Most of the effort in an e-commerce project goes into the part a buyer can see: the design, the catalogue, the checkout flow. Almost none of it goes into the question that carries the actual risk.
How does the money reach you, and who is holding it on the way?
Payment operators are regulated; developers are not
Building an online store requires no licence in Malaysia. Operating a payment system does. Payment system operators fall under Bank Negara Malaysia’s remit through the Financial Services Act 2013, and Bank Negara publishes lists of the operators it has approved.
Your developer is almost certainly not the payment provider. They are integrating one. So the check is not on them — it is on the gateway they have chosen, and it is a check you can do yourself.
Ask which gateway is being integrated, then look it up.
Why the choice tends to get made badly
Gateway selection is frequently decided by whichever integration the developer has built before. That is not unreasonable — a familiar integration is a cheaper and less buggy integration — but it optimises for build time rather than for the thing you will live with for years.
The consequences of the choice are all yours: the settlement period, the transaction fee, the chargeback process, which payment methods your customers actually see, and what happens when a payout is held.
Questions with commercial teeth
- Which gateway, and is it on Bank Negara’s approved list?
- What is the settlement period — when does money actually arrive?
- What is the total cost per transaction, including any fixed component?
- Does it support the methods your customers use here — FPX and the local wallets, not only cards?
- Whose name is on the merchant account?
That last one is the same question as domain ownership, wearing different clothes. The merchant account should be in your company’s name.
Migration is the expensive part
Changing a theme is a weekend. Changing a payment provider after launch means reintegration, re-testing, a new merchant application, and a window where subscriptions and saved payment methods can break.
Which is why this is worth twenty minutes before the build, rather than a year of living with a decision that was made for you on the basis of what was quickest to plug in.