RBA Code of Conduct v8.0 · Malaysia Compliance

RBA Compliance & SMETA Audit Readiness for Malaysian Employers (2026 Guide)

Q: Must employers reimburse migrant worker recruitment fees?

Yes. Under the Employer Pays Principle, aligned with ILO Convention No. 181, workers must not bear recruitment costs. If fees were previously charged, employers must implement a documented reimbursement programme — failure is often classified as a PNC.

Meet global buyer requirements and pass RBA and SMETA audits with confidence. We help Malaysian employers achieve full compliance with the Responsible Business Alliance Code of Conduct v8.0 — labour standards, foreign worker protection, and ethical supply chain practices.

Get Audit-Ready — Free Consultation View Compliance Checklist

1 PNCCan Suspend All Business

30–90dTo Close Major Non-Conformances

2 yrsVAP Certificate Validity

v8.0Current CoC Version

RBA Meaning — Quick Answer

RBA stands for Responsible Business Alliance. It is the world's largest industry coalition for corporate social responsibility in global electronics, retail, automotive, and manufacturing supply chains — formerly known as the Electronic Industry Citizenship Coalition (EICC). RBA compliance means an employer's labour, health & safety, environmental, and ethics practices meet the RBA Code of Conduct, typically verified through an RBA Validated Audit Process (VAP) or SMETA audit.

Overview

What Is RBA (Responsible Business Alliance)?

RBA stands for Responsible Business Alliance — formerly the Electronic Industry Citizenship Coalition — the world's largest industry coalition for corporate social responsibility in global supply chains. Its member companies span electronics, retail, automotive, and manufacturing.

In Malaysia — a major hub for electronics manufacturing and EMS — RBA compliance is a contractual and commercial prerequisite for supplying global brands. Malaysian facilities are typically assessed through the RBA Validated Audit Process (VAP) or SMETA (Sedex Members Ethical Trade Audit) — many customers accept either framework.

RBA CoC compliance is not a Malaysian statutory requirement, but it's embedded in supplier contracts. Non-compliance triggers audit failures, corrective action plans, business suspension, and contract termination.

Administered By

The Responsible Business Alliance, headquartered in Washington D.C., with global audit programmes managed through EICC-ON and the Validated Audit Process (VAP).

Legal & Commercial Authority

RBA CoC compliance is embedded in supplier contracts and purchase orders — non-compliance affects business continuity, not government prosecution.

Non-Conformance Risk

What a Failed RBA or SMETA Audit Actually Costs You

Non-conformances are graded by severity. A single Priority Non-Conformance can suspend all business with a customer immediately.

Priority Non-Conformances (PNCs) — Immediate Business Risk

A single PNC can result in immediate business suspension. Priority issues include:

Forced labour — debt bondage, passport confiscation, or involuntary recruitment fees
Child labour — workers under the legal working age or under 15 years old
Life-threatening safety conditions — blocked emergency exits, inadequate fire suppression
Wage theft or human trafficking indicators

Classification	Definition	Typical Customer Response
Priority Non-Conformance (PNC)	Immediate, serious risk to worker health, safety, or fundamental rights	Business suspension or shipment hold; full closure required before reinstatement
Major Non-Conformance	Systemic failure or repeated minor findings	Corrective Action Plan (CAP) required within 30–90 days
Minor Non-Conformance	Isolated, partial failure without systemic breakdown	CAP submission; closure verified at next audit cycle
Observation	Potential risk or emerging gap, not yet a violation	Documented for continuous improvement

The Five Pillars

RBA Code of Conduct v8.0: Core Principles

Each pillar contains specific standards that Malaysian facilities must implement and demonstrate during audits.

Pillar A

Labour

Freely chosen employment, young worker protection, working hours (max 60 hrs/week), wages & benefits, humane treatment, non-discrimination, freedom of association.

Pillar B

Health & Safety

Occupational safety, emergency preparedness, industrial hygiene, machine safeguarding, and dormitory & canteen standards.

Pillar C

Environment

Environmental permits, pollution prevention, hazardous substances, solid waste, air emissions, energy & water conservation.

Pillar D

Ethics

Business integrity, anti-bribery, disclosure of information, intellectual property, responsible minerals sourcing, privacy protection.

Pillar E — Management Systems

Company commitment, management accountability, legal & customer requirements, risk identification, training, worker feedback, internal audits, corrective action processes, documentation, and supplier responsibility — the infrastructure that makes the other four pillars sustainable rather than one-off.

Employer Pays Principle

Zero-Fee Recruitment & ILO Convention No. 181 Alignment

RBA's Employer Pays Principle requires that no worker ever pays for their own job.

Under the RBA Code of Conduct's Employer Pays Principle, recruitment fees, transport, and placement costs must be borne entirely by the employer, never the worker. This directly reflects the fee-charging restrictions set out in ILO Convention No. 181 on Private Employment Agencies, which prohibits agencies from charging workers directly or indirectly for job placement.

Andaraya operates a strict zero-fee-to-worker policy on every placement, aligned with both the RBA Employer Pays Principle and ILO Convention No. 181. Where legacy fees were charged prior to engagement, we support employers in building a documented reimbursement programme to close the gap before an audit.

What "Employer Pays" Covers

Recruitment agency fees
Pre-departure medical exams (FOMEMA)
Visa, permit & documentation costs
Transport from home country to worksite
PPE and mandatory training

Where RBA Exceeds Malaysian Law

Why Passing JTKSM Inspection Isn't the Same as Passing an RBA Audit

Where local law and RBA requirements differ, facilities must meet whichever standard is more protective of workers. In practice, RBA routinely exceeds Malaysian legal minimums.

Topic	RBA CoC v8.0 Requirement	Malaysian Local Standard
Recruitment fees	Zero fees to workers; employer must verify & reimburse (Employer Pays Principle)	Employment Act 1955 restricts deductions but doesn't mandate overseas reimbursement
Weekly working hours	Max 60 hrs/week including overtime, 1 rest day in 7	Up to ~74 hrs/week in practice (48 regular + 104 OT/month)
Dormitory freedom of movement	No curfews or lockdowns during non-working hours	Not explicitly regulated under
CCTV in private areas	Strictly prohibited in sleeping areas, bathrooms, changing rooms	PDPA 2010 doesn't explicitly prohibit this
Supplier flow-down	Tier 1 suppliers must acknowledge and comply with RBA CoC	No statutory equivalent

Audit Process

How SMETA & RBA VAP Audits Work: Step-by-Step

Typical RBA VAP duration: 1–3 days on-site depending on facility size.

1. Complete the Annual RBA Self-Assessment Questionnaire

2. Internal Pre-Audit Mock Assessment

Systematic internal gap analysis across all five CoC pillars, ideally with an experienced third-party consultant.

3. Documentation Package

12 months of payroll, working hours data, training records, safety incident logs, environmental reports, and dormitory registers.

4. Brief Management & Worker Representatives

Workers must understand they may be interviewed confidentially and aren't required to seek permission to speak freely with auditors.

5. Corrective Action Plan (CAP)

Prioritise PNCs for immediate closure, assign owners and deadlines, and submit CAP within the customer-specified deadline — typically 30 days.

Compliance Checklist

RBA CoC v8.0 Self-Assessment Checklist

A. Labour

No employer retention of passports
Recruitment fee reimbursement documented
Working hours within RBA limits (max 60 hrs/week)
Accessible, confidential grievance mechanism

B. Health & Safety

Current HIRARC risk assessments
Valid BOMBA fire certification
Workers free to exit accommodation off-hours
Dormitory inspection records maintained

D. Ethics & Data

Anti-bribery policy implemented
Annual RBA SAQ completed
No CCTV in dormitories or private areas
Whistleblower channel established

Worker Accommodation (B6 & Act 446)

Valid Certificate of Accommodation
Individual beds, no sharing
Workers free to leave accommodation
Evacuation plan in workers' languages

How We Help

How Andaraya Keeps You Audit-Ready

We support employers before, during, and after RBA and SMETA audits — not just at recruitment stage.

Gap Assessments

Pre-audit review against all five RBA CoC pillars, benchmarked against your customer's specific SAQ requirements.

Documentation Review

Payroll, working-hours, training, and dormitory records checked and organised into an audit-ready package.

Worker Interview Preparation

Briefings so workers understand their rights during confidential auditor interviews, in their own language.

Corrective Action Support

CAP drafting and follow-through on PNCs and Major Non-Conformances, tracked against customer deadlines.

FAQ

RBA & SMETA Compliance FAQ

What does RBA mean?

RBA stands for Responsible Business Alliance — the world's largest industry coalition for corporate social responsibility in global electronics, retail, automotive, and manufacturing supply chains. In Malaysia, RBA compliance is a contractual requirement for suppliers to RBA member brands, assessed through the RBA Validated Audit Process (VAP) or SMETA.

Is RBA CoC compliance legally required in Malaysia?

Not a statutory requirement — but it's contractually required by RBA member brands. Non-compliance risks business loss rather than direct government penalties, though many RBA standards overlap with the Employment Act 1955, OSHA 1994, and Act 446, so violations can still trigger local enforcement.

How often are RBA audits conducted?

RBA VAP audit certificates are typically valid for two (2) years. Customers may still require annual Self-Assessment Questionnaires and can request interim audits after incidents or operational changes.

What's the difference between a PNC and a Major Non-Conformance?

A Priority Non-Conformance indicates immediate, severe risk — forced labour or critical safety issues — and may lead to suspension. A Major Non-Conformance reflects systemic failure but typically allows a corrective action period.

Must employers reimburse migrant worker recruitment fees?

Yes. Under the Employer Pays Principle — aligned with ILO Convention No. 181 — workers must not bear recruitment costs. If fees were previously charged, employers must implement a documented reimbursement programme — failure is often classified as a PNC. Our zero-fee recruitment process is built around this principle from the outset.

Do RBA requirements apply to contract and agency workers?

Yes. RBA CoC applies to all workers at the facility — direct employees, contract staff, agency workers, and temporary personnel.

Can RBA audit results be shared with multiple customers?

Yes. RBA VAP reports are uploaded to the EICC-ON platform and can be shared with multiple customers, reducing duplicate audits.

Related Resources

Preparing for an RBA or SMETA audit?

Gap assessments, risk analysis, documentation review, worker interview preparation, and corrective action planning — book a confidential consultation.

Get Audit Readiness Support Contact Us Back to Homepage