Licensing boundary: a robo-adviser that is quietly managing money

The analysis turns on what Rimbun does, not on what the client clicks or what the licence says.

• Advising on securities - covered. Recommending model portfolios built from ETFs, unit trusts and money market funds is advice on securities, whether delivered by a human or an algorithm. The 'client clicks agree' defence is weak: consent is not the test; the test is who decides what the client holds.
• Fund management - probably being carried on, and not covered. Quarterly rebalancing plus a switch triggered by Rimbun's own investment committee is a discretionary decision taken for the client's portfolio. That is the classic 'managing a portfolio of securities' activity. The 24-hour post-trade notification is evidence of discretion, not a substitute for client instruction.
• Dealing in securities - fact-dependent. Passing client orders to a broker may be dealing if Rimbun makes or offers to make the arrangement with the client, or induces the client to acquire or dispose; it may fall away if the broker contracts directly with the client as principal-to-agent. This needs a written legal opinion, not an assumption.

The practical conclusion: either restructure to a genuinely non-discretionary model where every switch requires a fresh, specific client instruction and confirmation, or apply to vary the CMSL to add fund management (and dealing if the order flow is Rimbun's), and operate under a digital investment management operating model with matching client-asset, suitability and disclosure controls.

Advising on corporate finance is a separate regulated activity under the CMSA and sits outside the definition of 'advising on securities', so the existing licence does not reach it.

Preparing two family-owned companies for an ACE Market listing - pre-IPO restructuring, valuation, due diligence coordination, drafting representations to Bursa Malaysia and the SC - is corporate finance advice on its face. There is a second issue: an ACE Market applicant must be sponsored by a Principal Adviser approved by Bursa Malaysia. If Rimbun is not approved, it cannot act as sponsor and would have to work under one, which changes the fee split and the liability profile.

Consequences of proceeding without cover:

• Carrying on a regulated activity without a licence is an offence under the CMSA, and the SC can also take administrative action against the firm and against directors and the compliance officer who knew or ought to have known.
• The CMSA attaches civil consequences to agreements and arrangements made in the course of unlicensed activity, so the two mandates may be unenforceable by Rimbun and the fees recoverable.
• Reputational damage is acute for a firm whose entire pitch is low-cost digital advice.

The CEO's premise that the SC 'only regulates public offers' is wrong - the licensing gate is activity-based. Immediate steps: suspend the mandates or limit them to unregulated project support, apply to add advising on corporate finance, appoint a responsible person meeting fit-and-proper and competency expectations, and install information barriers between the retail app and the corporate finance team before the two businesses co-exist.

The memo should be short, ranked by regulatory risk, and give the board decisions rather than observations.

1. Licence scope first. Everything else is secondary until the fund management question is resolved; a remediation plan with dates and a voluntary engagement with the SC is better than being found out at inspection.
2. Suitability and client understanding. The 12-question profiler must map to a documented suitability assessment, with a documented process for a client who overrides the recommended portfolio, and periodic re-papering of risk tolerance. Digital delivery does not lower the standard.
3. Disclosure of the algorithm's role. Clients must be told plainly that Rimbun, not they, decides switches, what the investment committee does, and what the fee stack is (management fee plus the 0.15% execution fee).
4. Third-party data and model risk. The risk profiler, the fund-downgrade trigger and any ESG scoring are model outputs. The firm needs documented validation, a named owner, change control and a fallback when data is missing - a model that quietly fills gaps is a conduct risk, not an IT detail.
5. The 'click agree' theory. Record in the minute that compliance does not support it. If the board relies on it, the exposure shifts from the firm to individual directors and officers.
6. Records and complaints. Keep records of advice and client instructions, and route complaints through a documented handling process, because complaint patterns are the earliest warning of suitability failure.