Since 1 June 2020, a commercial organisation in Malaysia is liable for corruption committed by any associated person — employee, agent, supplier, partner — where the corruption was carried out for the organisation's benefit. Whether or not senior management knew about it.
The penalty on conviction is a fine of not less than ten times the value of the bribe, or RM1 million, whichever is higher, or imprisonment for up to 20 years, or both. Section 17A(2) →
Directors, controllers, officers and partners involved in the management of the organisation at the time of the offence are deemed to have committed the offence themselves. A defence exists, but only one: prove the offence was committed without your consent or connivance, and that you exercised adequate procedures to prevent it.
The case law is being written right now. Two corporate Section 17A prosecutions have been brought since the law came into force — one struck out on procedural grounds in May 2026, one heading to High Court trial. No court has yet ruled on what "adequate procedures" looks like as a successful defence. You do not want your company to be the test case.
The Governance, Integrity and Anti-Corruption Centre under the Prime Minister's Office issued the Guidelines on Adequate Procedures in December 2018. Five principles, arranged as the acronym T.R.U.S.T. — Top-level commitment, Risk assessment, Undertake control measures, Systematic review, Training and communication. Guidelines on Adequate Procedures →
Due diligence on counterparties, partners, directors and key hires is exactly what Risk assessment and Undertake control measures look like in practice.