Section 17A of the Malaysian Anti-Corruption Commission (MACC) Act introduced something many business owners still underestimate: corporate liability. If a person associated with your company — an employee, agent or third party — commits corruption to benefit the business, the company itself (and, by extension, its directors and management) can be held liable. The good news is there is a defence. The bad news is you have to build it before anything goes wrong.

This guide explains Section 17A in plain English: who it applies to, what "adequate procedures" means, and the practical steps to protect your organisation.

What Section 17A actually says

In essence, a commercial organisation commits an offence if a person associated with it corruptly gives or offers gratification to obtain or retain business or an advantage for the organisation. Key features:

  • It's a corporate offence — the organisation is liable, not just the individual.
  • "Associated persons" is broad — directors, employees, and third parties acting for the company.
  • Directors and management can be deemed personally liable unless they prove the offence happened without their consent and they exercised due diligence.
  • The penalties are severe — significant fines, imprisonment, or both.

The one defence: "adequate procedures"

An organisation charged under Section 17A has one statutory defence: proving it had adequate procedures in place to prevent associated persons from committing corruption. The official guidelines frame these procedures around five principles, often remembered as T.R.U.S.T.:

  • T — Top-level commitment: leadership visibly owns the anti-corruption agenda.
  • R — Risk assessment: identify and evaluate your corruption risks regularly.
  • U — Undertake control measures: put proportionate policies and controls in place.
  • S — Systematic review, monitoring & enforcement: check that controls actually work.
  • T — Training and communication: make sure people understand the rules.

How ISO 37001 and whistleblowing fit in

Adequate procedures don't exist in a vacuum. Two international standards operationalise them:

  • ISO 37001 (Anti-Bribery Management Systems) gives you a recognised framework to design, implement and audit anti-bribery controls — strong evidence of "adequate procedures".
  • ISO 37002 (Whistleblowing Management Systems) helps you build safe reporting channels so wrongdoing surfaces early — increasingly important as Malaysia strengthens whistleblower protection.

A practical checklist for your organisation

  • Secure visible top-level commitment and assign accountability.
  • Run a corruption risk assessment across your operations and third parties.
  • Put an anti-bribery policy, gifts & hospitality rules, and due-diligence controls in place.
  • Establish a whistleblowing channel and protect those who use it.
  • Train your people — and keep records that prove you did.
  • Review, monitor and enforce; update as risks change.

That last point matters: "adequate procedures" is judged on substance and evidence, not a policy PDF in a drawer.

Get your team trained — HRD Corp claimable

Megabyte Consultancy's Anti-Corruption, Governance & Legal Compliance program takes your leaders and teams through Section 17A adequate procedures, ISO 37001 anti-bribery, ISO 37002 whistleblowing, AML and PDPA — customised to your organisation and rich with real case studies. It's delivered in-house and is HRD Corp claimable. Led by an HRD Corp accredited governance and anti-corruption specialist.

Frequently asked questions

Does Section 17A apply to SMEs?

Yes. Section 17A applies to commercial organisations broadly, not only large or listed companies. SMEs are equally expected to have adequate procedures.

Is a policy document enough to be "adequate"?

No. Adequate procedures are assessed on whether they are real, proportionate to your risks, communicated, enforced and reviewed — with evidence, including training records.

Is anti-corruption training HRD Corp claimable?

Yes. This in-house governance and anti-corruption program is HRD Corp claimable for eligible employers; apply on eTRiS at least one day before training begins.