It has never been easier to launch a digital lending product. Underwriting models, payment rails, and even full lending-as-a-service infrastructure are available off the shelf, and a founder with a clear thesis on an underserved borrower segment can have a working prototype in weeks. This ease is exactly what makes the compliance gap so dangerous — the speed of technical launch has outpaced most founders' understanding of what regulatory infrastructure that speed actually requires underneath it.
Malaysia's own experience over the past year is instructive. The Consumer Credit Act 2025 came into force on 1 March 2026, together with the establishment of the Consumer Credit Commission, bringing previously unregulated sectors — buy-now-pay-later schemes, leasing, factoring, and their Islamic equivalents — within a licensing regime for the first time. Licensing and registration requirements took effect on 1 June 2026, with a six-month transition window for existing operators to come into compliance. The scale of what had been operating outside clear oversight is notable: BNPL alone recorded 140.4 million transactions worth RM12 billion in the second half of 2025, according to figures published by the Consumer Credit Oversight Board Task Force, before any licensing regime existed to govern it.
Licensing is the visible obligation. It is not the hard one
Most founders entering digital lending correctly identify that they need some form of licence or registration to operate legally, and they budget time and legal cost accordingly. What catches founders off guard is everything that sits downstream of the licence. Under Malaysia's new framework, credit businesses must meet minimum shareholders' funds requirements, submit to fit-and-proper assessments of directors and key personnel that apply on an ongoing basis rather than as a one-time gate, and maintain comprehensive annual reporting. Credit service providers — debt collection agencies, debt counselling firms — face a parallel registration regime built around codes of conduct emphasising fair treatment and the avoidance of coercive collection tactics.
A founder who treats licensing as a one-time hurdle to clear before launch has misunderstood the nature of the obligation. It is a continuous operating requirement, and the businesses that get into trouble are usually not the ones that launched without a licence — they are the ones that had one and then drifted out of compliance with its ongoing conditions as the business scaled faster than its compliance function did.
Data and credit decisioning carry their own regulatory weight
Digital lenders increasingly rely on alternative data — transaction history, telco data, behavioural signals — to underwrite borrowers that traditional credit bureaus cannot adequately score. This is a genuine innovation and a real advantage over incumbent lenders. It also creates a regulatory exposure that many founders underweight: data protection obligations around how that data was collected and consented to, and increasingly, obligations around explainability when an automated credit decision is challenged.
A lender that cannot explain why an applicant was declined — because the decision came from a model that even the lending team cannot fully interpret — is building a liability into its underwriting process from day one. Regulators across the region are moving toward requiring this explainability, and lenders that have not built it in from the start face a materially harder retrofit than those who treated it as a design requirement from the outset.
Collections conduct is where reputational risk concentrates
The single fastest way for a digital lender to attract regulatory attention and reputational damage in ASEAN markets is aggressive or non-compliant debt collection practice. This is true even for lenders whose underwriting and disclosure practices are otherwise sound. Malaysia's new regime makes this explicit: credit service providers involved in debt collection are subject to registration and codes of conduct specifically because collections conduct — communication frequency, permitted contact methods, treatment of vulnerable borrowers, dispute handling — is where regulators have historically seen the most consumer harm.
Founders building lending products often underinvest in collections infrastructure and training relative to underwriting and product, treating it as an operational afterthought. In practice, it deserves the same design rigour as the lending decision itself, because it is the part of the lending relationship most likely to end up in front of a regulator or in the press.
Capital planning needs to assume compliance cost grows faster than revenue
Founders raising capital for a digital lending business frequently model compliance cost as a fixed, front-loaded expense — the cost of getting licensed — rather than a cost that scales with the loan book and the number of jurisdictions the business operates in. Malaysia's framework alone illustrates the layers involved: minimum capital thresholds, ongoing fit-and-proper reassessment, annual reporting, and — as the Consumer Credit Commission's Authorisation Standards made clear when issued in June 2026 — even entities outside direct consumer lending may face annual declaration obligations. Founders who have not modelled this non-linear growth in compliance cost find themselves compliance-constrained precisely at the point when the business is otherwise ready to scale.
What this means in practice
None of this argues against building digital lending businesses in ASEAN — the underserved borrower segments are real, and the technology genuinely can serve them better than incumbent lenders have. It argues for founders to treat regulatory and compliance infrastructure as a core product decision, resourced and designed alongside underwriting and distribution, rather than a legal formality to clear before the real work begins. The lenders who build this in early move slower for the first six months and considerably faster for the following five years than the ones who treat compliance as something to catch up on later.