Malaysia regulates crypto exchanges through the Digital Asset Exchange (DAX) Operator regime, a sub-category of the Regulated Market Operator (RMO) framework supervised by the Securities Commission Malaysia (SC). Since 2019, digital currencies and tokens have been prescribed as securities, bringing them squarely under capital-markets rules. Only SC-approved assets may be listed or traded.

The legal stack combines the Capital Markets & Services Act 2007 (CMSA, as amended) and two cornerstone rulebooks: Guidelines on Regulated Market Operators and Guidelines on Digital Asset Exchanges. A notable threshold is the minimum paid-up capital of MYR 5,000,000 (≈ USD 1.05M). In 2025, CMSA amendments clarified the statutory definition of a “digital token,” further aligning supervision with market practice.

The DAX Operator license authorizes operation of a crypto exchange using an order book and/or digital broker model, with listing limited to SC-approved tokens (e.g., BTC, ETH, AVAX, MATIC, BCH, XRP, LTC, SOL, LINK, UNI, ADA — subject to SC updates). Margin, derivatives, staking, lending, or advisory generally require separate permissions or are restricted.

Malaysia is a high-bar, slow-track jurisdiction. Few licenses are granted and scrutiny is deep.

• Establish a resident Malaysian company (not Labuan).
• Appoint an initial board of directors and a company secretary.
• Begin funding to meet the MYR 5,000,000 paid-up capital requirement.

• Appoint a Responsible Person (RP) (must be CEO/CFO/COO).
• Draft full policy suites: AML/CFT & KYC/EDD, market surveillance, custody, cybersecurity, BCP/DR, conflicts of interest, insider-trading prevention, etc.
• Set up internal audit and risk management functions; prepare financial projections and token listing/admission criteria.

File the dossier with the SC; expect multiple interview rounds, clarifications, and iterations on governance, custody, and IT architecture. Approval leads to authorization and inclusion in SC’s public list of licensed DAX operators. Total timeline often exceeds one year.

• Entity: Malaysian resident company (Labuan entities cannot apply).
• Capital: MYR 5,000,000 paid-up (plus additional MYR 5,000,000 for broker models).
• People: Board and management must pass fit & proper tests; RP must be CEO/CFO/COO.
• Compliance: AML/CFT aligned with FATF; continuous monitoring and STR filing.
• Technology: Cybersecurity, incident response, segregation of client assets, wallet policies.
• Market Integrity: Real-time surveillance for manipulation; clear token listing/delisting processes.
• Audit & Reporting: Annual external audit, returns, penetration tests, and IT audits.

• CMSA 2007: main statute for RMO/DAX licensing.
• 2019 Prescription Order: designates crypto assets as securities.
• 2025 Amendment: refines “digital token” definition.
• RMO & DAX Guidelines: detailed operational standards.
• Registry: SC publishes active and former licensees online.

• Corporate Income Tax: 24% on profits.
• Withholding Tax: none generally (5–10% on royalties, depending on treaties).
• Capital Gains: no tax on crypto gains for companies or individuals (confirm with tax counsel).
• Labuan entities are ineligible for onshore DAX license (distinct regime applies).

• Maintain fair, orderly, transparent markets.
• Offer only SC-approved assets.
• Keep segregated custody accounts and adequate liquidity.
• File annual audited reports and periodic IT/cyber tests.
• Notify and seek SC approval for key personnel or ownership changes.

Malaysia enforces strictly. Unlicensed activities or non-compliance can trigger license revocation, market bans, heavy fines, or criminal liability. Notable actions demonstrate SC’s strong stance on investor protection.

Why Malaysia (Onshore DAX):

• Transparent capital-markets regime with investor focus.
• High institutional credibility and brand reputation.
• Clear token-admission and operational rulebooks.

Key Constraints:

• High capital and staffing thresholds.
• Limited token list (SC-approved).
• Lengthy approval process with intensive supervision.

1. Incorporate resident Malaysian company (not Labuan).
2. Fund MYR 5m+ paid-up capital; set board and RP.
3. Build AML/CFT, custody, cybersecurity, and risk frameworks.
4. Design token listing process; prepare application package.
5. File with SC and complete review cycles.
6. Operate under ongoing reporting and audit requirements.