How to Avoid MACC Prosecution: A Prevention Guide for Malaysian Companies

No Malaysian company wants a call from the MACC. Since Section 17A of the MACC Act 2009 came into force, a business can be prosecuted for corruption committed by its people or partners, even if management knew nothing about it. The good news is that prosecution is largely preventable. This guide sets out how to avoid MACC prosecution by building the controls the law expects, from adequate procedures to ISO 37001 certification.

Why Can a Company Be Prosecuted by the MACC?

A company can be prosecuted by the MACC because Section 17A of the MACC Act 2009 makes a commercial organisation criminally liable when an associated person commits corruption for its benefit. In force since 1 June 2020, the offence applies even if directors and management had no knowledge of the bribery. Liability attaches to the organisation automatically once the corrupt act is proven.

The penalties are severe: a fine of not less than ten times the value of the bribe or RM1 million, whichever is higher, and imprisonment of up to twenty years. Senior management can also be held personally liable unless they prove they exercised due diligence. This is why understanding MACC Section 17A is the starting point for any company that wants to avoid prosecution. The law shifts the burden onto the organisation to show it did the right things in advance.

What Is the Only Defence Against MACC Prosecution?

The only statutory defence against a Section 17A prosecution is proving that the company had adequate procedures in place to prevent corruption. There is no defence of ignorance and no way to argue the act was unauthorised. The company must show, on the balance of probabilities, that it had genuine anti-corruption controls operating at the time.

What counts as adequate is guided by the Prime Minister’s Department Guidelines on Adequate Procedures, issued in December 2018, built around five principles known by the acronym TRUST: Top-level commitment, Risk assessment, Undertake control measures, Systematic review, and Training and communication. Malaysian courts use these guidelines as the benchmark. Crucially, procedures must be real and operational, not a policy document that was written once and filed away. A defence built on paper alone will not hold. This matters even for smaller businesses, and our article on why ISO 37001 is becoming essential for SMEs explains why.

How Do You Avoid MACC Prosecution? A Prevention Checklist

You avoid MACC prosecution by putting genuine adequate procedures in place before any incident occurs, aligned with the TRUST principles. Work through this checklist:

• Secure top-level commitment. The board and senior management must visibly own the anti-corruption programme, not delegate it and forget it.
• Run a bribery risk assessment. Identify where corruption risk is highest, such as procurement, government dealings, agents, and tenders, and review it regularly.
• Vet third parties. Conduct due diligence on agents, suppliers, and partners, and include anti-corruption clauses in contracts.
• Set clear policies. Put gifts, hospitality, and conflict-of-interest rules in writing and communicate them across the business.
• Provide a whistleblowing channel. Give employees and third parties a safe, confidential way to report concerns without retaliation.
• Train your people. Deliver anti-corruption training suited to each role, and keep records of who was trained and when.
• Monitor and review. Audit the programme regularly and fix gaps, so it stays effective and defensible over time.

How Does Third-Party Due Diligence Reduce Your Risk?

Third-party due diligence reduces your risk because associated persons, not direct employees, are the most common source of Section 17A exposure. An agent who pays a bribe to win business for you can trigger the company’s liability, even if no one in the company authorised or knew about it.

Effective due diligence means checking who you are dealing with before engaging them: their ownership, reputation, and any red flags around government connections or unusual payment terms. It continues after onboarding through anti-corruption clauses, audit rights, and ongoing monitoring of higher-risk relationships. In our ISO 37001 work with Malaysian companies, the exposure almost always comes from third parties, agents, or intermediaries, rather than from direct employee bribery. A company that cannot show it vetted and monitored its associated persons has a weak adequate-procedures defence, no matter how good its internal policies look.

How Does ISO 37001 Help You Avoid Prosecution?

ISO 37001 helps you avoid prosecution by giving you a documented, independently audited anti-bribery management system that demonstrates adequate procedures. Certification to ISO 37001 maps directly to the TRUST principles and is recognised as strong evidence that the controls the law expects are genuinely in place and operating.

The value is in the independent verification. A certificate from a body accredited under the MACC scheme shows the system was tested by an external auditor, not just self-declared, which is far more persuasive than an internal claim. Certification also forces the discipline that keeps a programme alive: risk assessments, training, monitoring, and corrective action. Understanding what auditors look for in an ISO 37001 audit shows how thoroughly the system is examined. For a company facing scrutiny, an ISO 37001 certificate backed by a real system is the clearest way to show it took reasonable steps to prevent corruption.

What Should You Do If the MACC Investigates Your Company?

If the MACC investigates your company, the priority is to cooperate, preserve all relevant records, and engage qualified legal counsel immediately. Do not destroy or alter documents, as this can create fresh offences and severely damage your position. Gather and protect the evidence of your anti-corruption programme, since your adequate procedures are your defence.

An investigation is not automatically a conviction. Companies that can produce a genuine, well-documented anti-corruption system, ideally backed by ISO 37001 certification, are in a far stronger position than those scrambling to assemble evidence after the fact. This is general information, not legal advice, and any company under investigation should obtain advice from a qualified Malaysian lawyer. The best protection, however, is built long before an investigation begins, through the controls described above.

The Time to Build Your Defence Is Before the MACC Calls

Avoiding MACC prosecution is not about luck or staying under the radar. It is about building genuine anti-corruption controls before you ever need them. Section 17A puts the burden on your company to prove it had adequate procedures, so the businesses that invest in risk assessment, third-party due diligence, training, and monitoring are the ones that can defend themselves. ISO 37001 certification packages all of this into an independently verified system that stands up to scrutiny. The time to build that defence is now, not when the MACC calls.

Protect your business from bribery risks. Get ISO 37001 certified with Connext.

Frequently Asked Questions About Avoiding MACC Prosecution

How can a company avoid MACC prosecution in Malaysia?

A company avoids MACC prosecution by putting adequate procedures in place before any incident, which is the only defence under Section 17A. This means top-level commitment, bribery risk assessment, third-party due diligence, clear policies, a whistleblowing channel, training, and monitoring. ISO 37001 certification provides independent evidence that these controls are genuinely operating.

What is Section 17A of the MACC Act?

Section 17A of the MACC Act 2009, in force since 1 June 2020, makes a commercial organisation criminally liable when an associated person commits corruption for its benefit, even without management’s knowledge. The penalty is a fine of at least RM1 million or ten times the bribe, whichever is higher, and up to twenty years imprisonment.

What are adequate procedures under Section 17A?

Adequate procedures are the documented, operational anti-corruption controls that form a company’s only defence against Section 17A liability. They follow the Prime Minister’s Department Guidelines issued in December 2018 and the five TRUST principles. The procedures must be genuinely implemented and enforced, not simply written down and filed away.

Can ISO 37001 protect a company from MACC prosecution?

ISO 37001 does not grant immunity, but it provides the strongest available evidence of adequate procedures. Certification from a MACC-scheme accredited body shows an independently audited anti-bribery management system is operating, which is far more persuasive than a self-declared programme when a company needs to prove it took reasonable steps to prevent corruption.

What should a company do during a MACC investigation?

During a MACC investigation, a company should cooperate, preserve all records, and engage a qualified lawyer immediately. Destroying or altering documents can create further offences. The company should protect the evidence of its anti-corruption programme, as adequate procedures are its defence. This is general information, not legal advice.