The Consumer Credit Act 2025 (Act 873) is no longer a bill to watch. It received Royal Assent on 22 December 2025, was gazetted on 31 December and came into force on 1 March 2026, when the Government set up the Consumer Credit Commission (Suruhanjaya Kredit Pengguna, or SKP). The licensing regime in Part V took effect on 1 June 2026, and the Ministry of Finance gave firms six months to apply, a transition that closes on 30 November 2026. For BNPL providers, fintech lenders, leasing and factoring firms, the board question is now what has to be fixed before SKP looks closely.
Why scrutiny will follow
Bank Negara Malaysia's Financial Stability Review for the second half of 2025 explains the urgency. BNPL transactions reached 140.3 million, worth RM11.9 billion, in the half, up from 102.6 million and RM9.3 billion in the first half. Outstanding BNPL debt rose to RM4.9 billion at end-December 2025, from RM3.8 billion in June, and active accounts reached 7.5 million. The overdue share held at 3.2%, measured from just one day past due, down from 6% in March 2023. BNPL is still only 0.3% of household debt, but the central bank said its rapid growth warrants continued close monitoring. Small, fast-growing books that reach millions of consumers are where conduct supervisors usually start.
Step one: confirm your scope
The Ministry of Finance has set out two tiers. Credit providers, including BNPL, leasing and factoring companies, need a licence. Credit service providers, meaning debt collection agencies, impaired loan buyers, and debt counselling and management agencies, must register. Read the consumer definition carefully. Under a ministerial order effective 1 March 2026, a micro or small enterprise taking credit of up to RM300,000 counts as a consumer, so leasing and factoring firms that think of themselves as business-to-business may still be in scope. Map every entity, product and Islamic variant. Under the Act, running an unlicensed credit business can bring a fine of up to RM5 million, up to five years' imprisonment, or both.
Step two: governance, fit-and-proper and financial resources
Licensing eligibility under the Act reaches beyond the company to the individuals who control and manage it. Directors, the CEO and controlling shareholders should be checked now for integrity, competence and financial soundness, with the checks documented. Boards need real independent oversight, plus a compliance and risk function that reports directly to them. On capital and financial resources, meet whatever SKP prescribes, but do not stop there. Stress-test funding lines and liquidity for a downturn in collections. SKP's Executive Chairman, Abu Hassan Alshari Yahaya, is a former Bank Negara Malaysia Assistant Governor who led the Consumer Credit Oversight Board (CCOB) Task Force. We would expect supervisory habits shaped by the central bank.
Step three: affordability and fair treatment
Section 84 of the Act places a duty of fair, responsible and professional conduct on credit providers. Section 85 lets regulations require an affordability assessment before credit is granted. The CCOB's 2023 consultation set out the likely conduct agenda: disclosure, fair terms, fees and charges, affordability, fair debt collection, relief from financial hardship, data protection and complaints handling. Bank Negara Malaysia's Responsible Financing policy document for banks is the obvious benchmark. In practice: affordability logic documented for each product tier, clear rules for raising credit limits, late fees tested for fairness, total cost shown up front, and a working route for customers in hardship. Merchant partners' marketing needs the same discipline.
Step four: collections and third-party agents
Collection agencies must register with SKP themselves, but the lender stays accountable for how its customers are treated. Two Bank Negara Malaysia documents are useful benchmarks: its Circular on Fair Debt Collection Practices, issued in September 2007, and its 2024 policy document on Disposal and Purchase of Impaired Loans/Financing. The 2024 document applies fair-collection standards to non-bank buyers and the collectors they appoint. List every agent and check its registration status. Rewrite contracts to include conduct standards, audit rights, call recording, limits on contact and termination triggers. Where debt is sold, confirm that the buyer is registered.
Step five: data and reporting
When the bill went through Parliament, Deputy Finance Minister Lim Hui Ying said BNPL providers would report consumer credit data to credit reporting agencies such as CTOS through a centralised platform. That needs one reconciled record of accounts, arrears ageing, hardship cases and complaints. It should feed both board reporting and regulatory returns. Firms still pulling figures by hand from several systems will struggle to answer SKP consistently.
Sequencing the remaining seven weeks
With approximately seven weeks left before the 30 November deadline, if your application is not yet filed, file it. Settle scope first, then run governance and fit-and-proper work alongside the affordability and collections policies, with data remediation underneath both. Each step should end in a board paper with an owner and a date. The licence is where supervision starts, not where it ends.