9.4 Shariah Control Functions & SNC Management

IBFIM Associate Qualification in Islamic Finance AQIF

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: AQIF Orientation, Shariah Foundations & Rule-Making

1.1 About the AQIF Assessment & How to Use This Guide 1.2 Shariah Worldview, Fiqh & Legal Maxims 1.3 Primary & Secondary Sources of Shariah 1.4 Rule-Making in Modern Islamic Banking & Finance 1.5 Maqasid al-Shariah & Property Rights

2 Chapter 2: Islamic Economics, Core Prohibitions & Contract Essentials

2.1 Islamic Economics & the Fundamentals of Islamic Banking 2.2 Riba in Debts and Sales 2.3 Gharar, Maysir & Prohibited Activities 2.4 Contractual Essentials, Options & Unilateral Promises

3 Chapter 3: Exchange & Sale Contracts (Murabahah, Tawarruq, Salam & Istisna')

3.1 Murabahah & Bai Bithaman Ajil (BBA) 3.2 Tawarruq, Commodity Murabahah & BSAS 3.3 Forward Sales: Salam & Istisna'

4 Chapter 4: Leasing & Partnership Contracts (Ijarah, Mudarabah & Musharakah)

4.1 Ijarah & Ijarah Muntahiyah bi al-Tamlik (IMBT) 4.2 Mudarabah (Profit-Sharing Partnership) 4.3 Musharakah & Diminishing Partnership (MMP)

5 Chapter 5: Fee-Based, Security & Gratuitous Contracts (Wakalah, Kafalah, Rahn & Qard)

5.1 Agency & Service Contracts: Wakalah & Ju'alah 5.2 Security & Guarantee Contracts: Kafalah & Rahn 5.3 Gratuitous & Custody Contracts: Qard, Wadiah & Hibah

6 Chapter 6: Ethics in General, Islamic Ethics & Fiduciary Conduct

6.1 Ethics in General: Concepts, Sources & Theories 6.2 Foundations of Akhlaq in Islamic Finance 6.3 Market Conduct & Prohibited Trade Practices 6.4 Fiduciary Duties, Conflict of Interest & Confidentiality

7 Chapter 7: Treating Customers Fairly, VBI & Professional Standards

7.1 Treating Customers Fairly & Responsible Financing 7.2 Value-Based Intermediation (VBI) & Social Finance 7.3 Professional Conduct & AAOIFI Code of Ethics

8 Chapter 8: Malaysian Statutory Framework (IFSA & CMSA)

8.1 Islamic Financial Services Act 2013 (IFSA) Overview 8.2 Islamic Deposits vs. Investment Accounts under IFSA 8.3 Capital Markets and Services Act (CMSA) & Dispute Resolution

9 Chapter 9: Corporate & Shariah Governance in Islamic Financial Institutions

9.1 Corporate Governance in Islamic Financial Institutions 9.2 Two-Tier Shariah Governance Structure 9.3 Institutional Shariah Committee Roles & Operations 9.4 Shariah Control Functions & SNC Management 9.5 Issues & Challenges in Implementing Shariah Governance

10 Chapter 10: Islamic Finance Industry, Banking & Takaful Architecture

10.1 Overview of the Global Islamic Finance Industry 10.2 Islamic Banking System & Money Markets 10.3 Takaful Principles & Operational Models

11 Chapter 11: Islamic Capital Markets, Wealth Management & Contemporary Trends

11.1 Sukuk Structures & Market Mechanics 11.2 Shariah Equity Screening & Islamic Asset Management 11.3 Islamic Wealth Management, Social Finance & Contemporary Issues

9.4 Shariah Control Functions & SNC Management

Key Takeaways Explain This Topic AI

SGPD 2019 requires three ongoing Shariah control functions: Shariah risk management, Shariah review, and Shariah audit. Shariah research and day-to-day advice are performed by the Shariah committee secretariat (SGF 2010 had listed research as a fourth function).

The secretariat provides in-depth Shariah research and daily advice based on SAC rulings and SC decisions. Shariah review, part of the compliance function, regularly assesses whether operations comply with Shariah.

Shariah risk management is integrated into enterprise-wide risk management. Shariah audit, part of internal audit, gives independent assurance and reports results to the board and the Shariah committee.

Under Section 28(3) of IFSA 2013, an institution that becomes aware of Shariah non-compliance must immediately notify BNM and its Shariah committee, immediately cease the activity, and submit a rectification plan within 30 days.

Shariah non-compliant income (SNCI) cannot be recognised as income or distributed to shareholders; it is purified by channelling it to charitable purposes approved by the Shariah committee.

Last updated: October 2026

Shariah Control Functions & SNC Management

A robust Shariah governance policy is only as effective as the operational machinery designed to enforce it. Bank Negara Malaysia's Shariah Governance Policy Document (SGPD 2019) requires every Islamic financial institution (IFI) to perform three control functions on an ongoing basis: Shariah risk management, Shariah review and Shariah audit (paragraph 16.3). Shariah research is now the job of the Shariah committee secretariat , which must be staffed by Shariah-qualified officers. The earlier Shariah Governance Framework (SGF 2010) had listed research as a fourth function.

The control functions sit within the Three Lines of Defence model: the business is the first line, risk management and compliance the second, and internal audit the third. Each senior officer running a control function has direct, unimpeded access to the Shariah committee. Control functions must be independent of business lines and must not take part in revenue-generating activities.

Shariah Research, Secretariat Support and the Control Functions +--------------------------------------------------------------------------+

| Shariah Governance Support & Control (SGPD 2019) |
+--------------------+--------------------+--------------------------------+
| Function | Where it sits | Core Focus |
+--------------------+--------------------+--------------------------------+
| Shariah research & | Secretariat to the | In-depth research, day-to-day |
| advice | Shariah committee | advice, SC meeting support |
+--------------------+--------------------+--------------------------------+
| Shariah risk | Risk management | Identify, measure, monitor and |
| management | (second line) | report SNC risk |
+--------------------+--------------------+--------------------------------+
| Shariah review | Compliance | Regular assessment of actual |
| | (second line) | compliance with Shariah |
+--------------------+--------------------+--------------------------------+
| Shariah audit | Internal audit | Independent assurance on |
| | (third line) | controls and compliance |
+--------------------+--------------------+--------------------------------+
1. Shariah Research and Advice (Secretariat)

Under SGPD 2019 the secretariat to the Shariah committee performs in-depth research on Shariah issues, gives day-to-day advice based on SAC rulings and the committee's decisions, disseminates those decisions, and supports the committee administratively. Officers doing the research and advisory work must be Shariah-qualified. Typical duties include:

Preliminary Juristic Research: Conducting comprehensive Fiqh studies on proposed banking products, analyzing classical jurisprudential treatises across the major madhahib , and comparing contemporary resolutions from the SAC BNM, SAC SC, AAOIFI, and the International Islamic Fiqh Academy (IIFA);

Product Structuring Support: Collaborating with product development teams, treasury desks, and legal counsel to engineer Shariah-compliant alternatives to conventional financial instruments;

Secretariat Support: Preparing detailed research papers, legal memos, and transaction dossiers for Shariah Committee meetings, while meticulously recording meeting minutes, deliberations, and formal rulings; and

Day-to-Day Fiqh Inquiries: Providing immediate guidance to front-line business units on routine operational questions within parameters pre-approved by the SC.

2. Shariah Review (Continuous Operational Monitoring)

Shariah Review is part of the IFI's compliance function (second line of defence), led by the senior officer responsible for compliance. While Research focuses on product design prior to launch, Review focuses on execution fidelity during live operations. Its core responsibilities include:

Continuous Assessment: Conducting regular, concurrent examinations of business activities, operational workflows, customer onboarding files, executed contract agreements, and marketing materials to ensure adherence to SC decisions;

Transaction Testing & Branch Sampling: Periodically visiting physical branches, business centers, and digital operations to sample live customer files, verify asset delivery documentation, and confirm that sale sequences ( e.g., purchasing the commodity before executing Murabahah sales ) were strictly executed;

Pre-Execution Vetting: Reviewing customized, non-standard transactions and complex syndicated corporate facilities prior to drawdown; and

Reporting: Regularly reports Shariah non-compliance issues and findings to the board, the Shariah Committee and senior management, and updates them on new SAC rulings and regulatory developments. It also ensures staff are trained on relevant Shariah requirements.

3. Shariah Risk Management (Identification & ERM Integration)

Shariah Risk Management (SRM) is the responsibility of the senior officer accountable for risk management, and it embeds Shariah non-compliance risk into the institution's Enterprise Risk Management (ERM) framework. Operating alongside conventional credit, market, and operational risk teams, SRM ensures that Shariah risks are systematically managed through recognized risk tools:

Risk Identification: Systematically identifying vulnerabilities where operational failures could trigger Shariah Non-Compliance (SNC) events (e.g., executing sales without valid asset ownership, late payment penalty calculation flaws, or documentation mismatches);

Measurement and Key Risk Indicators (KRIs): Establishing quantitative and qualitative KRIs to monitor potential SNC exposures, tracking metrics such as operational exception logs, staff compliance training completion rates, and documentation error frequencies;

Control and Mitigation: Formulating internal risk control standards, risk appetite statements, and contingency remediation workflows; and

Integration: Ensuring that Shariah risk is recognized as an integral component of the institution's Internal Capital Adequacy Assessment Process (ICAAP) and overall operational risk profile.

4. Shariah Audit (Independent Ex-Post Assurance)

Shariah Audit functions as the Third Line of Defense , delivering independent, objective assurance to the highest levels of governance. Unlike Review officers (who may possess pure Shariah backgrounds), Shariah Auditors are internal audit professionals who possess specialized competency in Shariah auditing methodologies. Key attributes include:

Ex-Post Periodic Examination: Conducting retrospective, scheduled audits of business units, control systems, IT infrastructure, and governance processes after transactions have settled;

Assessing Internal Control Effectiveness: Evaluating whether the first and second lines of defense (Research, Review, and Risk Management) are operating effectively to mitigate SNC risks;

Independence and Reporting: Shariah audit is part of the internal audit function, which reports to the Board Audit Committee (BAC) . SGPD 2019 requires audit results to be communicated to the board and the Shariah Committee through audit reports with findings, recommendations, and management's action plans; and

Comprehensive Audit Program: Executing a multi-year, risk-based Shariah audit plan approved by both the BAC and the Shariah Committee.

Comparative Matrix: Shariah Review vs. Shariah Audit

A clear understanding of the distinction between Shariah Review and Shariah Audit is essential for regulatory compliance and professional examination success:

Dimension Shariah Review Shariah Audit
Defense Line Second Line of Defense Third Line of Defense

Timing & Cadence Continuous, regular, concurrent, and ongoing monitoring Periodic, scheduled, retrospective (ex-post) assurance

Primary Objective Detect operational deviations and ensure daily compliance with SC rulings Independently evaluate the adequacy and effectiveness of internal controls and governance

Primary Reporting Line Reports regularly to the board, the Shariah Committee and senior management; sits under compliance Part of internal audit, reporting to the Board Audit Committee (BAC) ; results also go to the SC

Methodology Workflow vetting, pre-execution checks, transaction sampling, branch spot-checks Risk-based audit testing, internal control evaluations, substantive testing, process re-performance

Independence Level Operationally independent from business units; part of risk management infrastructure Highest level of independence; completely detached from executive and risk operations

Staff Profile Officers qualified for compliance work with sound knowledge of Shariah requirements (may include Shariah-qualified officers) Internal auditors qualified to audit, with the requisite knowledge of Shariah requirements

Shariah Non-Compliance (SNC) Governance under IFSA 2013

Under Malaysia's legal architecture, Shariah compliance is not a mere voluntary ethical guideline; it is a strict statutory obligation . The Islamic Financial Services Act 2013 (IFSA 2013, Act 759) establishes the most comprehensive and punitive statutory regime for SNC management in the world:

1. Statutory Mandate (Section 28(1) IFSA 2013)

Section 28(1) of IFSA 2013 imposes an affirmative, non-delegable statutory duty on every licensed institution:

"An institution shall at all times ensure that its aims and operations, business, affairs and activities are in compliance with Shariah."

2. Severe Criminal Penalties (Section 28(5) IFSA 2013)

To eliminate willful negligence and underscore the gravity of Shariah compliance, Section 28(5) establishes severe criminal sanctions. Any financial institution or officer who contravenes Section 28 commits an offense and shall, upon conviction, be liable to:

Imprisonment for a term not exceeding eight (8) years ; or
A fine not exceeding twenty-five million Malaysian Ringgit (MYR 25,000,000) ; or

Both imprisonment and fine .

3. Immediate Operational Cessation (Section 28(3) IFSA 2013)

Under Section 28(3), once an institution becomes aware that it is carrying on any business, affair or activity that does not comply with Shariah, its Shariah committee's advice, or an SAC ruling, it must immediately cease that activity and any similar new business. The institution cannot wait for board approval, external legal advice, or scheduled committee meetings before halting the non-compliant process.

4. Statutory Notification Timelines
Section 28(3) sets the sequence: [ Institution becomes aware of SNC ]
|
v
Immediately: notify BNM AND the Shariah committee
|
v
Immediately: cease the activity and any similar new business
|
v

Within 30 days (or a longer period BNM specifies):

submit a rectification plan to BNM

Immediate Notification: Notify BNM and the Shariah committee immediately on becoming aware of the non-compliance.

Immediate Cessation: Stop the non-compliant business, affair or activity at once, and take on no similar business.

30-Day Rectification Plan: Within thirty days of becoming aware (or such further period as BNM specifies), submit a plan to rectify the non-compliance. BNM may assess whether the rectification has been completed (s.28(4)).

Do not confuse these with the 14-day notice in Sections 33 and 34 of IFSA, which applies when a Shariah committee member resigns or is disqualified.

Shariah Non-Compliant Income (SNCI) Purification

When a transaction is executed in violation of Shariah—such as selling an asset under Murabahah before acquiring ownership or constructive possession ( qabd ), collecting unauthorized compounding penalty charges, or investing funds in non-compliant commercial assets—the revenue generated from that transaction is legally classified as Shariah Non-Compliant Income (SNCI) .

Accounting and Balance Sheet Treatment

Under BNM guidelines and Malaysian Accounting Standards Board (MASB) standards, tainted funds are subject to strict non-recognition rules:

Zero Revenue Recognition: SNCI cannot be credited to the institution's statement of comprehensive income as bank revenue, profit, or fee income;

Zero Shareholder Distribution: SNCI cannot be capitalized into retained earnings, distributed to shareholders as dividends, or utilized to calculate executive performance bonuses;

Zero Expense Offset: The bank cannot use SNCI to offset its own operational expenses, administrative overhead, legal fees, or taxes; and

Immediate Segregation: Tainted funds should be identified and kept apart from the bank's own income, typically in a dedicated account, until they are disposed of.

Charitable Purification and Disposal Protocols

The entire balance of SNCI must be purged from the banking institution through charitable purification:

Eligible Beneficiaries: Funds are channelled to charitable bodies or public-benefit purposes approved by the Shariah Committee (e.g., poverty alleviation, disaster relief, medical facilities for the underprivileged, or educational aid for low-income students);

No Commercial Advantage: Purification is not charity by the bank. The bank should not use it to gain marketing publicity or other commercial benefit; and

Disclosure: Under SGPD 2019, where a material SNC event has occurred, the Shariah Committee's annual opinion must disclose its nature, status, and the measures taken to address it. Islamic banks also typically report the amount of non-compliant income and how it was purified in their financial statements.