Is Airwallex safe? A guide for Malaysian businesses (2026)

Key Takeaways:

• Airwallex (Malaysia) Sdn Bhd holds a Money Services Business Class A licence in Malaysia, along with E-Money Issuer approval and Registered Merchant Acquirer status under the Financial Services Act 2013.

• Your funds are held in a designated account at a licensed Malaysian bank, kept separate from Airwallex's own operating capital, as required under the Money Services Business Act 2011.

• Airwallex is a legitimate platform used by businesses across Malaysia, and understanding how its regulartory compliance framework works helps you use it with confidence.

Is Airwallex safe? The short answer is yes — and this article explains why.

Airwallex is licensed in Malaysia and certified to internationally recognised security standards. It is a legitimate platform that businesses across Malaysia use to move money across borders, and understanding how it is regulated gives you a clearer picture of what those protections mean for your funds.

This article covers how Airwallex is regulated in Malaysia, how your money and data are protected, and what you need to know about compliance checks.

Is Airwallex a legitimate company?

Yes. Airwallex is a real, registered financial platform founded in Melbourne, Australia, in 2015. It has grown into one of the world's largest fintech companies, now serving 200,000+ customers globally and holding a valuation of US$8 billion following a Series G fundraise in 2025.¹

Airwallex is co-headquartered in Singapore and San Francisco, and holds 70+ licences across North America, Europe, the Middle East, and Asia-Pacific.

In Malaysia, Airwallex operates as Airwallex (Malaysia) Sdn Bhd — a company incorporated under Malaysian law with company registration number 201801007747 (1269761-X).

It holds a Money Services Business Class A licence in Malaysia, along with E-Money Issuer approval under the Financial Services Act 2013 and Registered Merchant Acquirer status.

Airwallex is not a bank. It is a licensed money services business and e-money issuer — a distinct regulatory category under Malaysian law, with its own obligations and protections. The next section explains what that means for your money.

Is Airwallex regulated in Malaysia?

Yes. Airwallex is regulated in Malaysia under the Money Services Business Act 2011 (MSBA 2011) and the Financial Services Act 2013 — two key pieces of legislation governing non-bank financial services providers in Malaysia. Here is what that means in practice.

What is an MSB Class A licence?

Money Services Business licences are issued under Malaysia's regulatory framework. A Class A licence authorises a business to provide both remittance services and money changing under the Money Services Business Act 2011 (MSBA 2011), covering both activities under a single licence.

Airwallex holds this licence in Malaysia, alongside E-Money Issuer approval and Registered Merchant Acquirer status under the Financial Services Act 2013.

To obtain and maintain these licences, Airwallex must meet ongoing regulatory requirements across several areas: financial soundness, operational risk management, anti-money laundering and counter-terrorism financing controls, and customer fund protection.

Licensed entities are subject to ongoing regulatory oversight, not only at the point of application. If Airwallex failed to meet these standards, its licences may be suspended or revoked.

How your funds are protected

One of the most important requirements under the Financial Services Act 2013 for e-money issuers is the protection of customer funds. Airwallex must deposit all funds received from customers into a designated trust account in Malaysia, and keep these entirely separate from its own operating capital.

Malaysian regulations also set legal restrictions on how Airwallex can use or withdraw those funds. Your money cannot be pooled with Airwallex's business funds or used for its own operations. In the unlikely event of Airwallex facing insolvency or bankruptcy, the funds in that designated account are not deemed to form part of Airwallex's property.

On a daily basis, Airwallex reconciles all payment instructions to verify that transactions are processed correctly and that account balances are accurate. This reconciliation is part of its ongoing regulatory obligations.

Airwallex is not covered by Perbadanan Insurans Deposit Malaysia (PIDM), which insures deposits at licensed banks. But the e-Money fund ring-fencing requirement achieves a similar outcome: your funds are legally segregated, with no cap on the amount protected.

How does Airwallex keep your money safe?

Beyond its regulatory obligations, Airwallex holds several internationally recognised security certifications. Here is what each one means for your business:

PCI DSS Level 1 certification

The Payment Card Industry Data Security Standard (PCI DSS) Level 1 is the highest certification tier for organisations that handle card payment data. It covers secure network architecture, strong access controls, encrypted data transmission, and regular security testing.

Airwallex is PCI DSS Level 1 certified. If your business accepts card payments through Airwallex, your customers' card data is handled to the most stringent standards the card industry requires. This certification is audited by an external assessor; it cannot be self-declared.

SOC 2 Type II certification

SOC 2 Type II is an independently audited report on how a company manages security, availability, and data confidentiality over a sustained period. Unlike a one-off audit, it tests whether controls work consistently — not just whether they exist on paper.

Airwallex has held SOC 2 Type II certification since 2021. The reports are compiled by Ernst & Young and are available to customers through Airwallex's security portal at security.airwallex.com.

This gives you a third-party verified view of how Airwallex's security controls perform in practice.

Data encryption

All data sent to and from Airwallex is encrypted in transit using TLS v1.2, which is the industry standard for secure data transmission. Data stored on Airwallex's servers is encrypted using AES-256, the same standard used by financial institutions and government agencies worldwide.

Even if data were intercepted, it would be unreadable without the correct decryption key.

Airwallex also tests its infrastructure through red team exercises, adversary simulations, and penetration testing conducted by external security firms — to identify and fix weaknesses before they can be exploited.

How does Airwallex protect your account?

Beyond certifications, Airwallex applies several security controls at the account level — from your first login onwards.

Two-factor authentication

Two-factor authentication (2FA) is mandatory for every Airwallex account. It cannot be turned off. Each time you log in, you need your password and a one-time code sent to your registered device. This applies to everyone on your team, not just administrators.

If an employee's password is ever compromised, 2FA prevents an attacker from getting in. One practical note: Airwallex's support staff will never ask for your password or 2FA codes. If anyone claiming to be Airwallex asks for these, treat it as a phishing attempt.

Real-time fraud detection

Every transaction processed through Airwallex passes through machine learning models trained on data from across the platform. These models detect and flag suspicious patterns in under half a second², before a fraudulent payment is completed.

For card transactions, Airwallex uses 3D Secure authentication to confirm that the genuine cardholder is making the purchase. A dedicated global security team monitors alerts around the clock, every day of the year.

If suspicious activity is identified, Airwallex initiates an investigation and notifies the account holder.

Independent security testing

Before any new product or feature reaches customers, it goes through internal security tests and reviews. Airwallex regularly commissions external security firms to run realistic attack simulations, including red team exercises, adversary simulations, and penetration testing.

Airwallex also proactively scans the internet for phishing sites and fraudulent pages targeting its customers, and works with providers like Google Cloud Platform and Cloudflare to have them removed.

What about account freezes and compliance checks?

One of the most common questions about any fintech platform is why an account or transaction might be temporarily restricted.

There are several possible reasons for this, including security concerns, suspected fraud, technical issues, or regulatory compliance checks.

Compliance reviews are a normal part of how regulated financial institutions operate, but they're often less familiar to businesses than other types of account restrictions. Here's what happens during a compliance review, and why.

Why compliance checks happen

Airwallex, like every licensed money services business in Malaysia, is legally required to conduct anti-money laundering (AML) and counter-financing of terrorism (CFT) checks.

These obligations fall under the Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA 2001) and other applicable AML/CFT regulatory requirements.

In practice, Airwallex's systems monitor transactions for patterns that fall outside normal parameters. A check may be triggered by a large or unusual inbound transfer, a payment from a new jurisdiction, a sudden change in transaction volume, or activity that does not match the business profile on file.

This is not a sign that your account is in trouble. It is the platform doing exactly what a regulated financial institution is required to do. Traditional banks carry out the same checks: the difference is that a bank manager might call you directly, while a fintech platform sends an email or in-app notification.

What to expect if your account is reviewed

If your account is flagged, you will typically be asked to provide supporting documentation, such as invoices, purchase orders, contracts, or information about the counterparties in a transaction. Airwallex may place a temporary restriction on transactions while the review is underway.

A few practical steps make a real difference:

• Keep your SSM registration and company documents current.

• If you expect a large or unusual payment, notify Airwallex in advance and have supporting documents ready before the funds arrive.

• Respond to compliance requests quickly — delays on your side extend the review period.

• Read the notifications Airwallex sends. Reviews are flagged by email and in-app; acting on them early is the most effective way to reduce downtime.

Is Airwallex safe for Malaysian businesses?

Yes. Airwallex is licensed in Malaysia and independently certified, with customer funds safeguarded in accordance with Malaysian regulations.

For Malaysian businesses with cross-border operations, it offers something traditional banks often cannot: a single platform that covers collections, FX, payments, and spend management — all under full regulatory oversight.

Applecrumby, a Malaysia-born baby care brand expanding across Southeast Asia and beyond, chose Airwallex to manage its international payments and multi-market financial operations. After it started using Airwallex, payment gateway costs fell by 0.5% and overseas transfer costs dropped by around RM100 per transaction.

As Winson Lee, Finance Director of Applecrumby, puts it: "Airwallex has made a real difference to our team and our bottom line. By reducing costs on payments, FX, and transfers, we've unlocked substantial savings that we can channel back into growth."

Frequently asked questions (FAQs)

Is Airwallex a bank?

No. Airwallex is a licensed non-bank financial platform, not a bank. In Malaysia, it holds a Money Services Business Class A licence, along with E-Money Issuer approval and Registered Merchant Acquirer status under the Financial Services Act 2013. This means it is legally authorised to provide payment and remittance services — but it does not offer deposits, loans, or the full suite of products a bank provides.

How do I know my funds are protected with Airwallex?

Under the Money Services Business Act 2011, Airwallex is required to hold all customer funds in a designated account at a licensed Malaysian bank, completely separate from its own operating capital. This means your money is not pooled with Airwallex's own funds. Airwallex also reconciles all payment instructions daily to ensure balances are accurate.

Is Airwallex safe to send money internationally?

Yes. Every transfer is monitored in real time by Airwallex's fraud detection system, which flags unusual activity in under half a second. Your account is protected by mandatory two-factor authentication, and all payment data is encrypted in transit using TLS v1.2.

Why did Airwallex restrict my account?

Account restrictions typically happen when a transaction triggers an automated compliance check under Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001. This is a legal requirement for all licensed Money Services Businesses — not unique to Airwallex. In most cases, you can resolve it quickly by responding to the documentation request from Airwallex's compliance team.

Is Airwallex licensed in Malaysia?

Yes. Airwallex (Malaysia) Sdn Bhd holds a Money Services Business Class A licence (Licence number 00743, expiry 3 August 2028), is an approved E-Money Issuer, and is a Registered Merchant Acquirer under the Financial Services Act 2013.

Sources:

1.  https://www.airwallex.com/sg/who-we-are

2. https://www.airwallex.com/global/blog/is-airwallex-safe