Securities Commission issues Practice Note on Broking Services for Digital Assets
06 February 2026
- CMSL holder for dealing in securities; and
- CMSL holder for dealing in securities restricted to listed securities,
(individually a “CMSL holder” and collectively “CMSL holders”).
The PN sets out the requirements that have to be complied with by a CMSL holder who wishes to offer digital assets broking business.
Notification to the SC
A CMSL holder that wishes to offer digital assets broking services must:
- notify the SC of its intention prior to offering of the services; and
- submit a declaration in the specified format and validation by a third-party validator2, as to whether the CMSL holder’s operational policies and procedures are in compliance with the relevant SC’s guidelines.3
Source of digital assets
The PN requires a CMSL holder to only source digital assets from:
- a digital asset exchange (DAX) that is registered with the SC; or
- a digital asset trading platform or other counterparty outside Malaysia that:
- is registered with, or is regulated by one or more laws of a foreign country giving effect to the Financial Action Task Force (FATF) recommendations relating to virtual asset service provider; and
- has a risk-based Anti-Money Laundering, Countering the Financing of Terrorism and Countering Proliferation Financing (“AML/CFT/PF”) systems and controls that are supervised or monitored by a competent authority empowered by law to supervise and enforce AML/CFT/PF measures.
In addition, a CMSL holder must only facilitate trading in
digital assets that have obtained concurrence of the SC 4.
Terms of business
All transactions between the CMSL holder and their client for the purchase of digital assets must be conducted on a cash upfront basis. The CMSL holder must not:
- provide margin or lending facilities to clients for the purpose of digital assets trading; or
- exercise discretionary authority over clients’ digital assets trading account.
Client asset protection
The CMSL holder must ensure that all clients’ assets, including both fiat and digital assets, are fully segregated from the CMSL holder’s own assets and clearly identified and held separately to prevent commingling and misuse.
The CMSL holder must ensure that all clients’ digital assets must be held or custodised with a digital asset custodian (“DAC”) registered with the SC unless written approval is sought from the SC for the appointment of a foreign DAC.
Any income, yield, or benefit derived from the clients’ digital assets must be accrued to the client, unless the client has provided express written consent stating otherwise. The PN requires a CMSL holder to maintain records of such consent and distribution of returns.
Disclosure
A CMSL holder must make adequate disclosure of relevant material information relating to the digital assets and communicate such information in a clear and easily comprehensible manner to their clients, which, among others, shall include:
- the key administrative controls and business continuity plans, including appropriate treatment of clients’ digital assets and their respective rights, for distributed ledger technology related events such as hard forks and airdrops; and
- the custodial arrangement.
Risk Management
A CMSL holder must have the necessary manpower and expertise to understand the nature of digital assets broking business, especially ownership and technology risks, and shall manage such risks appropriately.
Exemption
The SC may, upon application, grant an exemption from or a variation to the requirements of the PN if the SC is satisfied that such variation is not contrary to the intended purpose of the relevant provision in the PN, or there are mitigating factors which justify the exemption or variation being granted.
Alert by Lee Ai Hsian (Partner) of the Fintech Practice of Skrine.
2 The third party validator must be an auditor registered with the Audit Oversight Board.
This article/alert contains general information only. It does not constitute legal advice nor an expression of legal opinion and should not be relied upon as such. For further information, kindly contact skrine@skrine.com.