Blogs

How Malaysian companies strengthen HR onboarding with eKYC and digital signatures

November 5, 2025
by Wan Muhammad Syafiq

In today’s remote-friendly workplace, HR onboarding happens almost entirely online.
Offer letters, contracts, and policy forms move faster than ever – but one crucial question remains:

“How do we know who’s really signing?”

A typed name or an uploaded signature image can’t confirm identity.

That’s why modern HR onboarding now combines eKYC (electronic Know-Your-Customer) with digital signatures.

Together, they verify who signs, when, and how – giving HR teams confidence that every document is legitimate, compliant, and protected.

Why identity verification matters in HR

Your HR system can send documents instantly.

Employees can click “I agree” in seconds.

But do you actually know who clicked that button?

In traditional offices, HR could check an IC in person, witness the signature, and file the physical document.

In hybrid or remote work, that verification layer disappears – creating a dangerous gap between convenience and compliance.

The growing threat landscape

Identity fraud during the hiring process is rising worldwide (1). According to global HR reports:

Fraud rates increased from 1.1% in 2021 to 2.5% in 2024. (2)
77% of companies found discrepancies in candidate data last year. (3)
Identity fraud cases more than doubled between 2019–2020 (4)

As New Straits Times reported, three-quarters of Malaysians now fear becoming victims of identity theft – a sign of how deeply fraud has entered everyday life. (5)

While these scams often target jobseekers, they highlight a wider problem: identity manipulation can happen on both sides of hiring.

What’s at stake when verification fails

Legal & compliance exposure

Contracts signed by unverified individuals may fail in labour disputes.
Wrong IC details cause issues with EPF, SOCSO, and LHDN reporting.
Hiring without valid permits violates Malaysian immigration laws.
Under the Employment Act 1955, employers must maintain verified employee records.

Financial & operational risk

Payroll errors when IC data doesn’t match bank records.
Costs from terminating or rehiring after false credential discoveries.
Data breaches if unverified individuals access company systems.

Reputational damage

Public fraud cases harm employer branding.
Loss of trust among genuine employees.
Difficulty attracting quality talent.

Remote work has changed the game

Identity verification becomes even harder when new hires never visit the office.

Video calls can’t confirm document authenticity, and scanned ICs can be edited easily.

Traditional methods break down when:

Employees work across states or countries.
Physical checks aren’t practical.
HR relies on manual uploads instead of secure verification.

Companies adopting digital identity verification report up to 50% faster onboarding – without sacrificing security. (6)

The common misunderstanding: Electronic ≠ digital signature

Many HR teams assume that using online tools means their signatures are legally valid.

But in Malaysia, that’s not always true.

Type	What it means	Legal strength
Electronic Signature	A typed name, scanned image, or “click-to-approve” action	Shows intent but no verified identity
Digital Signature	Issued by a licensed Certification Authority (CA) with verified identity and encryption	Legally binding under Digital Signature Act 1997

If your onboarding process only uses inserted or uploaded signatures, it’s still electronic, not digital.

In a dispute, such signatures may not hold up in court – there’s no proof of who signed or whether the document was altered later.

That’s why HR departments are now adopting eKYC + digital signature solutions.

They verify every signer’s identity and ensure HR documents are enforceable under Malaysian law.

How eKYC works in employee onboarding

eKYC uses digital tools to confirm an employee’s identity before the system allows signing.

The process:

Document capture
- The employee uploads their MyKad or passport.
Liveness detection
- A selfie or face scan confirms they’re real.
Data matching
- The system validates MyKad details with HR records.
Digital signature issuance
- Once verified, the employee signs under DSA 1997 compliance.

It takes minutes – faster than manual checks, yet far more secure.

From eKYC to legally binding signatures

After eKYC verification, a Digital Signature Certificate (DSC) is issued by a licensed Malaysian CA (MSC Trustgate, Pos Digicert, or Raffcomm Technologies Sdn Bhd).

That certificate links the verified identity to a cryptographic key.

When the employee signs, the system:

Locks the document from edits.
Adds a timestamp and digital fingerprint.
Records every action in a traceable audit log.

The result:
A tamper-proof, DSA-compliant document that’s both fast and fully auditable.

For large companies – Integrate eKYC seamlessly

Enterprises using Workday, SAP, or Lark already manage data digitally, but most lack legally verified signing.

By integrating SigningCloud’s eKYC + Digital Signature API, HR teams can:

Trigger identity verification at the start of onboarding.
Auto-send signing invitations once eKYC is complete.
Sync verified contracts back into the HRMS automatically.

Benefits include:

Speed: Onboarding in minutes, not days.
Legal assurance: Verified under DSA 1997.
Audit confidence: Complete trail from verification to signature.
Data accuracy: Automated extraction prevents manual entry errors.

This closes the final gap between digital convenience and legal trust – every hire becomes verifiable and compliant.

For SMEs – Protect the company from risk

Most SMEs still onboard via email, PDFs, and shared folders – exposing themselves to fake signatures and disputes.

With eKYC-verified Digital Signatures, small teams can achieve enterprise-level protection without expensive systems.

Using SigningCloud, HR can:

Verify new hires via MyKad or passport instantly.
Send secure signing links by email or mobile.
Receive timestamped, verified contracts within minutes.

“We may be a small company,” said one HR manager,

“but now every document we sign can stand in court if needed.”

Compliance simplified: Malaysia’s legal framework

Regulation	What it ensures	Why it matters for HR
Digital Signature Act 1997 (DSA)	Legal validity of digital signatures from licensed CAs	Ensures contracts & NDAs are enforceable
Electronic Commerce Act 2006 (ECA)	Recognition of electronic records	Supports digital document retention
Personal Data Protection Act 2010 (PDPA)	Secure processing of personal data	Protects employee information during eKYC
Employment Act 1955	Proper documentation of employment	Requires verified, traceable employee records

These four Acts form the legal backbone of HR digitalization in Malaysia.

Actionable takeaways for HR leaders

Verify before you sign
- Build eKYC into your onboarding workflow.
Use DSA-compliant platforms
- Only signatures from licensed CAs are legally valid.
Integrate early
- Connect eKYC APIs with your HRMS to automate verification.
Protect data under PDPA
- Store signed records securely and encrypted.
For SMEs
- Adopt lightweight eKYC + digital signing to prevent disputes and protect your business reputation.

Conclusion

HR onboarding today is not just about speed – it’s about trust, verification, and compliance.

With eKYC + Digital Signatures, every hire can be verified in minutes and signed with legal confidence.

For large companies, integration brings end-to-end compliance.

For SMEs, it’s an affordable way to protect both people and the business.

The future of HR onboarding in Malaysia is clear: verified, secure, and digitally signed.

References:

Wan Muhammad Syafiq

E-Signature Expert. Syafiq aim to help organizations modernize their document processes through secure & compliant digital signature solutions. With a strong understanding of e-signature adoption, he committed to deliver value-driven solutions tailored to each client’s unique workflow.

Share this article