Malaysia has no refugee law. What a UNHCR card actually does — and what the new DPP changes.

Scam warning first, because it matters most right now. UNHCR has stated that the first phase of the government's Dokumen Pendaftaran Pelarian (DPP) programme covers people held in immigration detention centres. Anyone approaching refugees outside detention facilities claiming to register them for DPP is not legitimate. Official information comes from the Ministry of Home Affairs channels only.

Malaysia hosts one of the largest refugee populations in Southeast Asia, and it does so without a refugee law.

Malaysia is not a signatory to the 1951 Refugee Convention or its 1967 Protocol. There is no domestic legislation recognising refugee status. Under section 6 of the Immigration Act 1959/63, no non-citizen may enter Malaysia without a valid Entry Permit or Pass — which means, legally, a refugee who fled persecution is in the same category as any undocumented migrant.

1. Why there's no legal status

Three things together create the gap:

No convention. Malaysia hasn't ratified the 1951 Refugee Convention, so it has no treaty obligation to recognise refugee status or provide the protections that come with it.

No domestic law. There's no Refugee Act. Nothing in Malaysian legislation defines a refugee or attaches rights to that condition.

The Immigration Act applies to everyone. Section 6 requires a valid Entry Permit or Pass. A person fleeing persecution who arrives without documents has, on the face of the Act, committed an immigration offence.

Section 59A(1) compounds this: it provides that there shall be no judicial review of any act done or decision made by the Minister or Director General under the Act, except regarding compliance with procedural requirements. That ouster clause means courts generally cannot examine the substance, reasonableness, proportionality or duration of a detention decision.

The practical consequence is indefinite detention where removal isn't realistic. Rohingya are treated as stateless by Myanmar authorities, and the Myanmar embassy in Malaysia does not issue travel documents for their return — so there is often nowhere to deport them to, and no time limit on holding them. Fortify Rights documented people held for years without judicial recourse.

What has protected refugees in practice is policy rather than law: the government has extended protection on humanitarian grounds, and worked with UNHCR to register people needing international protection.

2. What a UNHCR card actually does

Be precise about this, because both overstatement and understatement cause harm.

What it does NOT do:

• It does not grant legal status or immigration status
• It does not grant a right to work
• It does not make you immune from Malaysian law
• It is not formally recognised by authorities as conferring status

What it does in practice:

• Reduces the risk of arrest and detention for immigration offences related to lack of documents
• Identifies you to authorities as a person of concern to UNHCR
• Supports access to healthcare — cardholders have historically received a discount at government facilities
• Enables the resettlement process to third countries, where a place is available
• Is treated by the government as grounds not to deport for document-related offences

The Immigration Department's own position, stated by Director-General Datuk Zakaria Shaaban in June 2026: valid UNHCR cardholders would not be detained for immigration offences involving absence of documents — but they remain subject to other laws and can face action if they commit other offences.

That's the accurate summary. The card is a shield against one specific category of enforcement, not a general immunity.

3. The DPP: what changed in January 2026

This is the biggest development in Malaysian refugee policy in years, and it postdates almost everything else written on this topic.

What it is. The Dokumen Pendaftaran Pelarian (DPP) — Refugee Registration Document — is a government registration system launched 1 January 2026, developed by MIMOS Berhad, collecting biometric and personal data to build a refugee database.

What the government says. Home Minister Saifuddin Nasution Ismail told Parliament in January 2026 that the DPP would be the sole mechanism for managing refugees and their only recognised documentation, with UNHCR's role limited henceforth to resettlement referrals. The government has framed it as filling a gap where previously only UNHCR held records.

The rollout:

• Phase one focuses on people in immigration detention centres — starting with roughly 4,003 Rohingya detainees, with a reported 78 granted DPP status at the Bidor centre early on
• 1 June 2026 — phase one extended to detainees in immigration detention centres nationwide
• A comprehensive refugee management plan was to go to Cabinet in mid-June 2026

Work rights. Under the scheme as reported, eligible Rohingya refugees aged 20 to 40 can be matched with employers in five sectors: manufacturing, construction, agriculture, plantations and services.

The critical limitation, stated by the Home Minister himself: the DPP does not grant permanent residency or legal status. It is temporary, pending repatriation, resettlement in a third country, or deportation.

4. The concerns, stated fairly

This is contested policy and we'd rather set out both sides than pretend otherwise.

The case for it: the government argues it needs its own records rather than relying on data held by a foreign entity, and that a formal registration system with work-matching in defined sectors is better than the informal limbo that preceded it. On that view, DPP is a step toward managed status.

The concerns raised by rights organisations:

• Human Rights Watch warned the system lacks adequate privacy and refugee rights safeguards, and urged suspension until a proper legal framework exists. It wrote to the Home Ministry in April 2026 and reported no reply at time of publication.
• Fortify Rights called for confidentiality, due process, collaboration with UNHCR, and safeguards against detention, forced returns and data misuse — noting the government has predominantly framed DPP as a security measure.
• Refugee representatives have questioned whether a parallel government process will meet the procedural safeguards built into UNHCR's refugee status determination.
• Excluding UNHCR from status recognition removes an independent check, since the system is designed to work "without depending on data from foreign entities."

On Directive No. 23. The scheme operates under National Security Council Directive No. 23 — an unpublished policy allowing UNHCR-registered refugees to remain on humanitarian grounds, revised in 2023 ostensibly to grant a right to work. Its confidentiality has created real uncertainty about what it actually contains. SUHAKAM, Malaysia's human rights commission, described the "inexplicably" private directive as "a too late and too little approach" rather than a sustainable rights-based solution.

Our honest read for a reader in this situation: the DPP may improve things or may not, and nobody can currently tell you with confidence which. What is clear is that phase one is limited to detention centres, that the document doesn't grant legal status, and that anyone approaching you outside a detention facility offering DPP registration is not legitimate.

5. Practical guidance

If you hold a UNHCR card:

• Carry it. It is your main protection against detention for lacking documents.
• Keep it in good condition and keep a photograph of it separately.
• Understand it doesn't protect you against other offences.
• Report loss to UNHCR immediately.

On the DPP:

• Phase one is for people in immigration detention. If you're in the community, you are not currently being registered.
• Anyone approaching you outside a detention facility to register you for DPP is not legitimate. This is UNHCR's own warning, and it exists because people are being targeted.
• Official information comes from the Ministry of Home Affairs channels.
• Do not pay anyone for registration.

If you or a family member is detained:

• Contact UNHCR Malaysia as soon as possible — help.unhcr.org/malaysia
• Note the detention centre name and location
• NGOs including Fortify Rights, SUARAM and the Malaysian Bar's Migrants, Refugees and Immigration Affairs Committee may be able to advise
• Understand that section 59A limits judicial review, which is why organisational advocacy often matters more than litigation

On work:

• There is no general right to work for refugees in Malaysia outside the DPP sectoral scheme.
• Undocumented work exposes both worker and employer to enforcement.
• You are still protected against crimes committed against you. Assault, unpaid wages obtained by deception, trafficking and forced labour are offences regardless of your immigration status — though we recognise the practical difficulty of reporting when reporting risks detention. Approach an NGO first if you can.

If you're a Malaysian wanting to help: organisations working in this space include UNHCR Malaysia's implementing partners, Fortify Rights, SUARAM, and community-based groups. Employing someone without authorisation, however well-intentioned, exposes them to greater risk, not less.