On 6 April 2026, Bank Negara Malaysia (BNM) imposed an Administrative Monetary Penalty (AMP)^[1] of RM520,000 on AEON Credit Service (M) Berhad (AEON Credit) for failure to comply with requirements relating to targeted financial sanctions (TFS).^[2]

As a reporting institution (RI), AEON Credit is required to reject a potential customer when there is a positive match against individuals and entities listed in the Domestic List^[3] and the United Nations Security Council Resolutions (UNSCR) List.^[4] AEON Credit is also required to freeze the customer’s funds upon determination of the customer’s identity as a specified entity in the lists. This is essential to protect the RI and the broader financial system from being abused for terrorism financing activities.

BNM identified the breaches following an on-site supervisory examination on AEON Credit, which revealed that a specified entity listed under the Domestic List was onboarded as its customer. AEON Credit failed to reject the potential match despite it being a positive match.  Additionally, there was also a delay in the freezing of the customer’s account upon confirmation that the customer was a specified entity. These breaches were attributed to lack of staff oversight and gap in AEON Credit’s standard operating procedure (SOP).

AEON Credit has since taken remedial measures by enhancing its SOP and conducting refresher training for relevant staff to ensure compliance with TFS requirements.

In deciding the AMP to be imposed, relevant aggravating and mitigating factors were considered. These include the severity of the breaches and AEON Credit’s:

1. lack of reasonable care in ensuring compliance with the TFS requirements;
2. past compliance record; and
3. post-misconduct behaviour, including the effectiveness of remedial actions to prevent the recurrence of breaches.

On 16 April 2026, AEON Credit paid RM520,000 for the AMP imposed by BNM.

BNM requires all RIs to ensure compliance with TFS requirements. BNM will not hesitate to take appropriate supervisory and/or enforcement actions should any RI fail to meet its legal and/or regulatory requirements.

The enforcement action taken against AEON Credit is in line with the approach and processes outlined in BNM’s published Enforcement Approach.

^[1] BNM imposed the AMP pursuant to section 234(3)(b)(i) of the Financial Services Act 2013 (FSA).

^[2] These requirements are set out under section 48(1)(a) of the FSA read together with paragraphs 27.6.1 and 27.6.2 of the Anti-Money Laundering, Countering Financing of Terrorism and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT and TFS for FIs PD).

Note: The AML/CFT and TFS for FIs PD was in effect from 1 January 2020 to 5 February 2024 and has since been superseded by the Anti-Money Laundering, Countering Financing of Terrorism, Countering Proliferation Financing and Targeted Financial Sanctions for Financial Institutions Policy Document (AML/CFT/CPF and TFS for FIs PD), which took effect on 6 February 2024. These requirements are preserved under paragraphs 27.6.1 and 27.6.2 of the AML/CFT/CPF and TFS for FIs PD.

^[3] The Domestic List is a list of names and particulars of specified entities declared by the Minister of Home Affairs under the relevant subsidiary legislation made under section 66B(1) of the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA).

^[4] The UNSCR List is a list of names and particulars of persons as designated by the United Nations Security Council (UNSC) or its relevant Sanctions Committee pursuant to the relevant UNSCR and are deemed as specified entities by virtue of section 66C(2) of the AMLA.