Search for:

In brief

The Consumer Credit Oversight Board Task Force (“Task Force“) has issued the first of a two-part consultation paper to the Consumer Credit Act (“CCA“) (“Paper“) to obtain feedback from interested parties and members of the public on the proposed enactment of the CCA. The public consultation period will close on 5 September 2022.

New CCA framework

The Paper is focused on seeking feedback on the proposed regulatory framework and authorisation approach under the CCA. A summary is set out below.

I. Who will the CCA apply to?

  1. The CCA is intended to consolidate and provide a consistent framework to regulate entities carrying on business as a credit provider or credit service provider. Credit providers or credit service providers include:
    • entities carrying out the businesses of buy-now, pay-later (“BNPL“), factoring and leasing, impaired loan buyers (“ILB“) and debt collection agencies (“DCA“) (collectively, the “Unregulated Credit Businesses“);
    • licensed moneylenders and pawnbrokers, which are currently regulated by  the Ministry of Housing and Local Government (“KPKT“) under the Moneylenders Act 1951 (“MA“) and Pawnbrokers Act 1972 (“PA“) respectively; and
    • non-bank hire-purchase and credit sale companies, which are currently regulated by the Ministry of Domestic Trade and Consumer Affairs (“MDTCA“) under the Hire-Purchase Act 1967 (“HPA“).
  2. The CCA will not apply where credit or services provided are not the entity’s core business (e.g., employers providing staff loans) or are offered by government-linked entities (e.g., statutory bodies, government agencies, state corporations or foundations providing student loans and micro-financing facilities) on a not-for-profit basis.

II. Who will be protected under the CCA?

The CCA does not seek to protect all consumers, only the most vulnerable, less resilient and those who lack bargaining power when dealing with credit providers (i.e., “credit consumers”). Under the Paper, credit consumers include:

  1. an individual who obtains, has obtained or intends to obtain, credit from a credit provider, wholly or predominantly for personal, domestic or household purposes;
  2. a person who is a small or micro enterprise who obtains, has obtained or intends to obtain credit from a credit provider, of up to RM500,000; and
  3. individuals who act as a guarantor for a credit consumer, not for the purpose of making profit.

III. Who are the key regulators?

  1. The CCA will establish an independent competent authority for consumer credit business, known as the Consumer Credit Oversight Board (“CCOB“), which will in its early stages regulate only the Unregulated Credit Businesses.
  2. Existing regulatory and supervisory authorities (“RSA“) will continue to regulate their respective sectors in accordance with their own legislation and ensure that their regulated entities also comply with new regulations and standards issued under the CCA.
  3. As the CCA will be implemented in phases, the regulatory ambit of each of the CCOB and the RSA is expected to change over time. Please see the discussion on “Phased implementation” under the “In more detail” section below.

In more detail

Phased implementation

The Paper is proposing a phased implementation approach in order to facilitate a smooth transition and minimise disruptions in the consumer credit industry while enabling the CCOB to build its capability and capacity to assume greater responsibilities over time. The phases are as follows:

1Upon enactment of the CCAa. The CCOB will oversee the regulation of the Unregulated Credit Businesses.
b. The authorisation regime (see below) will come into effect.The existing ministries and agencies will continue to serve as the RSA for their respective sectors. However, the CCA will empower the CCOB to issue standards which may be adopted and enforced by the relevant RSAs on its regulated entities.
c. Existing moneylenders’ and pawnbrokers’ licences obtained under the MA and PA respectively, and permits issued to individuals for repossession of goods under the HPA, will remain valid.
e. However, the HPA will be reviewed under Phase 1 to consider whether any provisions are outdated or which may not serve the best interests of consumers.
f. There will be provisions to facilitate Islamic credit business by non-bank credit products, including to ensure that such businesses and product offerings comply with Shariah principles.
2To commence no earlier than 2025a. The MDTCA and KPKT will gradually transfer its consumer credit regulatory functions to the CCOB.
b. Legislation such as the MA and PA, and provisions relating to credit sales transactions under the Consumer Protection Act 1999, will be repealed and the CCA will be amended to incorporate relevant provisions of these Acts under an amalgamated legislation.
3After 2030Enhancements will be made to existing regulatory oversight of all financial firms, including the possibility of the “twin peaks” approach to financial regulation (i.e., where two distinct and separate authorities are responsible for prudential and conduct regulation and supervision of financial services respectively).

Authorisation regime

For Phase 1, the CCA is proposing the following authorisation framework for non-bank entities carrying on the business of providing credit and credit services:

ActivityKey requirement(s)
Direct provision of credit to credit consumers (i.e., BNPL, leasing and factoring)Licensing requirement.
Provision of services to the credit providers or credit consumers (i.e., activities of ILBs and DCAs)Registration requirement.
Provision of credit to persons other than credit consumersNo licensing requirement but a requirement to provide an attestation to the CCOB:
a. that their business model does not include activities extended to “credit consumers” falling within the scope of the CCA; and
b. including a commitment to pursue authorisation if/when their circumstances change.

Other proposed provisions under the CCA

  1. The Paper also proposes that the CCA will cover the key credit consumer protection areas of: (i) prohibited business conduct; (ii) advertisement and solicitation; (iii) credit agreement; (iv) financing charges; (v) credit assessment; (vi) debt collection and repossession of goods; and (v) relief from financial hardship.
  2. The CCA will also require credit providers and credit service providers to establish sound internal controls, policies and procedures. Specific responsibilities will be placed on their respective Board and senior management to ensure internal compliance and alignment, including standards on responsible lending and fair treatment and protection for credit consumers.
  3. Credit providers and credit service providers will be required to establish dedicated complaints units to ensure credit consumers have access to an efficient and timely redress mechanism. Credit consumers may also subsequently lodge a complaint with the CCOB or the respective RSAs, as the case may be.

Conclusion and next steps

Part 2 of the Paper which is expected to set out the authorisation requirements and the standards of conduct of participants is slated for issuance by the fourth quarter of 2022. In tandem with this, the Task Force will be holding focus group discussions / engagement sessions with industry players and other relevant stakeholders in the coming months to better understand the various business models and practices, industry challenges and to seek input on the proposals.

In the interim, credit providers and credit service providers dealing with credit consumers should consider how the CCA will impact their existing business models and should take the opportunity to provide its views and feedback on the proposals in the Paper.

The proposed CCA is welcomed to ensure that the interest of credit consumers continue to be safeguarded in light of new and innovative service offerings (such as BNPL) which has become commonplace in the market. The CCA is a step towards ensuring consistent regulatory treatment of players in the consumer credit space, such as in the areas of responsible lending and fair treatment of credit consumers which existing regulated financial institutions are already required to comply with.

* * * * *

This client alert was issued by Wong & Partners, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “partner” means a person who is a partner or equivalent in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.


Sue Wan Wong is a partner in the Corporate, Commercial & Securities Practice Group of Wong & Partners and she also drives the Firm's fintech practice. Chambers FinTech Legal ranks the practice as the sole Band 1 firm in Malaysia and lists Sue Wan as a Notable Practitioner. She was recognised as a Notable Practitioner for M&A in 2020 and 2021 by IFLR1000, having previously been named as Rising Star in 2018 and 2019. She is also ranked as a Distinguished Practitioner for Corporate and M&A since 2020 by Asialaw Profiles, which has also recognised her expertise in Labour & Employment and Insurance & Reinsurance previously. Sue Wan was named as Woman Lawyer of the Year in 2018 by Asian Legal Business, and was recognised in 2015 in their inaugural The ALB 40 Under 40 list which showcases the brightest legal minds in Asia. Sue Wan is a member of the US-ASEAN Business Council (Financial Services Committee) and she was the former Secretary of the Fintech Association of Malaysia.


Adrian Wong is a Senior Associate in Wong & Partners, Kuala Lumpur office.


Yee Sun Tang is an Associate in Baker McKenzie, Kuala Lumpur office.