A first Southeast Asia hire comes down to six decisions: employment structure, registration path, statutory filings, banking and payroll setup, the compliance calendar, and the exit or scale-up plan. Get the order wrong and a finance team ends up chasing pieces separately, pulling answers off whatever page a search engine surfaces that week. Weeks disappear that way. This checklist runs the six in the sequence a CFO or HR leader needs to work through, documents and deadlines attached to each step.
This is a working checklist, not a deep explainer. For the full decision framework on entity versus EOR, SummitNext’s guide to doing business in Malaysia covers the cost and timeline tradeoffs in detail. For the compliance question underneath the structure decision, the breakdown of permanent establishment risk explains what triggers PE exposure and how the 2025 OECD threshold update changed the calculation. This piece links out to both rather than repeating them, and instead tracks the checklist a team runs through in practice, phase by phase.
Phase One: Decide the Employment Structure Before Anything Else
Every other step in this checklist depends on this decision, so make it first. A company hiring one to five people in Malaysia within the next quarter should default to an employer of record. A company already committed to a permanent Malaysia office, a local sales entity, or headcount above roughly 15 to 25 people should run the entity math before deciding. SummitNext’s entity setup comparison lays out where that breakeven sits, and SummitNext’s consultation services can walk a specific headcount plan through the decision before you commit either way.
Decision point: EOR or entity. Documents needed: None yet, since this is a planning call, not a filing. Deadline: Settle it before any step below. Reopening the question mid-registration burns real weeks, and some registration fees paid up to that point never come back.
What Documents Does an EOR Need to Onboard a New Hire?
Four items get a new Malaysia hire onboarded through an EOR: a signed offer letter, the candidate’s passport or national ID, bank details for payroll, and a completed employment particulars form covering job title, salary, and start date. SummitNext gathers all four straight from the client and the candidate once the hire is confirmed. No company registration paperwork touches the client’s side of the process.
A new Malaysia hire onboards through an EOR in one to three weeks from signed offer to first payroll run. Setting up a self-managed entity first stretches that same hire out to eight to sixteen weeks. Four items move the EOR route: a signed offer letter, the candidate’s passport or national ID, payroll bank details, and an employment particulars form. Registration happens on SummitNext’s own Malaysia employer status, so EPF, SOCSO, and EIS get filed without the client ever touching SSM, LHDN, or the Companies Commission directly. No minimum headcount applies either. A single hire stands as a full engagement on its own, not a trial run toward something bigger. Companies can still convert that hire to their own entity down the line whenever it makes sense, without breaking the employment relationship to do it. Figures reflect SummitNext’s onboarding process as run in August 2026.
Decision point: Lock the candidate and the compensation package before any document moves. Documents needed: Signed offer letter, passport or ID copy, bank details, employment particulars form. Deadline: Get these in at least 10 business days ahead of the intended start date. Statutory registration needs that runway.
What Documents Does Registering a Malaysia Entity Require?
A name reservation with the Companies Commission of Malaysia (SSM) comes first, followed by a registered local address and at least one resident director. A constitution document goes with the filing. Once SSM clears the entity, separate registrations with LHDN cover tax, plus EPF, SOCSO, and EIS on top of that. SummitNext’s entity setup breakdown walks through what each filing covers and roughly how long it takes.
The company name reservation and SSM incorporation typically clear first, since everything downstream depends on having a registered entity number. LHDN tax registration, the corporate bank account, and the statutory contribution registrations for EPF, SOCSO, and EIS all follow, and several of them cannot start until the entity is fully incorporated. That sequencing is the single biggest reason entity setup runs eight to sixteen weeks rather than two or three.
Decision point: Confirm the resident director and registered address before filing. Documents needed: Name reservation, constitution, resident director details, registered address proof. Deadline: Budget eight to sixteen weeks end to end. Do not commit to a hire start date before SSM incorporation clears.
When Does Permanent Establishment Risk Enter the Picture?
Permanent establishment risk enters the picture the moment a company has staff performing revenue generating or contract negotiating work inside Malaysia, regardless of whether that company has registered a local entity. A remote employee who closes deals or signs contracts on the company’s behalf can trigger PE exposure even under a pure EOR arrangement. The full explainer on PE risk and the OECD threshold update covers the dependent agent test and the specific triggers in detail.
The practical takeaway for this checklist: PE risk is a function of what the hire does, not how they are employed. An EOR resolves employment and payroll compliance. It does not, on its own, resolve PE exposure if the role itself creates a taxable presence. Companies hiring sales or deal making roles specifically should read the PE explainer before finalizing the job description, not after the hire starts.
Decision point: Does the role involve contract negotiation, deal closing, or fixed physical presence. Documents needed: None directly, but flag the role type to tax counsel before the hire starts. Deadline: Before the offer goes out, not after the first quarter of activity.
Phase Three: Building the Compliance Calendar
Once the employment structure is settled, the recurring compliance calendar becomes the operational piece that needs tracking month over month. Malaysian statutory contributions run on fixed monthly deadlines: EPF and SOCSO/EIS payments are due by the 15th of the following month, and PCB monthly tax deductions follow the same cycle. Missing these dates carries penalties regardless of whether the employer is an EOR or a self-registered entity.
Get a quote from SummitNext to see how this calendar gets handled without adding it to your own finance team’s workload, whether you are running one hire or scaling toward a full country team over the next year.
Decision point: Who owns the monthly filing calendar, an internal finance team or the EOR provider. Documents needed: Monthly payroll register, EPF/SOCSO contribution statements, PCB deduction records. Deadline: Recurring, by the 15th of each following month, indefinitely for as long as the employment relationship runs.
Phase Four: Banking, Payroll Currency, and the First Pay Run
A first Malaysia payroll run under an EOR arrangement typically executes within the first full calendar month after the employee’s start date, paid in Malaysian ringgit through the EOR’s local payroll infrastructure. The client company is invoiced separately, usually in USD, and never needs to open a Malaysia bank account or manage local currency exposure directly. A company setting up its own entity instead needs a Malaysia corporate bank account before its first payroll run, which typically requires the entity’s SSM registration, a resident director present for account opening in many cases, and two to four additional weeks once incorporation is complete. That banking step is often the most underestimated timeline item in a full entity setup, since it depends on bank-specific processes SummitNext does not control. Companies planning to convert from EOR to a self-managed entity later should start the banking conversation early, since it rarely moves as fast as the rest of the registration.
Decision point: EOR-managed payroll currency and invoicing, or a self-managed Malaysia bank account. Documents needed: For entity route, bank account opening forms, board resolution, director identification. Deadline: Start the bank account process the same week SSM incorporation clears, since it is frequently the longest single step in entity setup.
Phase Five: The Scale-Up or Exit Decision
The checklist does not end at the first hire. Companies that start with an EOR for one or two people should revisit the entity question once headcount crosses roughly 15 to 25, since that is where the statutory cost load of a self-managed entity typically starts to undercut EOR pricing per head. SummitNext’s cost comparison covers where that line sits for a given headcount and function mix.
The reverse move, converting from a self-managed entity back to EOR or winding down Malaysia operations entirely, carries its own compliance steps: final payroll runs, statutory contribution closeouts, and formal entity deregistration with SSM if the company is exiting the market instead of changing employment structure alone. Case studies from other companies that scaled through this exact sequence show how the timeline plays out in practice, and SummitNext’s read on why global companies keep expanding outsourcing operations across Southeast Asia covers the regional pattern behind that scale-up decision.
A first-time mover into the region should also weigh the mistakes that trip up other US companies before finalizing a timeline. SummitNext’s list of outsourcing mistakes US companies make in Asia covers the operational missteps that show up most often once a checklist like this one gets handed off to an internal team to execute.
Frequently Asked Questions
How long does it take to hire someone in Malaysia through an EOR? One to three weeks, start to first payroll run. Employment registration and the statutory contribution setup happen on SummitNext’s own Malaysia employer registration, so no entity paperwork holds up the hire before it starts, and the client never files anything directly with Malaysian authorities.
Do I need to register a company before hiring in Malaysia? No, not if using an EOR. An EOR is already a registered Malaysia employer and can hire on a client’s behalf without the client setting up its own entity. Registering an entity is only necessary for companies planning permanent local infrastructure.
What documents does SummitNext need to onboard a new Malaysia hire? Four things: a signed offer letter, the candidate’s passport or national ID, payroll bank details, and an employment particulars form covering job title, salary, and start date. Nothing tied to company registration is needed from the client, and none of these documents require a Malaysia entity to already exist.
When does a Southeast Asia hire trigger permanent establishment risk? When the role performs revenue generating or contract negotiating work inside Malaysia, regardless of employment structure. This applies to EOR-employed staff too, since employment status alone does not resolve PE exposure. Review the role’s functions against the PE test before the offer goes out, not after.
At what headcount does entity setup become cheaper than an EOR? Roughly 15 to 25 employees in Malaysia, depending on function mix and salary levels, is where the statutory cost load of a self-managed entity typically starts to undercut EOR pricing per head. Below that range, EOR is usually the lower total cost.
Can I start with an EOR and switch to my own entity later? Yes, and it’s a common path. A company starts with an EOR for the first hire or two, then registers its own entity once headcount or a bigger strategic commitment justifies the move. Existing staff keep their employment relationship through the conversion, no break required.
Working the Checklist
A Southeast Asia expansion moves fastest when the employment structure decision happens first and every other step follows from it, not the other way around. Skipping straight to documents without settling EOR versus entity is the single most common reason a first Malaysia hire slips past its intended start date.
SummitNext runs this checklist directly with companies making their first Southeast Asia hire. Book a consultation with SummitNext and get a specific timeline for your situation before you commit to a start date.
English 
Русский 
繁體中文