- Published on
Malaysian Banking Law – Banking Secrecy, Confidentiality and Permitted Disclosure under Sections 132–134 of the Financial Services Act 2013
Introduction
Banking secrecy is one of the most important obligations imposed upon a bank in its relationship with customers. A customer who deposits money with a bank expects that information concerning his accounts, transactions, financial position and dealings with the bank will remain confidential.
The duty of confidentiality serves two important functions. First, it protects the privacy rights of customers. Secondly, it promotes public confidence in the banking system by assuring customers that their financial affairs will not be disclosed indiscriminately.
In Malaysia, banking secrecy is principally governed by sections 132, 133 and 134 of the Financial Services Act 2013 (FSA 2013). These provisions impose a statutory duty of secrecy upon banks and their personnel while also recognising circumstances in which disclosure is necessary and legally justified.
Importantly, the duty of confidentiality is not derived solely from statute. Malaysian courts have recognised that confidentiality is also an implied contractual term in the banker-customer relationship. Therefore, a bank may face both criminal liability under the FSA 2013 and civil liability for breach of contract where customer information is disclosed without authority.
The protection extends beyond account balances and transaction records. It includes all information obtained by the bank through the banking relationship, whether acquired directly from account records or through dealings with the customer.
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
The provision states that neither the Finance Minister nor Bank Negara Malaysia (BNM) is generally authorised to investigate the affairs or accounts of a specific customer of a financial institution.
The objective is to prevent unnecessary intrusion into private banking relationships and preserve customer confidentiality.
Exception
Section 132(2) recognises that confidentiality cannot obstruct regulatory oversight.
Accordingly, BNM may inquire into a customer’s affairs where such inquiry is necessary for exercising its powers and functions under:
Case Scenario 1: BNM Investigation
Facts
ABC Bank notices suspicious transactions involving a customer who appears to be moving large sums of money through multiple accounts.
BNM commences an investigation and requires the bank to disclose the customer’s account statements and transaction records.
The customer objects, claiming that the information is protected by banking secrecy.
Solution
The customer’s objection will fail.
Section 132(2) expressly permits BNM to investigate customer accounts when exercising its statutory functions.
The bank may therefore provide the requested information without breaching its confidentiality obligations.
Critical Analysis
This provision demonstrates that banking secrecy is not absolute.
The law seeks to balance:
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict statutory duty of secrecy.
The duty applies to:
The obligation continues even after employment or office has ceased.
Scope of Protection
The protection afforded by section 133 is broad.
It covers:
Any information acquired because of the banking relationship is protected.
Criminal Liability
A person who unlawfully discloses customer information commits an offence.
Upon conviction, the offender may be liable to:
Exceptions under Section 133(2)
The duty of secrecy does not apply in the following situations:
(a) Disclosure to BNM
Information disclosed to BNM for purposes connected with the exercise of its statutory functions.
(b) Statistical or Aggregated Information
Information disclosed in summary form where no particular customer can be identified.
For example, a bank may publish statistics indicating that it has 100,000 savings account holders without revealing individual customer identities.
(c) Public Information
Information that has already been lawfully made available to the public from a source other than the bank.
For example, where a listed company voluntarily publishes information regarding its banking arrangements in its annual report.
Case Scenario 2: Disclosure by a Bank Employee
Facts
A bank officer discovers that a celebrity maintains RM20 million in her account.
The officer reveals this information to friends and acquaintances.
The information subsequently spreads through social media.
Solution
The bank officer has breached section 133(1).
The information was obtained solely through the banking relationship and remains confidential.
The officer may be subjected to criminal prosecution, disciplinary action and possible civil liability.
Critical Analysis
The banking industry depends heavily on public trust.
If customers cannot trust bank employees to preserve confidentiality, confidence in the banking system will be seriously undermined.
3. Prohibition Against Further Disclosure (Section 133(3))
Section 133(3) extends protection beyond the original disclosure.
A person who knowingly receives information that has been disclosed in breach of section 133(1) is prohibited from further disclosing that information.
The provision prevents confidential information from continuing to circulate after the initial breach.
Case Scenario 3: Secondary Disclosure
Facts
A bank employee unlawfully discloses customer information to a journalist.
The journalist is aware that the information was obtained illegally.
Nevertheless, the journalist publishes the customer’s banking details.
Solution
The journalist may also be liable under section 133(3) because he knowingly disclosed information obtained through an unlawful disclosure.
Critical Analysis
The law aims to suppress both:
4. Banking Secrecy as an Implied Contractual Duty
Although sections 132–134 create statutory obligations, confidentiality also exists as an implied term of the banker-customer contract.
This means that a customer may bring a civil action against the bank even where criminal proceedings are not commenced.
The leading Malaysian authority is Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36.
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff was formerly employed by Malayan Banking Berhad.
After leaving the bank’s employment, he verbally informed the bank that he wished to close his account.
However, he failed to provide the written instruction required by the bank’s procedures.
Because no written authorisation was received, the bank continued to regard the account as active.
Over time, service charges and interest accumulated, resulting in an outstanding balance of approximately RM15.
Subsequently, a credit officer informed the plaintiff’s brother about the existence of the outstanding amount.
The plaintiff then sued the bank for breach of confidentiality.
Held
The court held that the account had not been properly closed because the plaintiff failed to submit the required written instructions.
The court also found that the statement made by the credit officer was not defamatory.
However, the court recognised that the disclosure of the plaintiff’s banking information to his brother amounted to a breach of the implied duty of confidentiality arising from the banker-customer relationship.
The court was reluctant to determine whether there had been a contravention of section 97(1) of the Banking and Financial Institutions Act 1989 (the predecessor of section 133 FSA 2013).
Nevertheless, the plaintiff could succeed on the basis of the implied contractual duty of confidentiality.
The court awarded nominal damages of RM15.
Legal Principle
This case establishes that:
Case Scenario 4: Disclosure to a Family Member
Facts
Ali verbally requests closure of his account but does not complete the bank’s written closure form.
The account remains active and incurs RM50 in service charges.
A bank officer later informs Ali’s sister about the outstanding balance.
Ali sues the bank.
Solution
Following Tan Eng Seong, the account remains active because the required written instructions were not submitted.
However, the disclosure to Ali’s sister constitutes a breach of the implied contractual duty of confidentiality.
Ali may therefore recover damages despite suffering minimal financial loss.
Critical Analysis
The case demonstrates that confidentiality extends even against disclosures made to close relatives.
A customer’s spouse, sibling, parent or child remains a third party unless authorised by the customer or permitted by law.
The decision reinforces the principle that privacy, rather than financial loss, lies at the heart of banking confidentiality.
5. Permitted Disclosures (Section 134 FSA 2013)
Although secrecy is the general rule, section 134 recognises that disclosure may sometimes be necessary.
A bank may disclose customer information:
The 18 Permitted Disclosures under Schedule 11
The principal permitted disclosures include:
1. Customer’s Written Consent
A bank may disclose information where written consent has been given by:
A customer authorises his bank to provide financial information to another bank when applying for a housing loan.
Solution
The disclosure is lawful because the customer expressly consented.
Critical Analysis
The right to confidentiality belongs to the customer and may therefore be waived by the customer.
2. Administration of a Deceased Customer’s Estate
Disclosure is permitted for obtaining:
The administrator of a deceased customer’s estate requests details of the deceased’s bank accounts.
Solution
The bank may lawfully disclose the information.
3. Bankruptcy and Winding-Up Proceedings
Disclosure is permitted where the customer is bankrupt or undergoing liquidation.
Case Scenario
A bankruptcy trustee seeks information concerning the bankrupt’s accounts.
Solution
The bank may disclose the information.
Critical Analysis
The trustee must identify assets for distribution among creditors.
Public interest outweighs confidentiality concerns.
4. Litigation Involving the Bank
Disclosure is permitted in civil or criminal proceedings involving:
A customer sues the bank for wrongfully dishonouring a cheque.
Solution
The bank may disclose relevant account information to defend the claim.
5. Garnishee Proceedings
Banks may disclose information when complying with garnishee orders.
Case Scenario
A judgment creditor obtains a garnishee order against funds held in a customer’s account.
Solution
The bank may provide the necessary information.
6. Court Orders
Disclosure is permitted pursuant to a court order issued by a court not lower than the Sessions Court.
Case Scenario
The High Court orders a bank to produce customer account statements.
Solution
The bank must comply.
7. Requests by Enforcement Agencies
Disclosure is permitted where required by law enforcement agencies conducting investigations.
Case Scenario
MACC requests customer account records during a corruption investigation.
Solution
The bank may lawfully disclose the information.
8–18 Other Permitted Disclosures
Disclosure is also permitted for:
Confidentiality During Court Proceedings
Section 134 provides additional safeguards where customer information is disclosed in legal proceedings.
The court may:
These safeguards ensure that disclosure remains limited to what is necessary for the administration of justice.
Jeyamary Case
Facts
A bank officer printed a customer’s account information and provided it to a friend who was a private investigator.
The information was later passed to a blogger.
Decision
The bank officer was convicted and sentenced to:
Banking secrecy extends beyond account balances and transaction records.
It encompasses all confidential information obtained through the banking relationship.
Critical Analysis
The case illustrates the strict approach adopted by Malaysian courts toward unauthorised disclosures.
Even seemingly minor disclosures may attract criminal sanctions.
Johari and Rafizi (National Feedlot Corporation Case)
Facts
A bank clerk disclosed confidential banking information relating to the National Feedlot Corporation to politician Rafizi Ramli.
Both individuals were initially convicted and sentenced to thirty months’ imprisonment but were later acquitted.
Legal Principle
The case highlights the tension between:
Although public accountability is important, banking information remains protected unless disclosure falls within recognised legal exceptions.
The case demonstrates the sensitivity of customer banking information and the serious legal consequences that may follow unauthorised disclosure.
Key Examination Principles
Section 132
Conclusion
Under Malaysian Banking Law, banking secrecy is protected by both statute and contract. Sections 132–134 of the Financial Services Act 2013 establish a comprehensive statutory framework regulating customer confidentiality, while cases such as Tan Eng Seong v Malayan Banking Bhd confirm that confidentiality is also an implied term of the banker-customer relationship. Consequently, unauthorised disclosure may expose a bank or its employees to criminal penalties, regulatory consequences and civil liability. The law therefore strikes a careful balance between protecting customer privacy and allowing disclosure where required for regulatory supervision, law enforcement, judicial proceedings and other legitimate public interests.
Introduction
Banking secrecy is one of the most important obligations imposed upon a bank in its relationship with customers. A customer who deposits money with a bank expects that information concerning his accounts, transactions, financial position and dealings with the bank will remain confidential.
The duty of confidentiality serves two important functions. First, it protects the privacy rights of customers. Secondly, it promotes public confidence in the banking system by assuring customers that their financial affairs will not be disclosed indiscriminately.
In Malaysia, banking secrecy is principally governed by sections 132, 133 and 134 of the Financial Services Act 2013 (FSA 2013). These provisions impose a statutory duty of secrecy upon banks and their personnel while also recognising circumstances in which disclosure is necessary and legally justified.
Importantly, the duty of confidentiality is not derived solely from statute. Malaysian courts have recognised that confidentiality is also an implied contractual term in the banker-customer relationship. Therefore, a bank may face both criminal liability under the FSA 2013 and civil liability for breach of contract where customer information is disclosed without authority.
The protection extends beyond account balances and transaction records. It includes all information obtained by the bank through the banking relationship, whether acquired directly from account records or through dealings with the customer.
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
The provision states that neither the Finance Minister nor Bank Negara Malaysia (BNM) is generally authorised to investigate the affairs or accounts of a specific customer of a financial institution.
The objective is to prevent unnecessary intrusion into private banking relationships and preserve customer confidentiality.
Exception
Section 132(2) recognises that confidentiality cannot obstruct regulatory oversight.
Accordingly, BNM may inquire into a customer’s affairs where such inquiry is necessary for exercising its powers and functions under:
- The Financial Services Act 2013;
- The Islamic Financial Services Act 2013; or
- Section 47 of the Central Bank of Malaysia Act 2009.
Case Scenario 1: BNM Investigation
Facts
ABC Bank notices suspicious transactions involving a customer who appears to be moving large sums of money through multiple accounts.
BNM commences an investigation and requires the bank to disclose the customer’s account statements and transaction records.
The customer objects, claiming that the information is protected by banking secrecy.
Solution
The customer’s objection will fail.
Section 132(2) expressly permits BNM to investigate customer accounts when exercising its statutory functions.
The bank may therefore provide the requested information without breaching its confidentiality obligations.
Critical Analysis
This provision demonstrates that banking secrecy is not absolute.
The law seeks to balance:
- Individual privacy; and
- The public interest in combating money laundering, terrorism financing and financial crime.
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict statutory duty of secrecy.
The duty applies to:
- Financial institutions;
- Directors;
- Officers;
- Employees;
- Agents; and
- Former directors, officers and agents.
The obligation continues even after employment or office has ceased.
Scope of Protection
The protection afforded by section 133 is broad.
It covers:
- Savings accounts;
- Current accounts;
- Fixed deposits;
- Financing facilities;
- Credit information;
- Account balances;
- Transaction histories;
- Customer identities;
- Financial standing;
- Information obtained through banking dealings.
Any information acquired because of the banking relationship is protected.
Criminal Liability
A person who unlawfully discloses customer information commits an offence.
Upon conviction, the offender may be liable to:
- Imprisonment for up to five years;
- A fine of up to RM10 million; or
- Both imprisonment and a fine.
Exceptions under Section 133(2)
The duty of secrecy does not apply in the following situations:
(a) Disclosure to BNM
Information disclosed to BNM for purposes connected with the exercise of its statutory functions.
(b) Statistical or Aggregated Information
Information disclosed in summary form where no particular customer can be identified.
For example, a bank may publish statistics indicating that it has 100,000 savings account holders without revealing individual customer identities.
(c) Public Information
Information that has already been lawfully made available to the public from a source other than the bank.
For example, where a listed company voluntarily publishes information regarding its banking arrangements in its annual report.
Case Scenario 2: Disclosure by a Bank Employee
Facts
A bank officer discovers that a celebrity maintains RM20 million in her account.
The officer reveals this information to friends and acquaintances.
The information subsequently spreads through social media.
Solution
The bank officer has breached section 133(1).
The information was obtained solely through the banking relationship and remains confidential.
The officer may be subjected to criminal prosecution, disciplinary action and possible civil liability.
Critical Analysis
The banking industry depends heavily on public trust.
If customers cannot trust bank employees to preserve confidentiality, confidence in the banking system will be seriously undermined.
3. Prohibition Against Further Disclosure (Section 133(3))
Section 133(3) extends protection beyond the original disclosure.
A person who knowingly receives information that has been disclosed in breach of section 133(1) is prohibited from further disclosing that information.
The provision prevents confidential information from continuing to circulate after the initial breach.
Case Scenario 3: Secondary Disclosure
Facts
A bank employee unlawfully discloses customer information to a journalist.
The journalist is aware that the information was obtained illegally.
Nevertheless, the journalist publishes the customer’s banking details.
Solution
The journalist may also be liable under section 133(3) because he knowingly disclosed information obtained through an unlawful disclosure.
Critical Analysis
The law aims to suppress both:
- The original leak; and
- Any subsequent dissemination.
4. Banking Secrecy as an Implied Contractual Duty
Although sections 132–134 create statutory obligations, confidentiality also exists as an implied term of the banker-customer contract.
This means that a customer may bring a civil action against the bank even where criminal proceedings are not commenced.
The leading Malaysian authority is Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36.
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff was formerly employed by Malayan Banking Berhad.
After leaving the bank’s employment, he verbally informed the bank that he wished to close his account.
However, he failed to provide the written instruction required by the bank’s procedures.
Because no written authorisation was received, the bank continued to regard the account as active.
Over time, service charges and interest accumulated, resulting in an outstanding balance of approximately RM15.
Subsequently, a credit officer informed the plaintiff’s brother about the existence of the outstanding amount.
The plaintiff then sued the bank for breach of confidentiality.
Held
The court held that the account had not been properly closed because the plaintiff failed to submit the required written instructions.
The court also found that the statement made by the credit officer was not defamatory.
However, the court recognised that the disclosure of the plaintiff’s banking information to his brother amounted to a breach of the implied duty of confidentiality arising from the banker-customer relationship.
The court was reluctant to determine whether there had been a contravention of section 97(1) of the Banking and Financial Institutions Act 1989 (the predecessor of section 133 FSA 2013).
Nevertheless, the plaintiff could succeed on the basis of the implied contractual duty of confidentiality.
The court awarded nominal damages of RM15.
Legal Principle
This case establishes that:
- Banking secrecy exists not only as a statutory obligation but also as an implied contractual duty.
- A customer may sue for breach of confidentiality even where the statutory provision is not relied upon.
- Disclosure to family members may constitute an unauthorised disclosure.
- Actual financial loss is not essential for a successful claim.
Case Scenario 4: Disclosure to a Family Member
Facts
Ali verbally requests closure of his account but does not complete the bank’s written closure form.
The account remains active and incurs RM50 in service charges.
A bank officer later informs Ali’s sister about the outstanding balance.
Ali sues the bank.
Solution
Following Tan Eng Seong, the account remains active because the required written instructions were not submitted.
However, the disclosure to Ali’s sister constitutes a breach of the implied contractual duty of confidentiality.
Ali may therefore recover damages despite suffering minimal financial loss.
Critical Analysis
The case demonstrates that confidentiality extends even against disclosures made to close relatives.
A customer’s spouse, sibling, parent or child remains a third party unless authorised by the customer or permitted by law.
The decision reinforces the principle that privacy, rather than financial loss, lies at the heart of banking confidentiality.
5. Permitted Disclosures (Section 134 FSA 2013)
Although secrecy is the general rule, section 134 recognises that disclosure may sometimes be necessary.
A bank may disclose customer information:
- Under Schedule 11; or
- With the written approval of BNM.
The 18 Permitted Disclosures under Schedule 11
The principal permitted disclosures include:
1. Customer’s Written Consent
A bank may disclose information where written consent has been given by:
- The customer;
- The executor or administrator of the customer’s estate; or
- A legal representative of an incapacitated customer.
A customer authorises his bank to provide financial information to another bank when applying for a housing loan.
Solution
The disclosure is lawful because the customer expressly consented.
Critical Analysis
The right to confidentiality belongs to the customer and may therefore be waived by the customer.
2. Administration of a Deceased Customer’s Estate
Disclosure is permitted for obtaining:
- Faraid certificates;
- Grants of probate;
- Letters of administration; or
- Distribution orders.
The administrator of a deceased customer’s estate requests details of the deceased’s bank accounts.
Solution
The bank may lawfully disclose the information.
3. Bankruptcy and Winding-Up Proceedings
Disclosure is permitted where the customer is bankrupt or undergoing liquidation.
Case Scenario
A bankruptcy trustee seeks information concerning the bankrupt’s accounts.
Solution
The bank may disclose the information.
Critical Analysis
The trustee must identify assets for distribution among creditors.
Public interest outweighs confidentiality concerns.
4. Litigation Involving the Bank
Disclosure is permitted in civil or criminal proceedings involving:
- The bank and its customer;
- Guarantors or sureties;
- Competing claimants; or
- Property over which the bank has rights.
A customer sues the bank for wrongfully dishonouring a cheque.
Solution
The bank may disclose relevant account information to defend the claim.
5. Garnishee Proceedings
Banks may disclose information when complying with garnishee orders.
Case Scenario
A judgment creditor obtains a garnishee order against funds held in a customer’s account.
Solution
The bank may provide the necessary information.
6. Court Orders
Disclosure is permitted pursuant to a court order issued by a court not lower than the Sessions Court.
Case Scenario
The High Court orders a bank to produce customer account statements.
Solution
The bank must comply.
7. Requests by Enforcement Agencies
Disclosure is permitted where required by law enforcement agencies conducting investigations.
Case Scenario
MACC requests customer account records during a corruption investigation.
Solution
The bank may lawfully disclose the information.
8–18 Other Permitted Disclosures
Disclosure is also permitted for:
- PIDM functions;
- Securities Commission investigations;
- Stock exchange functions;
- Trade repositories;
- Inland Revenue Board investigations;
- Credit reporting agencies;
- Supervisory authorities;
- Centralised group functions;
- Due diligence exercises;
- Outsourcing arrangements;
- Consultants and adjusters;
- Suspected criminal offences.
Confidentiality During Court Proceedings
Section 134 provides additional safeguards where customer information is disclosed in legal proceedings.
The court may:
- Conduct proceedings in camera;
- Restrict access to confidential information;
- Make further confidentiality orders;
- Prohibit publication of names, addresses, photographs or identifying information.
These safeguards ensure that disclosure remains limited to what is necessary for the administration of justice.
Jeyamary Case
Facts
A bank officer printed a customer’s account information and provided it to a friend who was a private investigator.
The information was later passed to a blogger.
Decision
The bank officer was convicted and sentenced to:
- Two days’ imprisonment; and
- RM20,000 fine.
Banking secrecy extends beyond account balances and transaction records.
It encompasses all confidential information obtained through the banking relationship.
Critical Analysis
The case illustrates the strict approach adopted by Malaysian courts toward unauthorised disclosures.
Even seemingly minor disclosures may attract criminal sanctions.
Johari and Rafizi (National Feedlot Corporation Case)
Facts
A bank clerk disclosed confidential banking information relating to the National Feedlot Corporation to politician Rafizi Ramli.
Both individuals were initially convicted and sentenced to thirty months’ imprisonment but were later acquitted.
Legal Principle
The case highlights the tension between:
- Banking secrecy; and
- Public interest disclosure.
Although public accountability is important, banking information remains protected unless disclosure falls within recognised legal exceptions.
The case demonstrates the sensitivity of customer banking information and the serious legal consequences that may follow unauthorised disclosure.
Key Examination Principles
Section 132
- Protects customers from arbitrary inquiries.
- Restricts governmental intrusion into banking affairs.
- Allows BNM investigations for statutory purposes.
- Creates a statutory duty of secrecy.
- Applies to banks, directors, officers, employees and agents.
- Continues after employment ends.
- Covers all information obtained through the banking relationship.
- Breach may result in imprisonment of up to five years or a fine of up to RM10 million.
- Creates statutory exceptions to secrecy.
- Permits disclosure under Schedule 11.
- Permits disclosure with BNM’s written approval.
- Allows courts to impose confidentiality safeguards.
- Banking confidentiality is also an implied contractual duty.
- Customers may sue for breach of confidentiality.
- Disclosure to relatives may still be unlawful.
- Nominal damages may be awarded even where financial loss is minimal.
Conclusion
Under Malaysian Banking Law, banking secrecy is protected by both statute and contract. Sections 132–134 of the Financial Services Act 2013 establish a comprehensive statutory framework regulating customer confidentiality, while cases such as Tan Eng Seong v Malayan Banking Bhd confirm that confidentiality is also an implied term of the banker-customer relationship. Consequently, unauthorised disclosure may expose a bank or its employees to criminal penalties, regulatory consequences and civil liability. The law therefore strikes a careful balance between protecting customer privacy and allowing disclosure where required for regulatory supervision, law enforcement, judicial proceedings and other legitimate public interests.
0 Comments