BNM DCR 2026 Explained: Scope, Submission and What Follows

Does your firm know what DCR 2026 requires, and what follows once it is submitted?

Bank Negara Malaysia set out the requirements for the Data and Compliance Report 2026 at the end of June. The scope now extends to eleven sectors, submissions run through a new reporting system, and the questionnaire examines a firm's compliance practices more closely than the 2024 edition did.

For firms entering the reporting perimeter for the first time, there is no internal precedent to work from. For those that submitted in 2024, the changes to scope, platform and content are substantial enough that prior experience offers limited guidance.

DCR 2026 is mandatory and enforceable under the AMLA, the submission window closes on 30 September, and Bank Negara Malaysia uses the information submitted for supervisory purposes and risk assessment.

Establishing your firm's position under BNM DCR 2026 is where the work begins. DCR 2026 Malaysia calls for a clear reading of what has changed, what applies to your firm and what the regulator does with the answers, well ahead of DCR submission Malaysia.
‍

What Is DCR in Malaysia and Why BNM Requires It?

The Data and Compliance Report, or Laporan Data dan Pematuhan, is a compliance submission that reporting institutions make to Bank Negara Malaysia. It serves two purposes for the regulator. One is to assess whether a firm is meeting its AML/CFT/CPF and TFS obligations. The other is to gauge how exposed that firm is to ML/TF/PF risk.

It is issued under the AMLA 2001, together with the Financial Services Act 2013 and the Islamic Financial Services Act 2013, and enforcement action can follow non-submission. The obligations being measured are those set out in BNM's AML/CFT/CPF and TFS for DNFBPs and NBFIs Policy Document, which remains the governing standard for firms in scope.

DCR 2026 also functions as a self-assessment. The firm evaluates its own compliance position and reports the result, which is what gives BNM a view of standards across each sector it supervises.

Submissions are not simply filed and closed. BNM reviews each one and issues the firm a report card setting out the gaps found in its responses.

Information reported through BNM DCR 2026 reaches the Financial Intelligence and Enforcement Department, the same function that receives suspicious transaction reports and leads enforcement.
‍

Who Needs to Submit DCR 2026 in Malaysia?

BNM has widened the DCR scope this year. New sectors have been added and are now required to file, while reporting institutions that filed in the 2024 cycle are working to a broader and more detailed set of questions than they answered before.

Reported in 2024 and returning:

• Lawyers
• Accountants
• Company secretaries
• Registered estate agents
• Dealers in precious metals and precious stones

Captured for the first time:

• Licensed gaming outlets
• Moneylenders
• Pawnbrokers
• Trust companies
• Factoring companies
• Leasing companies

Falling within a listed sector is not the end of the assessment. For lawyers, accountants, company secretaries and trust companies, the obligation depends on whether the firm carries out gazetted activities under the AMLA. These include:

• Buying and selling immovable property
• Managing client money, securities or other property
• Managing client accounts, including bank and securities accounts
• Organising contributions for the creation, operation or management of companies
• Creating, operating or managing legal entities and arrangements, and buying and selling business entities

A practice limited to audit work carries out none of these and falls outside DCR 2026. The same holds for a registered estate agent whose services are confined to valuation.

The reporting institution is the firm, and the submission is made once on that basis. Partners and other practitioners are not required to report in their own right. Lawyers, accountants and company secretaries employed in-house are also outside the scope, as they serve their employer rather than clients of a practice.
‍

DCR Form 2026 or Declaration Form: Getting the Scoping Right

BNM accepts a submission in one of two forms, and which applies depends on what a firm did across 2024 and 2025 rather than on the sector it sits in. A self-assessment is provided for the decision, and the outcomes are set out below.

Neither form is required from:

• Firms with no legal existence, having been struck off, dissolved or had their business registration terminated
• In-house company secretaries, lawyers and accountants
• Firms notified of a BNM on-site or off-premise examination in 2025 or 2026

Selection for an Independent Audit Review is not an exemption, and those firms still submit.

Size makes no difference either. Small-sized reporting institutions file in full, since the simplifications they receive cover employee screening, training and the independent audit function rather than the reporting obligation.

Group structures need care:

• One submission per business entity, so a group running company secretarial services through one firm and accounting through another files for each
• Branches are aggregated into the head office submission
• A branch operating independently with its own Compliance Officer responds separately

Filing a Declaration Form where the DCR Form 2026 was required leaves the obligation unmet, and there is no route back once a submission is in.
‍

DCR 2026 Requirements: What the Form Actually Asks

The questionnaire moves from facts a firm already holds to judgements it may never have recorded, and the difficulty rises as it goes. Every question and its guidance sits in the DCR 2026 information kit.

Firm details come first:

• Name, registration details and contact information
• Compliance Officer name and number
• Headcount, including practitioners carrying out gazetted activities
• Branch locations, group affiliations and international network arrangements

The report card goes to the email address given here, so it should be one the firm monitors.

Business information covers 2024 and 2025:

• Revenue or transaction value for each year
• Number of transactions for each year
• Percentage breakdown by service line for 2025
• Payment methods used by clients in 2025
• Total inward and outward cash transaction values for each year
• Overseas transactions, foreign clients and non-face-to-face clients

Definitions differ by sector and carry real consequences. For law firms, value of transaction means the value of the client's underlying matter, covering sale price, financing amount or client money managed, and it excludes legal fees, stamp duty and disbursements. Moneylenders report only what derives from moneylending, leaving out hire purchase and leasing revenue.

Risk assessment follows:

• Whether the firm has assessed its own ML/TF/PF risk, and whether that assessment is documented
• How often it is reviewed
• Whether the National Risk Assessment informed it
• Risk ratings across client, product, delivery channel and geographic factors

The mandatory requirements run deepest, and this is where DCR 2026 separates written policy from daily practice:

• Total client numbers for 2024 and 2025, with the breakdown by type and nationality given for 2025
• Numbers of politically exposed persons, high net worth clients, sanctioned clients and clients under investigation orders
• Information collected and documents used to verify identity
• Whether every layer of corporate shareholding is traced to the ultimate beneficial owner
• Sanctions lists screened against and how screening is performed
• Client risk profiling and when it is reviewed
• Source of wealth, source of funds and senior management approval before accepting higher-risk clients
• Record keeping, retention periods and how client information is centralised
• Red flags for suspicious transactions and who decides to report
• Whether the Compliance Officer has attended AML/CFT/CPF training

The compliance programme closes it out:

• Written policies, their approval and whether staff receive them
• Employee training
• Employee screening
• Independent audit

Firm size determines the extent of this part. Small-sized reporting institutions are subject to simplifications and exemptions that reduce what they report, while large-sized firms address the compliance programme requirements in full.

Revenue and transaction figures are historical and fixed. Most of what follows is answered against current process and practice, which is what makes the DCR 2026 requirements under BNM DCR 2026 harder than the question count suggests.
‍

Dynamic Submissions Portal Access and The CO Number

Submissions are made through BNM's Dynamic Submissions Portal, and entry to it depends on a Compliance Officer already registered with the regulator.

What a firm needs in place:

• A Compliance Officer appointed by the firm
• That appointment notified to BNM through its online form
• A CO number issued by BNM to the firm's registered email
• An account on the portal, reactivated if it dates from an earlier cycle

Where a Compliance Officer was notified in a previous cycle, the CO number already assigned remains valid and can be used for this submission. A fresh notification is required only where the firm appoints someone new.

The number is issued per firm. A Compliance Officer covering several practices holds one for each, and BNM uses it across every AML/CFT/CPF matter involving that firm.

DSP Malaysia is the only route for submission. Nothing is accepted by email, PDF or spreadsheet.
‍

DCR 2026 Submission Deadline and What Cannot Be Undone

The DCR 2026 submission deadline falls on 30 September, and BNM has confirmed that no extension will be provided. Submissions are final once filed, with no requests to amend entertained.

That places the weight on accuracy before filing rather than on speed. A figure entered under the wrong definition, a scoping decision that should have gone the other way, or a question answered from memory stands as submitted.

Non-submission of BNM DCR 2026 carries its own exposure. Enforcement action can be pursued under the AMLA, the FSA and the IFSA, including monetary penalties. For accountants, non-submission is also a breach of the MIA By-Laws on professional ethics, which brings a second body into play from a single omission.

Filing is not the end of it. Each reporting institution receives a report card highlighting gaps and areas for improvement, drawn from its own answers.

Those findings carry weight beyond the submission. They come from the regulator's reading of the firm, they identify specific weaknesses rather than general ones, and they are the clearest account a firm will get of where its controls need work.
‍

Getting DCR 2026 Right, and Staying Ready For the Next Cycle

Where this cycle gets difficult is rarely a matter of missing information. It is information held in unusable form, scattered across client records, transaction histories and risk decisions that were never brought together. Reporting institutions that stay ahead are the ones running compliance automatically throughout the year, where each control feeds the next, every decision is captured as it happens, and nothing waits on manual assembly.

That is what turns a DCR submission into retrieval rather than reconstruction, and it holds whenever a regulator asks, not only in a reporting window.

FlexComply, from leading global fintech conglomerate FlexM, is built for exactly that. Customer due diligence, dynamic risk scoring, ongoing monitoring, enhanced due diligence and audit-ready records operate as one automated system, designed for shifting obligations and widening regulatory exposure, and it scales as demands change.

                                                                                                                                 [Automate DCR readiness with FlexComply]
                                                                                                        A 30-minute session mapped to your DCR gaps

‍