Who Regulates Cryptocurrency in Malaysia?

The Securities Commission Malaysia, or SC, is the main regulator for digital asset activities that fall within Malaysia's capital markets framework, including digital asset exchanges, certain token offerings, and digital asset custody. Bank Negara Malaysia, or BNM, also has a role where an activity involves payment or currency matters.

So there is no single rule that says every activity involving cryptocurrency belongs to one regulator. The regulator and legal requirements depend on what the business or individual is actually doing.

Buying Bitcoin is different from operating a crypto exchange. Accepting USDT as payment is different from issuing a token to raise money. Holding your own cryptocurrency is different from safeguarding digital assets for customers.

The activity matters more than the word "crypto."

The Securities Commission Malaysia is the main digital asset regulator

For most people dealing with cryptocurrency as an investment or digital asset, the Securities Commission Malaysia is the regulator they are most likely to encounter.

Malaysia brought certain digital currencies and digital tokens within its securities regulatory framework through the Capital Markets and Services (Prescription of Securities) (Digital Currency and Digital Token) Order 2019.

The SC has since developed specific frameworks governing important parts of the digital asset market.

These include:

• Digital Asset Exchanges, commonly known as DAX operators;
• Digital Asset Custodians;
• certain digital token fundraising activities; and
• other capital market activities involving digital assets.

The SC also determines which digital assets may be traded on regulated digital asset exchanges in Malaysia.

For an ordinary investor, this means the SC website should be one of the first places to check before using a cryptocurrency platform that claims to operate legitimately in Malaysia.

Who regulates crypto exchanges in Malaysia?

Digital asset exchanges operating within Malaysia's regulated market fall under the Securities Commission Malaysia.

These platforms are regulated as Recognised Market Operators for Digital Asset Exchanges, commonly referred to as RMO-DAX operators.

The SC imposes requirements relating to areas such as governance, investor protection, safeguarding client assets, operational resilience, management, financial resources, and the digital assets that may be traded.

The regulatory framework was further revised in May 2026, including stronger requirements relating to client asset safeguards and the resilience and governance of DAX operators.

The SC maintains an official list of registered digital asset exchanges. This list should be checked directly because operators and regulatory approvals can change over time.

A platform being popular internationally does not mean it is registered to operate as a digital asset exchange in Malaysia.

That distinction is important.

What does Bank Negara Malaysia regulate?

Bank Negara Malaysia is Malaysia's central bank. Its role in cryptocurrency is different from the SC's role.

BNM has consistently stated that digital assets are not legal tender in Malaysia.

BNM becomes particularly relevant where a digital asset activity overlaps with payment systems, currency matters, financial institutions, or other activities falling within laws administered by the central bank.

For example, a business model involving cryptocurrency solely as an investment asset may primarily raise SC issues. A structure involving digital assets as part of a payment system may also require consideration of BNM's regulatory framework.

This is why a crypto business cannot simply ask, "Are we regulated by the SC or BNM?" and choose one.

The actual business model needs to be examined.

An example: buying Bitcoin

Consider an individual who wants to buy Bitcoin in Malaysia.

The individual is not operating an exchange, issuing tokens, or holding customer funds. They simply want to purchase Bitcoin as an investment.

The practical regulatory issue is largely the platform being used.

If the individual wants to trade through a Malaysian regulated digital asset exchange, they should check whether the platform is registered with the SC and whether Bitcoin is permitted for trading on regulated exchanges.

The investor should still understand that SC regulation does not guarantee the value of Bitcoin or prevent losses.

Regulation provides a framework for the market and its operators. It does not turn cryptocurrency into a guaranteed investment.

Another example: launching a crypto exchange

The position changes significantly if a company wants to create a platform where Malaysians can buy and sell digital assets.

The company is no longer simply using cryptocurrency. It is operating a digital asset business.

A platform facilitating the trading of digital assets may fall within the SC's Digital Asset Exchange framework and require registration as a Recognised Market Operator.

The operator would need to consider regulatory requirements before launching the business.

Building the website first and asking about regulation later is the wrong approach.

A crypto platform should determine its regulatory position before accepting customers, marketing its services, taking custody of assets, or facilitating transactions.

What about issuing your own token?

Token issuance creates another set of issues.

A company may call its product a utility token, membership token, governance token, payment token, investment token, or something entirely different.

The name does not decide the legal position.

The actual rights and economic features matter. Regulators may look at how the token is structured, what purchasers receive, how money is raised, what representations are made, and whether investors expect returns.

Malaysia has a framework for certain digital token offerings under the SC's Guidelines on Digital Assets.

A business planning to raise money through tokens should therefore conduct legal and regulatory analysis before marketing or selling them.

Changing the word "investment" to "community participation" does not necessarily change the substance of the arrangement.

Who regulates digital asset custody?

Custody is another regulated part of Malaysia's digital asset ecosystem.

A Digital Asset Custodian safeguards digital assets for other persons. This is different from an individual holding their own cryptocurrency in a personal wallet.

Digital asset custodians operating within Malaysia's regulatory framework are subject to the Securities Commission Malaysia's Guidelines on Digital Assets.

The SC currently maintains a list of registered Digital Asset Custodians alongside other regulated digital asset players.

This matters because custody involves control over customer assets. If a business holds private keys or otherwise controls digital assets belonging to customers, the legal and regulatory analysis becomes much more serious.

Businesses should not assume that calling themselves a "wallet provider" avoids custody regulation.

Again, the actual activity matters.

What about stablecoins?

Stablecoins sit in an interesting position because they can be used for several purposes.

Someone may hold USDT or USDC as a digital asset. A trader may use stablecoins to move between cryptocurrency positions. A business may accept stablecoins as payment. A platform may facilitate stablecoin trading or custody.

Each arrangement can create different regulatory considerations.

A stablecoin being designed to track the US dollar does not make it legal tender in Malaysia. It also does not automatically make the activity a traditional foreign currency transaction.

Businesses using stablecoins for commercial payments or financial services should examine both the nature of the asset and the service being provided.

What about foreign crypto exchanges?

This is where many Malaysian users become confused.

A cryptocurrency platform may be licensed or regulated somewhere else in the world. That does not automatically mean it is authorised to operate in Malaysia.

The SC has taken enforcement action against digital asset exchanges that operate in Malaysia without registration.

For Malaysian users, the practical concern is also enforcement. If something goes wrong with an offshore exchange, recovering assets or enforcing legal rights may be more difficult because the operator, assets, contracts, and servers may be located outside Malaysia.

Before using a platform, check its regulatory status through official sources rather than relying on the platform's own claim that it is "licensed," "regulated," or "globally compliant."

Always ask: licensed where, by whom, and for what activity?

Other Malaysian authorities may still become involved

The SC and BNM are the main financial regulators relevant to cryptocurrency, but they are not the only authorities that may become relevant.

A crypto scam may become a police matter.

Tax consequences may involve the Inland Revenue Board of Malaysia.

Consumer issues may engage consumer protection laws depending on the nature of the transaction.

Personal data handling may raise obligations under Malaysia's data protection framework.

Money laundering, sanctions, fraud, breach of trust, contractual disputes, and cybercrime may bring other laws and enforcement agencies into the picture.

Crypto does not exist in a separate legal universe. Ordinary Malaysian laws continue to apply where relevant.

What this means for ordinary crypto users

For an ordinary user, regulation does not need to be complicated.

Start by checking the platform.

If you are buying or trading digital assets through a platform in Malaysia, check the SC's official list of registered Digital Asset Exchanges.

Do not assume that a platform is approved because it has a Malaysian website, accepts ringgit, advertises to Malaysians, or has thousands of users.

Be particularly careful with private investment groups, Telegram traders, agents offering to manage crypto for you, and schemes promising fixed or guaranteed returns.

Keep transaction records. Save wallet addresses, transaction hashes, exchange statements, payment records, and communications.

If something goes wrong, these records may become important evidence.

What this means for crypto businesses

Businesses need to go further.

Before launching a crypto product in Malaysia, identify exactly what the business will do.

A company operating an exchange faces different requirements from a company providing custody. A token issuer faces different issues from a merchant accepting stablecoins. A blockchain software company may have a different regulatory profile again.

The legal analysis should cover the product structure, movement of funds, custody arrangements, customer relationship, marketing, token rights, payment function, and jurisdictions involved.

This should happen before launch.

One of the most expensive mistakes a crypto business can make is assuming that it is "just a technology company" when its actual activities fall within financial regulation.

Frequently Asked Questions

Who is the main cryptocurrency regulator in Malaysia?

The Securities Commission Malaysia is the main regulator for digital asset activities falling within Malaysia's capital markets framework. This includes regulated digital asset exchanges, digital asset custodians, and certain token offering activities.

Does Bank Negara Malaysia regulate cryptocurrency?

BNM has a role where digital asset activities involve matters within its regulatory jurisdiction, including payment and currency matters. BNM has also stated that digital assets are not legal tender in Malaysia.

Are crypto exchanges regulated in Malaysia?

Yes. Digital Asset Exchanges operating within Malaysia's regulated framework must be registered with the Securities Commission Malaysia as Recognised Market Operators.

How do I know whether a crypto exchange is regulated?

Check the Securities Commission Malaysia's official list of registered Digital Asset Exchanges. Do not rely only on statements made on the exchange's own website or advertisements.

Does SC regulation mean my crypto investment is safe?

No. Regulation does not guarantee investment returns or prevent cryptocurrency prices from falling. Investors still face market, custody, platform, fraud, and transaction risks.

Final takeaway

The Securities Commission Malaysia is the main regulator for cryptocurrency and digital asset activities that fall within Malaysia's capital markets framework. Bank Negara Malaysia also becomes relevant where the activity involves payment, currency, or other matters within its jurisdiction.

But crypto regulation depends on the activity.

Buying Bitcoin, operating an exchange, holding customer assets, issuing tokens, and accepting stablecoins are legally different activities. The right regulatory analysis starts by understanding exactly what the person or business is doing.

For users, check the platform before transferring money. For businesses, determine the regulatory position before launching the product.

Speak to JPP LAW

Justin, Poh & Partners, also known as JPP LAW, assists clients with digital assets, blockchain, Web3, fintech, digital finance, token structures, commercial contracts, digital asset disputes, and regulatory matters in Malaysia.

If you are launching a digital asset business, issuing tokens, operating a crypto-related platform, dealing with digital asset custody, or need to understand how Malaysian regulation applies to your business model, you may contact us to discuss the matter.

---

Disclaimer: This article is for general information only and does not constitute legal advice. Cryptocurrency regulation depends on the nature of the asset, business model, services provided, transaction structure, parties involved, and applicable Malaysian laws and regulatory frameworks. You should seek advice based on your specific circumstances.