Corporate Liability for Corruption Under Section 17A MACC Act

What Is Section 17A of the MACC Act 2009?

Section 17A of the Malaysian Anti-Corruption Commission Act 2009 (MACC Act) introduced a form of corporate liability for corruption that came into force on 1 June 2020. This provision fundamentally changed how Malaysian law treats bribery involving companies.

Under this section, a commercial organisation commits an offence if a person associated with it corruptly gives, agrees to give, promises or offers any gratification to any person. The corrupt act must be intended to obtain or retain business for the organisation, or to obtain or retain an advantage in the conduct of business for the organisation.

The term "commercial organisation" is defined in section 17A(8). It covers companies incorporated under the Companies Act 2016, companies incorporated anywhere that carry on business or part of a business in Malaysia, partnerships under the Partnership Act 1961, limited liability partnerships, and partnerships formed elsewhere that carry on business in Malaysia.

Who Is an Associated Person?

The law casts a wide net when defining who counts as an associated person. This includes:

• Directors, partners, and employees of the organisation
• Any person who performs services for or on behalf of the organisation
• For example, agents, contractors, subcontractors and consultants, where they perform services for or on behalf of the organisation

This means your company could face criminal liability for corrupt acts committed by external sales agents, joint venture partners, customs brokers, or any third party acting on your behalf, even if you had no knowledge of the misconduct. Whether someone performs services for the organisation is decided on all the relevant circumstances, not just the label on the relationship (section 17A(7)).

Personal Liability for Directors and Management

Section 17A(3) creates personal criminal liability for individuals in leadership positions. Where the organisation commits an offence under Section 17A, every person who, at the time, was its director, controller, officer or partner, or was concerned in the management of its affairs, is deemed to have committed that offence unless that person proves both of the following:

• The offence was committed without their consent or connivance, and
• They exercised the due diligence to prevent it that they ought to have exercised, having regard to the nature of their role and the circumstances

The burden is on the individual, not the prosecution. A director who never put anti-corruption controls in place, or who ignored warning signs, may find it hard to show the due diligence the section requires.

Under section 17A(2), the penalty on conviction is a fine of not less than ten times the sum or value of the gratification (where it can be valued) or one million ringgit, whichever is higher, or imprisonment for up to twenty years, or both. Because a director or manager under section 17A(3) is deemed to have committed the same offence, the same penalty applies to them.

The Adequate Procedures Defence

Section 17A(4) provides a statutory defence. A commercial organisation will not be guilty if it proves that it had in place adequate procedures designed to prevent persons associated with it from undertaking corrupt conduct.

This is the statutory defence for the organisation, and the burden is on the company to prove that adequate procedures were in place at the time of the offence.

The Prime Minister's Department issued the Guidelines on Adequate Procedures under section 17A(5) in December 2018 to help organisations understand what constitutes adequate procedures. These guidelines introduce the T.R.U.S.T. principles.

The T.R.U.S.T. Principles Explained

T — Leadership Commitment

Senior management must be committed to preventing corruption. This means the board of directors or equivalent body must establish a clear anti-corruption policy, communicate it throughout the organisation, and lead by example. The commitment must be more than words on paper—it must be demonstrated through actions and resource allocation.

R — Risk Assessment

The organisation must conduct regular assessments to identify the nature and extent of its corruption risks. Risk assessments should consider the countries where you operate, the sectors involved, the types of transactions undertaken, and the third parties you deal with. Different businesses face different risk profiles, and your procedures should reflect your specific circumstances.

U — Undertake Control Measures

Based on the risk assessment, the organisation must implement proportionate control measures. These may include due diligence on business partners, financial controls over gifts and entertainment, clear approval processes for high-risk transactions, and proper record-keeping. Controls should be documented and embedded in standard operating procedures.

S — Systematic Review, Monitoring and Enforcement

Procedures must be monitored and reviewed regularly. This includes internal audits, compliance checks, and updating policies when risks change. Critically, the organisation must enforce its policies. If violations occur, there must be consistent disciplinary action regardless of the seniority of the person involved.

T — Training and Communication

All personnel must understand the anti-corruption policy and know how to apply it. Training should be tailored to different roles and risk levels. The organisation should also establish secure channels for reporting suspected corruption, protecting those who report in good faith.

Practical Checklist for Owner-Managed Companies

Smaller companies often assume Section 17A targets large corporations. This is incorrect. The law applies to all commercial organisations, including Sdn Bhd companies with a single shareholder-director. Here is a practical checklist:

Governance and policy:

• Adopt a written anti-corruption policy approved by the board or shareholders
• Include anti-corruption commitments in your company's code of conduct
• Document board-level responsibility for compliance oversight

Risk assessment:

• Identify which of your business activities involve government dealings, permits, or licences
• Map your third-party relationships, particularly sales agents and intermediaries
• Assess which transactions carry higher corruption risk

Controls:

• Implement due diligence checks before engaging agents or distributors
• Set clear limits on gifts, entertainment, and hospitality
• Require written approvals for payments that could raise red flags
• Include anti-corruption clauses in contracts with third parties

Monitoring:

• Review compliance procedures at least annually
• Keep records of all risk assessments and policy reviews
• Investigate any reports of suspected misconduct promptly

Training:

• Brief all staff on the anti-corruption policy when they join
• Provide refresher training periodically, particularly for staff in higher-risk roles
• Document attendance and content of all training sessions

Why This Matters for Business Owners

For owner-managed companies, the personal liability provisions under Section 17A(3) deserve particular attention. If you are both a shareholder and director, and your company is convicted of an offence under Section 17A, you are deemed to have committed the offence unless you prove you did not consent or connive and that you exercised proper due diligence to prevent it.

The adequate procedures defence requires evidence that systems were in place before any corrupt act occurred. Policies written after an investigation begins will not show that procedures were in place at the time. Records of policies, training and checks made in the ordinary course are what a court will look at.

Proportionality matters. The guidelines recognise that a small trading company cannot implement the same elaborate compliance programme as a multinational corporation. What matters is that your procedures are reasonable and appropriate for your size, resources, and risk profile. A documented, genuine effort to prevent corruption—even if modest in scale—is far better than no effort at all.

Common questions

Does Section 17A apply to small private companies?

Yes. Section 17A applies to all commercial organisations incorporated or carrying on business in Malaysia, including small Sdn Bhd companies with only one or two shareholders.

Can I be personally charged if my employee pays a bribe without my knowledge?

Potentially yes. If the company is guilty, Section 17A(3) deems its directors and managers guilty too, unless each proves the offence happened without their consent or connivance and that they exercised due diligence to prevent it.

What must I prove to use the adequate procedures defence?

Your company must prove that it had adequate procedures in place to prevent associated persons from giving bribes. The government's Guidelines on Adequate Procedures, built around the T.R.U.S.T. principles, explain what such procedures look like.

Do I need a formal compliance department to satisfy the law?

No. The law requires procedures proportionate to your company's size and risk profile. Small businesses can satisfy the requirements with documented policies, basic due diligence, and staff training.

When did Section 17A come into force?

Section 17A came into force on 1 June 2020. Corrupt conduct by an associated person on or after that date can lead to corporate liability.