How to hire employees in Malaysia

Hiring an employee in Malaysia means either setting up a Malaysian entity and running payroll with the required contributions and deductions, or engaging an employer of record (EOR) that employs the person for you and, for foreign hires, sponsors the work pass. The first is the right foundation once you plan to build a team there; the second gets a first hire working, and handles immigration, without a local company. Capstan does not offer EOR services, so if that is the route you need, engage a provider directly.

Malaysia is administratively organised around a handful of named statutory schemes, and a few of them (EPF, SOCSO, EIS, and the monthly tax deduction) catch founders out because they stack together. This guide is a conceptual map, not a rate card. Rates, ceilings, and rules change, so confirm current figures with Malaysian counsel or a Malaysian payroll provider before you rely on them. This is not legal advice.

Entity or employer of record

If you incorporate in Malaysia and register with the relevant authorities, you employ the person directly, make the EPF, SOCSO, and EIS contributions and the tax deductions, and sponsor any work passes yourself. That is worth doing once you intend to hire several people or stay for the long run.

If you are not ready for that, an EOR employs the person under its own Malaysian entity, handles payroll and contributions, and sponsors work passes for foreign hires. You direct the work; they hold the employment. It costs more per head and gives you less control, and it is a practical bridge for a first hire, especially where immigration is involved. In both cases the person is an employee, not a contractor.

EPF, SOCSO, EIS, and the monthly tax deduction

Every Malaysian payroll run applies a stack of contributions and a tax deduction that fit the specific employee. You do not need to master the maths, but you should recognise the pieces, because they are separate schemes with separate rules.

EPF. The Employees Provident Fund is the mandatory retirement savings scheme, funded by employer and employee contributions. It is the largest of the statutory lines and the one most people know by name.

SOCSO and EIS. The Social Security Organisation provides cover for workplace injury and invalidity, and the Employment Insurance System supports employees who lose their jobs. Both are funded by contributions and sit alongside EPF rather than inside it.

The monthly tax deduction (PCB). Income tax is withheld from wages at source through the monthly tax deduction and remitted to the tax authority, with reconciliation at year end. How much is withheld depends on the employee’s circumstances and reliefs.

The pattern is several named schemes that stack, with eligibility and rates that depend on the person. That is why the calculation belongs with a provider who tracks it, and why this guide gives you none of the numbers.

Contracts, notice, and leave

Written employment contracts are standard and expected in Malaysia. The Employment Act sets baseline protections, and its coverage has been broadened in recent years, so more employees fall within it than founders sometimes assume. It touches working hours, leave entitlements, notice, and termination. Notice periods are typically defined in the contract within legal norms, and probation is a widely used convention for assessing fit. Confirm what the Employment Act covers for your specific hire, and how notice, leave, and probation should be framed, with Malaysian counsel.

Data protection: the PDPA

Employee and personal data in Malaysia falls under the Personal Data Protection Act, which governs how organisations process personal data in commercial transactions, with obligations around consent, purpose, security, and retention, and which has been amended in recent years. Keep employee data in one controlled place with proper access limits rather than scattered across drives and chats. Our note on HR data security and compliance covers practices that hold up under regimes like the PDPA.

The contractor line

Malaysia, like everywhere, distinguishes genuine contractors from employees, and getting it wrong can bring back contributions and other liabilities. A real contractor runs an independent business with autonomy over how the work is done; someone integrated into your team, working under your direction on your schedule, looks like an employee whatever the contract says. If you are unsure, read contractor versus employee and take local advice before you commit.

Where Capstan fits

Capstan does not run Malaysian payroll and is not an employer of record. It holds no EPF, SOCSO, EIS, or tax tables and files nothing with any authority. What it does is be the system of inputs around the calculation: employee records, pay structures, joiners and leavers, leave, attendance, and adjustments, compiled into a documented export for your Malaysian payroll provider. Their computed results come back onto the employee record, so your record and their submissions agree. Contractors live in the same workspace as your team, and the contractor module adds their portal, invoices and payout register on top; like every module it is already included on every plan, the free one included.

Public holidays. An administrator can import a bundled set of Malaysian public holidays for a year in one click and then edit it, because a bundled set is a starting point rather than an authority. The calendar also carries the working week it runs on, and holidays are typed as public or restricted, where a restricted holiday is optional and the calendar caps how many an employee may pick. Calendars are assigned to locations, and an employment inherits its calendar through its location.

Jurisdiction rules are data, not code. Nothing in Capstan hardcodes a country. Contractor tax content is a country pack your workspace configures per jurisdiction, which is what lets you update a rate yourself instead of waiting on a software release. You fill in each country’s contractor withholding, tax lines and document requirements yourself: a draft pack appears the moment you add a contractor in that jurisdiction, and you activate it once the values are ready. It covers contractor invoicing, not employee payroll. For Malaysia, the tax treatment comes from you and your provider.

Where the workspace runs. Capstan runs from one self-contained EU region, with data resident in Frankfurt and compute in Amsterdam, and a market it serves is served from there rather than from a separate local deployment. Sign-in is passwordless. Your Malaysian payroll provider does the Malaysia-specific work; Capstan holds the record it feeds from.

The payroll export is the same shape everywhere. It carries day counts, the compensation components in force at period end, and joiner or exit prorations recorded as dates and payable days rather than prorated amounts. There is no Malaysian branch in it, because there is no country logic in it at all. Your provider supplies the country; Capstan supplies clean, documented inputs and files the computed results back onto the record.

Where to go next

If your Malaysian hire is part of a cross-border team, the guide to hiring global contractors covers the wider structures, and the country notes for Singapore, Indonesia and the Philippines follow the same shape. For the current EPF, SOCSO, EIS, and tax rates this guide has left out on purpose, speak to a Malaysian payroll provider or employment lawyer. The structure is what carries over; the numbers you confirm each year.