After DCR 2026: Building AML Compliance That Holds Year-Round

What happens to your AML obligations now that DCR 2026 has closed?

Bank Negara Malaysia required reporting institutions including DNFBPs to file the Data and Compliance Report by 30 September 2026. The submission window is now closed, no extension was granted, and DCR 2026 is final for every firm that filed.

What follows differs by firm. Those that submitted are waiting on a report card from BNM that will set out the specific compliance gaps found in their answers. Those that did not are exposed to enforcement under the AMLA, the FSA and the IFSA.

The obligations themselves run year-round, independent of any reporting window. BNM DCR 2026 assessed how a firm operates day to day, not what its policies state on paper.

Which is why AML compliance Malaysia is judged across the whole business cycle rather than at the point of filing.
‍

What Changed in DCR 2026 Malaysia This Cycle?

BNM widened the reporting population for this cycle. Licensed gaming outlets, moneylenders, pawnbrokers, trust companies, factoring companies and leasing companies now submit alongside the lawyers, accountants, company secretaries, registered estate agents and DPMS firms that reported in 2024.

The submission also moved to the Dynamic Submissions Portal, a system-based platform with input validation, draft saving and a discussion function that routes questions on the form directly to BNM and the statutory regulatory bodies.

DCR 2026 Malaysia now reaches a much larger share of the businesses that handle client money and set up corporate structures in Malaysia.

Whatever a reporting institution submitted stays confidential. BNM uses it for supervisory purposes and risk assessments.
‍

What Happens After DCR Submission: The BNM Report Card?

BNM reviews every completed submission and issues a DCR report card setting out the gaps found in a firm's answers.

It goes to the email address the firm entered at question A4 of the DCR form, and BNM notes it may land in spam or junk rather than the inbox.

The report card is not an enforcement notice. BNM positions it as a self-assessment tool, meant to show a firm where its AML/CFT/CPF processes need strengthening.

Its value lies in what it is. A regulator's reading of a firm's controls, naming specific weaknesses, drawn from the firm's own account of its practice under DCR 2026.
‍

Reading Your DCR Compliance Gaps

Reading and interpreting your Data and Compliance Report gaps is a critical exercise, because each finding marks a point where a firm's defence against money laundering, terrorism financing and proliferation financing risk is thinner than the obligation requires. DCR compliance gaps are not regulatory checkboxes. They are indicators of structural vulnerability, and for DNFBPs, converting those indicators into a remediation plan is the step that matters.

Where the gaps most commonly sit:

• Beneficial ownership verification - Ownership traced only to the registered holder rather than through every layer of corporate shareholding to the individual who ultimately owns or controls the client.
• Customer due diligence - Identification collected without independent verification, or verification completed after the relationship has already begun.
• Targeted financial sanctions screening - Screening run once at onboarding rather than continuously, or no defined procedure for handling a confirmed match.
• Customer risk profiling - Risk assigned through a partner's judgement on individual files instead of a standardised process applied to every client.
• Enhanced due diligence - Source of funds, source of wealth and senior approval obtained after a higher-risk client has been taken on, rather than before.
• Ongoing due diligence - Client information left unchanged after onboarding, with no review of whether transactions still match the client's profile.
• Record keeping - Identification documents or transaction records held incompletely, or retained for less than the required period.
• Client information systems - No means of aggregating one client's transactions across multiple accounts, files and branches, whether the system is electronic or manual.
• Suspicious transaction reporting - Red flags that never reached employees, no internal escalation route, or no named decision-maker.
• Compliance programme - Written policies never approved, never updated against current requirements, or never distributed to staff.

Each of these sits in the Policy Document as a standing requirement. A finding in the DCR report card identifies where a firm is falling short of AML/CFT/CPF Malaysia obligations that applied before the submission and continue to apply after it.
‍

Where a Missed DCR 2026 Submission Leaves Your Firm?

Missing the 30 September deadline places a firm in breach of a mandatory and enforceable requirement. BNM set out what that breach carries in its DCR 2026 information kit, and for some sectors the consequences extend beyond the regulator.

What a missed DCR 2026 submission exposes a firm to:

• Statutory non-compliance- Failure to submit constitutes non-compliance with the AMLA, the FSA and the IFSA, as the case may be.
• Enforcement action - BNM may pursue enforcement under the applicable laws, including the imposition of monetary penalty. The Malaysian Bar relayed the same warning to its members in Circular 205/2026.
• Professional body consequences - For accountants, non-submission is also a breach of the MIA By-Laws on professional ethics, confirmed in the joint circular issued by BNM and MIA.
• No report card- BNM issues report cards only for completed submissions, which leaves a non-filing firm without the regulator's assessment of its own gaps.

Before anything else, a firm should establish whether the obligation applied to it at all. BNM DCR 2026 exempted firms with no legal existence, in-house company secretaries, lawyers and accountants, and firms notified of a BNM on-site or off-premise examination in 2025 or 2026. Firms that were dormant, had no clients across 2024 and 2025, or provided no gazetted activities were required to file only a Declaration Form.

Where the requirement did apply, BNM handles DCR enquiries at dcr@bnm.gov.my. The underlying obligations remain in force for every reporting institution Malaysia covers, whether or not a submission was made.
‍

The Ongoing AML Obligations That Run Regardless of the DCR

Ongoing AML obligations are the duties that sit inside a firm's day-to-day operations rather than on a compliance calendar. Under AML/CFT/CPF Malaysia requirements, they apply every time the business takes on a client, handles a transaction or receives new information, which means their timing is set by the firm's own activity, not by BNM's reporting cycle.

A DCR asks firms to describe these obligations after the fact. Meeting them as they arise is what gives that description substance, and it is the foundation of AML compliance in Malaysia between one cycle and the next.
‍

Preparing for the Next DCR Cycle

BNM has run the DCR in 2020, 2021, 2022, 2024 and 2026, and while the timing of the next DCR cycle has not been announced, the pattern makes it one to plan for. Readiness comes down to whether a firm's records, decisions and business data are already held in a form that can answer BNM's questions when they arrive, rather than being rebuilt under a deadline.

What that looks like in practice:

• Business data captured by calendar year - DCR 2026 Malaysia asked for revenue or transaction value, transaction numbers, inward and outward cash values, payment methods, and client numbers by type and nationality, each broken down by year. Holding those figures in that shape as the year runs removes the heaviest lift from any future submission.
• Decisions recorded when they are made - Client risk ratings, enhanced due diligence approvals and decisions on whether to file a suspicious transaction report should carry a date and a named decision-maker at the time, not added later.
• Report card findings kept as a working log - Each gap assigned to an owner, with the action taken and the date it closed, so the firm can show progress rather than describe it.
• Compliance Officer details kept current - The CO number issued by BNM remains valid across cycles, and the report card goes to the firm's registered email, so both need to reflect who actually holds the role.
• Changes in scope tracked - New gazetted activities, additional branches or a change in group structure can alter which form a firm files and how many submissions it makes.

A firm that meets its ongoing AML obligations this way already holds most of what the next submission will ask for.
‍

Making AML Compliance Malaysia a Year-Round Standard

AML regulation in Malaysia keeps changing. In 2026 alone, the AMLA (Amendment) Act 2025 came into force on 1 March, and DCR 2026 brought six new sectors into BNM's reporting scope.

Every change of this kind extends what a reporting institution must verify, document and report. Where those processes are manual, each amendment means redesigning them. Where they run on an integrated, automated system, new requirements can be absorbed into existing workflows, and AML compliance Malaysia stays aligned with the regulation as it evolves.

FlexComply, from leading global fintech conglomerate FlexM, is built for exactly that. It provides end-to-end AML coverage through connected modules with audit-ready records, designed to adapt as regulatory obligations shift and to scale with a firm's growing exposure.

‍

                                                                                                                                                                       [Automate Your Ongoing AML Obligations] 
                                                                                                                              A 30-minute session mapped to your report card findings

‍