How do people in Malaysia pay online?
FPX is the local favourite. Financial Process Exchange, owned and run by PayNet, lets the shopper pick their bank at checkout, sign in to online banking and approve the payment there. Bank Negara Malaysia counted 956.1 million FPX transactions worth RM 465.4 billion in 2025, up from 826.3 million in 2024, and 699.1 million in the first eight months of 2026.
Cards follow closely. Bank Negara Malaysia recorded 485.7 million card-not-present debit card transactions and 444.0 million card-not-present credit card transactions in 2025, with 55.4 million debit cards and 11.7 million credit cards in circulation at the end of the year. Apple Pay and Google Pay are both available in Malaysia.
E-wallets and QR codes are rising. E-money transactions, which also include fund transfers, reached 6.37 billion in 2025, up from 5.02 billion in 2024. Payment providers such as Xendit offer Touch ‘n Go eWallet, GrabPay and ShopeePay at online checkouts. PayNet processed 8.44 billion digital payment transactions across its systems in 2025 and added 681,250 DuitNow QR acceptance points. In the Xendit and Cube Ecommerce Payments Momentum Report 2026, digital adoption in Malaysia was the highest in the region at over 80%, and a missing payment method was the top reason shoppers abandoned a purchase (31%).
What rules shape online payments in Malaysia?
Foreign digital services carry service tax. A foreign provider whose digital services to Malaysian consumers exceed RM 500,000 in a 12-month period must register with the Royal Malaysian Customs Department. The tax started on 1 January 2020 at 6% and rose to 8% on 1 March 2024. Service tax is generally 8% for other taxable services, and sales tax on goods is 5% or 10% depending on the class of goods.
Imported low-value goods carry sales tax. Since 1 January 2024, goods sold online for less than RM 500 and shipped into Malaysia carry 10% sales tax, and sellers and marketplaces must register once such sales exceed RM 500,000 in 12 months.
Personal data falls under the Personal Data Protection Act 2010, amended in 2024. The amendments require controllers to notify the Personal Data Protection Commissioner of a data breach as soon as practicable, and affected people where significant harm is likely; to appoint a data protection officer; and to allow data portability. The maximum fine for breaching the data protection principles rose from RM 300,000 to RM 1,000,000.
How would Omno route payments in Malaysia?
A merchant would connect once and set routing rules per method, currency and customer group. In Malaysia:
- FPX payments would go to a provider connected to FPX, with the hosted checkout showing the shopper’s bank list and the order confirmed by the provider’s notification.
- Card pay-ins can be routed by BIN, with cascading to the next provider in the rule if one is unavailable or rejects the request.
- E-wallet pay-ins would go to providers that support Touch ‘n Go eWallet, GrabPay or ShopeePay in MYR.
- Apple Pay and Google Pay would run on the hosted checkout and follow the card routing rules.
Webhooks would report the final status of every payment, and the routing-decision log would show which provider handled each payment and why.
What should merchants plan for?
Plan for FPX and cards together. They carry similar online volumes, and many shoppers expect both.
Plan for e-wallets. A missing payment method is the top reason Malaysian shoppers abandon a purchase.
Plan for tax on cross-border sales. Check the RM 500,000 thresholds for digital services and low-value goods.
Plan for data protection duties. Name a data protection officer and set up breach notification under the amended PDPA.