A Malaysian private company is an exempt private company (EPC) when it passes three tests drawn from the Companies Act 2016 (CA 2016), as at 1 August 2022. It has no more than twenty members, none of them a corporation, and no corporation holds a beneficial interest in its shares, directly or indirectly.
For each financial year, an EPC may lodge a certificate with the Companies Commission of Malaysia (SSM, written CCM in some English sources) in place of its financial statements.
Section 260(1) of the Companies Act 2016 calls it “a certificate relating to its status as an exempt private company”. SSM’s FAQ, updated 19 May 2026, shortens this to the EPC certificate.
An EPC that lodges the EPC certificate keeps its accounts off SSM’s public file. Those accounts are still audited.
The EPC status is not the audit exemption. The audit exemption has its own test, set by SSM’s Practice Directive 10/2024 of 16 December 2024.
An EPC that lodges the EPC certificate cannot elect the audit exemption.
Key Takeaways
- An exempt private company (EPC) needs no application to SSM. Check the shareholder list and ask each shareholder whether they hold shares for another company or a limited liability partnership.
- Anyone who buys a company’s information from SSM can see its shareholders, directors and registered office address, even when it is an exempt private company (EPC).
- An exempt private company (EPC) within the audit exemption limits pays a yearly audit fee to keep its accounts private. Electing the audit exemption makes its accounts public.
- Under the Companies Act 2016, the EPC certificate is due at SSM within 30 days of circulating the audited accounts. A director, the auditor and the company secretary sign it.
- Under the Companies Act 2016, an exempt private company (EPC) still lodges an Annual Return within 30 days of the anniversary of its incorporation.
- An exempt private company (EPC) loses its status when another company or a limited liability partnership takes even one share. The former EPC’s accounts then go on SSM’s public file.
What Is an Exempt Private Company in Malaysia?
An exempt private company (EPC) is a private company that has no more than twenty members, none of them a corporation, and in which no corporation holds a beneficial interest in the shares, directly or indirectly. That is the definition in section 2 of the Companies Act 2016, as at 1 August 2022. The members are the company’s shareholders. In an ordinary private company, a member may be an individual or a body corporate, such as another company.
“Exempt” in the name does not mean exempt from audit.
An EPC that lodges the EPC certificate still has its accounts audited and circulated to its members. The certificate says so, by confirming that audited financial statements and reports went to them.
The status gives the company the right to lodge the EPC certificate in place of its financial statements. The status also frees the company from the ban on loans to directors that binds other companies.
An EPC is a status, not a separate type of company with its own registration. A company holds the status for as long as it meets the definition.
SSM’s FAQ, updated 19 May 2026, says exempt private companies need no application.
Under the Companies Act 2016, a company can be limited by shares, limited by guarantee or unlimited. A company limited by guarantee must be a public company, so it can never be an EPC.
A company limited by shares or an unlimited company can be private or public. This article deals with the Sdn Bhd, a private company limited by shares. The guide to the types of company in Malaysia, and what each one means sets out how each kind works.
Who Qualifies: The Three Tests, and How to Check Your Company
A company qualifies as an exempt private company (EPC) when it passes three tests on who its members are and who benefits from its shares.
A company that fails any one of the three tests does not qualify as an EPC.
- No more than twenty members.
- No member is a corporation. A single share held by a company rules the status out. So does a share held by a limited liability partnership (LLP), because an LLP is a body corporate.
- No corporation holds a beneficial interest in the shares, directly or indirectly. A company whose individual shareholder holds shares for another company fails it too.
An indirect interest is generally taken to include shares an individual holds as nominee for a company, and shares held on trust for a company. It is also generally taken to include a chain, such as shares held for a person who in turn holds their interest for a company.
If any shareholder holds shares for someone else, trace the arrangement to its end before you rely on the status.
You can check an existing company against the three tests in three steps.
- Start with the company’s own list of shareholders, or the shareholder list in the Company Profile that SSM sells through its e-Info and MyData portals. Check that it shows no more than twenty shareholders, none of them a company or an LLP.
- Ask each shareholder whether they hold any share for, or on behalf of, another company or an LLP. If any of them says yes, the company fails the third test.
- If the company passes all three tests, it has qualified as an EPC, and there is nothing to apply for.
How Exempt Private Companies Differ From Ordinary Private Companies in Malaysia
An exempt private company (EPC) is a private company with tighter rules than an ordinary private company on who may own it. To compare the two, start with what private companies in Malaysia are. Under the Companies Act 2016, as at 1 August 2022, a private company limited by shares may have no more than fifty shareholders. It must restrict the transfer of its shares, and it may not offer its shares or debentures to the public. Its name must end in “Sendirian Berhad” or “Sdn. Bhd.”, which means “private limited” in Malay.
In English, a Sdn Bhd is a private limited company.
The table sets an ordinary private company beside an EPC.
| Ordinary private company | Exempt private company (EPC) | |
|---|---|---|
| Who may hold shares | Individuals or bodies corporate | Individuals only, and no corporation may hold a beneficial interest in the shares |
| Most shareholders allowed | Fifty | Twenty |
| Lodged with SSM within 30 days of circulating the accounts | The financial statements | The EPC certificate in their place, or the financial statements |
| Accounts on SSM’s public file | Yes | No, where the EPC certificate is lodged |
| Audit | Required, unless the company qualifies for and elects the audit exemption | Required where the EPC certificate is lodged; an EPC that lodges its financial statements instead may elect the audit exemption if it qualifies |
| Loans to directors | Barred, except for the uses the Act allows with the company’s approval, given beforehand or within six months of the loan | Permitted |
| Raising money as an issuer on an equity crowdfunding platform | Open | Closed, under the Securities Commission Malaysia’s FAQ of 15 November 2022 |
Unlike ordinary private companies that must submit full audited financial statements, an EPC whose accounts are audited can lodge the EPC certificate instead.
Four things do not change when a company is an EPC.
- It is a separate legal entity. A member’s liability is limited to any amount still unpaid on their shares.
- It keeps a company secretary. A Sdn Bhd must have a qualified company secretary, EPC or not.
- It lodges an Annual Return. The Annual Return is due within 30 days of the anniversary of incorporation.
- Its directors owe the same duties. A director must act for a proper purpose, in good faith in the company’s best interest, and with reasonable care, skill and diligence.
What the Status Keeps Private, and What Stays Public
An exempt private company (EPC) that lodges the EPC certificate keeps its financial statements out of SSM’s records, so nobody can buy them from SSM. That confidentiality matters because a company’s financial details are otherwise open to the public. SSM sells a Company Profile that includes a company’s financial information.
Anyone who buys a company’s information from SSM can also look up its directors, shareholders and registered office address. That holds for exempt private companies as for any other company.
The EPC certificate replaces the public lodgment of audited accounts, not the audit itself.
Every member of an EPC that lodges the EPC certificate still receives the audited financial statements and reports, because the EPC certificate confirms that they were circulated. A private company circulates them within six months of its financial year end.
The company can also show its audited accounts to anyone it chooses, a bank among them.
In company law, limited liability comes from the company being limited by shares, not from the EPC status. The status therefore changes nothing about what the company’s creditors can claim.
Lending to Directors: The Ban That Does Not Apply to an Exempt Private Company
An exempt private company (EPC) may lend to its directors. The ban on loans to directors in section 224 of the Companies Act 2016 does not apply to it. The ban in section 225 on loans to people connected with a director, such as the director’s spouse, parent, child, brother or sister, does not apply to it either.
The freedom to lend does not lift the directors’ duties. A director must still exercise their powers for a proper purpose, in good faith in the company’s best interest, and with reasonable care, skill and diligence.
A director who breaches that duty commits an offence carrying up to five years’ imprisonment, a fine of up to RM3,000,000, or both.
A loan to a director also goes into the company’s accounting records like any other transaction, with the entry made within 60 days of the loan.
The freedom to lend lasts only while the company is an EPC. Once the company stops meeting the definition, the ban in section 224 applies to it as it does to any other company.
Which Companies Are Exempt From Audit?
A private company can be exempt from audit if it stays within at least two of three limits, on turnover, total assets and full-time employees, in the current financial year and the two before it. SSM sets the limits in Practice Directive 10/2024 of 16 December 2024. SSM’s FAQ, updated 19 May 2026, sets out the limits in phases, by the date the financial period begins. All three years are tested against the limits for the current financial period. A new company that is not dormant cannot elect the audit exemption until it has two past financial years to test. The employee count is the number of full-time employees at each financial year end (FYE).
| Financial period beginning | Turnover | Total assets | Full-time employees |
|---|---|---|---|
| 1 January 2025 to 31 December 2025 | RM1,000,000 | RM1,000,000 | 10 |
| 1 January 2026 to 31 December 2026 | RM2,000,000 | RM2,000,000 | 20 |
| On or after 1 January 2027 | RM3,000,000 | RM3,000,000 | 30 |
The audit exemption is a choice, and it is not automatic.
SSM’s FAQ, updated 19 May 2026, says a company does not apply for it. The company assesses for itself whether it is eligible and elects to be exempted.
A company that qualifies for audit exemption may still appoint an auditor if it wants one. The exemption does not apply where another law, additional requirements or a third-party obligation calls for audited financial statements.
A company that elects the audit exemption still puts time and administrative work into financial reporting each year.
- It prepares its financial statements.
- It circulates them. The financial statements still go to the members.
- It lodges three documents with SSM within 30 days of circulation. These are the unaudited financial statements, a directors’ report and a certificate signed by a director. Practice Directive 10/2024 calls that certificate the Audit Exemption Certificate, a different document from the EPC certificate.
Four kinds of company are shut out of the audit exemption under Practice Directive 10/2024 and SSM’s FAQ.
- An exempt private company (EPC) that opts to lodge the EPC certificate.
- A public company. A public company is shut out whether or not it is listed.
- A private company that a public company controls. A private company that is a subsidiary of a public company, or is jointly controlled by one, is shut out.
- A foreign company.
A private company that is an associate of a public company is not shut out, and it is eligible if it meets the prescribed qualifying criteria. A company that has been dormant since incorporation stays exempt from audit.
The rules on the statutory audit and the audit exemption apply to all private companies, not only to EPCs.
The EPC Certificate or the Audit Exemption: Choosing Between Them
An exempt private company (EPC) that falls within the audit exemption limits has two routes, and it cannot take both. SSM’s FAQ, updated 19 May 2026, says an EPC that opts to lodge the EPC certificate in place of its financial statements cannot elect to be exempted from audit. An EPC that satisfies the audit exemption criteria and lodges its unaudited financial statements with SSM can elect the audit exemption.
The EPC certificate route keeps the audit, so privacy costs the company the audit fee every year. The audit exemption route saves the audit fee, but it means public lodgement of the company’s accounts.
An auditor and an accountant together cost about RM2,000 to RM5,000 a year. These costs rise with the company’s size and its transactions.
The audit is only part of that range, because the accounts still have to be prepared on either route. The audit exemption therefore saves less than the whole figure.
SSM’s lodging fees are small by comparison. The EPC certificate costs RM200.00 to lodge, and unaudited statements cost RM20.00.
SSM’s FAQ, updated 19 May 2026, notes that certain agencies, including financial institutions and government agencies, still require audited financial statements for purposes such as licensing, grants and loans.
Privacy matters most to a family company that would rather keep its accounts from competitors and the public. For business owners, saving the audit fee matters most when no lender, grant body or licensing agency asks the company for audited accounts.
Nothing in the rules set out here says a company must stay on one route. Even so, confirm with your auditor and company secretary before switching from the EPC certificate one year to the audit exemption the next.
Advantages and Disadvantages of Being an Exempt Private Company
Being an exempt private company (EPC) brings three advantages.
- Private accounts. When the company lodges the EPC certificate, its financial statements stay off SSM’s public file.
- Loans to directors. The company may lend to its directors.
- Nothing to apply for. A company that meets the definition is an EPC without applying to SSM.
Being an EPC also carries four disadvantages.
- The audit stays. An EPC that lodges the EPC certificate is still audited every year, and it cannot elect the audit exemption.
- No company as a shareholder. An EPC has no more than twenty members, with no company or LLP among or behind them, so it cannot take a corporate investor or have a holding company above it.
- No equity crowdfunding. An EPC cannot be an issuer on an equity crowdfunding platform, under the Securities Commission Malaysia’s FAQ of 15 November 2022.
- A yearly solvency statement. Each year, the EPC certificate states that, at the date its accounts were made up to, the company appeared able to meet its liabilities as those liabilities fall due.
Some guides describe the EPC status as reduced compliance. It is not.
An EPC that lodges the EPC certificate still has its accounts audited, still circulates the full audited reports to its members and still lodges an Annual Return. Every year, it also has to file a certificate that a director, the auditor and the company secretary all sign.
The EPC framework offers the company a choice of what to lodge with SSM, but being an EPC does not simplify the company’s yearly compliance.
Who the Status Suits, and Who Should Not Rely on It
The exempt private company (EPC) status suits closely held businesses in Malaysia, including companies that serve as the structure for family-owned or owner-managed businesses. These are companies whose shares are held by a small group of individuals, often related, and that have no plan to bring in a company as an investor. The status is not reserved for small businesses, because the three tests look at the company’s ownership structure, not at turnover, assets or staff.
Four kinds of company should not rely on the status.
- A company planning to bring in a corporate investor or a holding company.
- A company planning to raise money through equity crowdfunding.
- A company expecting more than twenty shareholders.
- A company within the audit exemption limits that would rather not pay for an audit.
How Do You Register an Exempt Private Company, and Where Does Company Incorporation Fit?
You do not make a separate application to SSM for the status itself. A company is an exempt private company (EPC) when its shareholders pass the three tests. It uses the status by lodging the EPC certificate for each financial year.
The deadlines below come from the Companies Act 2016, as at 1 August 2022.
- Register a Sdn Bhd with no more than twenty shareholders, all of them individuals, and with no company or LLP holding a beneficial interest in the shares. If the company already exists, check it against the three tests instead.
- Appoint an auditor for the financial year. A new company’s board appoints the first auditor at least 30 days before the deadline for lodging its first financial statements.
- Have the year’s financial statements audited, then circulate them, with the reports, to the members within six months of the financial year end.
- Have a director, the auditor and the company secretary sign the EPC certificate.
- Lodge the EPC certificate with SSM, in place of the financial statements, within 30 days of circulating them. The EPC certificate goes through MBRS, the Malaysian Business Reporting System.
- Repeat steps 2 to 5 for every financial year.
You register an EPC with SSM like any other Sdn Bhd. The guide on how to register a Sdn Bhd, step by step walks through that process.
What an Exempt Private Company Must Still Do Every Year
An exempt private company (EPC) still has these statutory obligations every year under the Companies Act 2016, as at 1 August 2022.
- Keep proper accounting records. The records must sufficiently explain the company’s transactions and financial position, with entries made within 60 days of a transaction. The company keeps these financial records for seven years after the transactions are completed. Under section 47 of the Companies Act 2016, the accounting records and copies of the financial statements are kept at the registered office, or at another place SSM has been told about.
- Have the accounts audited. The company appoints an auditor to audit its accounts for each financial year, unless it lodges its financial statements instead of the EPC certificate and elects the audit exemption.
- Circulate the financial statements. Under section 257 of the Companies Act 2016, the company sends its financial statements and reports to every member, every auditor, everyone entitled to notice of general meetings and any debenture holders who ask. A private company does so within six months of the financial year end. The company and every officer who contravenes section 257 commit an offence, with a fine of up to RM50,000.
- Lodge with SSM. Within 30 days of circulation, an EPC must lodge the EPC certificate or its financial statements. Lodging the EPC certificate takes the place of the financial statement filing for that year, and SSM holds no copy of the financial statements if the company lodges it. An EPC that lodges the EPC certificate also lodges an auditor’s statement under section 261.
- Lodge the Annual Return. The Annual Return is due within 30 days of the anniversary of incorporation.
- Keep a company secretary and a registered office. The company secretary must be qualified. The registered office must be in Malaysia, and open and accessible to the public during ordinary business hours.
A company that fails to lodge an Annual Return for three or more consecutive years may be struck off.
SSM has required the EPC certificate and the Annual Return to go through MBRS 2.0 since 1 December 2024.
The Annual Return and the SSM filing calendar apply to every company. The dates that matter depend on the anniversary of the company’s incorporation and on its financial year end.
The EPC Certificate in Place of Financial Statements: What It Confirms, Who Signs It and When It Is Due
An exempt private company (EPC) lodges the EPC certificate with SSM within 30 days of circulating its audited financial statements. A director, the auditor and the company secretary sign the certificate. Under the Companies Act 2016, as at 1 August 2022, the certificate confirms three things.
- The company is, and has at all relevant times been, an exempt private company.
- Audited financial statements and reports have been circulated to its members.
- At the date to which the financial statements were made up, the company appeared able to meet its liabilities as they fall due.
An EPC that lodges the EPC certificate also lodges an auditor’s statement, under section 261 of the Companies Act 2016. Its auditor signs it, stating:
- Whether, in the auditor’s opinion, the company kept proper accounting records and other books.
- Whether the financial statements were audited in accordance with the Act.
- Whether the auditor’s report carries any audit qualifications or comments, with their particulars.
- Whether, at the date the financial statements were made up to, the company appeared able to meet its liabilities as they fall due.
The company and every officer who contravenes section 261 commit an offence. The fine is up to RM20,000, plus up to RM1,000 for each day the offence continues after conviction.
Every company must appoint its first company secretary within 30 days of incorporation. The secretary must be qualified.
The company secretary is also one of the three people who sign the EPC certificate. That makes your company secretary service the sensible place to have the yearly certificate and the Annual Return prepared.
As a rough guide, a company secretary costs about RM600 to RM2,000 a year, and a registered office address costs about RM300 to RM1,200 a year.
At Altomate, for example, our company secretaries are members of the Malaysian Association of Company Secretaries (MACS) and hold active practising certificates issued by SSM.
Our Essential Company Secretary Plan, the one we recommend, is the example here. It includes filing the Annual Return and the financial statements with SSM. It costs RM100 a month, billed annually at RM1,296 including tax.
The plan’s two-year contract carries a RM1,000 early termination charge. Altomate includes a registered office address at no extra charge.
On request, we prepare and lodge the EPC certificate in place of the financial statements (additional charges may apply; SSM fees not included).
We are not authorised or approved by any government body. What we do is prepare your files in the format each portal requires, and upload them to MBRS. You make the payment, or we can make it for you on request.
The plans are set out on the page for Altomate’s company secretary service.
What Directors Confirm When They Sign the EPC Certificate, and What They Answer For
A director of an exempt private company (EPC) should make four checks on the company’s solvency and compliance before signing the EPC certificate. The first three are each tied to a statement the certificate makes.
- The shareholders still pass the three tests.
- Every member has received the accounts.
- The solvency statement holds. At the date the accounts were made up to, the company appeared able to meet its liabilities as they fall due.
- The deadline is met. The company lodges the certificate with SSM within 30 days of circulating its financial statements.
A change of shareholders during the year matters, because the certificate confirms the company “has at all relevant times been” an EPC.
A company that stopped qualifying at any point in the financial year may not be able to give that confirmation for the year. Check this with the auditor and the company secretary before anyone signs.
Under the Companies Act 2016, as at 1 August 2022, the company and every officer who contravenes section 260, the section on the EPC certificate, commit an offence. The fine for non-compliance is up to RM20,000, plus up to RM1,000 for each day the offence continues after conviction.
A signatory who knowingly makes a materially false or misleading statement in the certificate commits a separate offence under section 591 of the Companies Act 2016. It carries up to ten years’ imprisonment, a fine of up to RM3,000,000, or both.
The duties that apply in any company apply to an EPC’s directors too. The company and its directors must keep accounting records that sufficiently explain the company’s transactions and financial position.
A director must also act for a proper purpose, in good faith in the company’s best interest, and with reasonable care, skill and diligence. A breach carries up to five years’ imprisonment, a fine of up to RM3,000,000, or both.
When a Company Stops Being an Exempt Private Company
A company stops being an exempt private company (EPC) when any of these happens.
- A company or an LLP takes shares. The status ends whether that company or LLP comes in as an investor or as a shareholder’s own holding company.
- A corporation comes to hold a beneficial interest through someone on the register. An individual shareholder who starts holding shares for a company is enough.
- The membership passes twenty. A twenty-first member ends the status, because an EPC cannot have more than 20 members.
- The company converts to a public company. A public company cannot be an EPC.
Bringing in more individual shareholders keeps the exempt status, up to twenty members in all.
Once a company stops being an EPC, it must file financial statements with SSM within 30 days of circulating them, like any private company. The company’s freedom to lend to its directors ends, and the ban in section 224 applies.
The ban in section 224 is on making a loan to a director, or guaranteeing or securing one that someone else makes. Review any existing director loan with the company secretary as soon as the status ends.
Checking the Status Each Year
Two checks keep an exempt private company (EPC) on the right side of the rules each year. The first check asks whether the shareholders still pass the three tests. The second check asks which route to take. The company can lodge the EPC certificate with an audit or, where it qualifies, elect the audit exemption without one.
