AML/CFT for DNFBPs: Accountants, Lawyers & Company Secretaries

Who is a DNFBP

AMLA's obligations do not fall only on banks and insurers. Designated non-financial businesses and professions (DNFBPs) are invoked as reporting institutions under the First Schedule of AMLA and supervised for AML/CFT purposes. In Malaysia this includes:

Accountants and audit firms
Advocates and solicitors (lawyers)
Company secretaries and trust or company service providers
Real-estate agents
Dealers in precious metals and precious stones
Licensed casinos and gaming operators

When the obligations bite

For most professions, AML/CFT obligations attach to specific “gatekeeper” activities — the transactions where a professional can, wittingly or not, help move or disguise illicit funds. For accountants and lawyers these typically include:

Managing client money or assets

Handling funds, securities or other assets on behalf of a client.

Company & arrangement formation

Creating, operating or managing companies, trusts or similar structures.

Real-estate & business transactions

Acting in the buying and selling of real estate or business entities.

Managing accounts

Managing bank, savings or securities accounts for clients.

The same core obligations apply

As reporting institutions, DNFBPs carry the same AML/CFT duties as financial institutions, scaled to their risk:

Customer due diligence and beneficial-ownership verification
A risk-based approach and an institutional risk assessment
Suspicious transaction reporting to BNM
Record-keeping sufficient to reconstruct transactions
A compliance programme with a designated compliance officer and staff training

Professional privilege is not a blanket shieldLegal professional privilege has limits in the AML/CFT context and does not extend to advice sought to further a crime. Professionals should understand precisely where privilege applies before relying on it to withhold a report.

Why DNFBPs are under growing scrutiny

The FATF and Malaysia's own National Risk Assessment recognise DNFBPs as attractive channels for laundering — professionals lend legitimacy and access to structures. Supervisory attention on the sector has intensified, and firms that treat AML/CFT as a box-ticking afterthought are increasingly exposed to enforcement and reputational risk.

Where a professional firm should start

1
Confirm you are in scope
Map your services against the gatekeeper activities to confirm which engagements trigger obligations.
2
Build a risk assessment
Assess your clients, geographies, services and channels, and document it.
3
Put CDD and screening in place
Establish onboarding CDD, beneficial-ownership checks and sanctions screening proportionate to risk.
4
Appoint a compliance officer and train staff
Designate responsibility, write your policy, and train everyone who touches client engagements.
5
Test it independently
Have the framework reviewed by an independent party to find gaps before the supervisor does.

FAQ

Frequently asked questions

Yes. When carrying out specified gatekeeper activities — such as managing client money, forming companies or trusts, or acting in real-estate and business transactions — they are reporting institutions under AMLA.

The core obligations are the same — CDD, risk assessment, STR reporting, record-keeping and a compliance programme — applied on a risk-based, proportionate basis.

Not entirely. Privilege has defined limits in the AML/CFT context and does not protect communications made to further a crime. Firms should understand exactly where it applies.

Bank Negara Malaysia acts as the AML/CFT supervisor for reporting institutions including DNFBPs, working with the relevant professional and sectoral bodies.

—

In conclusion

If your firm performs gatekeeper activities, AMLA applies to you as fully as it does to a bank — just scaled to your risk. The firms that get ahead of it now will not be the ones explaining gaps to a supervisor later.

AMLA · AML/CFT Advisory

AML/CFT support for professional firms

We help accountants, secretaries and other DNFBPs build proportionate AML/CFT frameworks — and test them independently.

Request a consultation