Malaysia Tax Identification Number (TIN)

Detects Malaysian individual Tax Identification Numbers (TIN / Nombor Pengenalan Cukai) issued by the Inland Revenue Board of Malaysia (LHDN / HASiL). Since 2 January 2023 individual TINs use the prefix IG followed by 9-11 digits (11-13 characters total); the legacy individual prefixes SG (employment income) and OG (business income) with the same digit range remain in circulation in older records. Entity TINs (C, D, F, PT, TA and similar prefixes) are deliberately out of scope: single-letter prefixes over a digit run are too collision-prone and entity TINs are not personal data.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Medium confidence: the two-letter prefix over a 9-11 digit run is distinctive but not unique (e.g. SG also prefixes Singapore-related reference codes), so corroborating LHDN / tax keywords are required on every tier. No tier fires on the bare value alone (D1 identifier convention).
Jurisdictions: my
Regulations: Income Tax Act 1967 (Malaysia), PDPA (Malaysia)
Frameworks: ISO 27001, ISO 27701
Data categories: pii, government-id, financial
Scope: narrow
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:IG|OG|SG)\s?\d{9,11}\b

Corroborative evidence keywords

tax identification number, TIN, LHDN, nombor pengenalan cukai, income tax number

Proximity: 300 characters

Should match

TIN IG115002000 was quoted on the e-Invois submission to HASiL — Current IG prefix with 9 digits
Nombor pengenalan cukai SG10234567090 telah didaftarkan dengan LHDN — Legacy SG prefix with 11 digits
The taxpayer's income tax number OG 4040080091 appears on the Form B filing — Legacy OG prefix, space-separated, with 10 digits

Should not match

Reference IG12345678 was logged in the CRM by the agent — Only 8 digits after the prefix is too short
Company TIN C20880050010 belongs to the corporate entity register — Entity C prefix is deliberately out of scope
Code SG123456789012 exceeds the individual tax number length — Twelve digits after the prefix is too long

Known false positives

SG- and OG-prefixed codes appear in non-tax contexts (Singapore-related references, order codes, part numbers). Mitigation: Every tier requires corroborating LHDN / tax keywords within the proximity window; there is no bare value-only tier.
Sample TINs in LHDN guidance, e-Invois documentation, or tax-agent templates may match the labelled form. Mitigation: The high and medium tiers apply the template-exclusion NOT-group to suppress sample and documentation content.
No checksum is published for the digit portion, so structurally valid but nonexistent TINs cannot be excluded by regex. Mitigation: Rely on prefix structure, length bounds, and keyword evidence; the digit run is variable length so a repeated-digit filter is not applicable.