A regulatory notice rarely arrives because a board intended to break the rules. More often, the immediate cause is familiar: an ignored warning, an under-resourced compliance function, a third party that was never properly vetted, or a report that did not reach the directors who needed to see it. So, can directors be liable for compliance failures? In Malaysia, the answer can be yes. The outcome depends on the governing statute, the director’s role and knowledge, the company’s controls, and what was done when concerns emerged.
For directors of fintechs, financial institutions, technology businesses and companies operating across borders, compliance is not a function that can simply be delegated and forgotten. Delegation may be necessary. Accountability remains.
Can directors be liable for compliance failures in Malaysia?
A company is a separate legal person, meaning it generally bears responsibility for its own obligations. That starting point matters, but it is not complete. Malaysian law can impose personal consequences on directors where they have breached their statutory and fiduciary duties, participated in wrongdoing, authorised it, or failed to exercise the degree of oversight expected in the circumstances.
The Companies Act 2016 requires directors to act for a proper purpose and in good faith in the best interests of the company. It also requires a director to exercise reasonable care, skill and diligence. These duties are not satisfied by attending meetings, accepting management assurances without question, or approving policies that are never put into operation.
Separate regulatory statutes may go further. Depending on the sector and allegation, they can create offences by directors or officers where an offence by the company occurred with their consent, connivance or neglect. Financial crime, anti-money laundering, data protection, consumer protection, competition, workplace safety and licensing laws all require careful consideration of their own enforcement provisions.
A director is therefore not automatically liable just because the company has failed. However, the corporate structure is not a shield for deliberate misconduct, wilful blindness, or a serious failure to supervise a known area of risk.
The routes to personal exposure
Personal exposure usually develops through one or more connected routes. The first is a direct breach of duty. A director who approves an unlawful transaction, allows company assets to be misused, makes misleading disclosures, or ignores a clear legal obligation may face claims by the company, shareholders, creditors in appropriate circumstances, or regulators.
The second route is statutory liability. Regulatory legislation often identifies directors, chief executives, managers and other officers as persons who may be prosecuted when the company commits an offence. The wording matters. Some provisions turn on proof of consent or connivance; others include neglect. A director’s job title alone is not always decisive, but neither is a claim of being non-executive or uninvolved.
The third route is involvement in a civil wrong. Where a director personally procures, directs or participates in unlawful conduct, they may face a claim alongside the company. This can arise in cases involving fraud, dishonest assistance, misrepresentation, misuse of confidential information, or other conduct causing loss.
Finally, a compliance failure can lead to scrutiny that is commercially damaging even before liability is determined. Freezing orders, document seizures, licence restrictions, reporting obligations, director disqualification risks, public enforcement action and difficult questions from banks, investors and counterparties can rapidly change the company’s position.
What regulators and courts are likely to examine
The central question is not whether the board had a compliance policy in a board pack. It is whether the board took reasonable steps to understand, govern and challenge the risk.
In a regulated financial or fintech business, that often means examining whether the directors understood the applicable licensing perimeter, the business model, and the risks created by customers, agents, payment flows, technology partners and cross-border activity. A director who does not manage day-to-day operations is not expected to conduct every customer check personally. They are expected to ensure that competent people, credible systems and meaningful escalation arrangements are in place.
Investigators commonly look at board minutes, risk registers, internal audit findings, compliance reports, training records, incident reports, emails and messaging records. They may compare what the board was told against information available elsewhere in the organisation. A repeated audit finding without a documented remediation plan can be far more damaging than a single isolated breach.
Warning signs may include unusually high-risk customers being onboarded without enhanced checks, sanctions or adverse-media alerts left unresolved, unexplained transaction patterns, overdue regulatory reporting, recurring cybersecurity incidents, or a compliance officer without sufficient authority or resources. None of these facts proves liability by itself. Together, they may support an argument that the board failed to respond reasonably.
Delegation is permitted, but passive reliance is risky
Boards must delegate. A director cannot personally operate every control in a growing business. The practical issue is whether the delegation was sensible and whether the directors maintained adequate oversight.
Reasonable reliance is stronger where the company has appointed qualified compliance, legal, finance and security personnel; defined their authority; ensured direct access to the board or a board committee; and tested the quality of the information being provided. It is weaker where compliance is treated as an administrative expense, reports are vague, or management filters bad news before it reaches the board.
Directors should also distinguish between a paper framework and an effective control environment. An AML policy is of limited value if customer due diligence is performed inconsistently. A cybersecurity policy will not answer an incident where access controls were never reviewed. A privacy notice cannot cure unlawful processing or poor breach response.
This does not mean a board must eliminate every breach. No compliance programme can guarantee that an employee, customer or third party will never evade controls. The legal and regulatory question is generally whether the company and its directors took proportionate, informed and timely steps in light of the risk.
Higher-risk situations for directors
The risk is often greatest when commercial pressure outruns governance. This is common where a start-up launches a product before obtaining clear licensing advice, a business expands into new markets through agents, or revenue targets discourage teams from escalating problematic customers.
Financial crime controls deserve particular attention. Under Malaysia’s anti-money laundering framework, regulated reporting institutions have specific duties relating to customer due diligence, record keeping, suspicious transaction reporting and internal controls. Failures can generate regulatory and criminal consequences. Directors should not assume that outsourcing onboarding, screening or transaction monitoring transfers their responsibility to assess the provider’s competence and performance.
Data protection and cybersecurity create a similarly board-level issue. A serious data incident can trigger operational disruption, regulatory engagement, contractual claims and reputational harm. Directors need clear visibility of what data the company holds, where it is stored, who can access it, how suppliers are controlled, and how incidents are escalated and investigated.
A director who joins after a problem began is not necessarily responsible for historic conduct. Yet once appointed, that director should not ignore credible evidence of an existing breach. Continuing failure after knowledge is obtained may create a different and more serious position.
What a defensible board response looks like
When a significant compliance concern is raised, speed and discipline matter. The first response should preserve the company’s ability to establish the facts and protect legal position. Avoid informal internal discussions that speculate, assign blame prematurely or alter records. Preserve relevant documents, system logs and communications, and consider whether legal professional privilege can be properly maintained through a lawyer-led investigation.
The board should then establish the scope of the concern: the relevant law or licence condition, the affected period, the people and systems involved, potential customer or public harm, and any reporting or notification deadline. This should be recorded in a clear decision trail. Minutes should reflect the information considered, the questions asked, the advice obtained and the rationale for the action taken.
The remedial plan should have ownership and dates, not merely aspirations. It may involve suspending a product or customer relationship, correcting filings, enhancing monitoring, retraining staff, replacing a provider, commissioning an independent review, or engaging with the regulator. The appropriate response depends on the facts. Self-reporting can demonstrate candour and control, but it should never be undertaken casually without understanding the legal implications and exposure for both the company and individuals.
For directors facing an inquiry, early independent advice is particularly valuable where there is potential divergence between the company’s interests and those of an individual officer. The company’s lawyer does not automatically represent every director personally.
Building oversight before the crisis
The most effective protection is evidence of active, proportionate governance before an incident occurs. Boards should receive regular reporting that is specific enough to support decisions: material breaches, unresolved high-risk cases, overdue remediation, regulatory developments, complaints, audit outcomes and the adequacy of resources. If a report is too general to reveal weaknesses, it is too general to govern by.
For heavily regulated businesses in Kuala Lumpur and across Malaysia, annual policy reviews alone are rarely enough. The board should test whether controls operate in practice, particularly after a new product launch, major outsourcing arrangement, acquisition, cyber incident or expansion into a new jurisdiction.
Compliance failures can place directors under intense personal and commercial pressure. A clear record of informed oversight, prompt escalation and decisive remedial action will not remove every risk. It does, however, place the board in a far stronger position to protect the company, its people and its reputation when scrutiny begins.