How to manage compliance risks when investing in Southeast Asia

Southeast Asia has robust growth potential and investors should be mindful of associated risks and obligations in this dynamic region.

In brief

• Failure to effectively address risks relating to fraud, corruption, cyber breaches and non-compliance can have far-reaching negative consequences.
• Investors must better manage such risks to effectively tap into Southeast Asia’s growth potential.
• Some key actions include managing integrity risks in M&As, creating a robust third-party risk management program and implementing cyber compromise detection.

With a population of over 666 million people and a gross domestic product (GDP) growth rate rivaling India’s and China’s1, Southeast Asia is driving strong consumer demand that is attractive to foreign investors thanks to its burgeoning middle class. Foreign direct investment (FDI) inflows into Southeast Asia reached an all-time high of US$224 billion in 2022, despite a 12% decline globally.2

Increased regulatory scrutiny, cybercrime and sustainability obligations

As investors seek to benefit from the region’s growth potential, they also need to be mindful of the risks of investing.

Transparency International’s 2022 Corruption Perceptions Index (CPI) placed eight of the 10 Association of Southeast Asian Nations countries in the higher-risk category for corruption risks.3 Over the years, Southeast Asian regulators have responded to corruption and fraud risks by establishing anti-corruption agencies aligned with the United Nations Convention Against Corruption, leading to more stringent legislation, enhanced enforcement actions and cross-border collaboration. Examples include Malaysia’s first prosecution under Section 17A of the Malaysian Anti-Corruption Commission Act 2009 in 2021 and the recent ramping up of anti-corruption efforts in Vietnam, Thailand and Indonesia. Across Southeast Asia, active anti-corruption crackdown efforts are evident from frequent high-profile cases reported in the media.

While financial crime is a global issue, cybercriminals and organized crime groups are also increasingly targeting Southeast Asia. The region had over 516.5 million internet users in 20224 and its digital economy is forecast to grow by 6 per cent annually, reaching as high as US$1 trillion by 2030.5 In addition, rising financial crime in Southeast Asia has been spurred by rapid post-pandemic economic development, undeterred by legal and regulatory changes and complex sanctions.

In fact, research found that about three out of five (67%) businesses in Southeast Asia were victims of ransomware attacks, which often result in data privacy breaches and loss of highly sensitive trade secrets.6 Singapore has enforced stricter penalties on organizations that encounter breaches by raising the financial penalty cap under its Personal Data Protection Act.

Bank phishing and investment and e-commerce scams are increasing at an alarming rate. Organized crime groups behind these scams are also actively trying to launder their illicit proceeds through the financial systems.

With regulators, investors and consumers increasingly focusing on sustainability risks, business need to scrutinize their supply chains for financial and socio-environmental risks via business partner due diligence and monitoring programs. The consequences of getting caught off guard by a business partner that breaches international laws and norms, such as those relating to modern slavery, bribery and corruption or other compliance requirements, go beyond operational disruption and financial losses. Doubts over management integrity and the reputational impact in such situations can alienate consumers, who expect businesses to hold themselves and their partners to a higher standard.