- Published on
Malaysian Banking Law – Banking Secrecy, Customer Confidentiality, Implied Consent and Permitted Disclosure under Sections 132–134 of the Financial Services Act 2013 and Common Law
Introduction
Banking secrecy is one of the most fundamental obligations imposed upon a bank in its relationship with customers. Customers entrust banks with highly sensitive information concerning their accounts, assets, liabilities, transactions and financial affairs. In return, the law requires banks to maintain strict confidentiality over such information.
The duty of confidentiality serves two essential purposes:
However, banking secrecy is not merely statutory. Malaysian courts have consistently recognised that confidentiality is also an implied term of the banker-customer contract. Accordingly, unauthorised disclosure may result in:
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
Neither the Minister of Finance nor Bank Negara Malaysia (BNM) may ordinarily inquire into the affairs or account of a specific customer.
The purpose is to safeguard customer privacy and prevent unnecessary interference with banking relationships.
Exception
BNM may investigate customer accounts where necessary for exercising its powers under:
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict statutory duty of confidentiality upon:
The duty continues even after employment or office has ended.
Scope of Protection
The protection covers:
Criminal Liability
Unauthorised disclosure constitutes a criminal offence punishable by:
3. Prohibition Against Further Disclosure (Section 133(3))
The law also prohibits further dissemination of information obtained through an unlawful disclosure.
A person who knowingly receives confidential customer information that has been improperly disclosed cannot further disclose that information to others.
This provision prevents banking secrecy from being undermined through indirect disclosures.
4. Banking Secrecy as an Implied Contractual Duty
Apart from statutory obligations, confidentiality is recognised as an implied term of the banker-customer contract.
This means that a customer may bring a civil action against a bank even if:
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff verbally instructed the bank to close his account but failed to provide the written instructions required by bank procedures.
The account therefore remained active and accumulated service charges.
A bank officer subsequently informed the plaintiff’s brother about the outstanding balance.
The plaintiff sued for breach of confidentiality.
Held
The court held that the account had not been properly closed because no written instruction was given.
Although the statement was not defamatory, disclosure to the plaintiff’s brother constituted a breach of the implied duty of confidentiality.
The plaintiff was awarded nominal damages.
Legal Principle
The case establishes that:
Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
Facts
CIMB mistakenly sent the plaintiff’s bank statements to an incorrect residential address.
The statements contained information concerning an account involving the plaintiff and his son from an earlier marriage.
The statements were opened and read by the plaintiff’s new wife.
The plaintiff sued for breach of confidentiality.
Held
The court held that CIMB was liable for breaching its duty of confidentiality.
However, exemplary damages were not awarded.
Legal Principle
The court emphasised that:
The case demonstrates that confidentiality may be breached not only through intentional disclosure but also through administrative negligence.
The bank’s duty requires positive steps to safeguard customer information.
Tan Lay Soon v Kam Mah Theatre Sdn Bhd (Malayan United Finance Bhd, Intervener) [1990] 2 MLJ 482
Facts
The defendant company had allegedly agreed to sell certain land to the plaintiff.
The land was charged to Malayan United Finance Bhd.
The sale documentation contained an express authorisation permitting part of the purchase price to be used to settle the outstanding debt owed to the financier so that the charge could be discharged.
A dispute subsequently arose and litigation commenced.
The plaintiff sought an injunction to preserve the land pending trial.
The financier argued that granting the injunction would require disclosure of the amount owed by the defendant under the charge.
According to the financier, such disclosure would breach section 97 of the Banking and Financial Institutions Act 1989 (the predecessor of section 133 FSA 2013).
Held
The court rejected the financier’s argument.
The court held that the privilege of confidentiality belonged to the customer, namely the defendant chargor.
By expressly authorising the purchase price to be used to discharge the outstanding debt, the defendant had effectively consented to the disclosure of information necessary for that purpose.
The consent was at least implied, if not expressly given.
Furthermore, the plaintiff would effectively act as the defendant’s agent or receiver for the limited purpose of paying off the debt secured by the charge.
The court also noted that the financier had already commenced legal proceedings and obtained an order for sale of the land, thereby disclosing the existence of the debt in any event.
Legal Principle
The case establishes several important principles:
Confidentiality Belongs to the Customer
The privilege of banking confidentiality belongs to the customer and not to the bank.
The bank cannot invoke confidentiality for its own benefit where the customer has authorised disclosure.
Consent May Be Express or Implied
Consent need not always be expressly stated.
Where a customer’s conduct or contractual arrangements necessarily contemplate disclosure, consent may be implied.
Disclosure Necessary to Give Effect to a Transaction Is Permissible
Where disclosure is necessary to implement a transaction authorised by the customer, banking secrecy will not prevent such disclosure.
Confidentiality Cannot Be Used as a Shield Against Legitimate Proceedings
A customer cannot rely on banking secrecy to prevent disclosure that is necessary to enforce rights already contemplated by the customer’s own agreements.
Significance of Tan Lay Soon
This case is particularly important because it clarifies the ownership of the confidentiality privilege.
Together with Wong Yeng Mun v CIMB Bank Berhad, it confirms that:
Where disclosure is necessary to complete a sale, discharge a charge, or facilitate payment of an outstanding debt, confidentiality cannot be invoked to frustrate the transaction.
Case Scenario: Implied Consent to Disclosure
Facts
Ali agrees to sell charged property to Bala.
The sale agreement expressly provides that part of the purchase price will be paid directly to XYZ Bank to redeem Ali’s outstanding financing facility.
During completion, Bala requests confirmation of the redemption sum from XYZ Bank.
Ali later argues that disclosure of the redemption amount breaches banking secrecy.
Solution
Applying Tan Lay Soon, Ali’s argument fails.
By agreeing that the sale proceeds would be used to redeem the financing facility, Ali has impliedly authorised disclosure of the amount necessary to complete the redemption.
The disclosure is therefore lawful.
Critical Analysis
Banking secrecy exists to protect customers, not to obstruct commercial transactions authorised by those customers.
Where disclosure is necessary to implement a transaction contemplated by the customer, the law recognises implied consent.
5. Permitted Disclosures under Section 134 and Schedule 11 FSA 2013
Although secrecy is the general rule, section 134 creates statutory exceptions.
Disclosure is permitted where:
Key Examination Principles
Section 132 FSA 2013
Conclusion
Under Malaysian Banking Law, banking secrecy is protected through a combination of statutory provisions and common law principles. Sections 132–134 of the Financial Services Act 2013 establish a comprehensive framework governing confidentiality, while cases such as Tan Eng Seong, Wong Yeng Mun, and Tan Lay Soon demonstrate how the courts balance customer privacy against commercial reality, regulatory requirements and the administration of justice. These authorities collectively establish that confidentiality belongs to the customer, may be waived by the customer either expressly or impliedly, and may give rise to both criminal and civil liability when breached. Ultimately, banking secrecy remains a cornerstone of the banker-customer relationship, but it is a protection designed to serve customers rather than an instrument to obstruct lawful transactions or legal proceedings.
Introduction
Banking secrecy is one of the most fundamental obligations imposed upon a bank in its relationship with customers. Customers entrust banks with highly sensitive information concerning their accounts, assets, liabilities, transactions and financial affairs. In return, the law requires banks to maintain strict confidentiality over such information.
The duty of confidentiality serves two essential purposes:
- Protecting the privacy rights of customers; and
- Preserving public confidence in the banking system.
However, banking secrecy is not merely statutory. Malaysian courts have consistently recognised that confidentiality is also an implied term of the banker-customer contract. Accordingly, unauthorised disclosure may result in:
- Criminal liability under the FSA 2013;
- Regulatory sanctions; and
- Civil liability for breach of contract.
1. Restriction on Inquiry into Customer Affairs (Section 132 FSA 2013)
General Rule
Section 132 protects customers from arbitrary inquiries into their banking affairs.
Neither the Minister of Finance nor Bank Negara Malaysia (BNM) may ordinarily inquire into the affairs or account of a specific customer.
The purpose is to safeguard customer privacy and prevent unnecessary interference with banking relationships.
Exception
BNM may investigate customer accounts where necessary for exercising its powers under:
- The Financial Services Act 2013;
- The Islamic Financial Services Act 2013; or
- The Central Bank of Malaysia Act 2009.
2. Statutory Duty of Secrecy (Section 133 FSA 2013)
General Rule
Section 133(1) imposes a strict statutory duty of confidentiality upon:
- Financial institutions;
- Directors;
- Officers;
- Employees;
- Agents; and
- Former directors, officers and agents.
The duty continues even after employment or office has ended.
Scope of Protection
The protection covers:
- Savings and current accounts;
- Fixed deposits;
- Financing facilities;
- Securities and investments;
- Customer identities;
- Credit information;
- Financial standing;
- Account balances;
- Transaction histories; and
- All information acquired through the banking relationship.
Criminal Liability
Unauthorised disclosure constitutes a criminal offence punishable by:
- Imprisonment up to five years;
- A fine up to RM10 million; or
- Both.
3. Prohibition Against Further Disclosure (Section 133(3))
The law also prohibits further dissemination of information obtained through an unlawful disclosure.
A person who knowingly receives confidential customer information that has been improperly disclosed cannot further disclose that information to others.
This provision prevents banking secrecy from being undermined through indirect disclosures.
4. Banking Secrecy as an Implied Contractual Duty
Apart from statutory obligations, confidentiality is recognised as an implied term of the banker-customer contract.
This means that a customer may bring a civil action against a bank even if:
- No criminal prosecution occurs;
- No regulatory action is taken; or
- The disclosure falls outside the statutory framework.
- Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
- Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
- Tan Lay Soon v Kam Mah Theatre Sdn Bhd (Malayan United Finance Bhd, Intervener) [1990] 2 MLJ 482
Tan Eng Seong v Malayan Banking Bhd [1997] MLJU 36
Facts
The plaintiff verbally instructed the bank to close his account but failed to provide the written instructions required by bank procedures.
The account therefore remained active and accumulated service charges.
A bank officer subsequently informed the plaintiff’s brother about the outstanding balance.
The plaintiff sued for breach of confidentiality.
Held
The court held that the account had not been properly closed because no written instruction was given.
Although the statement was not defamatory, disclosure to the plaintiff’s brother constituted a breach of the implied duty of confidentiality.
The plaintiff was awarded nominal damages.
Legal Principle
The case establishes that:
- Banking confidentiality is an implied contractual obligation.
- Disclosure to family members may constitute a breach.
- Confidentiality may be protected even where the customer suffers minimal financial loss.
Wong Yeng Mun v CIMB Bank Berhad [2010] MLJU 414
Facts
CIMB mistakenly sent the plaintiff’s bank statements to an incorrect residential address.
The statements contained information concerning an account involving the plaintiff and his son from an earlier marriage.
The statements were opened and read by the plaintiff’s new wife.
The plaintiff sued for breach of confidentiality.
Held
The court held that CIMB was liable for breaching its duty of confidentiality.
However, exemplary damages were not awarded.
Legal Principle
The court emphasised that:
- The privilege of confidentiality belongs to the customer.
- Banks must take reasonable steps to ensure confidential information reaches only authorised persons.
- Negligent disclosure can constitute a breach even without deliberate misconduct.
The case demonstrates that confidentiality may be breached not only through intentional disclosure but also through administrative negligence.
The bank’s duty requires positive steps to safeguard customer information.
Tan Lay Soon v Kam Mah Theatre Sdn Bhd (Malayan United Finance Bhd, Intervener) [1990] 2 MLJ 482
Facts
The defendant company had allegedly agreed to sell certain land to the plaintiff.
The land was charged to Malayan United Finance Bhd.
The sale documentation contained an express authorisation permitting part of the purchase price to be used to settle the outstanding debt owed to the financier so that the charge could be discharged.
A dispute subsequently arose and litigation commenced.
The plaintiff sought an injunction to preserve the land pending trial.
The financier argued that granting the injunction would require disclosure of the amount owed by the defendant under the charge.
According to the financier, such disclosure would breach section 97 of the Banking and Financial Institutions Act 1989 (the predecessor of section 133 FSA 2013).
Held
The court rejected the financier’s argument.
The court held that the privilege of confidentiality belonged to the customer, namely the defendant chargor.
By expressly authorising the purchase price to be used to discharge the outstanding debt, the defendant had effectively consented to the disclosure of information necessary for that purpose.
The consent was at least implied, if not expressly given.
Furthermore, the plaintiff would effectively act as the defendant’s agent or receiver for the limited purpose of paying off the debt secured by the charge.
The court also noted that the financier had already commenced legal proceedings and obtained an order for sale of the land, thereby disclosing the existence of the debt in any event.
Legal Principle
The case establishes several important principles:
Confidentiality Belongs to the Customer
The privilege of banking confidentiality belongs to the customer and not to the bank.
The bank cannot invoke confidentiality for its own benefit where the customer has authorised disclosure.
Consent May Be Express or Implied
Consent need not always be expressly stated.
Where a customer’s conduct or contractual arrangements necessarily contemplate disclosure, consent may be implied.
Disclosure Necessary to Give Effect to a Transaction Is Permissible
Where disclosure is necessary to implement a transaction authorised by the customer, banking secrecy will not prevent such disclosure.
Confidentiality Cannot Be Used as a Shield Against Legitimate Proceedings
A customer cannot rely on banking secrecy to prevent disclosure that is necessary to enforce rights already contemplated by the customer’s own agreements.
Significance of Tan Lay Soon
This case is particularly important because it clarifies the ownership of the confidentiality privilege.
Together with Wong Yeng Mun v CIMB Bank Berhad, it confirms that:
- Confidentiality belongs to the customer.
- The customer may waive confidentiality.
- Waiver may occur expressly or by implication.
- Banks cannot insist upon secrecy where the customer has authorised disclosure.
Where disclosure is necessary to complete a sale, discharge a charge, or facilitate payment of an outstanding debt, confidentiality cannot be invoked to frustrate the transaction.
Case Scenario: Implied Consent to Disclosure
Facts
Ali agrees to sell charged property to Bala.
The sale agreement expressly provides that part of the purchase price will be paid directly to XYZ Bank to redeem Ali’s outstanding financing facility.
During completion, Bala requests confirmation of the redemption sum from XYZ Bank.
Ali later argues that disclosure of the redemption amount breaches banking secrecy.
Solution
Applying Tan Lay Soon, Ali’s argument fails.
By agreeing that the sale proceeds would be used to redeem the financing facility, Ali has impliedly authorised disclosure of the amount necessary to complete the redemption.
The disclosure is therefore lawful.
Critical Analysis
Banking secrecy exists to protect customers, not to obstruct commercial transactions authorised by those customers.
Where disclosure is necessary to implement a transaction contemplated by the customer, the law recognises implied consent.
5. Permitted Disclosures under Section 134 and Schedule 11 FSA 2013
Although secrecy is the general rule, section 134 creates statutory exceptions.
Disclosure is permitted where:
- The customer provides written consent;
- Probate or estate administration is involved;
- Bankruptcy or winding-up proceedings arise;
- Litigation involving the bank exists;
- Garnishee proceedings are commenced;
- A court order is issued;
- An enforcement agency requests information under written law;
- Disclosure is required for tax, regulatory or supervisory purposes;
- Credit reporting obligations arise;
- Outsourcing, auditing or due diligence functions are performed;
- Criminal conduct is suspected.
Key Examination Principles
Section 132 FSA 2013
- Restricts arbitrary inquiries into customer affairs.
- Protects customer privacy.
- Permits BNM investigations for statutory purposes.
- Creates a statutory duty of secrecy.
- Applies to banks and their personnel.
- Covers all customer information.
- Continues after employment ends.
- Breach may result in imprisonment and substantial fines.
- Creates exceptions to confidentiality.
- Allows disclosure under Schedule 11.
- Allows disclosure with BNM approval.
- Protects confidentiality during court proceedings.
- Confidentiality is an implied contractual term.
- Disclosure to family members may amount to breach.
- Nominal damages may be awarded.
- Confidentiality belongs to the customer.
- Administrative negligence may amount to breach.
- Banks must protect customer information.
- Confidentiality belongs to the customer, not the bank.
- Customers may waive confidentiality.
- Waiver may be express or implied.
- Disclosure necessary to implement an authorised transaction is lawful.
- Banking secrecy cannot be used to frustrate legitimate commercial arrangements authorised by the customer.
Conclusion
Under Malaysian Banking Law, banking secrecy is protected through a combination of statutory provisions and common law principles. Sections 132–134 of the Financial Services Act 2013 establish a comprehensive framework governing confidentiality, while cases such as Tan Eng Seong, Wong Yeng Mun, and Tan Lay Soon demonstrate how the courts balance customer privacy against commercial reality, regulatory requirements and the administration of justice. These authorities collectively establish that confidentiality belongs to the customer, may be waived by the customer either expressly or impliedly, and may give rise to both criminal and civil liability when breached. Ultimately, banking secrecy remains a cornerstone of the banker-customer relationship, but it is a protection designed to serve customers rather than an instrument to obstruct lawful transactions or legal proceedings.
0 Comments