MyDigital ID integration: a guide for businesses in Malaysia
How a business accepts MyDigital ID in Malaysia: what users see, what is and is not published about data, law, AML, onboarding and prices, who cannot use it, and the document fallback.
By Alberto RosasCo-founder & CEO, DiditUpdated 
In short
A MyDigital ID integration lets a service in Malaysia sign a user in through the national digital identity app, which checks the person against government records.[1] On 5 October 2026 the sources reviewed for this guide show no public onboarding terms, attribute list or price list for businesses, and bank use is still moving through a supervised sandbox, according to Biometric Update.[4]
- Almost 10 million registered accounts on 12 February 2026, with a target of 17 million by the end of 2026, according to Malay Mail.[2]
- The published registration steps need a MyKad, so customers without one need another route.[1]
- Build a document route beside it.
MyDigital ID integration matters to businesses in Malaysia because the government is moving its own services to this sign-in and banks are testing the same app, according to The Vibes and Biometric Update.[4][5] This guide sets out what is documented today: the user flow, the data, the legal position, the ways to connect, and the fallback for customers the scheme cannot reach.
The public record is thinner than for most national electronic IDs (eIDs). Where sources are silent, this guide says so with the date. For the basics, see what eID verification is.
What MyDigital ID is
MyDigital ID is a Malaysian government initiative for online identity: an app that verifies a person against the government database and then lets them log in to applications and portals with one password.[1] It does not replace the MyKad, the national identity card, which stays in use at physical counters.[1]
MyDigital ID
Malaysia's national digital identity app
Two design points matter for a business. The operator says it stores no personal data: verification refers directly to the government database, and its deputy chief executive said the data stays at the National Registration Department (NRD), according to Malay Mail.[1][2] And the identity lives on one phone: after registration it is stored in the app on the user's device.[1]
Adoption: users, targets and the bank sandbox
These are registered accounts. No source reviewed gives active users, transaction counts or the share of adults covered.
According to Malay Mail, the scheme had 1.8 million accounts in February 2025, 7.3 million at the end of 2025 and almost 10 million on 12 February 2026; the operator expected 13 million by the middle of 2026.[2][3] No later count appears in the sources reviewed. The driver is fraud: the National Cyber Security Agency counted 5,159 online financial fraud cases in 2025, up from 1,812 in 2024, according to the same report.[2]
- 12 February 2026Bank MoUsMemoranda with 15 banks and fintech companies.[2]
- March 2026Sandbox 2Scheduled end of the second phase with 18 banks.[4]
- 1 May 2026MyJPJSole login for the transport app.[5]
- End of 2026Target17 million registered accounts.[2]
In January 2026, ten of the 18 banks were integrating and two had completed technical onboarding, according to Biometric Update, which cites a Ministry of Finance reply to parliament.[4] The outcome of the second phase is not reported in the sources reviewed.
What the user sees
The operator describes three journeys. Inside an app with the MyDigital ID login option, the user enters their password. On a desktop portal, the user opens the MyDigital ID app, taps Scan QR, scans the code on the portal and enters the password. In a mobile browser, tapping the QR code opens the app, and after the password the user returns to the portal logged in.[1]
Log in
Use the digital identity you already have.
MyDigital ID
Use an ID document instead
1The user picks the MyDigital ID login option.[1]
Scan or tap the code
On a phone, tap the code to open the app.
2A QR code appears: scanned from a desktop, tapped on a phone.[1]
Approve the login
Password or biometric on your registered phone.
Approve
3The user approves in the MyDigital ID app with a password or, according to The Vibes, a fingerprint or face.[1][5]
You are logged in
Returned from the MyDigital ID app.
4The user lands back on the service, logged in.[1]
In the portal and mobile browser journeys the password is typed in the scheme's own app, not on your page.[1] Access is tied to the registered device, according to The Vibes.[5]
Registration happens once. The user installs the app, confirms an email with a one-time password, enters their name and identification number, photographs both sides of the MyKad, completes a facial scan and sets a password.[1] The alternative is a kiosk, with a MyKad or MyTentera (the armed forces card) and a phone with an internet connection.[1]
What a business receives from a MyDigital ID integration
The public record is weakest here. The operator's page promises businesses a secure, document-free registration process and stops there: no list of attributes or response formats appeared in the sources reviewed on 5 October 2026.[1]
| Item | What the sources say | Status for a business |
|---|---|---|
| Identity confirmation | The person was verified against the government database held by the NRD[1][2] | The core of the service |
| Name and MyKad number | Entered by the user at registration; the app takes the number without dashes[1] | Delivery to a business not published |
| Date of birth, address | Not mentioned in any source | Not published |
| Portrait or face image | A facial scan is used at registration; the operator says it stores no personal data[1] | Not published; do not plan on receiving it |
| Signature | The operator's page names a MyDigital ID Certificate that can be cancelled and renewed; it does not describe signing[1] | Format and legal effect not published |
Watch out
Get the attribute list, the identifier format and the response signature in writing from the operator before you remove a field from your sign-up form.
In a statement reported by Malay Mail, the operator said MyDigital ID verifies identities directly against the NRD database in real time, which gives financial institutions a higher level of assurance for account opening and digital transactions.[2] That is the operator's wording, not a published level.
Legal standing and AML customer due diligence
MyDigital ID is a government initiative, run by a company in cooperation with six public bodies.[1] The research for this guide found no dedicated digital identity statute, and the operator's page cites no law.
The same applies to anti-money laundering (AML) rules: no provision saying that a MyDigital ID login satisfies customer due diligence appears in the sources reviewed, so there is none to quote. What is documented is the process: MyDigital ID Sdn Bhd and Bank Negara Malaysia, the central bank, oversee the bank rollout, and regulators have said nationwide deployment follows only once institutions show operational readiness and compliance with strict security requirements, according to Biometric Update.[4]
Note
If you are a regulated firm, ask your supervisor in writing whether a MyDigital ID login counts towards customer identification for your licence.
MyDigital ID has no eIDAS level of assurance (LoA) and is unrelated to the EU Digital Identity (EUDI) Wallet that European businesses are preparing for.
How a MyDigital ID integration works for a business
Private companies are in scope: the operator addresses businesses on its own page, and on 12 February 2026 it signed memoranda of understanding with 15 banks and fintech companies to test and implement its verification in their onboarding and transaction systems, according to Malay Mail.[1][2]
What is missing is a public relying party (RP) rulebook. The sources reviewed contain no eligibility criteria, licensing model, certification scheme for intermediaries, onboarding lead time, test environment or fee schedule. Prices are not published. For a contrast, the Aadhaar eKYC guide shows what a published licensing model for private use looks like.
Route 1
Directly with the operator
- You contract with MyDigital ID Sdn Bhd
- Banks have gone through a supervised sandbox[4]
- Terms, lead time and fees: not published
The documented route so far
Route 2
Through a verification provider
- One contract for eID and documents
- No certified intermediary scheme is documented
- Ask to see its agreement with the operator
Verify before you rely on it
Route 3
Document route only
- Works with or without a MyKad
- Chip reading, liveness and face match
- Independent of the scheme's timetable
The fallback you need anyway
Use cases and sector rules
Malaysia plans to integrate 95 percent of public services with MyDigital ID by 2030, according to Biometric Update.[4]
| Sector | What is documented | Open point |
|---|---|---|
| Government | Sole login for the MyJPJ transport app from 1 May 2026; also used by the National Integrated Immigration System, MyBayar PDRM and myPTPTN, according to The Vibes[5] | None for private firms |
| Banks, e-wallets, fintech | Two sandbox phases and 15 memoranda covering onboarding and transaction verification[2][4] | The AML rule that accepts it |
| Telecom | SIM cards are required to be activated using MyDigital ID, according to Biometric Update[4] | The text of the telecom rule |
| Social media age checks | From 1 June 2026, under-16s cannot open new accounts and existing users confirm identity with official government documents, according to the South China Morning Post[6] | Whether MyDigital ID is an accepted method |
No gambling rule appears in the sources reviewed. A login can only prove age if the business receives a date of birth or an age result, and no source reviewed confirms that MyDigital ID returns either.
Limits and fallbacks
The gaps follow from how registration works.
| Customer | Can they use MyDigital ID | Why |
|---|---|---|
| Malaysian with a MyKad and a smartphone | Yes | The published online steps need both[1] |
| Armed forces member with a MyTentera | Yes, at a kiosk | The kiosk route accepts MyKad or MyTentera[1] |
| Foreigner or non-resident without a MyKad | No documented route | The steps name no other document[1] |
| Minor | Not stated | No minimum age in the sources reviewed |
| Person without a smartphone | No | Even kiosk registration needs a phone with internet[1] |
A change of phone is a gap too: the user cancels the certificate from another person's phone that has the app, or at a kiosk, then registers again.[1]
The sources reviewed contain no outage history and no service level, so agree one in your contract.
The fallback is a document check: a photo of the identity document or passport, a chip read over near-field communication (NFC) where the document has one, then liveness and a face match.
1Start the sign-up
Offer MyDigital ID and a document option on the same screen.
The customer has MyDigital ID on this phone
Approve in the app
Password or biometric on the registered device.
Verify with a document
Chip reading where present, liveness and face match.
2Screen and decide
Run AML screening, keep the evidence, apply your own policy.
Implementation checklist
- Ask the operator for its business onboarding terms, test environment and fees in writing.
- Get the attribute list, the identifier format and the response signature method before you design forms.
- Confirm with your regulator whether the login counts towards customer due diligence.
- Set your own retention: the operator says it keeps no personal data.[1]
- Add a document route for customers without a MyKad, a smartphone or an active certificate.
- Agree a service level in the contract.
How Didit helps
Didit adds MyDigital ID on request. Our eID verification workflow puts national eIDs and a document route in one flow.
In Malaysia today, the document route works: ID verification with NFC chip reading, liveness and face match, plus AML screening against 1,300+ sanctions, politically exposed person (PEP) and watch lists. A full KYC check (ID document, passive liveness, face match, device and IP analysis) is $0.33, NFC verification $0.15 and AML screening $0.20; see pricing. The docs show how eIDs and the document fallback are set per country.
Didit provides
- Document verification with NFC chip reading, liveness and face match
- AML screening and ongoing monitoring
- The evidence of every check, by webhook or API
Stays with you
- Your customer risk assessment and your policies
- The judgement that a method meets your regulator's rules
- The onboarding decision
Bring MyDigital ID to your onboarding
Start with the document route today.
Key takeaways
- Almost 10 million registered accounts on 12 February 2026, according to Malay Mail.
- No public attribute list, price list or onboarding rulebook appeared in the sources reviewed on 5 October 2026.
- Bank use is in a supervised sandbox, and no AML provision naming MyDigital ID was found.
- Registration needs a MyKad and a smartphone; everyone else needs a document route.
Frequently asked questions
Can a private company integrate MyDigital ID?
Private use is under way but not self-serve. The operator signed memoranda with 15 banks and fintech companies in February 2026, and 18 banks were in a sandbox, according to Malay Mail and Biometric Update. No public onboarding rules for other businesses appeared on 5 October 2026.[2][4]
How much does a MyDigital ID integration cost?
Prices are not published. No fee schedule for businesses appeared in the sources reviewed on 5 October 2026, so ask the operator for a written quote.
What data does a business receive from MyDigital ID?
The operator publishes no attribute list for businesses. Users register with their name and MyKad number, but which fields reach a business is not documented. Do not assume a date of birth, address or portrait.[1]
Can banks use MyDigital ID for account opening and AML checks?
Banks are testing it. Eighteen banks were in the second sandbox phase in January 2026, overseen by MyDigital ID Sdn Bhd and Bank Negara Malaysia, according to Biometric Update. No provision stating that it satisfies customer due diligence was found, so confirm with your supervisor.[4]
Can foreigners use MyDigital ID?
No route for them is documented. The published registration steps require a MyKad, or a MyTentera at a kiosk. Foreign customers need a document check instead.[1]
Can minors use MyDigital ID?
The sources reviewed state no minimum age. Until the operator confirms one, send users whose age matters to a document check.
What level of assurance does MyDigital ID have?
None under eIDAS, because it is not an EU scheme and is not EU-notified. The operator speaks of a higher level of assurance for financial institutions, according to Malay Mail, but publishes no formal level.[2]
How long does a MyDigital ID integration take, and can I test it?
No lead time or public test environment is documented. The only timing on record is the bank sandbox: the first phase ended in June 2025 and the second was scheduled to end in March 2026, according to Biometric Update.[4]
Is MyDigital ID mandatory?
For some government services, yes. Since 1 May 2026 it is the sole way to log in to the MyJPJ transport app, according to The Vibes. No source reviewed says private businesses must accept it.[5]
Sources
- MyDigital ID, official website (home page, registration steps and FAQ), MyDigital ID Sdn Bhd, read 6 October 2026.
- Malaysia's MyDigital ID surges to 10 million users, targets 17 million by end-2026 to fight online scams, Malay Mail (Bernama), 12 February 2026 (secondary source).
- Malaysia targets 17 million MyDigital IDs by end-2026, Biometric Update, 16 February 2026 (secondary source).
- Malaysia is testing MyDigital ID integration with 18 banks, Biometric Update, 27 January 2026 (secondary source).
- MyDigital ID becomes mandatory login for MyJPJ as nation expands national digital system, The Vibes, 30 April 2026 (secondary source).
- Malaysia bars under-16s from social media as new rules come into force, South China Morning Post, 1 June 2026 (secondary source).
For every scheme by country, start with eID schemes by country, and see how national eIDs and documents share one workflow on our eID verification page.
Verify customers in Malaysia today
Start with document and chip checks. Didit adds MyDigital ID on request.
Related articles
- Didit vs Unit21: KYC, KYB, AML and monitoring on one record
- Didit vs Trinsic: eID sign-in plus document checks, AML and KYB
- Didit vs Thomson Reuters: government databases plus the whole flow
- Didit vs Regula: hosted checks with full evidence, KYB and monitoring
- Top 10 AI compliance agents for KYC and AML review automation in 2026
- Top 5 Travel Rule compliance solutions for crypto businesses in 2026