Rimbayu Holdings: Third-Party Funding, a Labuan Payout and a RM30 Million Promise
You are a dealer's representative at a licensed stockbroking company in Kuala Lumpur. On 3 March, Compliance asks you to review a corporate client onboarded six weeks earlier by a colleague who has since resigned. Rimbayu Holdings Sdn Bhd was incorporated four months ago, has RM2 paid-up capital, a single foreign director and a registered address that matches a virtual office. Over 11 days it received RM4.8 million in eight transfers from six unrelated companies, then bought RM4.6 million of two thinly traded ACE Market counters, pushing each price up 20-30%. It has since sold at a small loss and asked for the proceeds to be paid to a third-party account in Labuan. The client also asked to split an upcoming RM600,000 subscription into four tranches 'to keep things simple', and mentioned that his lawyer says 'all this paperwork is unnecessary'. Your team head says the client has promised RM30 million of future business if the account is kept open until the quarter ends on 31 March.
1. What regulatory obligations are triggered by these facts, and what must happen before 31 March? Explain the reasoning at each step.
Read the worked answer
Step 1 - identify what needs explaining. Rimbayu shows at least five classic placement and layering indicators: a shell-like company (nominal capital, virtual office, one foreign director); funding by eight transfers from six unrelated entities, i.e. third-party funding; rapid in-and-out trading in illiquid counters with outsized price impact; a request to pay proceeds to an unrelated Labuan account; and a request to split an order plus a 'lawyer says' nudge to avoid documentation. Each is a red flag under the SC's AML/CFT guidance for capital market intermediaries and the risk-based approach in the AMLA 2001.
Step 2 - the legal duties. The firm is a reporting institution. It must complete CDD, identify the beneficial owner, understand the purpose of the relationship, and apply enhanced due diligence because risk is high (foreign, complex ownership, unusual transactions). The departed colleague's file cannot be relied on. A suspicious transaction report must go to Bank Negara Malaysia's Financial Intelligence and Enforcement Department as soon as suspicion arises - the test is suspicion, not proof. Tipping-off is prohibited. A cash transaction of RM25,000 or more would also require a cash threshold report; here the movements are transfers, so the STR is the key filing.
Step 3 - before 31 March. Approve no new subscription and release no payout until enhanced due diligence is complete and senior management has approved continuation. Restrict trading to stop further layering. Refer the price pattern to Compliance for a market-conduct assessment under the CMSA 2007. The RM30 million promise has no legal weight and is itself a red flag.
2. The team head tells you to keep the account open and to ask the client for the extra documents 'quietly'. How do you respond, and what do you do?
Read the worked answer
No - but the constraint is narrow. The tipping-off prohibition stops me disclosing that a report has been or may be made, or anything that could prejudice an investigation. It does not stop ordinary CDD. I can ask for constitutional documents, a beneficial ownership chart, source-of-wealth evidence and the rationale for the Labuan payout as a routine periodic-review step. The skill is in the script: neutral, routine, no reference to Compliance's interest.
The instruction is the problem. A team head cannot authorise a breach, and 'get it done' is not a lawful instruction. I would (1) restate my obligations in writing, (2) copy the MLRO and head of compliance, and (3) if the pressure continues, escalate to the board audit or risk committee under the whistleblowing policy. AMLA protects good-faith reporters; retaliation would itself be a governance failure.
Records decide the outcome. Make a contemporaneous note of the conversation with the team head, the client's requests and the actions taken, and keep it with the STR file. If the firm overrules me, the file must show who decided, on what basis, and what monitoring was imposed. The SC assesses the firm's decision-making, not only the outcome.
3. Suppose you file the report. What monitoring, record-keeping and exit options are appropriate afterwards?
Read the worked answer
Monitor, do not signal. Keep the account under enhanced transaction monitoring: counterparties, flow of funds, trading pattern against peers, and any new third-party payment requests. Do not change behaviour in a way that signals suspicion to the client.
Records. Retain CDD records and the STR analysis for at least six years after the relationship ends. The file should contain the red flags identified, the enquiries made, the senior management approval, the monitoring plan and every decision, with dates and names. Keep STR material on a restricted-access basis - circulating it internally beyond those who need to know is itself a tipping-off risk.
Can the firm exit? Yes. De-risking by terminating a relationship is permissible and often sensible. It must be done without tipping off: give a commercially neutral reason consistent with the firm's terms, allow an orderly transfer or liquidation of positions where that is consistent with managing the risk, and document the exit decision at an appropriate senior level. Exit does not extinguish the reporting obligation - the report is filed first, exit second.
Parallel routes. Separately from the AML file, Compliance should consider whether the trading pattern amounts to market misconduct that should be reported to the SC or Bursa. Cooperation with any subsequent request from the authorities follows automatically; the firm should not wait to be asked.