Breach of Section 58(1) of the Capital Markets and Services Act 2007 (“CMSA”) read together with Section 354(1)(a) of the CMSA.

Carrying on a business in a regulated activity of providing investment advice to others concerning securities without holding a Capital Markets Services Licence.

1. Reprimand for the breach; and
2. Total Penalty of RM266,660.08 for the breach.

18 December 2025

On 24 December 2025, Nik Zulfaiza filed a review application with the SC against the quantum of penalty imposed.

The review application was dismissed by the SC on 11 March 2026.

Breach of:

1. Paragraph 8.01 of the Guidelines on Conduct for Capital Market Intermediaries (effective from 1 April 2022 to 30 September 2023) (“Conduct Guidelines”); and
2. Paragraph 8.03 of the Conduct Guidelines,

read together with Section 356(1)(a) of the CMSA

MBSB Investment Bank Berhad (formerly known as MIDF Amanah Investment Bank Berhad) (“MBSB IB”)

1. Failure to have in place appropriate and effective safeguards to protect clients’ information (“Breach 1”); and
2. Failure to have in place effective mechanisms to protect clients’ information from any risk of misuse and unauthorised disclosure (“Breach 2”).

1. Reprimand for each of the two (2) breaches; and
2. Penalty in the total sum of RM900,000 for the two (2) breaches.

1 August 2025

On 19 August 2025, MBSB IB filed a review application seeking for the SC to review the finding of breaches and penalty imposed against MBSB IB.
The review application was dismissed by the SC on 26 February 2026.

5 February 2026

Breach of:

(a) Paragraph 7.21 of the Guidelines on Technology Risk Management (effective 19 August 2024) (“GTRM”);

(b) Paragraph 6.02 of the GTRM; and

(c) Paragraph 9.16 of the GTRM,

read together with Section 356(1)(a) of the CMSA.

1. Failure to, as part of its technology risk management, implement effective measures to prevent losses from data breach or other acts of internal or external threats, negligence and cyber-attack (“Breach 1”);
2. Failure to establish and implement comprehensive and effective policies and procedures to support the Technology Risk Management Framework (“Breach 2”); and
3. Failure to establish clearly defined communication plan including escalation and decision-making processes to ensure that any adverse effect of a cyber incident is properly managed and recovery action can be initiated quickly (“Breach 3”).

1. Reprimand for each of the three (3) breaches; and
2. Total Penalty of RM500,000.00 for the three (3) breaches.