Importing, supplying, or using an unregistered medical device in Malaysia is an offence under the Medical Device Act 2012 (Act 737). Penalties can reach RM 200,000 in fines and up to 3 years in prison per offence. MDA has been actively sending enforcement letters to companies caught on the wrong side of this.
Over the past year, a growing number of businesses in Malaysia have received enforcement notices from MDA after being found importing or using medical devices that were not registered under Act 737. Some had been doing it for years without realising it was an issue. Others made a procurement decision without checking registration status first. In both situations, the consequences are serious, and the path forward requires prompt action.
This post covers what the law actually requires, the penalties that apply when it is not followed, and the practical steps to take if an MDA enforcement letter has already arrived.
- All medical devices intended for commercial sale, importation, or use in Malaysia are required to be registered with the MDA, without exception, regardless of approval status anywhere else in the world.
- The penalties under Act 737 are criminal in nature, carrying fines of up to RM 200,000 and up to 3 years imprisonment and a further RM 1,000 for each day that the offence persists after conviction.
- An MDA enforcement letter is a legal document requiring a written reply and a plan of remedial action within a certain period of time.
- Company directors and officers may be prosecuted personally if they were aware of and/or permitted the violation.
- The most important thing you can do at this moment is to cease distribution of the identified product, conduct a comprehensive review of your entire product line, and hire a regulatory expert.
What the Medical Device Act 2012 Actually Requires
The Medical Device Act 2012 (Act 737) is the regulatory framework for everything regarding medical devices in Malaysia, from the production or importation right down to the distribution and use of such products. Under this Act, every single medical device that comes into the Malaysian market has to be registered with MDA prior to its entry into Malaysia. Period.
No exceptions can be made regardless of which party the company belongs to in the supply chain. Whether you import, distribute or use any medical device commercially, whether you manufacture the device yourself or not, even if you are using the device for so many years without any one telling you off, and regardless of the CE or FDA approval, you need to register the device with MDA prior to its use in Malaysia.
What Are the Actual Penalties?
That is when things really start to get shocking. The penalties under Act 737 are not simple administrative fines to be paid off. These penalties constitute a criminal offence under the Act itself. Section 5(2) states that any person who contravenes the registration requirement commits an offence and shall, on conviction, be liable to a fine not exceeding RM 200,000 or to imprisonment for a term not exceeding three years or to both. Section 15(2) carries the same penalty for operating without an Establishment Licence. Your company faces criminal liability, and so do the individual directors and officers who allowed this to happen.
Per offence, for importing, exporting or placing an unregistered medical device in the market under Section 5 of Act 737.
Custodial sentence applicable alongside or instead of the fine, at the court's discretion, under Section 5(2) and Section 15(2).
Daily fine for each day the offence continues after the date of first conviction.
Individuals who consent to or permit the breach can be prosecuted alongside the company.
| Offence | Act 737 Reference | Maximum Penalty | Risk Level |
|---|---|---|---|
| Importing, exporting or placing an unregistered medical device in the market | Section 5(1) | Fine RM 200,000 and/or 3 years' imprisonment | Criminal |
| Operating as an establishment without a valid Establishment Licence | Section 15(1) | Fine RM 200,000 and/or 3 years' imprisonment | Criminal |
| Acting as LAR without a valid Establishment Licence | Section 15(1) | Fine RM 200,000 and/or 3 years' imprisonment | Criminal |
| Failure to comply with MDA recall or stop-supply notice | Section 48 | Fine RM 200,000 and/or 3 years' imprisonment | Criminal |
| Continuing offence after conviction | Section 60 | RM 1,000 per day for each day the offence continues | Daily Fine |
| Director / officer personal liability | Section 55 | Same as the principal offence if consent or neglect is proven | Personal |
So Your Company Has Received a Letter From MDA. What Now?
The first thing to understand is that an MDA enforcement letter is not a routine reminder. It is a formal legal notice that your company has been found in breach of Act 737. The letter will typically include the name and registration status of the specific device in question, the section of the Act that has been violated, a reference to the inspection or import records that triggered the notice, and a deadline to respond in writing with a corrective action plan. That deadline is usually 14 days, though in some cases MDA may allow up to 30 days depending on the nature of the breach.
After your written response is received, MDA may conduct a follow-up inspection at your premises to verify that the corrective actions you described have actually been carried out. This is not a formality. Officers will check whether the flagged device has been pulled from stock, whether supply has ceased, and whether any registration or licence applications have been initiated. What you commit to in writing, MDA will hold you to.
If MDA is not satisfied with the response, or no response is submitted at all, the matter can escalate through several stages. MDA may issue a compound offer, which is an out-of-court settlement that allows the company to pay a negotiated fine without going to trial. Accepting a compound does not eliminate the offence from the record, but it closes the matter faster and avoids prosecution. If the compound is refused or the breach is considered serious enough, MDA may refer the case to the Attorney General's Chambers for prosecution under Act 737. At that point, the criminal penalties described above become the reality your company is facing.
The worst thing you can do is nothing. Ignoring the letter, or sending a vague response without taking real action, does not make the issue go away. It creates a paper trail showing MDA you did not cooperate, which will be used against you if the matter escalates. Think of the letter as the opening of a process, not the closing of one.
How Do Companies End Up in This Situation?
Most companies that receive enforcement letters are not deliberate offenders. They are businesses that made assumptions, missed a renewal, or simply did not know the full scope of the requirements. These are the situations that come up most often.
-
Buying directly from overseas and assuming overseas approval is enough
CE marking, FDA clearance, and ISO certification are all credible international marks, but none of them count as MDA registration in Malaysia. A common assumption is that if a device is approved overseas, it is fine to bring in. It is not. Every device needs its own MDA registration number before it legally enters the Malaysian market.
-
Using a registered device for a purpose its registration does not cover
An MDA registration is tied to a specific device, a specific intended use, and specific models. Using a registered device for a clinical application that falls outside its certificate is treated as using an unregistered device for that purpose. This catches many companies off guard, particularly in clinical environments where device usage evolves over time.
-
Not realising the registration has expired
MDA registration certificates are valid for five years and do not renew automatically. From the day a certificate lapses, the device is legally unregistered. Businesses have continued importing and selling for months past the expiry date simply because no one was tracking renewal deadlines, and a routine audit is all it takes to surface this.
-
Operating without an MDA Establishment Licence
Any entity that imports or distributes medical devices in Malaysia must hold a valid MDA Establishment Licence and active GDPMD certification. Operating without both is a separate offence under Act 737, independent of whether the devices themselves are registered. MDA often identifies this issue alongside registration problems during an enforcement review.
-
Importing without a per-shipment ePermit (effective 2 January 2026)
Since 2 January 2026, every import or export shipment of a registered medical device requires its own ePermit through MeDC@St. Companies that have continued using older customs processes without applying for a per-shipment permit are in breach of this requirement, even if their device registration is fully current. This has caught a number of businesses off guard since the rule came into effect.
Your Step-by-Step Response Plan
-
Respond before the deadline, not after
The letter will give you a response window, usually 14 to 30 days. Do not let it pass. If you need more time to pull together an accurate response, write to MDA and ask for an extension before the deadline. Asking after it expires is a much harder conversation. What matters right now is showing MDA you are engaged, not avoiding them.
-
Stop distributing the flagged device right now
While the matter is open, cease all supply and import of the device named in the letter. Every additional unit that moves through your supply chain while you are under enforcement review is a new offence. It also makes any argument of good faith cooperation fall flat. Stop first, sort it second.
-
Audit your entire device portfolio, not just the one in the letter
MDA enforcement letters tend to name one device, but the problem is rarely just one device. Take this as the moment to check every product you import or distribute against the Malaysia Medical Device Register (MMDR). Flag anything that has expired, anything coming up for renewal in the next six months, and anything that was never registered to begin with. Better you find it now than MDA finds it next.
-
Get a regulatory specialist on the phone today
Every medical device registration in Malaysia must go through a licensed Local Authorised Representative (LAR). If your device does not already have one appointed, this is the first thing to resolve before registration can even begin. Beyond the LAR, a regulatory specialist who has dealt with MDA enforcement cases will know exactly what the response letter needs to say, what level of corrective detail MDA expects, and how to present your compliance timeline in a way that holds up to scrutiny. This is not the time to draft a response based on guesswork.
-
Submit a corrective action plan, not just an apology
Your reply to MDA is expected to contain more than an acknowledgment of the problem. You should present actions taken to resolve the situation, people involved and a realistic time frame. MDA team will assess the credibility of your plan. Therefore, a detailed action plan submitted in time will be of more value than a generic "we are working on it" sent in a delay.
Received an MDA Letter? TT Medical Can Help.
TT Medical Management supports medical device companies in Malaysia through every stage of regulatory compliance, from device registration and LAR appointment to responding to MDA enforcement action. Whether an enforcement letter has already arrived or a proactive portfolio audit is the goal, the team can assess the situation and map out a clear path forward.
Get in touch to discuss the situation. TT Medical will provide an honest assessment of what needs to be done and the most practical route to compliance.
Speak to Our Compliance TeamFrequently Asked Questions
Can a company be prosecuted even if it did not know the device was unregistered?
Yes. Act 737 does not require MDA to prove that a company knowingly broke the law. The responsibility to verify registration status rests with the importer and distributor. Not knowing about the requirement is not a legal defence, though a court may take it into account when determining the penalty.
This is why checking the Malaysia Medical Device Register before any procurement decision is important. Verifying registration status takes only a few minutes and should be a standard step before any medical device order is placed.
Does CE marking or FDA approval count as registration in Malaysia?
No. CE marking demonstrates compliance with EU requirements. FDA clearance or approval demonstrates compliance with US requirements. Neither carries any legal recognition in Malaysia. Every device must be separately registered with MDA under Act 737, regardless of what international approvals it holds.
That said, existing CE or FDA approval can support a faster registration pathway through CAB conformity assessment. It helps the process, but it does not replace MDA registration.
Can a foreign manufacturer register directly with MDA?
No. MDA does not accept applications directly from foreign manufacturers. All registrations in Malaysia must be submitted through a licensed Local Authorised Representative (LAR), which must be a Malaysian entity holding a valid MDA Establishment Licence and GDPMD certification. Foreign manufacturers cannot create a MeDC@St account without one. Appointing a suitable LAR is the first step for any foreign manufacturer seeking to enter the Malaysian market.
How long does registration take after receiving an MDA enforcement letter?
It depends on the device class. Class A devices can typically be registered in six to nine months with a well-prepared dossier. Class B, C, and D devices require CAB conformity assessment first, and the full process generally takes 12 to 18 months. Full registration will not be completed before the response deadline, but that is not what MDA requires at this stage.
What MDA looks for is evidence of genuine corrective action: that the device has been pulled from circulation, a LAR has been appointed, and the registration process has been initiated. Companies that demonstrate this clearly are in a significantly stronger position than those that have taken no steps at all.
How do I check if a device is registered with MDA?
Through the Malaysia Medical Device Register (MMDR), MDA's publicly searchable database of all currently registered devices. It can be searched by device name, registration number, manufacturer, or product category. If a device does not appear in the MMDR, or its registration shows as expired or cancelled, it should not be in circulation until the issue is resolved. Checking the MMDR before procurement is the simplest way to confirm compliance upfront.
