Malaysia Company's First 90 Days: Recruitment, Payroll and Operational Launch Checklist

Start with this conclusion: 90 days is a launch window, not a single statutory deadline

Completing incorporation does not mean a company is ready to hire, pay salaries and operate consistently. Common breakpoints include unconfirmed premises; a candidate who has accepted an offer while payroll payments and employer registration are not ready; or incomplete payment authority even though the first pay date is written into the contract.

For that reason, the "90 days" in this article is an internal launch window for foreign founders and operations leads whose companies have been incorporated and are preparing to begin real business in Malaysia. It is not one legal deadline for every company obligation. For example, workplace notification in Peninsular Malaysia and Labuan has its own 90-day deadline; EIS has a 30-day registration rule for new employees entering employment in an already registered industry; CP22 applies only to new employees who are taxable or likely to be taxable; and CP204 for a new company is due within three months of the start of business. Their starting points and subjects differ. They cannot be combined into one "90-day statutory checklist" simply because they all arise in the first three months. Employment Act 1955, EIS Act 800, HASiL's new employee notification and HASiL's corporate-tax guidance each set out different triggers.

The goal is to establish an evidence chain from company identity, premises, role, contract, payments and employer registration to payroll receipts before the first employee begins providing services, then repeat it monthly with a fixed owner after day 90. If incorporation is not complete, read the guide to registering a Malaysian Sdn. Bhd. as a foreigner first; this article is not a substitute for the incorporation process.

Scope: a launch-control article, not a general guide to incorporation or employment law

This article puts the launch relationship between the company, tax, EPF, PERKESO/EIS and foreign-work authorisation on one control board, but it does not reach the same conclusion for every Malaysian region or personal status. Its main discussion of employment conditions, wage payment, employee registers and workplace notification is limited to Peninsular Malaysia and the Federal Territory of Labuan. JTKSM expressly states that Sabah and Sarawak continue to be governed by their own labour ordinances. JTKSM's official FAQ also cautions against copying Peninsular rules directly to East Malaysia.

This article also does not answer which role has the lowest pay, which recruitment website is fastest, or whether a particular foreign candidate will certainly be approved. Those are separate assessments. For further context, see the guides to recruitment channels and process, employment contracts and local and foreign workforce planning.

Build a launch control board first: owner, trigger, evidence and stop point

Most checklists say only "open an account, recruit, register, run payroll." They look complete but do not answer the more important question: if this task is unfinished, who is authorised to let an employee start, who must stop it, and what proves that it is complete?

This article recommends managing every launch item with the same small card. It can be used without a table. Each card has four fixed lines:

1. Owner: one directly accountable business role only, such as a director, operations lead, hiring lead, payroll lead or external professional-services contact. Several people can collaborate, but the card cannot say merely "the team."
2. Trigger: a factual event rather than a vague date, such as "the company begins business at this location," "a candidate accepts a conditional offer," "the first payroll month closes," or "employee numbers cross a review threshold."
3. Evidence: a file, system receipt or verified payment record that the next owner can open. Verbal confirmation, chat screenshots and "it should already have been submitted" do not count as completion.
4. Stop point: state what must not proceed without a named item, such as "do not set an actual start date without a signed contract and payment path," "do not let the candidate provide labour while the foreign-work route is unconfirmed," or "do not release funds where pay or employee identity does not match."

A control board keeps departments from assuming that someone else has handled the work, while preserving the distinct meaning of statutory deadlines, recommended cadence and approval dependencies.

Days 0–30: connect the company, premises, roles and payment path

The internal goal for these first 30 days is not to "finish every registration." It is to build the foundation that makes the first contract and first payment possible. If the company has not decided its actual operating location, business scope or first roles, filing registration or payroll data early without factual support will usually only create correction work later.

Governance, banking and payment readiness: establish the authorisation chain before deciding whether payment is possible

Company identity is not paperwork only for the company secretary or bank. Under the Companies Act 2016 published by SSM, a company must display its registered name and company number at its registered office, place of business and place where accounting records are kept, and disclose them on its website, invoices, receipts and other business documents. It must also keep notices, its constitution, registers, minutes and statutory documents at its registered office.

During days 0–30, this can become a "company identity and payment authority card." The owner is usually a director or operations lead with written authority. The trigger is a need to enter commitments concerning premises, recruitment, suppliers or payroll. Evidence includes incorporation documents, consistent use of the statutory name and number, a record of signing authority, payment-approval levels, payee-verification rules and a tested payment path.

The stop point is practical: without written authority, monetary limits and a second-person review rule, do not treat a founder's personal account, third-party account or verbal instruction as the company payment process. Bank KYC requirements and timing vary by case. This article lists only the ability to pay wages and statutory contributions on time as a precondition to the recruitment start date. PERKESO's payment guidance also shows that FPX requires a usable internet-banking account, while direct debit requires completion of an e-mandate in ASSIST. Payment channels and authority therefore cannot wait to be tested until the first statutory contribution due date. PERKESO Contribution Payment

Registered office, operating location and workplace: three address cards cannot replace one another

A registered office addresses statutory communications and where company records are kept. An actual operating location answers where employees, customers, equipment and daily delivery are based. A workplace can trigger factual questions under labour law, local licensing, lease terms and permitted use. The three may be the same place, or they may not, but an existing registered office does not establish that a coworking space, virtual office or client site can be used as the actual workplace. For a more detailed assessment of addresses, coworking and real business activity, see the guide to registered offices and operating locations.

In Peninsular Malaysia and Labuan, where an enterprise starts, takes over or relocates a business at a place of employment where employees are or may be employed, section 63A of the Employment Act 1955 requires written notice to the Labour Department for the area with jurisdiction. Its 90-day clock does not simply run from the day a founder considers the business "officially open." It runs from the legally defined date the business starts or begins, including the earlier of the company's registration under written law and the date on which its first employee is hired for the business. Official statutory text

The address card should therefore state the registered office, actual workplace, actual business activity, lease or membership terms, permitted use, location owner and date of change. Its stop point is: if you do not know where employees actually provide services, or have not checked whether the location may host that activity, do not mark "an address exists" as "operational premises are ready."

First roles and recruitment: define who may start, and when

The outcome of first-month recruitment is not a pile of résumés. It is a role card for every position: delivery outcomes, direct owner, location or remote arrangement, budget source, target start date and whether a foreign-work route may be involved.

This lets the hiring lead ask four questions before posting a role, appointing a recruiter or arranging interviews: does the role really need to be filled first? Who owns approval and performance for it? What information must be available after the candidate accepts an offer before they enter payroll master data? If the candidate is foreign, has the applicable route been confirmed rather than inferred from a passport or personal connection?

Treat "candidate accepts an offer" as a conditional trigger event, not the same as "may work." On the control board, the hiring lead may advance screening and negotiations; the start date is released jointly by the operations, payroll and work-authorisation cards. A role with no budget, owner, location or work-authorisation assessment should be paused before posting. That is easier to correct than an offer that cannot later be honoured.

Employment contract, employee master data and foreign-work authorisation: an offer cannot substitute for approval

In Peninsular Malaysia and Labuan, an employment contract for more than one month must be in writing and state the method of termination. It must also specify a wage period of no more than one month. Wages generally must be paid to a financial-institution account in the employee's name; payment in cash or by cheque involves an exception procedure requiring the employee's written request and approval from the relevant authority. Employment Act 1955 provisions on contracts, wage periods and payment method explain why "start work first, then make up the contract and bank account at month-end" is not a sound launch method.

The employee master-data card should complete a factual check before the actual start date: name and identity evidence, start date, role and reporting line, contractual pay components, payroll period, material required for lawful deductions, employee payment account, work location and applicable arrangements. This does not mean collecting as many passports or personal details as possible. Collect only what is needed for this employment, payroll, statutory registration and lawful payment, and limit who can view it.

Open a separate "work-authorisation route card" for foreign personnel. In Peninsular Malaysia and Labuan, the Employment Act 1955 requires an employer to obtain the Director General's prior approval before employing a foreign employee. ESD's Employment Pass page explains that the relevant authority must first approve the position, that an EP permits its holder to work only for the company named on the pass, and that the pass is valid only in Peninsular Malaysia. JTKSM statutory text and the ESD Employment Pass guidance do not replace one another. ESD also states that a company must complete ESD registration before it can apply for a relevant pass for a proposed expatriate. MYXpats FAQ

State the stop point directly: passing an interview, signing an offer or the company submitting an application does not automatically give a candidate the right to work for that company. Where the route is unclear, the location is unsuitable, company eligibility is unconfirmed or authority approval is incomplete, continue candidate communication and document preparation but do not arrange for the person to begin providing labour. The pass category, quota, advertising, salary, dependant arrangements and sector conditions in any individual case should be reviewed against the authority's requirements on the day and by a qualified professional.

Days 31–60: make first payroll and employer registrations reviewable

The internal goal of the second stage is to complete the first loop from employee facts to receipts. It does not require a company to run payroll on day 31 merely to keep up with the plan. If recruitment is incomplete, the control board should truthfully show that it is waiting for recruitment or work authorisation, rather than pretend it has reached payroll. The real point is that once employment begins, the different legal clocks for registration and payroll do not pause because the company is still launching.

First employer registrations: put EPF, PERKESO/EIS and HASiL on the same employee facts

EPF requires employers to register within seven days from the date they employ an employee. Its employer-registration page also lists SSM company documents and the employer reference number among the registration material. KWSP Employer Registration PERKESO states that employers in applicable industries with one or more employees have registration and contribution duties, and can submit employer and employee details and supporting documents through ASSIST. PERKESO Employer Registration

The EIS arrangement is not identical to "day seven." Section 16 of Act 800 provides that a new employee entering employment after the industry has been registered must be registered and insured within 30 days after entering employment. The provision also leaves its specific scope and wage treatment to the statutory framework. Employment Insurance System Act 2017 The control board should therefore record the "actual employment start date," "EPF employer-registration date" and "PERKESO/EIS information-submission date" separately, rather than write "social security done" in one box.

Tax must likewise be separated by its applicable conditions. HASiL requires employers to register an employer tax number, deduct PCB/MTD under the rules and pay it by or before the fifteenth of the following month. It also requires records to be retained for seven years. HASiL employer responsibilities Correspondingly, CP22 applies only to new employees who are taxable or likely to be taxable and must be submitted through e-CP22 within 30 days after employment starts. It is not a form to apply indiscriminately to every new hire. HASiL new employee notification

The owner of this card should be the payroll or tax-and-finance contact. Evidence should include employer reference information for each institution, employee registration outcomes, submission dates, missing material, owners and receipt locations. The stop point is: where an employee's name, identity number, start date, wage or employer name differs in any system, do not keep copying the next set of data into the other systems. Identify the source, correct it once and retain a correction record.

First payroll: run it dry before payment and submission

The greatest risk in a first payroll is "the total is right but the fields are wrong." Before an actual payment, perform one internal gross-to-net dry run using the confirmed start date, contractual pay, payroll period, variables, deductions, employer amounts, payment account and institution numbers.

The dry run has three review layers: people (whether contract, identity, start date, role, location and account come from the same approved material); amounts (whether wages, deductions, employer amounts and net pay are calculated under that month's rules); and submission evidence (which payroll month the approver, payment time and Form A/ASSIST/tax data correspond to).

For timing, EPF says contributions must be paid by or before the fifteenth of the following wage month and requires the employer to submit the corresponding information and payment. PERKESO also provides that contributions for a month are due no later than the fifteenth of the following month. HASiL sets the same by-or-before-fifteenth-of-the-following-month point for PCB/MTD. KWSP Contribution Payment Channels, PERKESO Contribution Payment and HASiL employer responsibilities support these adjacent, but not wholly identical, control points. Do not infer that every agency's correction, weekend, public-holiday or exception rule is the same; check each submission against that agency's current guidance.

The stop point for days 31–60 is this: where the three review layers are incomplete, usable payment authority is absent, employee information does not match the contract, or any registration exception has no assigned owner, do not close the month by saying "pay it first and sort it out later." Timely payment matters to employees; the ability to explain amounts and filing records matters to the company too.

Days 61–90: turn one-off launch work into repeatable monthly operations

Once the third stage begins, the focus shifts from "bringing the first employee into the system" to "not having to find every fact again next month." A mature launch state does not mean every risk has vanished. It means each unresolved risk has an owner, next step, time label and escalation condition.

Corporate tax, workforce growth and records: put later triggers on the calendar early

If the company has started business, its tax calendar cannot wait until year-end. HASiL's corporate-tax page places estimated-tax submission under CP204 for a new company within three months from the start of business, and distinguishes subsequent payments, accounting periods and filing points from the "incorporation date." HASiL corporate-tax guidance The control board should therefore record the actual start-of-business date, financial period, responsible director or tax-and-finance contact, source material and next review date. Do not mechanically treat the incorporation date as the common start of every tax clock.

Workforce size can also change later assessments. HRD Corp's employer FAQ states that a company whose business nature is covered by the PSMB Act and which has more than 10 Malaysian employees needs to deal with Form 1. The FAQ also emphasises that HRD Corp, rather than the employer, decides whether the Act applies. HRD Corp Employers FAQ In practice, the company can set internal reviews at the fifth employee, when approaching the tenth and before crossing the threshold. Those three dates are recommended cadence, however, not a legal conclusion that headcount replaces the applicability test.

Records and review: use an evidence chain instead of "it should already be done"

The launch phase should build a minimal records repository rather than scatter employee IDs, contracts, bank information and government receipts across chat applications. For employment records in Peninsular Malaysia and Labuan, the Employment Act 1955 requires the employee register to be kept for at least six years. HASiL's employer and company pages both require relevant records to be kept for seven years. PERKESO's employer-registration guidance also requires monthly employee information to be retained for seven years from the last entry. Employment Act 1955, HASiL employer responsibilities and PERKESO Employer Registration show these different retention baselines.

The company's internal practice can use seven years as the minimum calendar baseline, with an exception field for "a longer period applies/professional confirmation pending." This is only to cover the different minimum rules above. It does not mean every record need be retained for only seven years, nor does it replace longer requirements under data protection, disputes, sector rules or contracts. In terms of access, hiring leads do not need to see complete payroll records, and routine operations do not need identity information beyond what the work requires.

During days 61–90, schedule a director or operations review that opens the evidence links on the control board one by one and confirms: whether the first payroll can be traced from contract to payment and agency receipts; whether any employee-data conflict remains open; whether the actual location matches registrations, lease terms and business activity; whether foreign roles remain at the correct approval state; and who owns the next tax, contribution and headcount reviews. If any answer is "someone should know," the gate cannot close.

Four time labels: statutory deadline, recommended cadence, dependency and verification item

Every item placed in days 0–30, 31–60 or 61–90 needs a time label. Without one, a team can mistake project-management cadence for regulation. Use only these four labels on the control board:

• Statutory deadline: the source expressly states the subject, starting event and period, such as EPF employer registration, EIS new-employee registration, CP22, workplace notification, each institution's monthly contribution, or CP204 for a new company. Record the specific law or official page, actual start date and owner.
• Recommended internal cadence: a risk-reduction schedule set by the company, such as testing payment authority on day 7, reviewing role cards on day 15, carrying out the first payroll dry run on day 45, or reviewing exceptions on day 75. It may be brought forward, moved back or cancelled, but the reason must be recorded.
• Dependency: a fact with no fixed number of days that nevertheless blocks the next step, such as bank KYC, operating-location permission, an employee payment account, foreign-pass approval or group funding being available. Do not record "waiting" as complete.
• Verification item: where information is insufficient, the applicable regime is uncertain or multiple regions are involved, list the question, owner and latest review date first. It is not a failure, but neither is it a releasable state.

These four labels let the team observe real deadlines without creating a false promise that everything will be complete before day 90. Particularly where foreign employment, special business permits, cross-state operations, director remuneration, EOR arrangements or complex tax residence are involved, the stop point takes priority over keeping to schedule.

Day-90 review: mark only retrievable actions as complete

Day 90 does not require a long meeting. A short, strict acceptance using the control board is enough: open the evidence for every card; give every unfinished item a next step and owner; confirm that the start date for every statutory point has not been entered incorrectly; and retain an escalation route for every work-authorisation, premises, payroll or tax exception.

The results can be divided into three groups. Operating steadily: at least one payroll cycle, the corresponding submissions and records have been fully read back, and the next owner and date are set. Established but awaiting a trigger: for example, recruitment has not started, headcount has not reached a threshold or a foreign-work route has not begun; retain the trigger condition. Blocked or requiring professional review: for example, the actual workplace does not match the documents, payment authority is incomplete, the contractual relationship is unclear, the pass route is uncertain or a correction has no receipt. These items must remain on the control board; they cannot close automatically because the company has been incorporated.

MANPRPOWER LIMITED can help organise company documents, role information, launch checklists and the interfaces with professional services into a handover-ready control board, and flag questions that need confirmation from company-secretarial, tax, employment, immigration or premises professionals. Whether an employment relationship exists, which tax or contribution applies, whether a location meets permit requirements, whether a foreign person may work for a specified company, and any individual contract or approval outcome should be reviewed by qualified professionals on the facts applicable on the day of submission.

Summary: before real operations begin, make one evidence chain work

A newly incorporated Malaysian company does not need to solve every future growth question by day 90. It does need to show that it has not treated recruitment, payroll, premises and work authorisation as unrelated temporary tasks. Start by using one launch control board to connect the owner, trigger, evidence and stop point. Then run it by the actual start of business, actual employment and actual payroll month, so the first quarter becomes a reviewable operating start rather than the start of the next remediation.