What Is a Payment Instrument Under Law?
The Penal Code covers a payment instrument or an account, and this is what that means for you.
Sources checked 2026-09-15
What does “payment instrument” mean in the Penal Code?
The Penal Code (Amendment) Act 2024 added the mule account offences in Sections 424A to 424C, and Section 424D explains the terms they use. [f4] Section 424D is a definitions section only. It creates no offence and no penalty. [f1]
It says a payment instrument is a prescribed designated payment instrument under the Financial Services Act 2013 or the Islamic Financial Services Act 2013. [f2] So the list of what counts is set by those laws, not by the Penal Code itself.
The amendment dates from 2024. [f5] If you are being investigated or charged under Section 424A, 424B or 424C, ask your lawyer exactly what the charge says your instrument or account was.
Is a bank account covered?
Yes. Sections 424A to 424C refer to a payment instrument or an account, so a bank account is covered as an account. A current or savings account at a licensed bank is the plainest example.
If someone else gets into your account by any means, the account is still what the charge is about. Joint accounts are no different: if the other holder uses the account for something that draws an investigation, the authorities may contact both holders.
Do e-wallets and cards count?
E-wallets and bank cards are commonly treated as payment instruments. Touch ‘n Go eWallet, GrabPay, Boost, BigPay and ShopeePay are everyday examples. The exact list is set under the FSA and IFSA, so a lawyer should confirm how it applies to your case.
If your e-wallet has been frozen in an investigation, the e-wallet guide sets out the steps.
Giving someone your debit card and PIN means handing over control of your account. With a credit card in your name, there is more at stake: spending by someone you let use the card can leave you owing the money and also at risk under the mule account sections.
What about online banking logins and OTP codes?
A login, password or security token is not named in the Penal Code definition. [f3] But it can still cause a problem, because it lets someone else make transactions through your account.
Sharing a login is one way people end up in a mule account investigation. Whoever has your login can move money through your account and pull it into a crime.
TAC (transaction authorisation code) and OTP (one-time password) codes work the same way. Forwarding them lets someone else complete a transaction, which puts your account in the chain.
Can a SIM card be a payment instrument?
The Penal Code definition does not list SIM cards. [f3] But your number receives OTP codes for transfers, e-wallet top-ups and payment approvals.
Lending your phone or SIM to someone who uses it to approve payments can give them access to your account. Young people can be caught out here, because they may lend phones or swap SIM cards without thinking about the banking linked to the number.
Why does the wording matter?
Lending a phone, sharing a login, handing over a card or forwarding an OTP can all lead to a transaction through your account. [f4]
Before the 2024 amendment, these acts were not specific crimes. The new Sections 424A, 424B and 424C cover possessing or controlling someone else’s account or card, giving control of your own account or card to someone else, and engaging in transactions through an account without a lawful purpose.
The law aims at the whole mule account chain. The person who provides an account, the person who receives it and the person who uses it are each covered by a different section.
What does this mean for my case?
If you are being investigated or charged, the facts decide which section applies and which defences are open to you.
The key question is usually whether you had lawful authority or a lawful purpose. A joint account holder, someone with power of attorney, or someone authorised by a company may have lawful authority. Someone who got login details through an informal arrangement may not.
A lawyer who handles cases under the 2024 amendments can look at what you shared and tell you where you stand. Asking early gives you more time to prepare.
Sources
- Penal Code (Amendment) Act 2024, Sections 424A, 424B, 424C, definition of “payment instrument”
- Low & Partners, “Keldai Accounts: When Helping a Friend Becomes a Criminal Offence” (2024)
- Bank Negara Malaysia, payment systems and e-wallet regulation
- Attorney General’s Chambers, Penal Code (Amendment) Act 2024
Need a Lawyer for Your Frozen Account Case?
Request Lawyer ContactFor people seeking legal representation. For general information, use our guides and tools.
Independent information resource, not a law firm. We do not provide legal advice. Where appropriate and with your consent, we can connect you with an independent lawyer. Availability and acceptance of a case are not guaranteed. How referral works
What counts as a payment instrument under Malaysia's Penal Code?
Penal Code Section 424D defines it as a prescribed designated payment instrument under the Financial Services Act 2013 or the Islamic Financial Services Act 2013 [f1]. The list is set by those laws. Sections 424A to 424C also cover a bank account, so you do not need a card for the offence to apply.
Are e-wallets like Touch 'n Go and GrabPay considered payment instruments?
E-wallets and cards are commonly treated as payment instruments, but the exact list is set under the FSA and IFSA [f2]. Whatever the label, letting someone else use your e-wallet account can put you at risk under Sections 424A and 424B. A lawyer can check your case.
Can a SIM card be a payment instrument?
The Penal Code definition does not list SIM cards [f3]. But a SIM that receives OTP codes is how many banking and e-wallet payments get approved. Lending your phone or SIM to someone who then uses your account can still cause serious trouble.
Does the definition apply only to the new Section 424 offences?
The definition came in with Sections 424A, 424B and 424C, and these are the main sections that use it. Other financial crime sections in the Penal Code use different terms.
When did this definition come into effect?
The Penal Code (Amendment) Act 2024, including this definition, was passed in 2024. Conduct before the amendment would not be charged under these new sections.
I shared my online banking login with a friend. Is that a payment instrument offence?
Sharing your login can give someone else control of your account. Handing over control of your own account can fall under Section 424B, and the person who received it may face Section 424A. Whether a charge applies depends on the facts, including lawful authority and lawful purpose.
What is the difference between a payment instrument and a bank account?
Sections 424A to 424C refer to a payment instrument or an account, so a bank account is covered on its own. A payment instrument is the wider term for items such as cards and e-money prescribed under the FSA and IFSA.
Related pages
If your situation is a little different, these pages cover the closest topics.
Need a Lawyer for Your Frozen Account Case?
Request Lawyer ContactFor people seeking legal representation. For general information, use our guides and tools.
Independent information resource, not a law firm. We do not provide legal advice. Where appropriate and with your consent, we can connect you with an independent lawyer. Availability and acceptance of a case are not guaranteed. How referral works