Practice Note No.1/2021 - Controls for Higher Daily Online Settlement

6 August 2020

This Practice Note is issued on 6 August 2021 under section 377 of the Capital Markets and Service Act 2007 and comes into effect on 1 September 2021.
This Practice Note is applicable to all Capital Market Services Licence (CMSL) holders dealing in securities, dealing in derivatives, dealing in private retirement schemes and fund management (collectively referred to as ‘the CMSL holder’) who makes use of online merchant-initiated payment solutions¹ to settle transactions of their individual client that are above RM30,000.
The CMSL holder is required to put in place adequate policies and procedures to manage and mitigate the risk of fraud and other abuses, including –

pre-registering identifiers/information to enable verification of identity of the customer, such as bank account number, National Registration Identity Card number or other information required by payment solution service providers;
allowing customers to only fund their trading accounts/transactions from bank accounts which have been verified by the CMSL holder through the proper matching of identifiers;
where a customer uses a third-party bank account for the purposes of payment for a trading account/transaction, undertaking the necessary assessments to verify the identity and relationship of the third party before pre-registering the bank account and adhering with the customer due diligence procedures set out in the Guidelines on Prevention of Money Laundering and Terrorism Financing for Reporting Institutions in the Capital Market; and
permitting sale proceeds/withdrawals to be transferred to only verified bank accounts under the customer’s name and not to any third-party’s bank account.

The CMSL holder is responsible to ensure that only payments from a verified bank account is accepted.
In the event of a failed matching, the CMSL holder shall undertake timely refunds to the originating bank account according to the relevant CMSL holder’s refund policy.
The CMSL holder shall ensure that all policies and procedures as outlined above are in place before commencing with the implementation of higher settlement limit for their customers.

Frequently Asked Questions

Introduction

As part of the initiative to increase the online settlement limit and reduce the dependency on cheque payments for large capital market transactions, the Securities Commission Malaysia (SC) has issued a Practice Note on the Controls for Higher Daily Online Settlement (Practice Note) which outlines the control measures for applicable Capital Market Services Licence (CMSL) holders to mitigate risk of fraud associated with a higher transaction limit.

Who would this Practice Note and the controls specified therein be applicable to?
These controls are applicable only to CMSL holders dealing in securities, dealing in derivatives, dealing in private retirement schemes and fund management (collectively referred to as “the CMSL holder”) who wishes to subscribe to merchant-initiated payment solutions to settle transactions of individual clients that are above RM30,000.

The CMSL holders may engage their payment solution service providers for the necessary arrangements.
What does the settlement limit refer to?
The settlement limit refers to the per-transaction limit for online payments.
What is the definition of “online merchant-initiated payment solutions”?
For the purpose of this Practice Note, “online merchant-initiated payment solutions” refers to a solution for payments that are initiated by the CMSL holder. The customers will make payment through payment gateways integrated to the CMSL holder’s digital platform. This would include FPX, DuitNow Online Banking/Wallets or other approved payment platforms that supports the higher settlement limit above RM30,000.

Transfers through Interbank Giro (IBG), JomPay, RENTAS, and Duitnow would not fall under the ambit of the Practice Note as they are customer-initiated payments, where customers make payments directly from their own individual online banking/e-wallet, without going through the CMSL holder’s digital platform.
What are the identifiers that need to be pre-registered for verification purposes?
The identifiers required to be pre-registered would depend on the payment solution service providers’ payer verification needs. This could include bank account number, National Registration Identity Card (NRIC) number or any other information for identification purposes. CMSL holders may approach their payment solution service providers on the necessary arrangements.
What is the rationale to pre-registration of relevant customer identifiers?
With higher settlement limit, there is a need for controls to be in place to manage fraud risks and mitigate severe fraud losses. The Practice Note stipulates for pre-registered customer identifiers, such as bank account number or others, which can be used by payment solution service providers to verify the payer’s identity for settlements at higher limit.
How is the verification as required by the Practice Note to be done?
CMSL holders may engage their payment solution service provider for clarifications on the processes involved.
Would the usage of multiple bank accounts (including third party bank accounts) be allowed for fund transfers/ withdrawals?
Customers are allowed to register more than one bank account, as customer identifiers. For a customer opting to pre-register a third-party bank account, CMSL holders will need to conduct the required customer due diligence (CDD) per the Guidelines on Prevention of Money Laundering and Terrorism Financing for Reporting Institutions in the Capital Market (AML/CFT Guidelines) to, among others, verify the identity and relationship with the said customer. These pre-registered bank accounts may then be used for inward transfers to the CMSL holder.

For outward transfers or withdrawals from a CMSL holder, transfers are only allowed to be done to bank accounts in the customer’s name and not to a third party.
On refunds, would the payment solutions service provider be able to return more than just the bank holder’s name for CMSL holders’ verifications (i.e. bank account number, ID)?
CMSL holders may engage their payment solution service provider for clarifications on the refund processes.
At which point of failed verification would the refund procedure be initiated?
The refund procedure should be initiated by the CMSL holders at the point of failed matching by the payment solution service provider.
What is the timeline for CMSL holders to implement the required controls through the reconfiguration of its systems and procedures?
The requirements for additional controls in the Practice Note would only be applicable to the CMSL holders who subscribes to the higher settlement solution. The CMSL holders shall ensure that all necessary policies and procedures are in place before commencing with the implementation of higher settlement limit above RM30,000 for their customers.

FPX or other approved payment platforms.