AI and business
AI Debt Collection in Malaysia: Building SKP Conduct Controls Into Your AI Calling
Debt collection agencies fall under SKP’s Conduct Standards. Here are the controls, design choices and honest limits to weigh before using AI voice agents for collection calls.
AI voice agents can support debt collection calls in Malaysia, but only inside the fair-conduct framework that Suruhanjaya Kredit Pengguna (SKP) applies to debt collection agencies. SKP’s Conduct Standards, issued under the Consumer Credit Act 2025, set out mandatory requirements and regulatory guidance, and include clear prohibitions against misleading, deceptive, exploitative or harassing conduct. An AI dialer does not change that. It becomes one more part of your collection process that must meet the same standard.
This guide covers why the rules matter now, the controls an AI calling setup should enforce, the design choices behind good controls, the honest limits, and how to put it to work.
Why now: debt collection is under SKP’s Conduct Standards
SKP is the competent authority established under the Consumer Credit Act 2025 (CCA). Its Conduct Standards apply to authorised non-bank credit providers and credit service providers. Debt collection agencies and impaired loan buyers are named explicitly, alongside BNPL, leasing and factoring companies and debt counselling and management agencies.
Debt collection is a named conduct area. It sits next to other areas that shape every collection call:
- Prohibited business conduct
- Financial hardship assistance
- Complaints handling
- Representative competency
- Consumer data protection
The Standards are enforceable and supported by significant penalties under the CCA. A script that pressures a consumer or misstates what happens next is a conduct problem, whether a person or a machine delivers it.
Accountability sits at the top. Boards and senior management must embed fair consumer outcomes into corporate culture, oversee governance and ensure misconduct is promptly investigated and remediated. Adopting an AI calling tool is therefore a governance decision. Your leadership will need to show how it supports fair outcomes, not just how many calls it places.
The rollout is phased. In Phase I (2026 to 2027), existing regulators such as BNM, SC, SKM, KPDN and KPKT continue to supervise their own sectors, while SKP oversees credit providers and credit service providers not currently regulated by any authority. Confirm which authority covers your entity before designing your collection process.
Saloma AI offers AI voice agents for phone calls, with planned reminders and callbacks, call workflows that update customer records, and human handoff where approved staff can listen to AI calls live and take over from their browser. In collections, that handoff matters: hardship requests, disputes and complaints need a trained person.
What it enforces: the compliance controls to look for
The prohibition on harassing and exploitative conduct has to become concrete rules the system follows on every call. When you assess any AI calling platform for compliance, look for these controls.
- Calling windows. Calls go out only during permitted hours, measured in the consumer’s local time rather than your office’s.
- Contact frequency. Attempts are capped and spaced so repeated calling cannot become pressure.
- Per-consumer counting. Limits are counted per consumer across all campaigns, not per campaign. Otherwise splitting work into separate campaigns could expose a consumer to far more calls than any single campaign shows.
- End-of-window handling. New attempts should not start just as the permitted window closes.
Stopping conduct
- A settled account, a regularised account or a consumer accepted into a debt resolution plan should cancel queued calls immediately.
- Opt-out, wrong-party and number-specific do-not-call requests should take effect so the person is not called again.
- A calling window confirmed with the consumer may replace the default window, but should never raise the contact limits.
Records and notice
- Every attempt should leave a reviewable trail, kept separately from recordings and transcripts. Your complaints team and senior management need it to investigate concerns and fix misconduct.
- Where your process requires written notice before recovery action, the system should record the notice date, channel and evidence for each contact. Recording a notice is not the same as sending or verifying it; that remains your process.
- How long records are kept is a decision for your legal team, not a vendor default.
Design choices worth telling
How controls are built matters as much as what they cover. These are the design choices to ask about.
- Enforcement at the dialer. Rules should block calls where they are placed, not only warn users in the interface. A warning can be ignored; a blocked dial cannot.
- Fail closed. If the consumer’s time zone is unknown or identity evidence is missing, the call should not go out. A skipped call can be rescheduled. A harassing one cannot be undone.
- Versioned rule packs. Rules grouped into versioned packs make changes traceable and allow other jurisdictions’ rules to be added without rewriting the system.
- Shared across the legal entity. Counts should apply across the whole entity so grouping teams or campaigns cannot dodge limits.
- Evidence by reference. Storing an evidence ID and digest rather than the document reduces the personal data the calling system holds, which supports consumer data protection.
- Split roles. Platform administrators assign rules, tenant administrators view them, and managers confirm changes only for their own agents. This limits who can alter calling behaviour.
Do not rely on a feature list. Ask any vendor, including Saloma, to demonstrate these controls in your own setup, with your time zones, campaigns and roles. Then have your compliance or legal team map each control against the actual provisions of the Conduct Standards, particularly those on notice, records, calling windows and contact limits, and stopping contact on settlement.
Honest limits
Controls help; they do not establish legal compliance. Calling rules, stop conditions and audit trails help you meet the Standards. Whether you meet them is a legal question, and accountability stays with your board and senior management.
Only calls placed through the platform are counted. Contact through another dialer, by message or through inbound calls is invisible to it. Track that separately, or a consumer’s real contact history may be heavier than any one system shows.
Answered calls can run past the window. A window stops new dialling; it does not end a conversation in progress. Train scripts and staff to close calls properly.
Uncertain attempts still count. If the system cannot tell whether an attempt connected, it should count it. That is cautious, and it may mean fewer calls than you expect.
Some features may not be available yet. Callback dialling, importing attempts made elsewhere and external pre-dial checks should be confirmed with the vendor rather than assumed.
Coverage depends on setup. Saloma states that call coverage depends on capacity and provider availability, and that languages and features depend on the model and setup. It lists 70+ languages across supported voice options; test Bahasa Malaysia and your customers’ other languages before live use. Its public demo is a recorded clinic enquiry, described as a demo, not a customer case study, so test collection scenarios yourself.
See it in action Request a demo to explore how this could work for your team. Book a demo.
How a customer uses it
Once your vendor has demonstrated the controls above, rollout typically follows these steps. Confirm with the vendor that each one is available in your build.
- Assign the rules. Ask the platform administrator to assign the Malaysian rule set, if offered, to your organisation.
- Set time zones. Configure organisation and agent time zones so windows are calculated correctly and missing data blocks calls rather than guesses.
- Mark campaign types. Flag recovery campaigns so notice and stop rules apply.
- Record accounts and notices per contact. Keep account status and notice evidence current so settled or resolved accounts drop out of every queue.
- Read the skip reasons. When a contact is not called, check the reason in your campaign view. Sample recordings for tone and accuracy against the prohibition on misleading, deceptive, exploitative or harassing conduct.
- Get legal sign-off before scaling. Have legal review scripts, retention and notice processes. Start with low-risk reminders with human handoff on.
On cost, Saloma invites you to request pricing for your call volume, simultaneous calls, models and phone setup, so quote against your pilot’s realistic minutes and concurrency before committing to a wider rollout.
Further reading
Sanjay W
