Malaysia: The Regulator Has Publicly Said No Crypto ATM Is Authorised, With Prison Terms Attached

Crypto trading is legal in Malaysia under a mature regulatory framework, but the Securities Commission has publicly and directly stated that no entity is authorised to operate a crypto ATM — with criminal penalties (up to RM 10 million or 10 years in prison) attached to running one anyway.

● Red

Trading cryptocurrency is legal in Malaysia under a mature, well-established dual-regulator framework, but there is a direct, public statement from the Securities Commission Malaysia (SC), published on its own website on 8 July 2020, that removes any ambiguity about physical crypto ATMs specifically: "the SC wishes to alert the public that entities operating Crypto ATMs are considered to be operating a Digital Asset Exchange (DAX) which require registration with the SC... the SC has not authorised any entity to operate Crypto ATMs."^1,2 The SC went further, explicitly warning all unauthorised crypto ATM operators to cease activity immediately and confirming that operating a DAX without authorisation is a criminal offence carrying a fine of up to RM 10 million (roughly USD 2.1 million) or up to ten years' imprisonment, or both. The age of this statement should be stated plainly: it dates from 2020 and this article found no evidence of a formal renewal or withdrawal since. Nothing in Malaysia's subsequent regulatory direction suggests the position has softened, and no SC-authorised crypto ATM operator has appeared in the intervening years, but an operator should confirm the SC's current stance directly rather than rely on a five-year-old notice.^1,2 GENERAL BYTES hardware has genuine history in this market — a machine was previously listed in Kuala Lumpur (B4U) — and various trackers describe anywhere from one to roughly ten machines having operated historically across Kuala Lumpur, Penang, Ipoh, and other cities, though current listings are sparse and unverified, consistent with operators either shutting down after the SC's warning or continuing to operate in violation of it.^3,4,5 Malaysia's core crypto framework is otherwise genuinely mature: the SC and Bank Negara Malaysia (BNM) have jointly regulated digital assets as securities since a foundational December 2018 statement, six Digital Asset Exchanges hold SC licences as of late 2025, and Malaysia does not tax individual capital gains on personal investment activity.^6,7 The advantage is a sophisticated, English-language-friendly regulatory environment with genuine institutional depth; the obstacle is that this specific business model has been the subject of a direct, unambiguous, and criminally-enforced public warning from the lead regulator.^1,2 As in most markets on our legislation map, General Bytes as a hardware and software vendor is not itself performing a licensable activity; it is the in-country operator of the machines who bears the DAX registration requirement and the associated criminal exposure for non-compliance. For GENERAL BYTES, Malaysia should be treated similarly to Singapore in this series: a genuinely strong crypto market generally, but one where the physical ATM format specifically carries an unusually direct and severe regulatory warning attached to it.

Last updated: August 2026

Regulatory Framework and Its Evolution

Malaysia's approach dates to a joint SC/BNM statement of 6 December 2018, which divided responsibility cleanly: the SC would regulate the offering and trading of digital assets as securities, while BNM would handle any payment-function aspects under its currency and payments laws.⁸ The Capital Markets and Services (Prescription of Securities) (Digital Currency and Digital Token) Order 2019 gave this legal force, and the SC has issued and refined detailed guidelines since — the Guidelines on Recognized Markets (most recently amended May 2026 to strengthen client-asset safeguards and governance) and the Guidelines on Digital Assets covering custodians and IEO platforms.^9,10 As of 30 October 2025, six digital asset exchanges held full SC licensing.

The SC's public caution on crypto ATMs sits within this otherwise maturing framework as a distinct, deliberate carve-out. The regulator did not simply fail to address ATMs — it directly named the format, classified it under the existing DAX licence category, confirmed zero authorisations exist for it, and attached the same criminal penalties that apply to running an unlicensed securities exchange generally.^1,2 This is a materially different posture from markets elsewhere in this series where the ATM's licensability is simply undefined or ambiguous — Malaysia has affirmatively addressed the question and answered no.

The SC wishes to alert the public that entities operating Crypto ATMs are considered to be operating a Digital Asset Exchange (DAX) which require registration with the SC... the SC has not authorised any entity to operate Crypto ATMs.
Securities Commission Malaysia, public statement, 8 July 2020

Getting Licensed: The DAX Category Exists, No ATM Has Ever Qualified

A DAX licence is achievable in Malaysia — six exchanges hold one — but every confirmed licensee operates as an online trading platform, not a physical cash kiosk network.⁷ There is no indication in any SC guidance, licensing history, or public statement that a physical ATM application has ever been approved, and the SC's own 2024 warning states plainly that none has been authorised to date.¹ Separately, the SC has taken a notably different approach for token issuance specifically: peer-to-peer payment-token transfers are permitted without a licence provided total monthly value per user stays under RM 10,000, and utility tokens can avoid securities classification if they only grant platform access — but neither of these carve-outs applies to a cash-to-crypto exchange kiosk, which is precisely the DAX activity the SC has targeted.¹¹

As with the rest of our legislation map, this licence (where it exists at all for other business models) sits with the in-country operator of the machines, not with General Bytes as hardware and software vendor.

AML and KYC

Licensed Malaysian DAX operators must comply with the Guidelines on Prevention of Money Laundering and Terrorism Financing for Capital Market Intermediaries, extending standard KYC/CDD and suspicious-transaction-reporting obligations to digital-asset businesses generally.^9,12 Historical, now largely defunct Malaysian crypto ATMs were explicitly marketed as requiring no verification process at all — precisely the kind of unaccountable, walk-up-anonymous format that is both commercially attractive to operators and squarely incompatible with the direction Malaysian securities regulation has taken generally.

Banking

Banking is not the binding constraint in Malaysia — licensed DAX operators generally function within Malaysia's mature banking system. The constraint is regulatory permission for the ATM format itself, not banking access once (or if) that permission existed.

The Next 24 Months: A Sophisticated Market Actively Closing the ATM Loophole

Malaysia's broader 2026 trajectory is one of continued professionalisation: a major guideline overhaul in May 2026 strengthened client-asset and governance standards, the SC has been actively expanding legitimate access (a February 2026 practice note now lets licensed stockbrokers offer digital-asset broking under existing securities rules), and BNM is simultaneously running ringgit-stablecoin and tokenised-deposit pilots through its Digital Asset Innovation Hub, with clearer guidance expected by the end of 2026.^13,14,15 None of this activity suggests the SC is reconsidering its position on physical ATMs — if anything, a regulator this actively engaged in tightening governance and enforcement generally is less likely to relax a position it has already stated in the strongest possible terms (criminal penalties, explicit public warning).

For GENERAL BYTES, the honest recommendation mirrors Singapore elsewhere in this series: Malaysia is not a market to pursue for physical ATM deployment under the current regulatory posture, regardless of operator preparation or partnership quality, since the SC has already and explicitly closed this specific door with real criminal exposure attached. Malaysia's broader digital-asset licensing environment remains genuinely credible for other business models — exchanges, custody, and now broker-distributed digital-asset access — and is worth separate attention on those terms, distinct from any ATM-specific plan.

Sources and references

1. SC's own media release, 8 July 2020: no crypto ATM operator authorised, DAX classification — sc.com.my
2. SC statement detail (July 2020): RM10 million fine / 10 years imprisonment for unauthorised DAX operation — theedgemalaysia.com
3. Former GENERAL BYTES machine listing in Kuala Lumpur (B4U) — coinatmradar.com
4. Historical count of ~9-10 Malaysian machines across multiple cities - unverified currently — coingecko.com
5. Additional historical Petaling Jaya/Nilai locations — asktraders.com
6. Joint SC/BNM regulatory approach, no capital gains tax on personal investment — cryptolawmap.com
7. Six SC-licensed DAX operators as of 30 October 2025 — kevinwuassociates.com
8. 6 December 2018 joint SC/BNM statement dividing regulatory responsibility — bnm.gov.my
9. Capital Markets and Services (Prescription of Securities) Order 2019; Guidelines on Recognized Markets amended May 2026 — sanctionscanner.com
10. Guidelines on Digital Assets for custodians and IEO platforms — sumsub.com
11. RM10,000/month unlicensed P2P threshold, utility-token carve-out — is-this-legal.com
12. AML/CFT guidelines for capital market intermediaries — cryptoslate.com
13. May 2026 Guidelines on Recognized Markets overhaul — coinpedia.org
14. February 2026 SC practice note allowing licensed stockbrokers to offer digital-asset broking — cbinsights.com
15. BNM ringgit stablecoin/tokenised deposit pilots via Digital Asset Innovation Hub — globallawexperts.com

Legal Disclaimer: This article by GENERAL BYTES is for informational purposes only and does not constitute formal legal, financial, or investment advice. The Securities Commission Malaysia stated in July 2020 that no entity is authorised to operate a crypto ATM in Malaysia and attached criminal penalties to unauthorised operation; this article found no formal renewal or withdrawal of that position since. Always consult specialised local legal counsel and confirm the current SC position directly before considering any change to market activity.