SSM (Suruhanjaya Syarikat Malaysia)

What SSM does

SSM (Suruhanjaya Syarikat Malaysia) is the Malaysian statutory body that registers every company and registered business in the country. Every Malaysian merchant onboarding an acquirer for payment processing has an SSM record. That record is the source of truth for the merchant's legal identity, and every downstream KYB check cross-references against it.

SSM e-Info is the public lookup service SSM operates. Given a company registration number, e-Info returns the structured company profile: the canonical company name, the current status, the type, the directors and secretaries, and the shareholders with their share percentages. For regulated acquirers and PSPs, this is the authoritative data, not whatever the merchant typed on an onboarding form.

Two registration number formats

Malaysian company registration numbers come in two formats, and both are still in circulation:

• Legacy format. Seven digits and a suffix letter, for example1234567-A. Companies registered before the migration still carry this format.
• New format. A 12-digit numeric format, for example202301012345. All companies registered after the migration use this format, and legacy companies were also assigned an equivalent.

A production SSM integration has to normalize both formats and resolve them to the same underlying record. Kenal AURA accepts either format in the onboarding form and resolves against e-Info without the merchant needing to know which one is canonical.

Why status gating matters

The SSM profile includes a company status field. The typical values are ACTIVE, EXISTING, DISSOLVED, STRUCK OFF, WINDING UP, and DORMANT. Only ACTIVE and EXISTING companies are eligible to onboard for payment processing. Everything else represents a company that no longer has legal standing to trade or is in the process of losing it.

A strong onboarding flow gates on status. A dissolved company cannot onboard, period. Not because of a manual review, but because the status check fails at the form. This is one of the first controls an acquirer's internal audit looks for when reviewing onboarding discipline.

Director and shareholder resolution

The SSM profile is where the real list of directors lives. The merchant can declare anyone they want on an onboarding form, but the authoritative list comes from SSM. Best practice (and what Kenal AURA does by default) is to resolve the merchant against SSM, pull the director list from the registry, and then run eKYC against that list instead of the self-declared one.

This closes a significant gap. A merchant trying to hide the real controlling person cannot simply omit them from the form. The registry already knows. Any delta between the declared list and the SSM list is flagged as a discrepancy on the case for analyst review.