Reading an MSA Before You Sign: a 20-Minute Insurance Checklist for Malaysian Founders
This is for you if you run a Malaysian services business, an enterprise client has sent you a master services agreement, and you have twenty minutes rather than a legal budget. It assumes you sell services, software or advice, not construction or site work.
The insurance cost of an MSA is set in four places, and only one of them is the clause headed "Insurance". Reading the other three is what stops you agreeing to something the policy cannot deliver.
Work through it in order. Twenty minutes now is worth more than a variation request in three weeks.
Key Facts: Insurance Terms in a Malaysian Master Services Agreement
What is an MSA asking you to do? Carry named covers at named limits for a named period, produce evidence by a date, and keep the cover running while the agreement lives. The four asks are separable and each is negotiated differently.
Who should read the insurance terms closely? Founders and finance leads at Malaysian SMEs signing with a client larger than themselves. The schedule is usually a template written for a much bigger supplier, which is why the numbers look strange against your fee.
What drives the real cost? The limit, the number of covers named and any obligation to keep cover running after the work ends. A tail requirement is the single most expensive line most founders price at zero.
Is any of it required by Malaysian law? No. For a Malaysian services business these are contractual demands, not statutory ones, which is exactly why the terms are open to discussion before signature.
What is most commonly wrong? The trigger. Clauses copied from overseas templates ask for professional indemnity on an occurrence basis, and Malaysian professional indemnity is written claims made.
Last verified: August 2026. Checked against the Financial Services Act 2013, the SME Corporation Malaysia definition guideline and current Malaysian contracting practice.
MSA in your inbox and a signature expected this week?
Send the insurance schedule before you mark it up. You will get back what is standard, what is a drafting error, and what your current cover already satisfies. Start from SME business insurance.
Minutes 1 to 5: find the four places
Search the document rather than reading it front to back. These are the terms to search for and why each one matters.
| Search for | What you are looking for | Why it changes the insurance answer |
|---|---|---|
| "insurance", "insured", "policy" | The insurance clause and any schedule it points to | Names the covers, limits, evidence and duration you must deliver |
| "indemnify", "indemnity", "hold harmless" | What you are promising to pay for regardless of insurance | This is the real exposure. The insurance clause only decides who funds part of it |
| "liability shall not exceed", "aggregate liability" | Your liability cap, and every carve-out from it | A cap with wide carve-outs is not really a cap |
| "confidential", "personal data", "security" | Data obligations, often in a separate annex | Drives whether a cyber requirement is coming, and how large |
If the indemnity is uncapped and the insurance clause names a modest limit, the document has already told you the balance sits with you. That is the most useful thing you will learn in the first five minutes.
Minutes 6 to 12: inside the insurance clause
Break the clause into four separate asks and mark each one. They are negotiated independently and success rates differ sharply.
| Element | What to check | How movable it is |
|---|---|---|
| The cover named | Whether it matches the loss they are actually worried about, and whether the Malaysian product uses that name | Moves least. This is the thing the clause exists for |
| The limit | Whether it is a flat figure or a formula, and what the formula multiplies | Frequently movable, especially where a formula produces an odd number on a small engagement |
| The trigger and duration | Whether it says occurrence or claims made, and whether cover must run after delivery | Very movable, because correcting a trigger is a fix rather than a concession |
| The evidence | What document, by when, and whether anyone must be noted on the policy | Usually movable where timing is the only issue |
Two specific things to flag with a highlighter. Any phrase asking for professional indemnity or errors and omissions cover "for each occurrence" should be corrected to claims made before signature. And any requirement to maintain cover for a period of years after delivery is a run-off obligation, whether or not the drafter used that word.
Minutes 13 to 17: the three clauses that decide what the insurance has to do
The insurance clause is downstream of these. Read them second and the numbers in the schedule start to make sense.
| Clause | What to look for | What to ask for |
|---|---|---|
| Indemnity | Whether it is limited to third-party claims or extends to the client's own losses | Confine it to third-party claims arising from your negligence, and align it to the liability cap |
| Liability cap | The number, the period it aggregates over, and the list of carve-outs | A cap tied to fees paid, and carve-outs narrowed to the ones the law would impose anyway |
| Data and security annex | Notification timeframes to the client, audit rights, and any security standard you must hold | Timeframes you can actually meet alongside your regulatory notification duties |
Data breach notification has been mandatory since 1 June 2025 under the Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024. If the annex also gives your client a shorter deadline than the regulator's, you now have two clocks running from the same incident, and the plan has to satisfy both.
Signing your first MSA with a data annex attached?
The annex usually decides whether a cyber requirement is coming, and how big. Worth reading alongside cybersecurity insurance before you agree the notification timeframes.
Minutes 18 to 20: the paperwork and the calendar
The last three minutes are administrative and they are where most deals actually slip.
| Item | Check |
|---|---|
| Entity name | The name on the agreement matches the insured name on your policy exactly, including the registration number |
| Evidence date | It is achievable from a standing start, not from an assumption that cover already exists |
| Renewal obligation | Whether a fresh certificate is due at each renewal, and whether you have to send it unprompted |
| Noted party | Whether the client wants to be noted, named as additional insured, or covered by a principal's indemnity extension. They are three different things |
| Tail obligation | In your calendar, with the renewal date, because a lapse after the project ends is the expensive version |
Red flags worth stopping for
Some drafting is standard even when it looks harsh. These five are the ones that genuinely justify holding the signature.
| Red flag | Why it matters |
|---|---|
| "The policy shall contain no material exclusions" | No policy complies, so you would be warranting something untrue at signature |
| An uncapped indemnity beside a modest insurance limit | The gap between the two is your balance sheet |
| A limit set by formula with no ceiling | Scope creep raises the insurance requirement automatically, after the fee is fixed |
| Cover required for years after termination | A run-off obligation with a real price attached, usually unpriced in your fee |
| A breach notification deadline shorter than your regulatory one | Two clocks from one incident, and the contractual one has a penalty attached |
What to send back, and in what order
A single consolidated mark-up beats five emails over three weeks. This is the order that gets answers fastest.
| Order | Ask | How to frame it |
|---|---|---|
| 1 | Correct the trigger to claims made | As a correction to match the Malaysian product, with replacement wording attached |
| 2 | Cap a formula limit, or set a flat figure | Tied to contract value, with a review if scope grows materially |
| 3 | Replace the no-exclusions warranty with a disclosure undertaking | Offer to disclose material exclusions and to notify changes at renewal |
| 4 | Convert a run-off requirement into continuous cover | Offer to maintain the policy with the retroactive date preserved instead |
| 5 | Set a workable evidence date | Give a real placement timeline rather than asking for an open extension |
Why the schedule rarely fits you
The mismatch is a size problem, not a competence problem. Malaysian suppliers are overwhelmingly small and medium businesses, and enterprise templates are not written with them in mind.
"A business will be deemed as an SME if it meets either one of the two specified qualifying criteria, namely sales turnover or full-time employees, whichever is lower."
That is SME Corporation Malaysia, Guideline for SME Definition. For services and other sectors, a small enterprise is one with sales turnover from RM300,000 to under RM3 million, or 5 to under 30 full-time employees, and a medium enterprise runs to RM20 million or 75 employees. Most firms signing their first enterprise MSA sit inside those bands.
At national level, micro, small and medium enterprises contributed 39.5% of GDP in 2024, worth RM652.4 billion, and employed 8.10 million people, 48.7% of employment, according to the Department of Statistics Malaysia in its Micro, Small and Medium Enterprises Performance 2024 release, which also records MSME growth of 5.8% against national growth of 5.1%. A supplier base that size will keep meeting schedules drafted for someone larger, so reading them properly is a repeatable skill rather than a one-off task.
FAQ
Can I ask an enterprise client to remove the insurance clause?
You can ask, and the answer is usually no, because the clause sits in a template approved above the person you are dealing with. Asking to correct specific terms inside it succeeds far more often. Aim at the limit, the trigger and the evidence date rather than at the clause as a whole.
What does "claims made" mean and why does the MSA get it wrong?
A claims-made policy responds to claims brought against you while it is in force, which is how professional indemnity is written in Malaysia. Templates drafted elsewhere often ask for an occurrence trigger by habit. Correcting the wording before signature closes a gap that no insurer created.
Does Malaysian law require me to hold any of these covers?
Not as a general rule for a services business. The Personal Data Protection Act and the Cyber Security Act 2024 impose duties on how you operate, not an obligation to insure. Where you must carry cover, the instrument is the agreement in front of you.
How long should I allow between signature and the evidence deadline?
Longer than you think if you are starting from no policy, because underwriting questions, disclosure and endorsements all take time. Where the deadline is tight, ask for it to be extended at signature rather than after. That request is granted far more readily before the date than after it.
Should I get a lawyer to read the whole MSA?
For a significant agreement, yes, and this checklist is not a substitute for that. What it does is let you arrive at the legal review already knowing which insurance points you are asking about, which makes the review shorter and more useful.
The client wants to be named as a beneficiary on my liability policy. Is that possible?
Not in that form. Beneficiary is a life and personal accident concept and does not translate onto a liability policy. Offer the mechanism your insurer can actually endorse, whether that is noted interest, additional insured status or a principal's indemnity extension.
Contingent Conclusion
An MSA does not hide its insurance cost in the insurance clause. It hides it in the indemnity, the liability cap and the data annex, and the schedule is simply the receipt for decisions made in those three places.
Twenty minutes gets you the four elements of the insurance clause, the three clauses upstream of it, and a calendar entry for the tail. That is enough to sign with your eyes open, and enough to make the legal review that follows worth what it costs.
Contingent helps Malaysian businesses get the cover their contracts and landlords require. Whether you're comparing options or checking whether your existing policy actually does what the contract asks, we can help.
Get a quote · or WhatsApp us directly
Related reading: our guide to professional indemnity insurance in Malaysia, PI for IT consultants and software companies, the cyber insurance guide, getting cover in place quickly for a contract or tender, professional indemnity insurance, and directors and officers liability insurance.
Primary sources: SME Corporation Malaysia for the SME definition, the Department of Statistics Malaysia for MSME performance in 2024, and the Laws of Malaysia portal of the Attorney General's Chambers for the Financial Services Act 2013 and the Personal Data Protection Act 2010.
Published by Contingent, the commercial insurance brand of Emerge Insurtech (Malaysia) Sdn. Bhd.
Disclaimer: This article provides general guidance on insurance terms in Malaysian commercial agreements as of August 2026. Insurance terms, coverage, and availability vary by insurer and risk profile. This is not a policy document, and it is not legal advice. Always consult a qualified insurance professional and, where the agreement is significant, a qualified lawyer before signing.
