CTR & STR: Malaysia's Transaction Reporting Obligations

Malaysia operates both reporting approaches recognised by the FATF standards: routine threshold reporting of large cash transactions (the Cash Threshold Report, or CTR) and suspicion-based reporting (the Suspicious Transaction Report, or STR). Both flow to the Financial Intelligence and Enforcement Department of Bank Negara Malaysia, and filing one never excuses the other — a reported cash transaction that is also suspicious needs an STR too.

The mechanics that trip institutions up:

An STR must be filed promptly and regardless of amount — including for attempted or proposed transactions — where the institution suspects or has reasonable grounds to suspect that a transaction or activity is:

• Unusual for the customer
• Without any clear economic purpose
• Apparently illegal
• Involving proceeds of an unlawful activity
• Indicative of the customer's involvement in money laundering, terrorist financing, or proliferation financing

Note the two tests: subjective suspicion and the objective “reasonable grounds to suspect” standard. An employee cannot avoid the obligation by declining to form a suspicion that a reasonable person would have formed.

1. 1
   Employee raises an internal report

   Branch and subsidiary staff channel internal STRs through the designated branch compliance officer to the head-office Compliance Officer; head-office staff report directly.
2. 2
   Compliance Officer evaluates

   The Compliance Officer assesses the grounds for suspicion. This is the institution's decision point — and it must not be a rubber stamp in either direction.
3. 3
   File — or document why not

   If suspicion is confirmed, the STR is submitted promptly via FINS. If the Compliance Officer decides there are no reasonable grounds, that decision must be documented and filed with supporting materials.
4. 4
   Keep it confidential

   Sections 14A and 35 of AMLA prohibit tipping off — disclosing that an STR has been or will be lodged, or that an investigation is underway. Business-as-usual handling of the customer must continue.

Reporting failures rarely happen in isolation — they are usually the visible symptom of weak monitoring or risk assessment upstream. Regional enforcement bears this out: in 2024 the Monetary Authority of Singapore imposed a S$2.5 million penalty on a wealth manager whose failures included not filing STRs despite sufficient basis, alongside inadequate risk assessment and CDD. The reporting obligation is where every earlier control failure surfaces.

A defensible reporting framework includes:

• Transaction monitoring calibrated to your customer risk profiles
• Clear internal escalation routes that staff actually know
• Documented Compliance Officer decisions — both filings and non-filings
• Training with attendance records, so “we didn't recognise it” is never the finding