Licensed Company Secretary: Your First Defence Against Corporate Mule Risk in Malaysia

A registered Sdn Bhd with a proper name, an SSM registration number and a corporate bank account looks trustworthy. That is exactly why criminal syndicates want to use one.

In a recent feature in The Edge Malaysia (2 November 2026), Suruhanjaya Syarikat Malaysia (SSM) laid out how it is strengthening measures against “corporate mule” activities, where a legitimate company or its bank account is misused to receive scam money, move funds or hide where the money came from. SSM was clear that company secretaries sit on the front line of this fight.

For honest SME owners, this has two practical effects. First, your licensed company secretary will ask more questions than before, during incorporation and after. Second, if you have ever been tempted to “lend” your name, your company or your bank login to someone else, the risks are now far higher.

This guide explains what a corporate mule is, what SSM is doing about it, and the mistakes that can quietly put your company and your name at risk.

What Is a Corporate Mule?

A corporate mule is a company or business that is used, knowingly or unknowingly, to help with unlawful activity. Based on SSM’s explanation, it usually happens in four stages:

  1. A company is registered using another person’s identity, or with directors who are only on paper.
  2. A corporate bank account is opened in the company’s name.
  3. Control is handed over. The company’s credentials or online banking access end up with third parties.
  4. The account is used to receive scam proceeds, move funds through multiple accounts or disguise the origin of illicit money.

Victims of investment scams are more willing to transfer money to a “real company” than to an individual’s account. That borrowed credibility is what syndicates are buying.

A practical example

Imagine Ali, a young graduate, is offered RM800 a month to be “director” of a trading company. He signs the forms, attends a bank appointment, then hands the online banking token to the “boss”. He never sees the accounts.

Six months later, the company account receives money from dozens of scam victims. Ali’s name is on the SSM register as director. He is the person investigators contact first. Saying “I was only a director on paper” is not a defence the law recognises, because an appointed director is responsible for the company’s affairs.

Why SSM Is Tightening the Net in 2026

Malaysia’s corporate landscape is large and still growing. According to SSM, cumulative registrations stood at 1,650,853 companies as at 31 December 2025, with another 25,846 companies registered in the first half of 2026. Even a small fraction of misused companies can cause real harm to the public.

SSM’s own enforcement numbers show how seriously it is taking the problem:

  • 580 investigation papers opened in 2025, with 504 cases resolved
  • False and misleading company reporting was the largest category, at 271 cases
  • Beneficial ownership data checks were carried out on 691,690 companies, with 4,078 notices issued involving 46,016 companies
  • 40 physical inspections covering 1,279 companies were conducted on beneficial ownership information

On the company secretary side, SSM carried out 140 inspections under the Companies Act 2016 and 10 AML/CFT inspections in 2025. Actions included 463 compounds, 36 show-cause notices for failing to act honestly or exercise reasonable diligence, and four warning letters for failing to verify company information before submission.

SSM has also said it will propose further measures, including guidelines for the direct verification of company officers and the registration of nominees.

The message is simple. The people named in a company’s records must genuinely be who they claim to be, and the information lodged with SSM must reflect who is really behind the company.

The Role of a Licensed Company Secretary as Gatekeeper

Under the Companies Act 2016, every Sdn Bhd must appoint at least one company secretary, who must be licensed by or registered with SSM and hold a valid practising certificate. As of 30 September 2026, SSM reported 7,548 company secretaries with active practising certificates.

SSM describes company secretaries as gatekeepers of Malaysia’s corporate ecosystem. Company secretaries are also Reporting Institutions under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA). That means customer due diligence is a legal duty, not a courtesy. You can read more in our guide on AML/CFT obligations for company secretaries in Malaysia.

From 1 January 2026, SSM’s enhanced guidelines also made AML/CFT training mandatory for company secretaries, alongside a stronger duty to verify documents before submitting them to SSM.

What “Know Your Customer” really means now

KYC used to feel like a photocopy of your IC. Today, a responsible company secretary needs to understand:

  • Who is setting up the company, and whether they are who they say they are
  • What business it will actually carry out
  • Who ultimately owns or controls it, including anyone behind the shareholders on record
  • Why each director is being appointed, and whether they know the business
  • Who will control the bank account
  • Whether the structure makes commercial sense

SSM’s guidance puts it plainly: do not incorporate first and ask questions later.

This is where a licensed company secretary earns their fee. A proper KYC conversation at the start protects you from approving a structure that regulators, banks or auditors will question later. If you are about to register, our Sdn Bhd incorporation service builds this verification into the process from day one.

Red Flags SSM Wants Company Secretaries to Catch

SSM has highlighted warning signs that should trigger extra questions. If your company secretary raises any of these, it is not personal. It is their legal duty.

  • A proposed director who knows little about the business
  • Unexplained involvement of third parties in the setup or decisions
  • Unusual urgency to incorporate several companies at once
  • People other than the declared directors, shareholders or beneficial owners appearing to call the shots
  • Requests to add someone to the bank mandate who has no official role

Common Mistakes SME Owners Make

Many corporate mule cases start with ordinary people making convenient decisions. These are the mistakes we see most often.

1. Lending your name as a “favour”
Being a director for a friend or relative who “just needs a Malaysian name” makes you legally responsible for the company. SSM does not recognise name-lending arrangements as a defence.

2. Sharing online banking access
Handing your token, TAC device or login to a business partner, agent or “accountant” who is not an authorised signatory is one of the clearest routes to misuse.

3. Treating beneficial ownership as paperwork
Every company must identify and record its beneficial owners and lodge that information with SSM. Inaccurate or outdated details can be treated as false information. Our beneficial ownership reporting guide explains what is required.

4. Signing documents you have not read
Under Section 591 of the Companies Act 2016, knowingly making a false or misleading statement in a required document, or intentionally leaving out material information, is an offence. Individuals face up to 10 years’ imprisonment, a fine of up to RM3 million, or both.

5. Choosing the cheapest secretary with no questions asked
If a provider asks for nothing beyond your IC and payment, ask yourself what else they are not checking. A lack of due diligence is a warning sign, not a convenience.

What About Nominee Directors?

Foreign founders often need a locally resident director. Nominee arrangements are lawful, but SSM’s plan to propose guidelines on registering nominees signals that transparency expectations are rising.

If you use a nominee, make sure the true beneficial owner is properly declared to SSM and the arrangement is documented. iComSec does not act as nominee director, but we can refer you to partner firms and handle the related secretarial and beneficial ownership filings. See our nominee director page for how this works.

How to Protect Your Company: A Simple Checklist

  • Only appoint directors who genuinely understand and take part in the business
  • Keep bank mandates limited to authorised signatories, and never share credentials
  • Make sure your beneficial ownership information is accurate and updated whenever it changes
  • Read and understand every resolution and form before you sign
  • Work with a licensed company secretary who holds a valid SSM practising certificate
  • Run an SSM company search on your own company now and then to confirm the records are correct
  • Respond to SSM notices promptly, and get help if you are unsure

If you are reviewing your current setup, our company secretary duties guide shows what a proper secretary should be doing for you throughout the year.

Frequently Asked Questions

What is a corporate mule in Malaysia?

A corporate mule is a registered company or business, and usually its corporate bank account, that is used to receive scam money, move funds or conceal illicit proceeds. The people named in the company may be complicit or may have been used without fully understanding the risk.

Why does my licensed company secretary ask so many KYC questions?

Company secretaries are Reporting Institutions under AMLA and must carry out customer due diligence. SSM also requires them to verify information before submitting it. These checks protect you from structures that could later be flagged by SSM, banks or enforcement agencies.

Can I be held responsible if I was only a director on paper?

Yes. An appointed director is responsible for the company’s affairs and compliance under the Companies Act 2016. SSM does not recognise name-lending as a defence, and directors of misused companies can be investigated.

What is the penalty for giving false information to SSM?

Under Section 591 of the Companies Act 2016, knowingly making a materially false or misleading statement in a required document can lead to imprisonment of up to 10 years, a fine of up to RM3 million, or both.

How do I check whether a company secretary is licensed?

Ask for their SSM licence or registration number and confirm they hold a current practising certificate. SSM has taken action against company secretaries who failed to renew their certificates on time, so this check matters.

Conclusion: Compliance Is Now About Integrity, Not Just Filing

SSM’s push against corporate mules changes what good compliance looks like. It is no longer enough to file on time. Regulators want to know that your company is genuine, that the people on record are real decision makers, and that your beneficial ownership information is accurate.

A licensed company secretary is the partner who helps you meet that standard without guesswork. Asking the right questions at the start is far cheaper than answering them in an investigation later.

At iComSec, our licensed company secretaries handle e-KYC, beneficial ownership lodgement, statutory records and SSM filings for SMEs across Malaysia, so you can focus on running your business with confidence.

Ready to make sure your Sdn Bhd is set up and maintained the right way? Contact iComSec for a consultation, or explore our company secretary services and pricing plans.

Related Reading