Every licensed firm in both countries that must verify its customers, the rule that applies to each, the vendors they already name, and a plan per country. The demo is the working target map behind it, with a country switch.
Bank Negara's e-KYC policy makes vendor quality a regulated measure: an independent assessment of the vendor, liveness tests that include deepfakes, and false-acceptance rates reported to BNM. Crypto is already won (2 of 5 exchanges). The growth is in e-money, digital banks, remittance and multi-licence groups, and the new MyKad just gave each of them a reason to re-test its vendor.
The rule decides the route. OJK firms must buy the Dukcapil-backed check from a local, OJK-registered PT, and lenders name local certificate providers. Crypto traders, which hold their own Dukcapil access and must run monitoring on a third-party application, and BI-licensed payment firms can buy a global stack directly.
The one line: in Malaysia, sell assessed quality into a market that must re-test its vendors; in Indonesia, sell where the rule lets a global stack in and partner locally where it does not.
What a BDM has to sell with today, from Sumsub's own public pages and press.
| Asset | Malaysia | Indonesia |
|---|---|---|
| References | HATA (96% pass rate, 0.27 s median verification) and Sinegy (Travel Rule), both SC-registered exchanges | No named Indonesian case study found |
| Local footprint | Reseller partner (Spectrum Edge); APAC team in Singapore | Local data processing since Sep 2024; partners PT Ogya Tekno Nusantara and PT Secure Pasifik Teknologi |
| Regulatory fit | Independent e-KYC assessment reported by press (Deloitte, Jul 2025), the credential BNM's policy asks of a vendor | Full stack for the crypto rule: liveness, duplicate accounts, Travel Rule, monitoring |
| Fraud data | Malaysian deepfakes up 408% (Sumsub, Nov 2025) | Highest identity fraud rate in APAC, 6.02% (2024 data) |
| Published prices | Basic $1.35 per verification ($149 monthly minimum), Compliance $1.85 ($299); volume and custom tiers priced per account | |
Sources: sumsub.com customers (HATA, Sinegy), newsroom (local data processing, 3 Sep 2024), pricing; Sumsub Identity Fraud Report coverage. Read 7 Oct 2026.
From the demo: nine SC and BNM registers merged into 500 target accounts, each matched to its rule, each website read for named identity vendors, and 127 apps sized on Google Play.
| Finding | Evidence | What I would do |
|---|---|---|
| The new MyKad broke e-KYC | Issued from 18 Sep 2026. JPN confirmed failures at apps including Touch 'n Go eWallet, Ryt Bank, AEON Bank and GXBank, and said "eKYC service providers are updating their respective systems" (The Star, 21 Sep 2026). | Open every e-wallet and digital bank conversation here: their failure rate since 18 Sep, and a side-by-side test. |
| Vendor quality is regulated | BNM e-KYC Policy Document (Apr 2024): the vendor must be assessed by an external independent assessor across document, biometric and liveness modules, with certifications such as ISO 30107-3 (para 8.22); liveness tests include 3D masks and deepfakes (App. 3); FAR above 5% in two of four months is notified to BNM (App. 2). | Sell the assessment, the deepfake test results and FAR reporting support, item by item against the policy. |
| Switching has a regulator step | Non-bank e-money issuers and money services businesses need BNM's prior written approval to change e-KYC vendor (para 11.1); banks give 14 working days notice after outsourcing and RMiT approvals (10.2, 10.4). | Build the approval into every deal plan and forecast; help the client prepare the submission. |
| Crypto is a reference base | 5 licensed exchanges, 2 of them on Sumsub. The SC Travel Rule has no minimum amount and requires due diligence on the counterparty exchange (SC AML Guidelines, Part IIIA). | Use HATA and Sinegy as references in every fintech pitch. |
| Few firms name their vendor | Of 184 Malaysian licensed firms whose websites were read (served and in a browser), 4 name an identity vendor (WISE AI, Veriff, and CTOS in a KYC context). 127 have an Android app matched on Google Play. | Discovery has to happen in the conversation: ask who runs e-KYC today, their FAR, and their MyKad pass rate. |
| One contract can cover several licences | 57 groups hold two or more SC or BNM licences, e.g. e-money plus remittance or acquiring. | Account plans by group, with KYC, KYB and monitoring in one contract. |
Rules quoted from the BNM e-KYC Policy Document (15 Apr 2024) and FAQ, BNM AML/CFT PD (Feb 2024), SC AML Guidelines (R3-2024). Registers fetched 7 Oct 2026; BNM directories print no as-of date.
| Vendor | What it is | Public Malaysian references | Strength | Sumsub's opening |
|---|---|---|---|---|
| CTOS | Credit bureau with an e-KYC product | Alliance Bank, AEON Credit (press) | Local data and bank relationships | Deepfake defence, crypto, KYB and monitoring in one contract |
| Entrust (Onfido) | Global identity verification | GXBank (press) | Digital bank reference | Local references in crypto; Travel Rule |
| Jumio | Global identity verification | Independent assessment by LGMS, "zero findings" (Mar 2026) | Assessment marketing | Assessment plus a wider compliance stack |
| Innov8tif | Local e-KYC (OkayID) | 51% being acquired by Datasonic Group | Government-linked, local | Global fraud network signals |
| WISE AI | Local AI e-KYC, MTDC-backed | Claims banks, insurers, e-wallets; none named | Price and local support | Named references, monitoring, KYB |
Sources: press and vendor pages collected 7 Oct 2026 (details in my application materials).
Every e-wallet and digital bank is re-testing document templates now. Offer a side-by-side test on the new card and the FAR evidence their board report needs.
Walk a compliance head through BNM's e-KYC policy paragraph by paragraph: assessment, certifications, deepfake liveness tests, FAR reporting. Each line maps to a Sumsub artefact.
The largest consumer onboarding volumes outside crypto. Plan the BNM approval step for non-bank issuers and money services businesses into each deal.
57 groups hold two or more licences. One contract for KYC, merchant KYB and monitoring across their entities.
HATA and Sinegy carry the pitch for fintechs; the remaining exchanges and the token issuers under the SC's May 2026 guidelines come next.
English, Mandarin and Bahasa Malaysia cover Malaysian compliance teams, Chinese-speaking founders and the regulator's own language.
From the demo: seven OJK and BI licence registers merged into 858 target accounts, each website read for named identity vendors (as served and in a real browser), 184 apps sized on Google Play, each vertical matched to its rule.
| Finding | Evidence | What I would do |
|---|---|---|
| The rule decides the route | POJK 8/2023 Pasal 22(2): an OJK firm's e-KYC third party must be an Indonesian PT or koperasi registered with OJK and hold its own Dukcapil agreement. BI's PADG 15/2025 Pasal 16(3) allows a party that holds or facilitates Dukcapil access. | Map every deal to its route on day one. Confirm with Sumsub legal how the local partners cover OJK clients. |
| Crypto is new and fully specified | 28 licensed traders. 7 crypto licences issued in 12 months, three traders since May 2026. POJK 27/2024 asks for liveness, one account per identity, the Travel Rule from USD 1,000, and transaction monitoring that must run on a third-party application (Pasal 97(3)). 4 of 28 crypto sites name a vendor (Pintu names VIDA for its biometric match). | First vertical: the whole stack matches the rule as written, and new licensees are choosing vendors now. |
| Lending is held by local providers | 26 of 88 P2P sites read name a vendor: Privy 17, VIDA 6, Digisign 6, ASLI RI 2, Verihubs 1, ADVANCE.AI 1. All local or regional. | Sell fraud, device and deepfake defence on top of the local e-signature and Dukcapil partner. |
| BI payments are the open door | 74 e-money and account issuers and 203 remittance firms; 3 of 61 sites read name a vendor. | Second vertical: direct sales under the looser BI rule. |
| A new vertical opened in July | Permenkomdigi 7/2026: facial biometric SIM registration against Dukcapil, mandatory for new SIMs from 1 Jul 2026. Dukcapil's Rp3,000 face check fee is under negotiation. | Research telco onboarding volumes and who supplies the face match. |
"Names a vendor" means the firm's own homepage, terms or privacy pages mention one. Many sites render with JavaScript, so silence means not disclosed. Clauses quoted from the OJK and BI PDFs with page numbers in the demo's Rules tab; counts from registers dated Jul to Sep 2026.
Who a buyer in Indonesia compares Sumsub with. "Named by" comes from the buyers' own terms, privacy and partner pages, read 6 to 7 Oct 2026.
| Vendor | What it is | Named by (public pages) | Strength | Sumsub's opening |
|---|---|---|---|---|
| VIDA | Local certification authority (PSrE) and e-KYC, OJK e-KYC cluster | Flip, LinkAja, Kredito, Pinjam Yuk, Lentera Dana (biometric match against Dukcapil) | Licensed locally; owns the Dukcapil route | Global fraud and deepfake signals; crypto stack |
| Privy | Local PSrE, e-signature and identity; 71M users (end-2025) | Pluang, PinjamanGo, Modal Nasional, Pinjam Yuk, Danamas and others in lending | E-signature is mandatory in lending agreements | Pair with it: Privy signs, Sumsub screens and monitors |
| Verihubs | Local identity verification; claims 300+ clients | Mobee (partner logo) | Local price and support | Travel Rule, KYT and KYB in one contract |
| Digisign | Local PSrE | Lending sites (partner logos) | E-signature | Complementary |
| ADVANCE.AI | Regional identity and risk | Modal Nasional (with Privy); Indodax per press | APAC footprint, lending data | Crypto depth, Travel Rule |
| Didit | Low-price global KYC | Advertises KTP plus Dukcapil at $0.33 | Price | Coverage, audit trail, support |
| Jumio, Onfido, Veriff | Global KYC | None found in the scan | Brand with global banks | Local data processing and local partners |
In lending, the names that appear are certificate providers. The terms show them doing two jobs: the e-signature on the loan agreement and the biometric match against Dukcapil. A global vendor wins the second job by partnering on the first.
Each licensed trader must cover liveness, duplicate accounts, the Travel Rule and monitoring. Sell the whole stack as one compliance file, starting with the newest licensees.
E-money issuers and remittance firms may use a party that facilitates Dukcapil access. Lead with account-upgrade KYC, sanctions screening and transaction monitoring.
Keep the lender's e-signature provider. Add multi-account, device and deepfake defence where the scam losses sit (Rp9.1 tn reported to OJK's anti-scam centre in 14 months).
Work the named local partners and the 24 OJK-registered aggregators and credit scorers, which onboard users for licensed firms.
Local vendors and low-price entrants quote well under list. Win on total cost: fraud avoided, pass rate and one contract in place of three.
PP 33/2026 applies from 16 Jan 2027 and biometrics are specific personal data. Local processing answers the first question in every security review.
Named accounts and their decision makers are held in my application materials.
The two postings list the same duties. First move per country.
| JD duty | Malaysia | Indonesia |
|---|---|---|
| Go-to-market in new verticals | E-money, digital banks and remittance first, on the MyKad moment; crypto as the reference base. | Crypto and BI payments direct; lending and multifinance with a local Dukcapil partner; telcos next. |
| Own the full cycle on the biggest accounts | Group-level account plans for the 57 multi-licence groups, with the BNM approval step in each timeline. | Account plans per vertical with rule, route, current vendor and deal size from the sizer. |
| Work with product and marketing | New-generation MyKad support, FAR reporting for STATsmart, MyDigital ID as an input. | Dukcapil route, KTP edge cases, Bahasa Indonesia flows; webinars on POJK 27/2024. |
| Conferences and external speaker | Talks on deepfakes and the BNM e-KYC policy for fintech and payments audiences, in English, Mandarin or Bahasa Malaysia. | Crypto association events and fintech summits, on Sumsub's Indonesia fraud data. |
| Internal expert on the verticals | Keep the rule sheets and the target map current; brief the SDR and partner teams monthly. | |
| Window | Malaysia | Indonesia |
|---|---|---|
| Days 1 to 30 | Product and assessment pack learned; MyKad test results ready; account plans for the top e-money, digital bank and remittance groups; first 40 conversations. | Partner terms and the Dukcapil route confirmed with legal; account plans for crypto and BI payments; first 40 conversations. |
| Days 31 to 60 | Side-by-side tests with two e-money issuers; one talk or webinar on the e-KYC policy and deepfakes. | Proofs of concept with two crypto traders; partner meetings for lending. |
| Days 61 to 90 | First contracts with the BNM approval step planned; reseller pipeline reviewed. | First contracts; a lending pilot through the partner; telco research. |
| Measure | Definition | Source |
|---|---|---|
| Coverage | Share of licensed firms per vertical with a contact, a current vendor and a route | Target map |
| Qualified opportunities | Accounts with a confirmed need, budget owner and timeline | CRM |
| Deal size | Monthly verifications × price, plus monitoring and Travel Rule modules | Deal sizer |
| Win rate by route | Direct against partner-led deals | CRM |
| Time to first verification | Signature to first production check | Product data |
Outside-in, from public data only (public job posting, 2026). Confirm every figure and every legal reading internally before it drives a deal.
Rules: POJK 8/2023 · POJK 27/2024 · POJK 40/2024 · PBI 10/2024 · PP 10/2023
Registers: OJK crypto traders (22 Sep 2026), P2P directory (Jul 2026), multifinance (Jul 2026), insurance (Q3 2025), ITSK (4 Aug 2026); Bank Indonesia licence register (6 Oct 2026)
Market: crypto accounts · P2P outstanding · scam losses · biometric SIM rule
Sumsub: local data processing · pricing · HATA · Sinegy
Malaysia rules: BNM e-KYC Policy Document · e-KYC FAQ · SC AML Guidelines
Malaysia registers: SC digital assets (20 Jul 2026), SC recognized markets, SC digital investment managers; BNM financial institutions, e-money, payments and money services directories (fetched 7 Oct 2026)
Malaysia market: new MyKad e-KYC issues · BNM payment statistics
Independent homework by Edward Tay for the Sumsub Business Development Manager, Malaysia and Indonesia applications. Public data only, no confidential Sumsub information. The demo is my own prototype.