Malaysia.
Decision Intelligence Report

These conditions are not exceptions. They represent common operating realities across most verification programmes in Malaysia.

These patterns are not isolated to specific vendors or programmes. They reflect how verification operates within Malaysia's dual-language, dual-track environment.

PDPA 2010 compliance requirements for BGV vendors

• Explicit written consent from candidates specifying scope of screening. Opt-out mechanisms are not permitted.
• Reasonable security measures for personal data throughout processing and storage.
• Data retention limits: retain data only as long as necessary for the stated purpose.
• Breach notification protocol: best practice is to align to GDPR's 72-hour standard, but no statutory obligation exists in Malaysia.

Cross-border transfer restrictions

• Section 129 of PDPA 2010 restricts transfer of personal data outside Malaysia unless the receiving country is approved by the Minister.
• BGV vendors processing Malaysian candidate data at offshore centres (India, Philippines) must ensure contractual safeguards are in place.
• Data processing agreements must explicitly address Section 129 requirements.
• Consent forms should disclose the countries where personal data will be processed.

In structured verification environments like Malaysia, gaps are less visible, but not absent. Each check type operates within a dependency chain where outcomes are shaped by access, response timelines, and regulatory constraints.

Identity depends on document type and workforce category

• MyKad (JPN): 12-digit national IC card, biometric-linked. Primary ID for all purposes. This is the strongest verification layer in the Malaysian system.
• Passport (JIM): international travel document, also accepted as domestic ID for limited purposes.
• Driver's License (JPJ): supports identity and address verification.
• Foreign workers: passport + PLKS permit. Expatriates: passport + Employment Pass. Each category follows a different document path.

For Malaysian nationals, identity confirmation is structurally robust. For foreign workers and expatriates, completeness depends on document availability and home-country sourcing.

Employment verification depends on employer response

• EPF contribution trace (KWSP) provides comprehensive employment records for formal-sector workers. However, EPF confirms contributions, not roles, responsibilities, or reasons for separation.
• Direct HR contact: employment letter, contract, or HR portal verification. Response may be delayed or unavailable, particularly for former employees at smaller organisations.
• SOCSO (Employees' Social Security Organisation): records for self-employed and informal sector contributors.

Completeness depends on cooperation, not process design. EPF provides the contribution record; confirming what the candidate actually did requires employer response.

Education verification depends on institutional response

• MQA Recognition List covers 700+ HEIs (public universities, private colleges, international branch campuses). Institutions not on the list are not recognised.
• No centralised digital depository exists. Verification requires direct registrar contact via email or certified request.
• PTPTN (National Higher Education Fund Corporation) provides a graduate database useful for cross-reference if the candidate received an education loan.
• Dual-language documentation variance: credentials are frequently issued in both Malay and English, or Malay-only. Verification agents must process both languages.

The institution may hold the record. Whether it responds, and how quickly, determines whether the check produces a confirmed outcome or remains unresolved.

Criminal verification depends on candidate cooperation

• PDRM Certificate of Good Conduct is the primary mechanism. Issued as "No Record Found" (Tiada Rekod) or "With Record" (Ada Rekod).
• The candidate must personally apply. Employers and BGV vendors cannot initiate the request on a candidate's behalf. The programme controls the process; the candidate controls the timeline.
• Processing time: 7 to 14 working days. Standard fee: RM20 at PDRM district HQ.
• When the PDRM certificate is delayed, some employers accept a Surat Akuan Sumpah (statutory declaration) as a temporary substitute. This carries no official verification weight.

Criminal record data exists within PDRM systems. It cannot be accessed directly by employers or verification vendors. The check depends entirely on whether the candidate initiates and completes the application.

Credit verification depends on which system can be accessed

• CCRIS (Bank Negara): institutional borrowing data. Access restricted to BNM-regulated financial institutions. Most BGV vendors cannot access CCRIS directly.
• CTOS (private bureau): trade references, litigation records, bankruptcy filings, directorship data, CCRIS summary, and CTOS Score. Accessible to subscribing companies with data subject consent.
• When a vendor claims "credit check included," clarify whether this means a CTOS report (accessible, standard) or a full CCRIS enquiry (restricted, requires financial institution intermediation).

Two systems exist. One is accessible to verification vendors; the other is not. The label "credit check" does not indicate which system was used, or what was actually covered.

Data protection and consent requirements shape how information can be accessed, verified, and used. Under PDPA 2010, each data point requires explicit candidate consent, and cross-border transfer is restricted unless the receiving country meets ministerial approval. These constraints do not prevent verification, but they define the boundaries within which every check must operate.

In many cases, what is not verified is not always visible in the final output. A report may show "completed" for a credit check without specifying whether CCRIS or CTOS was used. An employment confirmation may reflect EPF contribution data without confirming role, responsibilities, or reason for separation. The gap is in what was covered, not in whether a check was performed.

In each case, the limitation is not the system. It is what the system allows to be accessed and confirmed within the programme's operational window. These conditions are not exceptions. They represent common operating realities across most verification programmes in Malaysia.

Cross-border complexity is not a special case. It is the baseline for most programmes hiring through Malaysia as a regional hub.

These conditions are not exceptions. They represent common operating realities across most verification programmes in Malaysia.

The system appears controlled. Outcomes still depend on what can be accessed, confirmed, and documented within the constraints of each check type.