Investor Readiness Legal Audit: What a Malaysian Startup Must Fix Before a Term Sheet

An investor readiness legal audit reviews four things before a startup starts fundraising: whether the statutory register of members matches the cap table, whether the company actually owns its IP, whether equity and option promises were properly approved, and whether the material contracts and data-handling position will survive an investor's due diligence. The point is timing — every one of these is cheap to fix on your own schedule and expensive to fix on the investor's. This article covers what the audit checks, the Companies Act 2016 mechanics behind the gaps founders miss most often, and what leaving them for diligence to find actually costs.

Most founders prepare for a raise by rehearsing the pitch deck and stress-testing the model. The legal position gets examined for the first time when the investor's lawyers send the diligence request list — and by then, every gap they find is a negotiating point for them, not a task on your list.

What does an investor readiness legal audit actually check?

It is the mirror image of the diligence exercise an investor's own counsel will run, done from the company's side and before the process starts — the same fundraising process our complete legal guide to raising capital in Malaysia walks through end to end. See our guide to red flags in legal due diligence for what the other side is trained to look for. In practice it covers:

• Corporate records, statutory registers and shareholding history

• Founder and employee equity arrangements, including anything promised but never constituted

• Whether the company’s intellectual property is actually owned by the company

• Material customer, supplier and financing contracts

• Regulatory exposure, including data handling

Why does the cap table usually fail first?

Section 50 of the Companies Act 2016 requires every company to keep a register of members recording who holds what, and the date of every allotment. Section 77 separately requires the company to register an allotment in that register within fourteen days of the allotment. Section 78 requires a return of allotment to be lodged with the Companies Commission of Malaysia (SSM) within the same fourteen days, stating the number, class and amount paid on the shares allotted. That is two distinct fourteen-day duties, not one, and both are commonly missed when shares are issued informally between funding rounds.

Two adjacent questions usually come up at the same point in this process: see legal due diligence for institutional investors and cap table structuring for malaysian startups for how each is handled.

When a startup's working cap table — the spreadsheet everyone actually uses — does not match the statutory register, an investor's counsel treats the mismatch itself as the finding. Reconciling the two, and lodging whatever was never lodged, is exactly what our investor readiness legal audit checks first. Our guide on structuring a company's share cap table covers the mechanics in more depth.

Who actually owns the IP?

Section 26(2) of the Copyright Act 1987 sets the default rule: where a work is commissioned by someone other than the author’s employer, or is made in the course of the author’s employment, ownership is deemed to transfer to the commissioning party or the employer — subject to any agreement between the parties saying otherwise. That default does real work for employees. It is a weaker safety net for contractors and freelance developers, because whether a given engagement actually counts as “commissioned” within the meaning of the section turns on the facts of that engagement, not on a founder's assumption that it obviously does.

The reliable fix is the same either way: a signed assignment from every founder, employee and contractor who has touched the product, taken before the round rather than argued about during it. Relying on the statutory presumption instead of a signed document is the single most common finding in this part of the audit.

Can the company actually raise the way it is planning to?

A private company limited by shares with no more than fifty shareholders can register, convert to, or remain a private company under section 42 of the Companies Act 2016 — but section 43 then prohibits a private company from offering shares or debentures to the public, allotting shares with a view to a public offer, or inviting the public to deposit money with it. Unless the contrary is proved, an allotment or an agreement to allot is presumed to have been made with a view to offering those shares or debentures to the public if a public offer follows within six months of the allotment, or before the company has received the whole of the consideration for them.

Section 43(3)(c) carves out offers made in accordance with arrangements prescribed by the Securities Commission on a market regulated under the Capital Markets and Services Act 2007 — the basis on which equity crowdfunding and P2P platforms operate lawfully. Our guide to how equity fundraising works in Malaysia walks through the routes available and where each one sits against this exemption. The Securities Commission's own guidelines set the current fundraising and investment limits for equity crowdfunding; those limits are revised from time to time, so confirm the figure in force before relying on it in a raise.

Is the option pool actually enforceable?

Section 75 of the Companies Act 2016 requires prior shareholder approval, by resolution, before directors can exercise any power to allot shares, grant rights to subscribe for shares, convert a security into shares, or allot shares under an agreement or option. An option pool that exists as a number in a deck, or as promises made to early hires, is not a binding company action until that resolution has been passed and the scheme is properly constituted. Investors read an unconstituted pool as founder dilution still waiting to happen — because it is.

Does the company's data handling create exposure?

The Personal Data Protection (Amendment) Act 2024 introduced a mandatory Data Protection Officer appointment duty and a mandatory data breach notification duty. Both took effect on 1 June 2025, alongside the Commissioner's guidelines on each. A DPO must be appointed once a business processes the personal data of more than 20,000 data subjects, or sensitive personal data — including financial information — of more than 10,000 data subjects, or carries out activities requiring regular and systematic monitoring of personal data. A notifiable breach must be reported to the Commissioner as soon as practicable and no later than 72 hours after the breach occurs, and to affected individuals no later than seven days after that notification, where the breach causes or is likely to cause significant harm or affects more than 1,000 data subjects. A product collecting more data than the founders think it does is a common and avoidable finding at exactly this stage.

What gets flagged, and what it costs to fix at each stage

What it actually costs to let diligence find these first

None of this is theoretical once a term sheet is signed. A mismatched register or an unassigned piece of IP does not usually kill a round outright — it gets priced. Investors reprice around the risk, hold part of the consideration back in escrow until it is fixed, or push the closing out by however many weeks it takes counsel to clear the finding. The founder is fixing the same problem either way; the only variable this audit controls is who is holding the leverage while it gets fixed. Fixed in advance, it is a task. Found in diligence, it is a term.

Frequently Asked Questions

What does an investor readiness legal audit check?

Corporate records and statutory registers, founder and employee equity arrangements including anything promised but never constituted, whether the company actually owns its IP, the material contracts a buyer or investor would want to see, and the regulatory position — then a prioritised list of what to fix.

When should a startup have this done?

Before the fundraising process starts, ideally a few months ahead, so there is time to fix what the audit finds without doing it under a diligence deadline.

Does fixing these issues actually speed up a raise?

Usually. Clean diligence moves faster and gives the investor's counsel fewer openings to renegotiate terms once they have already been agreed in principle.

What if IP was built by a contractor who has since left?

An assignment can still be obtained after the fact, but it is harder to negotiate without the leverage a current engagement gives you, and sometimes needs a goodwill payment or a renegotiated term. Whether that is worth it turns on how central the work is to the product, which is a fact-specific call rather than a general rule.

Does the audit also cover whether contractors are actually employees?

It flags the question where it arises, because a contractor doing employee-like work raises both an employment classification issue and an IP ownership issue at the same time. Resolving the underlying employment position is a separate exercise from the audit itself.

Getting the audit done before the process starts

Every item above is a page in your own diligence file rather than a line in the investor's. Legal That Works runs an investor readiness legal audit across corporate records, founder and employee arrangements, intellectual property, material contracts and regulatory position, with a prioritised list of what to fix before the process begins. If a raise is on the horizon, do this before the deck goes out, not after the first term sheet lands.

This article is for general information only and does not constitute legal advice. Every transaction and every set of facts is different. Obtain specific advice from a qualified adviser before acting on any part of it.

Related guides

• Legal Due Diligence for Institutional Investors

• Cap Table Structuring for Malaysian Startups

• Investment and Subscription Agreements in Malaysia

• Equity Crowdfunding Compliance in Malaysia

• Transmission of Shares in Malaysia

• Asset Purchase Agreements in Malaysia