Bank Negara Malaysia issues Policy Documents on Payment Cards

08 January 2026

1. Policy Document on Debit Card and Debit Card-i (BNM/RH/PD 028-140) (“Debit Card Policy Document”);
2. Policy Document on Credit Card and Credit Card-i (BNM/RH/PD 028-141) (“Credit Card Policy Document”); and
3. Policy Document on Charge Card and Charge Card-i (BNM/RH/PD 028-142) (“Charge Card Policy Document”), 

1. approved issuers of debit card and debit card-i under section 11 or section 15 of the Financial Services Act 2013 (“FSA”) or section 11 of the Islamic Financial Services Act 2013 (“IFSA”); and
2. registered merchant acquirers of debit card and debit card-i under section 18(1) of the FSA, 

1. individuals;
2. micro, small and medium enterprises (“MSMEs”); and
3. corporate cardholders, 

1. paragraphs 17 and 18 which come into effect on 1 April 2026;
2. paragraph 11.2 on -

• new debit card products which come into effect on 1 June 2026;
• existing debit card products which come into effect on 1 January 2027; and

3. paragraphs 25.4, 25.6, 28.3, 28.4, 29.1, 31.1, 32, 34.2, 34.3(e) and 34.4(f) which come into effect on 1 January 2027. 

1. approved Shariah concept;
2. business conduct including fees and charges;
3. disclosure and transparency;
4. investigation and assessment of fraud cases including:

• liability for unauthorised transaction; and
• investigation and assessment of disputed cases;

5. complaints management;
6. risk management responsibilities;
7. fraud risk management including:

• use of secure device to authenticate card transaction;
• kill switch;
• hotline;
• transaction alerts; and

8. cash out facility. 

1. approved issuers of credit card and credit card-i under section 11 or section 15 of the FSA or section 11 of the IFSA; and
2. registered merchant acquirers of credit card and credit card-i under section 18(1) of the FSA, 

1. paragraphs 13.4, 13.5, 18, 20.2, 20.3, 21.14 to 21.16 and 24.15 which only apply to credit card issuers; and
2. paragraphs 8, 9, 10, 13.6, 13.7, 19, 20.4, 20.5, 20.6, 21.17 and 21.18 which only apply to credit card-i issuers. 

1. individuals;
2. MSMEs; and
3. corporate cardholders, 

1. paragraphs 27 and 28 which come into effect on 1 April 2026;
2. paragraph 21.2 on -

• new credit card products which come into effect on 1 June 2026;
• existing credit card products which come into effect on 1 January 2027; and

3. paragraphs 44.3, 44.4, 45.1, 48, 50.2, 50.3(e) and 50.4(f) which come into effect on 1 January 2027. 

1. approved Shariah concept;
2. business conduct including:

• minimum age and income;
• minimum monthly repayment;
• fees and charges;
• finance charges;
• profit or fee rate; and
• late payment charge;

3. disclosure and transparency;
4. investigation and assessment of fraud cases including:

• liability of supplementary cardholder;
• liability for unauthorised transaction;
• investigation and assessment of disputed cases;
• marketing practices; and
• unsolicited card/credit advance/credit limit increase;

5. other requirements including:

• debt collection; and
• complaints management;

6. risk management responsibilities; and
7. fraud risk management including:

• use of secure device to authenticate card transaction;
• kill switch;
• hotline; and
• transaction alerts. 

1. approved issuers of charge card and charge card-i under section 11 or section 15 of the FSA or section 11 of the IFSA; and
2. registered merchant acquirers of charge card and charge card-i under section 18(1) of the FSA, 

1. paragraphs 14.14 and 14.15 which only apply to charge card issuers; and
2. paragraphs 8, 9, 14.16 and 14.17 which only apply to charge card-i issuers. 

1. individuals;
2. MSMEs; and
3. corporate cardholders, 

1. paragraphs 20 and 21 which come into effect on 1 April 2026;
2. paragraph 14.2 on -

• new charge card products which come into effect on 1 June 2026;
• existing charge card products which come into effect on 1 January 2027; and

3. paragraphs 37.3, 37.4, 38.1, 41, 43.2, 43.3(e) and 43.4(f) which come into effect on 1 January 2027. 

1. approved Shariah concept;
2. business conduct including:

• minimum age and income;
• grace period for payment; and
• fees and charges;

3. disclosure and transparency;
4. investigation and assessment of fraud cases including:

• liability of supplementary cardholder;
• liability for unauthorised transaction;
• investigation and assessment of disputed cases;
• marketing practices; and
• unsolicited card/charge advance/charge limit increase;

5. other requirements including:

• debt collection; and
• complaints management;

6. risk management responsibilities; and
7. fraud risk management including:

• use of secure device to authenticate card transaction;
• kill switch;
• hotline; and
• transaction alerts.