MACC Once Asked For A Pendrive On Alleged Corruption. Here's What Malaysian Law Actually Requires You To Report.

Almost every Malaysian has been within one degree of something that smelled wrong. The tender that went to the contractor whose brother-in-law sits on the committee. The JMB treasurer whose renovation quotes always come from the same "friend." The officer who mentions, without quite mentioning, that things can be arranged.

Most people do the same thing: complain about it at the mamak, then do nothing.

A well-known episode from 2016 is a useful way into the actual law — not because anyone did anything wrong, but because it raised, in public, the exact question ordinary Malaysians get stuck on. If you hold information about someone else's alleged wrongdoing, what does the law require of you?

What happened in 2016

In mid-July 2016, His Royal Highness Tunku Ismail Ibni Sultan Ibrahim, then Tunku Mahkota Johor, said he was holding a pendrive containing information about activities inside the Football Association of Malaysia. He owned Johor Darul Ta'zim and had been publicly engaged in questions about how Malaysian football was being run.

Per reporting at the time, he described the contents as covering media personnel FAM engaged, former national footballers, money said to have been taken by the Football Malaysia Limited Liability Partnership on FAM's behalf, and an auditor's report he was critical of. He said the information came from friends in Kuala Lumpur.

MACC responded quickly. In a statement on 19 July 2016, the commission noted he had said he held such a pendrive, and said MACC welcomed him to hand over the information so that it could take the next step, adding that necessary action would be taken under the MACC Act 2009.

FAM's response was measured: it said he had every right to report the matter to MACC, and that it would meet him about it.

He initially declined to release it, and his stated reason is the part usually left out of the retelling. He said he was holding back the contents to avoid persecuting certain individuals, because the information included names that could have significant implications for those people. He said he intended to raise the issues directly with the FAM executive committee, with the aim of encouraging certain individuals to step aside in favour of people he considered better suited to lead.

In a statement carried on the Johor Southern Tigers Facebook page, he said the information belonged to him, that he would deal with the matter himself, and that he would inform MACC if he required assistance.

The matter then resolved through official channels. Khairy Jamaluddin received the pendrive and submitted it to MACC on 2 September 2016. On 5 September, MACC announced its finding: examination of the pendrive found no evidence of corruption as defined under the MACC Act 2009. The commission said it would provide FAM with an investigation report for its improvement process and further action, particularly on the technical issues raised, and that it remained ready to cooperate with FAM and others should corruption elements emerge later.

Two things follow from that, and both matter.

First, no one in FAM was found to have committed a corruption offence on the strength of that pendrive. That finding deserves to be stated plainly rather than left hanging, because the individuals whose names were in it were never charged with anything.

Second, the concerns did not simply evaporate — MACC's stated intention to give FAM a report on the technical issues suggests the exercise surfaced things worth fixing, even though they were not corruption offences.

Was there a legal duty to hand it over?

No — and understanding why is the single most useful thing in this article.

Section 25 of the MACC Act 2009 creates a genuine, enforceable duty to report. It is also narrower than most Malaysians assume.

Section 25(1) applies to any person to whom gratification is given, promised or offered in contravention of the Act. That person must report the gift, promise or offer — with the name of whoever gave, promised or offered it, if known — to the nearest MACC officer or police officer.

Section 25(2) makes non-compliance an offence: a fine up to RM100,000, imprisonment up to 10 years, or both.

Section 25(3) covers the mirror case — any person from whom gratification has been solicited or obtained, or from whom an attempt was made to obtain it. Same duty, as soon as reasonably practicable.

Section 25(4) sets that penalty lower: a fine up to RM10,000, imprisonment up to two years, or both.

Note the asymmetry. Being offered a bribe and staying silent is treated far more seriously than being solicited and staying silent.

"Gratification" under Section 3 is also very wide: money, donation, gift, loan, fee, reward, valuable security, property movable or immovable, financial benefit, or any other similar advantage. Not just cash in an envelope. A discounted renovation. A "free" holiday. A job for your nephew. And it cuts both ways — offering or giving gratification is a distinct offence under Section 17(b), so the classic roadside "duit kopi" catches the person handing it over, not just the officer taking it.

Now apply that. On the public record, Tunku Ismail was not the person to whom gratification was offered, nor the person from whom it was solicited. He was a third party holding documents concerning others. Section 25 imposes no general duty on a third party to surrender information about someone else's alleged corruption. MACC's own language reflected the legal position precisely — it welcomed the handover rather than demanding it, because a demand would have had no statutory basis.

Whether Malaysian law should impose a wider duty is a fair policy question with arguments on both sides. A general duty would catch more wrongdoing. It would also criminalise a great many ordinary people who received something in a group chat and had no way to assess it. Parliament has not gone there.

The harder version of the question is the one most Malaysians actually face: what if you were the one who paid?

READ MORE: Will you get in trouble if you report a bribe that you paid in Malaysia?

Where Section 25 does bite, it is not theoretical

Malaysians tend to treat Section 25 as decorative. The courts do not, and the people who get caught by it are ordinary employees.

In June 2021, the Kuala Lumpur Sessions Court fined an immigration officer, 37, RM35,000 in default three months' jail for failing to report bribery totalling RM21,000. He had received the money from a businessman through a third party's bank account, as inducement to help process travel documents for foreigners. He pleaded guilty and paid the fine.

In August 2021, a 43-year-old former senior buyer at an oil and gas company was fined RM7,000 or two months' jail — RM3,500 on each of two alternative charges — for failing to report a RM4,000 bribe connected to leaked tender pricing.

Look closely at that second one. The accused pleaded guilty to the alternative charges; the primary charge was the corruption offence itself. Section 25 is frequently what a prosecution lands on when the substantive graft charge is harder to prove. That makes it considerably more dangerous to a rank-and-file employee than the headline penalty suggests.

If a supplier hands you an envelope and you say nothing because you didn't accept it, you are already exposed.

Employers should note this too. Since Section 17A came into force, a company — and its directors, partners and managers personally — can be liable for corruption committed by an employee.

READ MORE: There's a new law against corruption — here's how it affects companies and their directors

The order you do things in decides whether you're protected

This is the part almost nobody knows, and it is where people genuinely lose out.

The Whistleblower Protection Act 2010 shields people who report wrongdoing from retaliation. The protection is conditional, and one condition catches out a great many well-meaning people.

In June 2025, MACC's senior director for legal and prosecution, Wan Shaharuddin Wan Ladin, said publicly that there is a growing misconception that anyone who exposes misconduct is automatically protected. Some believe they can post information on social media or speak to the press first and still claim protection. The law does not work that way.

MACC's published guidance sets the conditions out plainly: the report must go to a legitimate enforcement agency such as MACC or PDRM; it must be made in good faith rather than out of revenge or as a vehicle for defamation; and the whistleblower must not be complicit in the misconduct.

Post first, and you may have given away your own legal shield before anyone investigates.

The WPA gives a whistleblower three things: confidentiality of identity, immunity from civil, criminal and disciplinary liability, and protection against retaliation such as demotion or dismissal. It is also not the only shield — the Witness Protection Act 2009 sits alongside it.

READ MORE: What type of protection do whistleblowers get in Malaysia?

(That explainer predates the 2025 amendments, so its account of the Section 6 proviso and of revocation under Section 11(1)(a) describes the position before the changes set out below.)

What changed in 2025 — and what didn't.

The Whistleblower Protection (Amendment) Bill 2025 was tabled by Azalina Othman Said on 6 March 2025 and passed the Dewan Rakyat on 22 July 2025:

• Section 6 — the proviso denying protection where disclosure was prohibited by written law was removed, so classified material no longer automatically disqualifies a whistleblower.
• Section 11(1)(a) — "wilfully" inserted, so protection is revoked only for deliberate participation in the misconduct.
• New Section 11(1A) — enforcement agencies gain discretion to maintain protection even where a whistleblower is implicated.
• Section 7(3) — protection expanded to expressly include the Witness Protection Act 2009.
• A new Whistleblower Protection Committee to oversee implementation.

What the amendments did not do is widen the disclosure channels. Going to the media or the public before an enforcement agency still costs you protection. That was deliberate — it was reported the government had no plans to extend protection to public disclosures made first.

Both sides deserve a hearing. C4 Center and Transparency International Malaysia argue the restricted channels remain a serious gap, alongside the absence of physical protection and support services. The counter-argument is that early public disclosure can compromise a live investigation, alert subjects, and subject people to trial by social media who are later cleared of anything.

Further amendments were signalled in the Dewan Negara on 16 December 2025, when Anwar Ibrahim said the Act would be amended again to distinguish genuine whistleblowers from those seeking to hide behind it.

Publishing an allegation carries its own exposure

If you name someone publicly in a corruption allegation you cannot substantiate, the legal risk runs in both directions — and this applies with particular force where the subject is a member of the royal institution.

In June 2024, Johor police confirmed an investigation into a Facebook post by a political supporters' page that made a corruption allegation touching the Regent of Johor. Johor police chief M Kumar said the matter was being handled by the Classified Crime Investigation Unit under Bukit Aman CID, under Section 4(1) of the Sedition Act 1948 and Section 233 of the Communications and Multimedia Act 1998. He warned that stern action would be taken against parties sending, transmitting or sharing information that is seditious, slanderous or false. Johor Menteri Besar Onn Hafiz Ghazi said the state viewed the matter as an attempt at malicious incitement to undermine the royal institution, and the state government lodged a police report.

Section 233 CMA carries a fine, imprisonment, or both, and is used routinely against online posts. Civil defamation sits on top of that, and defamation in Malaysia is also a criminal offence under Section 499 of the Penal Code.

READ MORE: In Malaysia, shaming someone on social media could land you in jail

Sharing is not a defence either. Forwarding someone else's post can carry the same exposure as writing it.

READ MORE: Is there freedom of speech in Malaysia if you can get arrested for Facebook posts?

Bluntly: a screenshot in a WhatsApp group is not evidence, and forwarding it is not whistleblowing.

Information given to MACC does get used

A more recent example shows what the channel looks like when it runs end to end.

In August 2025, MACC disclosed that the Regent of Johor had provided information that assisted investigations under Op Sohor, an operation in which five senior armed forces officers were arrested over allegations of leaking military operation information to smugglers and colluding with a syndicate smuggling contraband including drugs and cigarettes, estimated at around RM5 million a month. Then-chief commissioner Azam Baki said His Royal Highness had been very cooperative in the matter and wanted such activities curbed.

That is the ordinary, unglamorous shape of it: information reaches the agency with statutory powers, and the agency acts on it.

A note on who leads MACC now: Azam Baki's tenure ended on 12 May 2026 after six years. He was succeeded by Abdul Halim Aman, a former High Court judge, appointed with the consent of the Yang di-Pertuan Agong on the Prime Minister's advice under subsections 5(1) and (2) of the MACC Act 2009. Older guidance naming Azam Baki as chief commissioner is out of date.

What to do if you know something

• Work out whether Section 25 applies to you. Were you offered it, or asked for it? If so, you have a legal duty and a clock running. If you merely know about someone else's situation, you don't — but the rest still applies.
• Report to MACC or the police before telling anyone else. Not the group chat, not a reporter, not Facebook. This single decision determines whether you keep whistleblower protection.
• MACC's hotline is 1-800-88-6000. You can also walk into any MACC state office or a police station.
• Bring what you have, and keep a copy. Documents, messages, transfer records, dates, names. Agencies assess what is actually there — "I have information" and "I have evidence of an offence" are not the same thing, and only an investigation can tell them apart.
• Don't sanitise your own involvement. Since the 2025 amendments, protection is revoked only for wilful participation, and agencies have discretion to maintain it even for implicated whistleblowers.
• Don't name anyone publicly. Sedition Act, CMA Section 233, and civil defamation all apply.
• For workplace matters, use the internal channel too — but that does not replace an enforcement agency report for WPA purposes.

The verdict

Strip the episode back and it leaves a clean legal point, and a reassuring one.

Malaysian law does not require a bystander to surrender information about someone else's alleged wrongdoing. It requires you to report what was offered to you, or demanded from you. That is a narrow duty, but within its scope it is real, and people are fined and jailed under it every year.

The second point is about sequence. Whether you keep whistleblower protection turns almost entirely on the order in which you do things — enforcement agency first, everyone else second. That is not etiquette. It is the difference between being a protected whistleblower and being a defendant.

And the third is about what an investigation is for. A pendrive that looked significant in July was examined in September and found to contain no corruption offence. That is the system working as designed: allegations get tested by people with the power to test them, and individuals who have not been proven to do anything wrong are not treated as though they have.