AML regulations across Southeast Asia share one FATF backbone but differ in instrument, deadline and reporting mechanism. The Philippines reports to the AMLC under GoTRACS, Indonesia to PPATK under OJK's POJK 8/2023, Malaysia under BNM, Singapore under MAS Notice 626, and Vietnam under its State Bank. A team operating in more than one holds five rulebooks at once.
This guide compares the five regimes at the level a compliance officer needs. Each regulatory detail should be reverified against the primary text before it drives a filing, because several of these instruments were updated recently and some national-language sources could not be independently confirmed here.
It is written for CCOs, CROs and heads of AML at institutions supervised by more than one Southeast Asian regulator, and for teams planning regional expansion.
How do AML obligations compare across the five regulators?
They rest on the same FATF recommendations but diverge on the reporting instrument, the filing deadline and the current assessment status.
The table below is an orientation, not a substitute for the primary text. Every row should be confirmed against the regulator's own instrument before it is relied on.
Our Southeast Asia CDD benchmark compares the due diligence standards in more depth.
What does BSP require in the Philippines?
Covered persons report to the AMLC on two clocks, and the country is now in a sustain-and-evidence phase after leaving the FATF grey list.
The AMLC's GoTRACS issuance sets the reporting deadlines at Sections 5.4(b) and 4.2: a suspicious transaction report by the next working day from the determination of suspicion, and a covered transaction report within five working days. The Philippines left the FATF grey list on 21 February 2025, and the next mutual evaluation is expected in 2027, so supervisory attention has shifted to sustained effectiveness. Our STR versus CTR guide sets the two clocks out in full, and our 2027 evaluation guide covers what assessors will look for.
What does OJK require in Indonesia?
A risk-based AML, CFT and counter-proliferation-financing programme under POJK 8/2023, with an individual risk assessment for each provider.
OJK issued POJK 8/2023 on the application of anti-money laundering, counter-terrorism-financing and counter-proliferation-financing programmes in the financial services sector. It took effect in June 2023, replaced the earlier POJK 12/2017, widened the set of covered financial service providers, and requires each to conduct its own risk assessment. Reporting of suspicious and cash transactions in Indonesia runs to PPATK, the financial intelligence unit, so an institution supervised by OJK answers to two bodies: OJK for the programme and PPATK for the reports.
What does BNM require in Malaysia, and what did the 2025 evaluation find?
A mature framework under the 2001 AML act, assessed strongly on technical compliance in the December 2025 mutual evaluation, with the main gap in turning investigations into prosecutions.
Malaysia's FATF mutual evaluation, published on 11 December 2025, rated the country compliant or largely compliant on all 40 recommendations, with no partial or non-compliant ratings. On effectiveness it was rated substantial on six of the eleven immediate outcomes and moderate on the other five. The report found that Malaysia has a robust framework for supervision and preventive measures. But it faces significant challenges in translating money-laundering investigations into prosecutions, and received a roadmap of recommended actions to complete within three years. For BNM-regulated institutions, the practical read is that supervisory pressure will concentrate on demonstrable effectiveness, not documentation.
What does MAS require in Singapore?
AML obligations under Notice 626, now extended by COSMIC, the platform that lets financial institutions share customer risk information with each other.
MAS sets AML and CFT requirements for banks through Notice 626, and has added COSMIC, a platform that allows participating financial institutions to share information about customers who exhibit red flags, so that risk signals are not trapped inside one institution. For a compliance team, COSMIC changes ongoing monitoring: a risk signal raised elsewhere can inform the institution's own view of a customer. Our guide to the COSMIC platform covers how it works in practice, and our note on FATF gaps Singapore banks must close sets the supervisory context.
What does SBV require in Vietnam?
A framework under the 2022 AML Law and its 2025 implementing circular, operating while Vietnam remains on the FATF grey list.
Vietnam's AML Law 14/2022/QH15 took effect in March 2023, and the State Bank has since issued Circular 27/2025 to update the implementing rules. Vietnam remains on the FATF grey list as of 2026, which raises the supervisory stakes for reporting institutions. The specific Vietnamese reporting mechanics, including any suspicious-transaction deadline, should be confirmed against the State Bank's primary texts, because the national-language instruments could not be independently verified here. This is a secondary-persona market for most regional teams, but a growing one.
What do all five regimes have in common?
A FATF core: risk-based customer due diligence, ongoing monitoring, suspicious and cash transaction reporting, and a rising emphasis on demonstrated effectiveness.
Underneath the different instruments, the obligations rhyme. Every regime requires risk-based due diligence, ongoing monitoring of transactions, and the reporting of suspicious and threshold transactions to a financial intelligence unit. The direction of travel is also shared: the FATF fifth round weighs effectiveness more heavily than technical compliance, so each regulator increasingly asks institutions to show that controls work, not just that they exist. A team operating across these markets can run one operating model with local reporting adapters. The model needs to aggregate behaviour, keep an audit trail, and produce each jurisdiction's report on its own clock. The common operational core is what our transaction monitoring guide describes, and the vendor questions that follow are in our buyer's guide.
How does Fyscal ARCX support multi-jurisdiction compliance?
Fyscal ARCX runs one monitoring and case model with reporting configured per jurisdiction, so a regional team keeps a single operating model while meeting each regulator's format and clock. A compliance team defines its own variables and rules, tests them against historical data before activation, and holds one case per customer with a timestamped trail. Regulatory Reporting prepares each jurisdiction's filing from the case record, and the Admin Control Center governs the configuration and audit trail across markets.
If you want to see one operating model carry different reporting obligations, book a walkthrough of Fyscal ARCX and bring the jurisdictions you operate in.