- Published on
Malaysian Banking Law – Banking Secrecy, Customer Confidentiality and Permitted Disclosure under Sections 132–134 of the Financial Services Act 2013 and Common Law
Introduction
Banking secrecy is one of the most fundamental obligations imposed upon a bank in its relationship with customers. Customers entrust banks with highly sensitive financial information and expect that information concerning their accounts, transactions, assets, liabilities and financial affairs will remain confidential.
The duty of confidentiality serves two important objectives. First, it protects the privacy rights of customers. Secondly, it preserves public confidence in the banking system by assuring customers that their personal financial affairs will not be disclosed without authority.
In Malaysia, banking secrecy is principally governed by sections 132, 133 and 134 of the Financial Services Act 2013 (FSA 2013). These provisions establish a statutory framework regulating customer confidentiality and prescribe circumstances in which disclosure may lawfully occur.
However, banking secrecy is not solely statutory in nature. Malaysian courts have consistently recognised that confidentiality is also an implied term of the banker-customer contract. Consequently, unauthorised disclosure may expose a bank to:
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
Neither the Minister of Finance nor Bank Negara Malaysia (BNM) is generally authorised to investigate the affairs or accounts of a specific customer merely out of curiosity or convenience.
The purpose of this restriction is to preserve customer privacy and prevent unnecessary governmental intrusion into banking relationships.
Exception
Customer confidentiality must sometimes yield to legitimate regulatory concerns.
Accordingly, section 132(2) empowers BNM to investigate customer accounts where necessary for the exercise of its powers and functions under:
Case Scenario 1: BNM Investigation
Facts
ABC Bank detects suspicious transactions involving a customer who appears to be moving substantial sums through multiple accounts.
BNM requires the bank to disclose account statements and transaction records as part of an anti-money laundering investigation.
The customer objects on the ground of banking secrecy.
Solution
The objection fails.
Section 132(2) expressly authorises BNM to investigate customer affairs for regulatory purposes.
The bank may lawfully disclose the information.
Critical Analysis
This provision demonstrates that banking secrecy is not absolute.
The law seeks to balance:
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict duty of secrecy upon:
Importantly, the duty survives termination of employment or office.
Scope of Protection
The protection extends to:
Rather, all information acquired through the banking relationship is protected.
Criminal Liability
A person who unlawfully discloses customer information commits a criminal offence.
The penalty may include:
Exceptions under Section 133(2)
The statutory duty does not apply where:
(a) Disclosure to BNM
Information is disclosed to BNM for the exercise of its statutory functions.
(b) Statistical or Aggregated Information
Information is disclosed in a manner that does not identify any particular customer.
(c) Public Information
Information has already been lawfully disclosed to the public from a source other than the bank.
Case Scenario 2: Disclosure by a Bank Employee
Facts
A bank officer discovers that a celebrity maintains RM20 million in her account.
He reveals this information to several friends.
The information subsequently appears on social media.
Solution
The officer has breached section 133(1).
The information was acquired solely through the banking relationship and remains confidential.
The officer may face criminal prosecution and disciplinary sanctions.
Critical Analysis
The confidence reposed in banks would be severely undermined if employees could freely reveal customer information.
The provision therefore serves as an essential safeguard for customer trust.
3. Prohibition Against Further Disclosure (Section 133(3))
Section 133(3) extends protection beyond the initial disclosure.
A person who knowingly receives information disclosed in breach of section 133(1) is prohibited from further disclosing that information.
The objective is to prevent confidential information from continuing to circulate after the original breach.
Case Scenario 3: Secondary Disclosure
Facts
A bank employee unlawfully discloses customer information to a journalist.
The journalist knows the information was obtained unlawfully but publishes it nonetheless.
Solution
The journalist may also be liable under section 133(3).
Critical Analysis
The law seeks to prevent both:
4. Banking Secrecy as an Implied Contractual Duty
Apart from the statutory framework, confidentiality is also recognised as an implied term of the banker-customer contract.
This means that a customer may bring a civil action for breach of confidentiality even where no criminal prosecution is initiated.
Two important Malaysian authorities are:
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff was a former employee of the defendant bank.
After leaving employment, he orally informed the bank that he wished to close his account.
However, he did not provide the written instructions required by the bank’s procedures.
The account therefore remained active and accumulated approximately RM15 in charges.
A bank credit officer subsequently informed the plaintiff’s brother about the outstanding amount.
The plaintiff commenced legal proceedings alleging breach of confidentiality.
Held
The court held that the account remained open because the plaintiff failed to submit the required written instructions.
Although the statement made by the bank officer was not defamatory, the disclosure constituted a breach of the implied duty of confidentiality.
The plaintiff succeeded and was awarded nominal damages of RM15.
Legal Principle
The case establishes that:
Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
Facts
The plaintiff maintained a banking account with CIMB Bank.
The account concerned financial arrangements involving the plaintiff and his son from a previous marriage.
CIMB mistakenly sent the plaintiff’s bank statements to an incorrect residential address.
The statements were subsequently opened and read by the plaintiff’s new wife.
As a result, confidential banking information relating to the plaintiff became known to an unauthorised third party.
The plaintiff brought an action against the bank for breach of banking confidentiality.
Held
The court held that CIMB was liable for breaching its duty of confidentiality.
By sending the bank statements to the wrong address, the bank failed to protect the confidentiality of the customer’s banking information.
However, the court declined to award exemplary damages.
Legal Principle
The court reaffirmed that:
Significance of Wong Yeng Mun
The importance of this case lies in its recognition that confidentiality can be breached through carelessness as well as intentional disclosure.
Unlike cases involving deliberate leaks by employees, the bank’s wrongdoing arose from an administrative failure.
The decision demonstrates that banks must implement effective systems and procedures to safeguard customer information.
A bank cannot avoid liability merely because the disclosure was accidental.
Case Scenario 4: Statement Sent to Wrong Address
Facts
A bank updates Ahmad’s mailing address incorrectly due to an administrative error.
Monthly account statements are sent to a stranger’s home and are opened by the recipient.
The stranger learns details of Ahmad’s savings and financing facilities.
Solution
Applying Wong Yeng Mun, the bank is likely liable for breach of confidentiality.
Although the disclosure was accidental, the bank failed to ensure the secure transmission of customer information.
Critical Analysis
The duty of confidentiality requires more than merely refraining from deliberate disclosure.
It also requires banks to adopt reasonable operational safeguards to prevent unauthorised access to customer information.
Case Scenario 5: Disclosure to a Family Member
Facts
Ali verbally requests closure of his account but does not complete the bank’s written closure form.
The account remains active and incurs service charges.
A bank officer later informs Ali’s sister about the outstanding balance.
Ali sues the bank.
Solution
Applying Tan Eng Seong, the account remains active because the required closure procedure was not followed.
However, the disclosure to Ali’s sister constitutes a breach of the implied contractual duty of confidentiality.
Critical Analysis
The case confirms that family members are legally third parties unless authorised by the customer.
Banks cannot assume that disclosure to relatives is permissible.
5. Permitted Disclosures (Section 134 FSA 2013)
Although secrecy is the general rule, section 134 recognises that disclosure may sometimes be necessary.
A bank may disclose customer information:
The 18 Permitted Disclosures under Schedule 11
The principal exceptions include:
Customer Consent
Disclosure authorised in writing by the customer.
Administration of Deceased Estates
Disclosure for probate, letters of administration, Faraid certificates and distribution orders.
Bankruptcy and Winding-Up
Disclosure to bankruptcy trustees and liquidators.
Litigation Involving the Bank
Disclosure necessary for legal proceedings involving the bank.
Garnishee Orders
Disclosure required to comply with garnishee proceedings.
Court Orders
Disclosure pursuant to court orders issued by courts not lower than the Sessions Court.
Enforcement Agency Requests
Disclosure to law enforcement authorities conducting investigations.
Other Permitted Disclosures
Disclosure relating to:
Confidentiality During Court Proceedings
Section 134 also empowers courts to protect customer information during legal proceedings.
The court may:
Jeyamary Case
Facts
A bank officer printed customer account information and gave it to a private investigator.
The information eventually reached a blogger.
Decision
The bank officer was convicted and sentenced to:
The duty of confidentiality extends to all information obtained through the banking relationship.
Johari and Rafizi (National Feedlot Corporation Case)
Facts
A bank clerk disclosed confidential banking information relating to the National Feedlot Corporation to politician Rafizi Ramli.
Both were initially convicted and sentenced to imprisonment before later being acquitted.
Principle
The case highlights the ongoing tension between:
Key Examination Principles
Section 132
Conclusion
Under Malaysian Banking Law, banking secrecy is protected through both statutory and contractual mechanisms. Sections 132–134 of the Financial Services Act 2013 impose strict obligations of confidentiality while recognising carefully defined exceptions necessary for regulatory supervision, law enforcement and the administration of justice. Malaysian case law, particularly Tan Eng Seong v Malayan Banking Bhd and Wong Yeng Mun v CIMB Bank Berhad, further confirms that confidentiality is an implied term of the banker-customer relationship. These authorities demonstrate that a bank may incur liability not only for deliberate disclosures but also for careless handling of customer information. Ultimately, the law treats banking confidentiality as a cornerstone of the banker-customer relationship and an essential component of public confidence in the Malaysian banking system.
Introduction
Banking secrecy is one of the most fundamental obligations imposed upon a bank in its relationship with customers. Customers entrust banks with highly sensitive financial information and expect that information concerning their accounts, transactions, assets, liabilities and financial affairs will remain confidential.
The duty of confidentiality serves two important objectives. First, it protects the privacy rights of customers. Secondly, it preserves public confidence in the banking system by assuring customers that their personal financial affairs will not be disclosed without authority.
In Malaysia, banking secrecy is principally governed by sections 132, 133 and 134 of the Financial Services Act 2013 (FSA 2013). These provisions establish a statutory framework regulating customer confidentiality and prescribe circumstances in which disclosure may lawfully occur.
However, banking secrecy is not solely statutory in nature. Malaysian courts have consistently recognised that confidentiality is also an implied term of the banker-customer contract. Consequently, unauthorised disclosure may expose a bank to:
- Criminal liability under the FSA 2013;
- Regulatory consequences; and
- Civil liability for breach of the implied contractual duty of confidentiality.
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
Neither the Minister of Finance nor Bank Negara Malaysia (BNM) is generally authorised to investigate the affairs or accounts of a specific customer merely out of curiosity or convenience.
The purpose of this restriction is to preserve customer privacy and prevent unnecessary governmental intrusion into banking relationships.
Exception
Customer confidentiality must sometimes yield to legitimate regulatory concerns.
Accordingly, section 132(2) empowers BNM to investigate customer accounts where necessary for the exercise of its powers and functions under:
- The Financial Services Act 2013;
- The Islamic Financial Services Act 2013; or
- Section 47 of the Central Bank of Malaysia Act 2009.
Case Scenario 1: BNM Investigation
Facts
ABC Bank detects suspicious transactions involving a customer who appears to be moving substantial sums through multiple accounts.
BNM requires the bank to disclose account statements and transaction records as part of an anti-money laundering investigation.
The customer objects on the ground of banking secrecy.
Solution
The objection fails.
Section 132(2) expressly authorises BNM to investigate customer affairs for regulatory purposes.
The bank may lawfully disclose the information.
Critical Analysis
This provision demonstrates that banking secrecy is not absolute.
The law seeks to balance:
- Individual privacy rights; and
- The broader public interest in maintaining the integrity of the financial system.
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict duty of secrecy upon:
- Financial institutions;
- Directors;
- Officers;
- Employees;
- Agents; and
- Former directors, officers and agents.
Importantly, the duty survives termination of employment or office.
Scope of Protection
The protection extends to:
- Savings accounts;
- Current accounts;
- Fixed deposits;
- Financing facilities;
- Securities holdings;
- Credit information;
- Customer identities;
- Account balances;
- Transaction histories;
- Financial standing; and
- Any information obtained through banking dealings.
Rather, all information acquired through the banking relationship is protected.
Criminal Liability
A person who unlawfully discloses customer information commits a criminal offence.
The penalty may include:
- Imprisonment for up to five years;
- A fine of up to RM10 million; or
- Both.
Exceptions under Section 133(2)
The statutory duty does not apply where:
(a) Disclosure to BNM
Information is disclosed to BNM for the exercise of its statutory functions.
(b) Statistical or Aggregated Information
Information is disclosed in a manner that does not identify any particular customer.
(c) Public Information
Information has already been lawfully disclosed to the public from a source other than the bank.
Case Scenario 2: Disclosure by a Bank Employee
Facts
A bank officer discovers that a celebrity maintains RM20 million in her account.
He reveals this information to several friends.
The information subsequently appears on social media.
Solution
The officer has breached section 133(1).
The information was acquired solely through the banking relationship and remains confidential.
The officer may face criminal prosecution and disciplinary sanctions.
Critical Analysis
The confidence reposed in banks would be severely undermined if employees could freely reveal customer information.
The provision therefore serves as an essential safeguard for customer trust.
3. Prohibition Against Further Disclosure (Section 133(3))
Section 133(3) extends protection beyond the initial disclosure.
A person who knowingly receives information disclosed in breach of section 133(1) is prohibited from further disclosing that information.
The objective is to prevent confidential information from continuing to circulate after the original breach.
Case Scenario 3: Secondary Disclosure
Facts
A bank employee unlawfully discloses customer information to a journalist.
The journalist knows the information was obtained unlawfully but publishes it nonetheless.
Solution
The journalist may also be liable under section 133(3).
Critical Analysis
The law seeks to prevent both:
- The original disclosure; and
- Subsequent dissemination.
4. Banking Secrecy as an Implied Contractual Duty
Apart from the statutory framework, confidentiality is also recognised as an implied term of the banker-customer contract.
This means that a customer may bring a civil action for breach of confidentiality even where no criminal prosecution is initiated.
Two important Malaysian authorities are:
- Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
- Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff was a former employee of the defendant bank.
After leaving employment, he orally informed the bank that he wished to close his account.
However, he did not provide the written instructions required by the bank’s procedures.
The account therefore remained active and accumulated approximately RM15 in charges.
A bank credit officer subsequently informed the plaintiff’s brother about the outstanding amount.
The plaintiff commenced legal proceedings alleging breach of confidentiality.
Held
The court held that the account remained open because the plaintiff failed to submit the required written instructions.
Although the statement made by the bank officer was not defamatory, the disclosure constituted a breach of the implied duty of confidentiality.
The plaintiff succeeded and was awarded nominal damages of RM15.
Legal Principle
The case establishes that:
- Banking confidentiality exists as an implied contractual obligation.
- Disclosure to relatives may still amount to unauthorised disclosure.
- A customer may succeed even where actual financial loss is minimal.
- Confidentiality is valuable in itself and deserving of legal protection.
Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
Facts
The plaintiff maintained a banking account with CIMB Bank.
The account concerned financial arrangements involving the plaintiff and his son from a previous marriage.
CIMB mistakenly sent the plaintiff’s bank statements to an incorrect residential address.
The statements were subsequently opened and read by the plaintiff’s new wife.
As a result, confidential banking information relating to the plaintiff became known to an unauthorised third party.
The plaintiff brought an action against the bank for breach of banking confidentiality.
Held
The court held that CIMB was liable for breaching its duty of confidentiality.
By sending the bank statements to the wrong address, the bank failed to protect the confidentiality of the customer’s banking information.
However, the court declined to award exemplary damages.
Legal Principle
The court reaffirmed that:
- Banking confidentiality belongs to the customer.
- The privilege of confidentiality is a customer right and not a bank right.
- A bank must take reasonable precautions to ensure customer information is delivered only to authorised recipients.
- Negligent disclosure may constitute a breach of banking secrecy even where there is no deliberate wrongdoing.
Significance of Wong Yeng Mun
The importance of this case lies in its recognition that confidentiality can be breached through carelessness as well as intentional disclosure.
Unlike cases involving deliberate leaks by employees, the bank’s wrongdoing arose from an administrative failure.
The decision demonstrates that banks must implement effective systems and procedures to safeguard customer information.
A bank cannot avoid liability merely because the disclosure was accidental.
Case Scenario 4: Statement Sent to Wrong Address
Facts
A bank updates Ahmad’s mailing address incorrectly due to an administrative error.
Monthly account statements are sent to a stranger’s home and are opened by the recipient.
The stranger learns details of Ahmad’s savings and financing facilities.
Solution
Applying Wong Yeng Mun, the bank is likely liable for breach of confidentiality.
Although the disclosure was accidental, the bank failed to ensure the secure transmission of customer information.
Critical Analysis
The duty of confidentiality requires more than merely refraining from deliberate disclosure.
It also requires banks to adopt reasonable operational safeguards to prevent unauthorised access to customer information.
Case Scenario 5: Disclosure to a Family Member
Facts
Ali verbally requests closure of his account but does not complete the bank’s written closure form.
The account remains active and incurs service charges.
A bank officer later informs Ali’s sister about the outstanding balance.
Ali sues the bank.
Solution
Applying Tan Eng Seong, the account remains active because the required closure procedure was not followed.
However, the disclosure to Ali’s sister constitutes a breach of the implied contractual duty of confidentiality.
Critical Analysis
The case confirms that family members are legally third parties unless authorised by the customer.
Banks cannot assume that disclosure to relatives is permissible.
5. Permitted Disclosures (Section 134 FSA 2013)
Although secrecy is the general rule, section 134 recognises that disclosure may sometimes be necessary.
A bank may disclose customer information:
- Under Schedule 11; or
- With the written approval of BNM.
The 18 Permitted Disclosures under Schedule 11
The principal exceptions include:
Customer Consent
Disclosure authorised in writing by the customer.
Administration of Deceased Estates
Disclosure for probate, letters of administration, Faraid certificates and distribution orders.
Bankruptcy and Winding-Up
Disclosure to bankruptcy trustees and liquidators.
Litigation Involving the Bank
Disclosure necessary for legal proceedings involving the bank.
Garnishee Orders
Disclosure required to comply with garnishee proceedings.
Court Orders
Disclosure pursuant to court orders issued by courts not lower than the Sessions Court.
Enforcement Agency Requests
Disclosure to law enforcement authorities conducting investigations.
Other Permitted Disclosures
Disclosure relating to:
- PIDM functions;
- Securities Commission investigations;
- Stock exchange functions;
- Inland Revenue Board investigations;
- Credit reporting agencies;
- Supervisory authorities;
- Centralised group functions;
- Outsourcing arrangements;
- Consultants and adjusters;
- Due diligence exercises; and
- Suspicion of criminal activities.
Confidentiality During Court Proceedings
Section 134 also empowers courts to protect customer information during legal proceedings.
The court may:
- Conduct proceedings in camera;
- Restrict access to documents;
- Issue confidentiality orders; and
- Prohibit publication of identifying information.
Jeyamary Case
Facts
A bank officer printed customer account information and gave it to a private investigator.
The information eventually reached a blogger.
Decision
The bank officer was convicted and sentenced to:
- Two days’ imprisonment; and
- RM20,000 fine.
The duty of confidentiality extends to all information obtained through the banking relationship.
Johari and Rafizi (National Feedlot Corporation Case)
Facts
A bank clerk disclosed confidential banking information relating to the National Feedlot Corporation to politician Rafizi Ramli.
Both were initially convicted and sentenced to imprisonment before later being acquitted.
Principle
The case highlights the ongoing tension between:
- Banking secrecy; and
- Public interest disclosures.
Key Examination Principles
Section 132
- Protects customers from arbitrary inquiries.
- Restricts governmental interference.
- Permits BNM investigations where authorised by statute.
- Creates a statutory duty of secrecy.
- Applies to banks, employees, officers, directors and agents.
- Continues after employment ends.
- Covers all information acquired through banking dealings.
- Breach may result in imprisonment and substantial fines.
- Creates exceptions to secrecy.
- Permits disclosures listed in Schedule 11.
- Permits disclosures approved by BNM.
- Allows courts to preserve confidentiality during litigation.
- Confidentiality is an implied contractual term.
- Disclosure to relatives may amount to breach.
- Nominal damages may be awarded even without substantial loss.
- Confidentiality belongs to the customer.
- Accidental disclosures may still create liability.
- Banks must maintain effective safeguards for customer information.
- Negligence in handling customer documents can constitute a breach of confidentiality.
Conclusion
Under Malaysian Banking Law, banking secrecy is protected through both statutory and contractual mechanisms. Sections 132–134 of the Financial Services Act 2013 impose strict obligations of confidentiality while recognising carefully defined exceptions necessary for regulatory supervision, law enforcement and the administration of justice. Malaysian case law, particularly Tan Eng Seong v Malayan Banking Bhd and Wong Yeng Mun v CIMB Bank Berhad, further confirms that confidentiality is an implied term of the banker-customer relationship. These authorities demonstrate that a bank may incur liability not only for deliberate disclosures but also for careless handling of customer information. Ultimately, the law treats banking confidentiality as a cornerstone of the banker-customer relationship and an essential component of public confidence in the Malaysian banking system.
0 Comments