Hata exchange profile: Malaysia fees, Global funding and withdrawal controls

Hata operates a custodial exchange with a Malaysia platform built around ringgit funding, spot orders, instant purchases, recurring investment and staking. Its Global service is a separate regional offering. The shared brand and application should not be read as one universal product list or one customer agreement. This profile principally uses the Malaysian tariff and identifies Global funding separately.[1]

Account allocation follows the country and identity details supplied during verification. Hata’s March 2026 guide explains that a newly registered customer may receive access only to the appropriate regional platform, rather than automatically to Hata Global. Malaysia uses MYR and Global uses USD. A visible switch or a globally accessible website therefore does not establish eligibility for both accounts.[21]

The order guide describes IOC as filling immediately to the extent possible and cancelling the remainder, while FOK requires an immediate complete fill. Iceberg orders cannot use those two time conditions; the documented total-to-visible quantity ratio cannot exceed ten.[24]

The terms qualify GTC: unexecuted open orders expire after 90 calendar days.[5]

The tariff recalculates rolling volume daily across markets in the primary currency. Its published band boundaries are reproduced above; the account screen resolves fractional boundary cases. An illustrative RM1,000 taker execution at 0.40% costs RM4, before funding costs or price movement.[4]

The send guide distinguishes a network charge from trading commission. A zero maker rate therefore says nothing about the eventual cost of moving coins to an external wallet. Compare the exact supported chain, minimum, displayed send fee and amount arriving at the destination; choosing a cheaper incompatible network can make the transfer unrecoverable.[15]

The bank-withdrawal guide starts in the MYR wallet and uses a registered local bank account. Check the bank details, amount and authentication request before confirming. A submitted instruction and the receiving bank’s completed credit are separate stages; retain the transaction record until both reconcile.[11]

The pending-withdrawal guide quotes 0–12 hours for MYR and 0–5 business days for USD SWIFT, with compliance checks, manual bank processing and queues capable of delaying completion. It invites support contact after 12–24 hours pending. A separate SWIFT FAQ gives 1–4 business days. These differing published estimates should be treated as guidance, not a guaranteed delivery deadline.[12][13]

Those deposit examples are explicitly subject to change. The same guide warns that a below-minimum transfer may never be credited and that some other assets incur address-creation or deposit charges. Read the current asset/network instructions before sending, including any destination tag, rather than assuming the sample thresholds cover every coin.[14]

Global customers also need to account for the wallet migration dated 13 March 2025. The FAQ, republished in August 2026, says the old addresses no longer support automatic crediting. Obtain the current address from Receive and replace saved withdrawal destinations elsewhere. Support may attempt recovery from an old address, but it can involve fees, several days or longer and no guaranteed success. The notice concerns Global wallets, not a universal Malaysia address replacement.[16]

Hata’s security page says customer balances are maintained one-for-one, separated from operating funds, with fiat held through a licensed trustee. These are company disclosures; the page does not establish a separately audited customer-specific reserve reconciliation or an insurance entitlement. It also lists transaction authentication, alerts and monitoring. App Lock is labelled forthcoming on that page and should not be treated as a verified live feature.[6]

The terms permit pooled addresses and Hata-controlled keys while asserting customer ownership. Customers aged 55 or older at onboarding have crypto sends disabled by default.[5]

The terms require applicants to be at least 18.[5]

Personal verification collects residence, nationality and tax-residency details, identity documentation and a live facial check. Malaysian customers use NRIC; non-Malaysians may use a passport under the guide. Address and source-of-funds or source-of-wealth evidence can also be requested. The ten-attempt daily ceiling leads to a 24-hour retry wait; a short form-completion estimate is not a promise of immediate approval.[20]

Hata’s March country guide lists restricted territories including Iran, North Korea, Syria, Cuba and Crimea and says restrictions can change. That is the platform’s own eligibility list, not a complete statement of current sanctions law. Its compliance policy also provides for risk-based due diligence and transaction monitoring, so initial verification does not pre-clear every future transfer.[23][9]

Businesses apply using the corporate account type, which cannot be changed after registration. Required material includes incorporation, directors/shareholders, business address, source of funds and wealth, authorised signatory/board records and relevant licences. Owners with at least 25% require identification. The business guide estimates one to two weeks or longer for review; funds should not be scheduled around a guaranteed approval date.[22]

Unused fiat may incur US$2 monthly after six months. Separate 24-month dormancy provisions follow unmet closure instructions. Voluntary closure requires balances below US$10 and 30 transaction-free days; residuals are retained. Under the terms, where Hata elects to terminate, eligible crypto above US$10 is liquidated to fiat and fiat return is capped at cumulative fiat deposits. Obtain written clarification before closing, particularly for gains or an intended external-wallet transfer.[5]

Ordinary account recovery uses the application’s Help Centre or Contact Support flow. A ticket can include a description and PDF, JPG, PNG or TIFF supporting material. The reset procedure makes clear that verification differs by account circumstances. Preserve the issue, time and transaction reference so that the agent can distinguish a login failure, a security hold and an already-submitted transfer.[19]

Formal complaints follow a staged written process. The policy targets acknowledgement within seven business days once the complaint is complete and complex-case resolution within fifteen, with updates for extensions. A review request is due within seven days of the resolution notice; the next stage targets acknowledgement in three business days, manager review in fifteen and committee review in twenty. These clocks are conditional process targets, not guaranteed reimbursement.[8]

The complaints policy describes Malaysian mediation and AIAC arbitration, subject to its escalation requirements and applicable rights. It also contains a one-year contractual period after the final manager decision for legal action. Preserve the applicable agreement and seek prompt clarification of deadlines rather than assuming an ordinary support exchange pauses them.[8]

The continuity policy provides for public status communication and recovery planning, but contains different seven-day and thirty-day recovery objectives. Neither should be presented as an uptime service-level guarantee or a commitment to execute a trade by telephone during an outage. Reconcile outstanding orders and transfers once access returns; the reviewed continuity document establishes no alternate dealing desk.[7]

The Securities Commission Malaysia’s current digital-assets page independently lists HATA Digital Sdn Bhd among recognised market operators for digital-asset exchanges. This verifies the named Malaysian operator and category. It does not confer the same status on Hata Capital Limited, the Singapore entity, every token or services available through a Global account. The inspected listing does not display a standalone licence number.[2]

Hata’s 20 April 2026 financing announcement reported more than 209,000 registered users by the end of 2025, RM1.04 billion in 2025 transaction volume and RM86.3 million in assets under custody at year-end. It also cited a September peak of RM115 million. These are company-reported measures over different periods; registered accounts are not active traders, and annual transaction volume is not current daily spot turnover.[3]

The same release announced an US$8 million Series A led by Bybit and named David Low as chief executive and Darien Ng as chief strategy officer. Bybit’s investment does not justify importing its customer numbers or permissions into this profile. Hata’s reported user series runs from its May 2023 launch through December 2025.[3]

Operator

Hata Digital Sdn. Bhd.; other entities by region

Exchange model

Centralised

Service scope

Malaysia MYR platform and separate Global access; spot, recurring purchases and staking.

Client types

Retail clients; Institutional clients

Pricing publication

Public and quoted pricing

Pricing scope

Published spot tiers; instant, card and network costs depend on the transaction.

Funding scope

Malaysia FPX, eWallet and local banks; eligible Global accounts use USD SWIFT.

Custody and asset handling

Hosted crypto and fiat balances; segregation described by the company.

Client eligibility

Regional allocation follows identity verification; Global access is not automatic.

Support

Help-centre tickets and a staged written complaints process.

Authorisation and registration scope

SC Malaysia lists HATA Digital Sdn Bhd as a digital-asset exchange operator; this does not cover every group service.

Exchange metadata checked 20 Oct 2026Source 1Source 2Source 4Source 5Source 6Source 8Source 13Source 21Source 22

Recurring purchases need a distinction between wallet-funded plans and card funding. The general Auto-Invest page advertises a RM30 minimum and up to five plans. A plan can be paused or cancelled, but a schedule does not guarantee an execution when its funding source is unavailable.[29]

For Malaysian debit-card Auto-Invest, the August FAQ instead requires at least RM100 per cryptocurrency and states a RM30,000 maximum. It accepts domestic Malaysian Visa or Mastercard debit cards; credit and overseas-issued cards are excluded. A declined charge means that scheduled purchase is not executed. Terminate a linked active plan before removing the card, and review the fee displayed when creating the instruction.[30]

Staking adds protocol and liquidity conditions to ordinary custody. The staking agreement describes 14-, 30-, 60- and 90-day terms, forfeiture of accrued rewards for early unstaking, and possible network withdrawal queues. It expressly allocates slashing risk to the customer and does not guarantee rewards. The agreement mentions SOL and ATOM, whereas the inspected current product page expressly advertises SOL; the contract’s example list alone does not establish a live ATOM offer.[32][31]

The June Buddy Bonus terms require eligible individual KYC accounts, a valid code entered within thirty days, qualifying activity within ninety days and maturity of any qualifying stake. Business/KYB accounts are excluded. Rewards depend on approval and the campaign’s current thresholds; the terms describe them as non-transferable and not redeemable for cash unless Hata decides otherwise. An indicative ringgit value is therefore not an unconditional cash-withdrawal entitlement.[33]

The API help page does not supply a complete endpoint-permission matrix or an autonomous AI mandate. A secret that is lost must be replaced by deleting and recreating the key. Define and verify the allowed operations before connecting software; the platform’s recurring-buy instructions are explicit schedules, not evidence of discretionary portfolio management.[26]