(8)(c). Each carries a fine of up to RM3 million, jail of up to five years, or both.

The case of Adam Rosly bin Abdullah, discussed below, shows how far this can go. The documents in that case were prepared by a lawyer and filled in by an assistant, both of whom ended up as prosecution witnesses. Staff who help to create paperwork after the event may find themselves drawn into a criminal case.

What your probe may uncover: false claims

Many internal investigations begin with suspicious invoices, claims or receipts. Section 18 of the MACC Act makes it an offence for an agent, such as an employee, to use a receipt, account or other document that he has reason to believe is false in a material particular, with intent to deceive his principal. No bribe needs to be involved. A conviction can mean as much as 20 years in jail, together with a fine of RM10,000 or five times the value of the false item, whichever amount is greater. If your probe finds inflated or fictitious invoices, the employee may be facing a serious criminal charge, and the evidence you preserve will matter.

Trap 3: Assuming your investigation file will stay private

Many business owners assume that an internal investigation report belongs to the company and stays inside the company. Under AMLA, that is not always so. Investigating officers have wide powers:

• Under section 31, an investigating officer who suspects an AMLA offence may, without a warrant, enter and search premises owned or controlled by the suspect, his staff or, for a company, its directors or managers, and may take away documents and data.
• Under section 32, an investigating officer may order anyone believed to know the facts of the case to attend an examination, to produce documents, or to give a written statement on oath. The person must answer truthfully and cannot refuse on the ground that the answer may incriminate him or his spouse. This power applies despite any duty of secrecy or confidentiality, including one in a contract.
• Under section 37, an investigating officer may, by written notice, require any person to deliver documents or information that are in his possession, custody or control, or within his power to provide.
• Under section 40, what is obtained through these powers is admissible as evidence in court, whether against the person who gave it or against anyone else.

In practice, this means your interview notes, your internal report and the emails between the investigation team may be demanded and used. Write them on the basis that a judge may one day read them. Stick to facts, record sources, avoid speculation and avoid opinions about guilt that the evidence does not support.

Does legal privilege help?

Communications between a client and its lawyer for the purpose of legal advice are generally protected by legal professional privilege, and the MACC Act expressly recognises this protection. Commentary on AMLA notes that the notice power in section 37 does not expressly remove privilege. Bringing lawyers in early, and having the investigation run under their direction, therefore helps protect legal advice and the lawyers’ analysis.

Privilege has limits, however. Section 47 of AMLA allows a High Court Judge, on application in a money laundering or terrorism financing investigation, to order a lawyer to disclose information about transactions relating to property that is liable to seizure. The lawyer may decline only to the extent that compliance would reveal privileged information obtained for the purpose of pending proceedings. Underlying facts and existing business documents are not privileged just because they have been sent to a lawyer, and communications made to further a crime are not protected at all.

Trap 4: Getting in the way of the official investigation

Once the authorities are involved, the company’s own probe must not compete with theirs. Three points stand out.

Treat every notice as urgent. A notice from an investigating officer may be served on a director or employee by handing it to an adult at his last known place of work or business. In Amirruddin Nin v Pendakwa Raya, a director was convicted because orders to attend an examination were left with the company’s finance manager and HR executives and he did not turn up. Make sure that receptionists, HR, finance and the company secretary know to pass any notice to the right person, and to the company’s lawyer, the same day.

Do not coach or pressure witnesses. Section 48 of the MACC Act makes it an offence to interfere with, frighten or threaten anyone involved in an investigation. Telling staff what to say, warning them about the consequences of cooperating, or suggesting that they “forget” certain events can expose the company and the individuals involved. Staff may be reminded of their right to legal advice and their duty to tell the truth, but nothing more.

Understand the role of lawyers at statement sessions. A witness called to give a statement does not have an automatic right to have a lawyer in the room. In the Latheefa Beebi Koya case, the MACC issued notices requiring two lawyers who had sat in on their client’s statement session to give statements themselves. The Federal Court later held that such investigative notices are generally not open to challenge in court. Prepare staff properly beforehand, rather than relying on the lawyer’s presence during the session.

Trap 5: Mishandling the whistleblower and the accused

Protect the person who reported

Many internal probes start with a tip from an employee. Under the Whistleblower Protection Act 2010, a person who discloses improper conduct to an enforcement agency, such as the MACC or the police, is protected. His identity and the information he gave are confidential, he is immune from civil, criminal and disciplinary action for making the disclosure, and it is an offence to take detrimental action against him or anyone associated with him in reprisal. Detrimental action includes dismissal, demotion, suspension, harassment and other adverse treatment at work. Disclosing a whistleblower’s confidential information carries a fine of up to RM50,000, jail of up to ten years, or both.

Two practical points follow. First, do not try to find out who the whistleblower is, and do not let the suspect’s manager take part in decisions about the person who reported. Second, note that the protection applies only to disclosures made to an enforcement agency. The Court of Appeal in Rokiah binti Mhd Noor, discussed below, held that officers who sent their allegations to political leaders and others did not qualify for protection. A good internal reporting channel, as the Guidelines on Adequate Procedures recommend, should encourage staff to report through the proper route and to keep the matter confidential.

For reporting institutions, section 24 of AMLA adds a further protection. Someone who provides information linked to a report made under that Part of AMLA cannot be sued, prosecuted or disciplined for doing so, unless he acted in bad faith.

Be fair to the accused employee

An internal probe is not a criminal trial, and the employee is not presumed guilty. If the company intends to take disciplinary action, the basic rules of natural justice apply: the employee should be told clearly what he is accused of, and should be given a real chance to answer. In Rokiah, the court upheld the disciplinary decisions because the charges were clear, the officers had responded in detail in writing and in person, and every step of the procedure had been followed. Decisions on suspension, domestic inquiries and dismissal are governed by employment law, which is outside the scope of this guide, so take specific legal advice before acting.

Step by step: running an internal probe safely

Do not confront anyone yet. Form a small investigation team of people who are senior, independent of the matter and not close to the suspect. Record what triggered the concern, who knows about it, and what is at stake, such as the amounts involved, the customers or public officials concerned, and whether any authority already appears to be involved.

Appoint external lawyers, or in-house counsel with suitable independence, to direct the investigation. This helps protect legal advice under privilege, ensures that the scope is clear, and allows the company to make informed decisions about reporting. Agree in writing on what the investigation will cover and who it reports to, usually the board or an audit committee.

Issue a document hold to the relevant departments, suspend automatic deletion of emails and chat messages, and take secure copies of the suspect’s laptop, phone (if company-owned), email account and shared drives. Restrict, but do not obviously cut off, the suspect’s access to sensitive systems if there is a risk of tampering. Keep a log of what was collected, when and by whom.

If the probe shows that someone was offered or asked for a bribe, section 25 of the MACC Act obliges that person to make a report to the MACC or the police, and staying silent is itself an offence. More generally, reporting early shows that the company takes its obligations seriously. Reports made only after a scandal becomes public may be dismissed as an afterthought, as happened in the Megan Media case. Once a report is made, coordinate with the authorities before taking further visible steps.

Interview documents and neutral witnesses first, and the suspect last. Prepare a list of topics and the documents you will show. If the authorities are already involved, check with your lawyer whether interviewing the suspect or key witnesses could interfere with their investigation. Remind each interviewee in writing to keep the interview confidential.

Have two people present, one to ask questions and one to take notes. Explain the purpose of the interview, make no threats or promises, and give the employee a fair chance to explain. Record answers accurately, including those that help the employee. Ask the interviewee to read and sign the notes if possible. Never ask anyone to prepare, sign or backdate documents to fill gaps in the records.

Prepare a factual report with the lawyers. Decide on disciplinary action through a fair process, consider recovering losses, and review the controls that allowed the problem to occur. In the UK case of Skansen Interiors, the wrongdoing came to light only when a new managing director took over. A company that learns from its own investigation, and updates its policies, approvals and training, is in a much stronger position to show adequate procedures in the future.

Do’s and don’ts at a glance

What the courts have said

Other lessons from the cases

The following cases are discussed in the books relied on for this guide. The full judgments were not reviewed.

Latheefa Beebi Koya (Federal Court, 2017). The Court of Appeal had quashed MACC notices requiring two lawyers to give statements after they attended their client’s statement session. The Federal Court reversed that decision, holding that actions taken in the course of a criminal investigation are generally not open to judicial review. Companies should comply with investigative notices and raise concerns with the officer or through their lawyers, rather than expect the courts to stop an investigation.

Dato’ Dr Haji Mohd Adam Che Harun (Megan Media). The executive chairman of a listed company argued that he had lodged police reports about the company’s false financial statements. The courts found that the reports were made only after the scandal became public and the Securities Commission had begun investigating, and treated them as an afterthought. Timing matters. Investigating and reporting early carries far more weight.

Amec Foster Wheeler (UK). In 2007, the company’s lawyers prepared a risk report on possible corruption in several countries. The board knew that senior staff were involved, but nothing was reported to any authority, and similar conduct soon recurred. The company later paid about £99.9 million under a deferred prosecution agreement. An internal investigation that ends in a report on a shelf is not enough.

Skansen Interiors (UK). Bribery by the managing director of this small company was discovered only after a new managing director arrived. The company’s adequate procedures defence later failed. Fresh eyes and independent review are often what bring problems to light, so investigation teams should be independent of the people under suspicion.

Frequently asked questions

Can I tell the employee that he is under investigation? Before any authority is involved, telling him may still be unwise because he could destroy evidence. Once a report has been made or the authorities are involved, telling him about their investigation may amount to tipping off. Secure the evidence first, then take legal advice on when and how to inform him.

Can we suspend the employee during the probe? Suspension may be appropriate to protect evidence and witnesses, but it is governed by employment law and the employee’s contract. A sudden suspension may also alert others. Get legal advice on both the employment law and the investigation aspects first.

If the MACC asks for our internal investigation report, must we hand it over? Investigating officers have wide powers to require documents, and refusing or hiding documents is an offence. Legal advice that is privileged may be protected, but facts and ordinary business records are not. Let your lawyer respond to the request and identify any privileged material properly, rather than refusing outright.

Can our lawyer answer the MACC’s questions on behalf of our staff? No. A person called for examination must attend personally and answer truthfully. The company’s lawyer can help prepare staff beforehand, but the statement is the witness’s own.

The employee resigned in the middle of the probe. Can we simply close the file? Resignation does not end the company’s exposure. If bribes were paid for the company’s benefit, the company may still face liability under section 17A. Complete the investigation, consider whether a report is needed, and fix the weaknesses it reveals.

Can we tell our bank, auditors or insurers? Sometimes you must, for example under the terms of an insurance policy or a loan. But each disclosure should be considered with your lawyer first, especially once the authorities are involved, so that it does not prejudice their investigation.

Conclusion

Investigating your own staff is no longer optional for Malaysian companies. Under section 17A of the MACC Act, how a company responds to red flags is part of what decides whether it can rely on the adequate procedures defence. But an internal probe carried out in a hurry, by the wrong people or in the wrong order can create fresh criminal exposure through tipping off, lost evidence, false documents or interference with witnesses.

The safer path is quiet, disciplined and documented: preserve the evidence, keep the circle small, involve lawyers early, respect the authorities’ role, protect the person who reported and treat the accused fairly. Done properly, an internal investigation protects the company, its directors and its honest staff.

Our team assists companies in planning and conducting internal investigations, preserving evidence, responding to MACC and AMLA notices, handling dawn raids and putting adequate procedures in place. If you suspect wrongdoing in your organisation, speak to us before you speak to the suspect.

Keywords: internal investigation Malaysia, workplace investigation, tipping off AMLA section 35, section 14A AMLA, MACC investigation, MACC Act section 48 obstruction, section 17A corporate liability, adequate procedures, T.R.U.S.T. principles, Whistleblower Protection Act 2010, employee fraud Malaysia, false claims section 18 MACC, money laundering investigation, AMLA section 32 examination, section 37 notice, legal professional privilege Malaysia, evidence preservation, dawn raid, disciplinary inquiry, Amirruddin Nin, Adam Rosly, Rokiah binti Mhd Noor