On the Board of a Malaysian Subsidiary?
Your Multinational Group’s Anti-Bribery Policy May Not Protect You

What parent-appointed directors and relevant executives need to know about personal exposure under Malaysia’s section 17A.

A multinational group may have a comprehensive anti-bribery policy, mandatory online training and regional compliance oversight. Its Malaysian subsidiary may even have formally adopted that policy. But if bribery occurs, those measures do not necessarily protect a director of the Malaysian subsidiary appointed by the multinational parent, or a relevant executive, from personal liability.

For directors of a Malaysian subsidiary, the group policy is only the starting point. Their position also depends on whether the policy was implemented effectively and what preventive steps they personally took. Chief legal and compliance officers should likewise consider whether their roles bring them within the personal liability regime.

1. The Exposure Is Personal, Not Merely Corporate

Section 17A(1) of the Malaysian Anti-Corruption Commission Act 2009 makes a commercial organisation liable where a person associated with it corruptly gives, agrees to give, promises or offers gratification with the intention of obtaining or retaining business, or an advantage in the conduct of business, for that organisation. The provision is not confined to bribery of public officials.

Under sections 17A(6) and (7), an associated person includes a director, partner or employee, as well as anyone performing services for or on behalf of the organisation. Whether services are performed is determined from all relevant circumstances, so exposure may arise through intermediaries as well as employees.¹

Section 17A(3) brings individuals within the liability regime. If the commercial organisation commits an offence, every person who was, at the relevant time, its director, controller, officer or partner, or concerned in managing its affairs, is deemed to have committed the same offence unless that person establishes the statutory defence. Formal title is not decisive: an executive who does not sit on the Malaysian board may still fall within one of these categories.¹

The consequences are substantial. Section 17A provides for a fine of at least ten times the value of the gratification, where capable of valuation or pecuniary in nature, or RM1 million, whichever is higher; imprisonment of up to 20 years; or both.²

2. The Personal Defence Has Two Cumulative Requirements

Under section 17A(3), the individual must prove both:

• that the offence was committed without the individual’s consent or connivance; and
• that the individual exercised the due diligence that ought to have been exercised to prevent it, having regard to the nature of the individual’s function and the circumstances.

A director who neither approved nor knew about the payment must still prove the preventive diligence appropriate to the director’s responsibilities and circumstances. The expected steps will therefore differ between, for example, a non-executive director, managing director and finance executive.

The individual defence under section 17A(3) should not be confused with the organisation’s defence under section 17A(4). The organisation must prove that it had adequate procedures to prevent associated persons from engaging in the prohibited conduct. Although the same compliance programme may provide evidence relevant to both defences, the individual must still prove their own due diligence.²

3. Appointment by the Multinational Parent Does Not Dilute Local Responsibilities

Appointment by the multinational parent does not displace a director’s duties to the Malaysian subsidiary. Section 213 of the Companies Act 2016 requires a director to act for a proper purpose, in good faith and in the company’s best interests, and to exercise reasonable care, skill and diligence. Section 217 further provides that a director appointed by, or as a representative of, a member or employer must not subordinate the duty owed to the company to the interests of the nominator.³

A parent-appointed director should therefore assess whether the group’s anti-corruption arrangements adequately protect the Malaysian subsidiary. If those arrangements are insufficient, the director should seek appropriate improvements rather than treat group approval as conclusive.

This governance responsibility sits alongside the separate question of whether the director can establish the personal defence under section 17A(3). Similarly, an executive falling within section 17A(3) must consider their own responsibilities. Reporting to a regional manager does not replace the statutory due-diligence inquiry.

4. Why Adopting the Group Policy Is Not Enough

Adopting the multinational group’s policy is evidence that the Malaysian subsidiary has taken a formal compliance step. It says much less about whether the policy addresses the subsidiary’s actual exposure, such as its use of agents, distributors or customs intermediaries, or whether the prescribed controls are followed in practice.

The Guidelines on Adequate Procedures issued under section 17A(5) require measures proportionate to the organisation’s scale, nature, industry, risks and complexity. Their T.R.U.S.T. principles address top-level commitment, risk assessment, control measures, systematic review, monitoring and enforcement, and training and communication.⁴

5. What Directors and Executives Should Do

The following measures translate the statutory test and the Guidelines into practical action. They are not a guaranteed safe harbour: the availability of the defence depends on the individual’s function, circumstances and evidence.

Understand the subsidiary’s corruption risks. Require a documented assessment of the subsidiary’s business, transactions and relationships, including procurement, licensing, customs, sales channels, intermediaries, government interactions, donations and sponsorships. Reassess when acquisitions, tenders, distributors or business models change.

Test the group policy against local operations. Assess the policy against Malaysian requirements and the subsidiary’s actual risks. Supplement it where necessary with local procedures, approval thresholds and reporting arrangements. Specify who approves hospitality, commissions, donations and higher-risk third parties, who may stop a transaction and how exceptions are escalated.

Allocate responsibility, authority and resources. Ensure that a competent compliance person or function has a clear mandate, sufficient resources and appropriate reporting lines. Group or external support may be used, but responsibility for the Malaysian subsidiary should be explicit. Directors should require meaningful reporting to the board, while executives should implement controls within their remit and escalate material problems.

Scrutinise intermediaries and their payments. Apply risk-based due diligence and continuing monitoring to relevant intermediaries. For higher-risk appointments, establish ownership, need, commercially justified remuneration and evidence of services, then apply suitable approvals, segregation of duties, payment verification and escalation. An anti-corruption undertaking supports but does not replace that scrutiny.

Make training and reporting usable. Ensure that employees and relevant business associates understand the rules in the context of their work. Procurement, sales, finance and government-facing personnel may require different scenarios and instructions. Reporting channels should be accessible, permit concerns to bypass implicated management and prohibit retaliation.

Challenge assurances and act on warning signs. Do not treat training statistics or an absence of reports as proof that controls work. Test higher-risk transactions, investigate credible concerns promptly, contain risks, remedy weaknesses and obtain advice on reporting obligations.

Preserve evidence of personal diligence. Keep contemporaneous records of questions, materials, decisions, requested resources and follow-up. Minutes should record substantive challenges, further testing and remediation deadlines rather than merely state that the board “noted” a report. Documentation cannot substitute for effective action, but it can help prove what the individual actually did.

6. The Questions Directors, Group Legal and Compliance Teams Should Ask

For each Malaysian subsidiary, its directors, together with group legal and compliance teams, should be able to answer:

• What are its material corruption risks?
• Who owns the controls addressing those risks?
• What evidence shows that those controls work?
• What have its directors and executives done about identified deficiencies?

These questions test whether the group policy operates as effective local controls and whether directors and executives can demonstrate the diligence required of them.

Directors need not conduct every compliance review personally. They should, however, be able to show what they did within their responsibilities to prevent the misconduct. Adoption of the group policy may support that evidence, but will not by itself establish the defence.