Self-custodial wallet / non-custodial software in Malaysia
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is permitted in Malaysia with no licensing burden.
Verdict Details
- Permitted
- yes
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML/CFT obligations attach to the software publisher because the publisher never holds, controls, or has access to user funds or private keys — the regulated activities under Malaysian law (exchanges, transfers, safekeeping/administration, participation in IEOs) all require custody or intermediation (my.aml.exchanges-between-digital-currencies-and, my.aml.exchanges-between-one-or-more, my.aml.transfers-of-digital-currencies, my.aml.safekeeping-andor-administration-of-digital).
Key Restrictions
- The non-custodial wallet software publisher must not hold, control, or have access to user private keys or funds — doing so would trigger DAX registration requirements (my.licensing.custody).
- The software must not offer exchange, transfer, or brokerage services between digital currencies or between fiat and digital currencies (my.aml.exchanges-between-digital-currencies-and, my.aml.transfers-of-digital-currencies).
- The publisher should not participate in IEOs or facilitate the offer/sale of digital currencies on behalf of users, as that would trigger SC oversight (my.aml.participation-in-and-provision-of).
Key Risks
- Regulatory ambiguity — Malaysian law prescribes digital currency and digital tokens as securities (Capital Markets and Services (Prescription of Securities) Order 2019), and SC has taken aggressive enforcement against unregistered platforms, including a cease-and-desist against Binance in 2021 (my.enforcement.entity-targeted-binance-holdings-limited, my.licensing.legislation-capital-markets-and-services-prescription-of-securities-orde).
- Risk that SC or BNM reinterprets non-custodial wallet distribution as 'participation' in regulated activities if the software has any integrated swap, bridge, or fiat on-ramp features.
- No specific consumer-protection or disclosure rules are cited for pure non-custodial software publishers — this regulatory gap creates uncertainty about which legal framework applies.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
SC Malaysia — Digital asset exchange registration, IEO oversight, cease-and-desist enforcement
Capital Markets and Services (Prescription of Securities) Order 2019 (2019) — Digital currency and digital token as prescribed securities
Guidelines on Digital Assets (2020) — DAX operator requirements
VASP: Recognized Market Operator (RMO) — DAX registration with SC. Only 5 operators registered (Luno, Tokenize, MX Global, Sinegy, Hata). SC strict and slow on registrations. 6-12 months.
CUSTODY: Included under DAX registration; customer asset segregation required
EXCHANGE: DAX registration with SC — MYR 5M (~$1.1M USD) minimum shareholders' funds. SC issued cease-and-desist orders against unregistered operators (incl. Binance 2021). IEO framework requires separate SC approval.
Exchanges between digital currencies and fiat currencies.
Exchanges between one or more forms of digital currencies.
Safekeeping and/or administration of digital currencies or instruments enabling control over digital currencies.
Participation in and provision of financial services related to an issuer’s offer and/or sale of a digital currency.
Entity Targeted: Binance Holdings Limited and its CEO, Changpeng Zhao (CZ). Violation Type: Operating a Digital Asset Exchange (DAX) without registration/license, which is a violation under the Capital Markets and Services Act 2007. The SC considers digital assets as securities, and operating a platform for trading them requires authorization. Penalty Amount: No explicit monetary fine was announced at the time of the public reprimand. The penalties were operational: a public reprimand, an order to cease all operations in Malaysia, disable access to its website and mobile applications, and cease all media and marketing activities targeting Malaysian investors. Outcome: Binance was forced to shut down its direct operations in Malaysia. Malaysian users were advised to withdraw their funds. The action led Binance to later pursue a compliant pathway to re-enter the Malaysian market by acquiring a stake in and partnering with a licensed local Digital Asset Exchange (DAX), MX Global, demonstrating the effectiveness of the SC's enforcement in driving regulatory compliance.
Entity Targeted: Various unauthorized digital asset platforms, investment schemes involving crypto, and individuals promoting them. (Specific names are too numerous to list here, but are updated frequently). Violation Type: Operating or promoting unauthorized investment schemes, digital asset exchanges, or services without the necessary licenses or approvals from the SC Malaysia. Penalty Amount: Typically no specific monetary penalty is announced publicly for being added to the alert list. The "penalty" is a public warning, which often leads to the platform being unable to operate effectively in Malaysia and subsequent cessation of operations or blocking of access. Outcome: Public awareness is raised, and investors are warned against dealing with these entities. This often leads to reduced or ceased operations for the targeted entities within Malaysia.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Yes — publishing non-custodial wallet software in Malaysia does not trigger VASP/DAX licensing or AML obligations because the regulated activities (exchange, transfer, safekeeping) presuppose custody and intermediation, though operators must be cautious not to integrate custody-adjacent features that could invite SC enforcement.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?