When does corporate mismanagement end and criminal liability for CBT begin?

 Does an unauthorised financial transaction, breach of corporate procedures or failure of governance necessarily constitute CBT?

From Zander Lim

Recent criminal breach of trust (CBT) prosecutions involving corporate directors, senior executives and individuals entrusted with institutional funds have renewed attention to the distinction between corporate mismanagement and criminal liability.

Among these are recent prosecutions involving former executives of UiTM Holdings Sdn Bhd and companies associated with Lembaga Tabung Haji.

These cases raise an important legal question: Does an unauthorised financial transaction, breach of corporate procedures or failure of governance necessarily constitute CBT?

In 2026, several CBT prosecutions were reported, including those involving a former senior military officer in relation to RM3 million belonging to the Armed Forces welfare fund; two company directors involving RM10.55 million connected with a glove manufacturing venture; former executives of three companies concerning contractor penalty payments; and the former CEO of UiTM Holdings Sdn Bhd involving approximately RM37.37 million allocated for a solar photovoltaic project.

The accused persons have pleaded not guilty, and the allegations remain subject to judicial determination.

Although these prosecutions involve different transactions and circumstances, they raise important legal questions concerning entrustment, corporate authority and the element of dishonesty required to establish criminal breach of trust.

What is criminal breach of trust?

In simple terms, CBT occurs when a person entrusted with someone else’s money or property dishonestly misuses it.

Under Section 405 of the Penal Code, the prosecution must generally prove three matters:

(a) Entrustment: the accused was given responsibility for, or control over, the money or property.

(b) Misuse: the accused used or dealt with it in a manner prohibited by law.

(c) Dishonesty: the accused acted dishonestly, rather than merely making a mistake or exercising poor judgment.

Section 409 provides heavier punishment where CBT is committed by certain persons, including public servants and agents.

Importantly, not every unauthorised payment or breach of company procedures amounts to CBT. Dishonesty must still be established.

When does mismanagement become a criminal offence?

Companies may suffer financial losses arising from poor investment decisions, inadequate due diligence, improper approvals or failures in corporate governance.

However, a bad business decision is not necessarily a criminal offence.

For example, Illustration (d) to Section 405 recognises that a person who acts contrary to instructions but genuinely believes the decision would benefit the owner of the property may not have committed CBT, although civil liability may arise.

Conversely, Section 409A makes clear that recording a transaction in the company’s accounts does not automatically protect a person from criminal liability.

In other words, a transaction is not necessarily criminal merely because company procedures were breached, nor is it necessarily lawful simply because it was properly recorded or approved.

What matters is whether the money or property was dishonestly misused in circumstances falling within Section 405.

Corporate seniority

In corporate organisations, financial decisions often involve several levels of management, including directors, finance departments and authorised signatories.

Holding a senior position does not necessarily mean that an individual controlled every company transaction. Similarly, approving a payment does not automatically establish dishonest misappropriation.

In determining whether CBT has been committed, consideration must be given to the accused’s control over the funds, the purpose of the transaction, the scope of authority and whether the evidence establishes dishonest intention.

In cases involving abetment under Sections 107 and 109 of the Penal Code, criminal liability cannot be established merely because an individual occupied a supervisory position or participated in an approval process.

The prosecution must establish the relevant acts and legal requirements constituting abetment.

Criminal liability must be based on the individual’s actual conduct, not merely the position he or she held.

The recent CBT prosecutions highlight the importance of proper financial controls, clear approval procedures and accountability in corporate management.

Nevertheless, financial irregularities, breaches of internal policies and unsuccessful business decisions do not automatically amount to criminal wrongdoing.

Ultimately, the distinction between corporate mismanagement and CBT is not determined by the amount of money involved, the seniority of the accused or whether company procedures were breached.

It depends on whether the accused dishonestly misused money or property entrusted to him or her in a manner prohibited by law.

This distinction is essential to ensuring that genuine criminal misconduct is addressed without treating every failure of corporate governance as a criminal offence. - FMT

Zander Lim is an advocate solicitor and managing partner of Law Chambers of Zander Lim.

The views expressed are those of the writer and do not necessarily reflect those of MMKtT

Disclaimer: This article is intended solely for general legal commentary and does not constitute legal advice. It is also not intended as comment on the merits of any pending criminal case. All accused persons are presumed innocent unless and until proven guilty by a court of law.