The distinction that matters most: registered vs. licensed
These are not the same thing, and mixing them up is how people end up sending money to a company that sounds official but has no authority to take it.
- Registered (SSM) — Suruhanjaya Syarikat Malaysia (SSM) is the companies registry. A search there confirms a business entity legally exists and is registered — nothing more. Registering a company in Malaysia does not require any authority to take deposits, manage investments, or give financial advice. Plenty of registered companies have no such authority at all.
- Licensed (BNM / SC) — Bank Negara Malaysia (BNM) licenses banks, deposit-takers and certain financial institutions; the Securities Commission Malaysia (SC) licenses capital-market intermediaries such as fund managers and dealers. Each keeps its own register of the entities it has actually licensed. This is the check that tells you whether a firm is allowed to do what it's asking you to pay it for.
A company can be registered and not licensed. That combination — real SSM registration, no licence — is one of the most common patterns behind investment scams, because a registration certificate looks reassuring even when it confirms nothing about legitimacy to invest.
Step 1 — Search SSM to confirm the company exists
Search the company name or registration number through SSM's own portal. This tells you the entity is real and registered — treat it as step one, not the final answer.
Step 2 — Check the licensed-entity register, not just the warning list
Separately from any warning list, both BNM and the SC publish their own registers of entities they have licensed. Look the company up there directly. If it isn't on the licensed register for the activity it's offering (taking deposits, managing investments, dealing in securities), don't proceed — regardless of what SSM or a warning list showed.
Step 3 — Check BNM's Financial Consumer Alert List and the SC's Investor Alert List
These are warning lists, built from reports BNM and the SC have received about entities suspected of unlicensed activity or scams. They're useful, but treat a name's absence from either list carefully: BNM states expressly that absence or removal from the Financial Consumer Alert List is not confirmation that an entity is or has been licensed. A name simply not having been reported yet is not the same as being cleared.
Never conclude "not on the warning list" means "safe" or "legitimate." The only thing that confirms legitimacy for taking your money is being on the licensed register in Step 2.
Watch for "potential clone" markers
Some entries on the SC's Investor Alert List are marked as a potential clone — meaning scammers are using the name (and sometimes the registration details) of a real, licensed firm to impersonate it, often with a different phone number, website or bank account than the genuine firm uses. Before drawing any conclusion about a business from an alert-list entry, check whether it carries this marker. If it does, the real, licensed firm may be entirely uninvolved — the scam is the impersonation itself.
Putting it together
No single check is sufficient on its own. In order: SSM tells you the entity exists; the licensed register tells you it's actually authorised for what it's offering; the warning lists tell you whether anyone has already reported concerns — and a clean result there is a "nothing found yet," not a certificate of safety. If you're unsure about a specific investment pitch, message or invoice, you can also run it through our free checker.
FAQ
If a company isn't on BNM's or the SC's warning list, is it safe to invest with?
No. BNM states directly that absence or removal from its Financial Consumer Alert List does not confirm a firm is licensed. Warning lists only reflect what's been reported so far. Always verify licensing directly on BNM's or the SC's own licensed-entity register before you decide.
The company has an SSM registration number — doesn't that prove it's legitimate?
No. SSM registration confirms a company legally exists and is registered — it says nothing about whether the company is licensed to take deposits, manage investments, or give financial advice. Many unlicensed schemes operate through a validly registered company.
What does "potential clone" mean on the SC's Investor Alert List?
It means the name (and sometimes other details) on that alert belongs to, or closely mimics, a real licensed firm being impersonated by scammers — not that the genuine, licensed firm is doing anything wrong. Check for this marker before assuming an alert-list entry tells you anything about the actual licensed business of that name.