Malaysian Payroll Compliance Guide 2026

EPF, SOCSO and EIS apply from your very first employee, including part-timers and (for SOCSO/EIS) most foreign workers under the Employees’ Social Security Act amendments. There’s no “small business exemption” you can rely on.

EPF covers all employees aged 14 and above earning wages. SOCSO and EIS apply to all employees regardless of salary, with banded contribution amounts. Contributions are due from the month the employee starts — even if they only worked a single day, you owe the prorated contribution.

The most common compliance mistake we see at Pandahrms is small founders treating their first one or two hires as “informal” and only registering once they grow. PERKESO and EPF audits are increasingly cross-checking against LHDN data, so this is a risky shortcut.

The cumulative method (Computerised Calculation) is the LHDN-recommended approach and the one all certified payroll systems use by default. It produces the most accurate monthly deduction and minimises year-end tax surprises for the employee.

The simplified PCB schedule (the printed table-lookup method) is still legally acceptable but produces less accurate monthly amounts, especially for employees with bonuses, multiple dependants, or mid-year salary changes. Most employees end up under- or over-deducted under the simplified method, which gets reconciled in their personal tax return.

If you’re using a modern HRMS or outsourced payroll provider, you’re almost certainly already on the cumulative method and don’t need to think about this.

HRD Corp registration is mandatory if you’re in one of the covered industries listed in the First Schedule of the PSMB Act and you have 10 or more Malaysian employees. For covered employers in the 5–9 employee range, registration is optional at a reduced 0.5% levy.

Covered industries now include manufacturing, services, mining and quarrying, and most commercial sectors — the list expanded substantially in recent years, so even pure-services SMEs are usually in scope. Check the latest gazette or the HRD Corp website if you’re unsure whether your MSIC code falls inside.

If you’re registered, you must pay 1% of monthly wages as levy by the 15th of the following month. The good news: that money sits in a fund you can claim back to subsidise approved staff training, often at 100% reimbursement for HRD Corp claimable courses.

Employee payroll data is some of the most sensitive personal data your business holds — MyKad, salary, bank account, EPF and tax numbers. Under the Personal Data Protection Act 2010, you’re a “data user” with seven obligations: general principle, notice and choice, disclosure, security, retention, data integrity, and access.

Practical implications: collect only what you need for payroll and statutory filings; store it on access-controlled systems (not shared Google Sheets); restrict access to authorised HR / finance staff only; have a written retention policy; and handle subject access requests within the prescribed time frame.

Note that the PDPA exempts personal data processed for credit reporting and certain statutory uses, but employee data is not blanket-exempt — you still need to comply with the security and notice principles. The 2024 amendments increased penalties significantly, so this is a higher-stakes area than it used to be.

For EPF, SOCSO and EIS, you’ll typically incur late payment charges or interest from the 16th onwards. The agencies will email or letter you; if you pay quickly with the late charge, the matter usually closes there.

For PCB, late remittance is technically an offence under the Income Tax Act and can attract a penalty, though LHDN’s first response for first-time minor delays is usually a reminder rather than an immediate fine. Repeat or substantial late payment is a different matter and can lead to formal compounds.

For Form E and CP8D, missing the 31 March (or 30 April e-Filing) deadline is the most expensive miss — Section 120 of the Income Tax Act exposes you to a fine of up to RM20,000 or imprisonment. In practice, LHDN issues penalty notices proportional to the delay and the size of the company. Either way: don’t be the company that finds out the hard way.

Three things need to happen, in this order. First, run their final payroll — including any unpaid leave, bonus, gratuity, or notice-in-lieu — with the correct PCB on the additional remuneration. Second, file CP22A with LHDN at least 30 days before the cessation date (or as soon as practical, if it’s a short-notice resignation), and consider withholding the final salary until tax clearance is received, particularly for higher earners.

Third, issue an EA Form for the year-to-date period when you’d normally issue annual EA Forms. The leaver is still your employee for the months they worked, so they appear on your CP8D for that year as well.

If they’re leaving Malaysia for more than three months (e.g. emigrating, expat repatriation), file CP21 instead of CP22A, and tax clearance is mandatory before final salary release.