Vetting a Malaysian SEO agency properly takes about 170 minutes per agency and costs RM15 to RM25 in SSM document fees. Everything else is free. You are checking three things in twelve questions: that the business legally exists, that the work is real, and that you can leave. The one that costs the most to get wrong is the Four Account Test: Search Console, GA4, Google Business Profile and the domain registrar must all sit in accounts you own, with the agency added as a user. Fail it and you can lose up to 16 months of search history the day you switch providers, because that is Google’s hard retention limit and there is no recovery route.
What you need before you start
Quick Answer: You need an SSM e-Info account, a Google account that will permanently own your marketing properties, your current Search Console and GA4 login details, and about 170 minutes per agency. Total cash cost is RM15 to RM25.
| What | Cost | Why |
|---|---|---|
| SSM e-Info account (ssm-einfo.my) | Free to register | Basic registration number and status search |
| SSM company profile, non-certified | RM15 to RM25 per document | Directors, shareholders, incorporation date, active or struck off |
| MySST registration status lookup | Free | Confirms whether the agency can legally charge you 8% |
| MyInvois verification | Free | Confirms an e-invoice is real |
| Search Console, GA4 and Business Profile access | Free | You are auditing who currently holds what |
| Your own Google account for ownership | Free | Use a company address, never a personal Gmail or a staff member’s |
| Time | About 170 minutes per agency | 510 minutes across a shortlist of three |
Fees per SSM e-Info and MyData-SSM published rates, retrieved 2 September 2026. One source lists the non-certified Company Profile (ROC) at RM15.40. Time estimates are the author’s working budget for the process below, not measured data.
Set against what you are deciding, that is a rounding error. A RM3,000 retainer runs to RM3,240 a month with service tax and RM38,880 across twelve months. Spending RM25 to check it is one ringgit of verification per RM1,555 at risk. Almost nobody does it.
Why this works
Quick Answer: These twelve questions work because most of them can be verified independently, without the agency’s cooperation, on free government and Google systems. A question that can only be answered by the person selling to you is not a vetting question. It is a sales prompt.
That distinction is the whole method. Google’s own hiring documentation recommends interviewing your prospective SEO and checking their business references, which is sound but relies on what the agency chooses to tell you. Malaysia gives you something better: a public registry lookup for the entity, a public tax registration lookup, and an invoice validation system. Three of the twelve questions below can be checked in a browser tab before you reply to the proposal.
The second reason has to do with liability. Google’s documentation states plainly that you are responsible for the actions of any company you hire, and that an agency creating deceptive content on your behalf can get your site removed from the index entirely. It also states that no one can guarantee a number one ranking. So the risk you are managing is not only wasted money. It is a site you own, damaged by decisions you did not make, with no recourse against a vendor whose registration number you never checked.
The third reason is structural. Google Search Console retains Performance data on a rolling 16-month window and permanently deletes anything older, with no retroactive recovery. Google Business Profile requires a new owner or manager to wait seven days before they can remove other users or transfer primary ownership. Those two mechanics mean access decisions made casually at signing become expensive and slow to unwind later. Vetting is cheap. Unwinding is not.
Key takeaway: Prioritise the questions you can verify without the agency. Those are the ones that catch problems before you have signed anything.
Phase 1: Verify the business exists (20 minutes)
Question 1: What is your SSM registration number?
Quick Answer: Ask for the registration number in the proposal itself, then check it on SSM e-Info. You are confirming the entity is active, not struck off, and has existed longer than the case studies it is showing you.
A good answer is a 12-digit number supplied without hesitation, matching the name on the quotation. A bad answer is a company name with no number, a number that returns a different trading name, or a Sdn Bhd registered three months ago presenting four years of case studies.
Verify it yourself. Register at ssm-einfo.my, search by name or registration number, and buy the non-certified company profile for RM15 to RM25 if the basic search raises questions. The profile shows incorporation date, directors, shareholders and status. Compare every field against the proposal, the website and the business card.
Done looks like: an active status, an incorporation date that predates the earliest case study, and a company name that matches the quotation exactly.
Common mistake: accepting the number without searching it. The number on a proposal is a claim until you look it up. Our guide to SSM registration fees and what each entity type means explains what you are looking at, and the comparison of sole proprietorship, Sdn Bhd and LLP covers why the structure changes what recourse you have.
Question 2: Are you registered for service tax, and is your quote inclusive or exclusive of 8%?
Quick Answer: Ask for the SST registration number if they are charging the tax, then check it free on the Royal Malaysian Customs MySST registration status inquiry at sst01.customs.gov.my/account/inquiry.
Malaysia’s standard service tax rate has been 8% since 1 March 2024, and providers of taxable services must register once annual taxable turnover exceeds RM500,000. An agency billing RM3,000 a month crosses that at roughly 14 retained clients, so plenty of small Malaysian agencies are legitimately below the threshold and should not be charging it at all.
The lookup takes under a minute. Select SST registration number or business registration number, enter it, complete the captcha. A registered provider returns a business name, effective date and registration status. An unregistered one returns No Record Found.
Done looks like: either a confirmed registration matching the invoicing entity, or a clear statement that they are below the threshold and their price carries no tax line.
Common mistake: paying an 8% line item nobody checked. On a RM3,000 retainer that is RM240 a month and RM2,880 a year. If the lookup returns No Record Found and the invoice still shows a tax line, stop and ask before you pay.
Question 3: Can you issue a MyInvois-validated e-invoice?
Quick Answer: Ask directly, and accept either answer as long as it is specific. Phase 4 of the mandate covers businesses with RM1 million to RM5 million turnover from 1 January 2026, and the Cabinet raised the permanent exemption to RM1 million on 6 December 2025, cancelling the planned final phase.
A larger agency should be issuing validated e-invoices. A genuinely small one may be exempt. What you are testing is whether they know which applies to them, because an agency that cannot answer a basic question about its own tax position is unlikely to be rigorous about yours. Validated invoices can be checked through the MyInvois portal’s UIN or QR lookup at no cost. If e-invoicing is new to your own business, our comparison of e-invoicing service providers in Malaysia covers the submission routes.
Done looks like: a clear yes with a stated phase, or a clear no with a stated exemption reason.
Common mistake: treating this as red tape. It is the cheapest available test of whether the agency runs a real finance function.
Key takeaway on Phase 1: three lookups, twenty minutes, RM25 at most. If an agency fails Phase 1, nothing in Phases 2 to 4 matters.
Phase 2: Verify the work is real (45 minutes)
Question 4: Show me a client in my industry, and tell me what did not work
Quick Answer: Ask for one relevant case study and one failure. The failure is the real question. Any agency can produce a winner. Only an experienced one can describe a campaign that underperformed and explain why without blaming the client.
Google’s hiring documentation recommends asking for examples of previous work and success stories, plus their experience in your industry and in your country or city. Add the failure question to that list.
Verify what you can. If they name a client site, look it up. Check whether the pages they claim to have built are actually live, when they were published, and whether the site ranks for the terms claimed. Search Console data belongs to the client, so you will not see it, but the published work is public.
Done looks like: a named site you can open, work you can see, and a candid failure story with a diagnosis attached.
Common mistake: accepting screenshots of traffic graphs. A screenshot has no provenance. The live pages do.
Question 5: Who will actually do the work, and what is their name?
Quick Answer: Ask for the name and role of the person running your account day to day. Not the founder who is pitching, not the account manager who forwards emails. The person writing and shipping.
A good answer names one or two people, states how much of their week your account gets, and offers to put them on the next call. A bad answer is “our team” repeated three times.
Done looks like: a named person you have spoken to before signing.
Common mistake: meeting a senior strategist during the pitch and getting a junior executive on delivery. Ask explicitly whether the person on this call will be on your account in month three. Our ranked list of SEO consultants in Malaysia is worth reading if the honest answer is that you want a specific individual rather than a firm.
Question 6: Do you follow Google Search Essentials, and how do you handle links?
Quick Answer: Ask both parts together. The second half is where the answer gets interesting, because link acquisition is the deliverable most likely to breach Google’s spam policies and the one you carry the liability for.
Google’s own guidance warns against providers that talk about link popularity schemes or submitting your site to thousands of search engines, and states that you should never have to link to an SEO. Ask where the last ten links they built for a Malaysian client actually live, then open them.
Done looks like: ten real URLs on sites with their own audiences, and a clear no when you ask whether they buy links.
Common mistake: not asking, then discovering the link profile during a manual action. Also worth checking: if they offer AEO or GEO services, Google now publishes its own guidance on optimising for generative AI features and tells buyers to check whether an agency’s advice lines up with it.
Key takeaway on Phase 2: you are testing whether claims survive contact with a browser. Open every link, every page, every case study site.
Phase 3: Verify the deliverables (60 minutes)
Question 7: Rewrite the proposal as a monthly schedule with counts
Quick Answer: Ask for every deliverable expressed as a number per month. Articles published, technical fixes shipped, links acquired, Business Profile posts. Anything without a number attached is not a deliverable.
Then apply the repetition test. If a line item happens once, you paid for setup, not for ongoing SEO. Keyword research is a legitimate one-off. “Content optimisation” appearing every month with no count is not.
Done looks like: a one-page table with a number in every row.
Common mistake: signing a proposal written in service categories rather than quantities. Categories cannot be under-delivered because they cannot be measured.
Question 8: How many hours a month does this retainer represent?
Quick Answer: Ask the question and divide. A RM3,000 retainer covering 20 hours is RM150 an hour. The same retainer covering 40 hours is RM75 an hour, which sits below the published Malaysian freelance floor of roughly RM80 an hour.
When the arithmetic lands below that floor, one of the two numbers is wrong, and in my experience it is the hours. Either the work is being automated or it is not happening. Ask which.
Done looks like: a stated hour range you can divide into the fee and get a defensible number.
Common mistake: treating the refusal to answer as a trade secret. It is a pricing structure, not a proprietary method.
Question 9: What does the monthly report contain, and can I see a real one?
Quick Answer: Ask for a redacted sample report before signing. It should lead with Search Console impressions, clicks and average position. Third-party scores can appear, but not in place of Google’s own data.
Here is why that ordering matters. Google states that it does not evaluate or endorse third-party SEO tools and that those tools have no access to Google’s internal ranking data. So a report leading with a domain authority score moving from 21 to 34 is showing you a vendor’s model of Google, not a number Google produces.
Done looks like: a sample report you have read, containing Search Console metrics and a plain-language section on what was shipped.
Common mistake: accepting the first report in month two and discovering it is a tool export with a logo on it.
Key takeaway on Phase 3: counts, hours and a sample report. Three artefacts, all obtainable before signing, all of which make under-delivery visible later.
Phase 4: Verify you can leave (45 minutes)
Question 10: Will all four accounts sit in my name? (the Four Account Test)
Quick Answer: Search Console, GA4, Google Business Profile and the domain registrar must all sit in accounts you own, with the agency added as a user. That is the Four Account Test, and it is the single most expensive clause to get wrong.
Create each property yourself, under a company email address rather than a personal Gmail or a staff member’s account. Then add the agency at the lowest useful level:
| Account | Correct role for the agency | Where to set it |
|---|---|---|
| Google Search Console | Restricted user during the audit stage, Full user once engaged | Settings, then Users and permissions |
| Google Analytics 4 | Viewer or Analyst, not Administrator | Admin, then Property access management |
| Google Business Profile | Manager. You keep Primary owner | People and access |
| Domain registrar | No access, or a separate DNS-only delegation | Your registrar account |
Role names per Google’s published permission documentation for each product, retrieved 2 September 2026.
Google’s hiring guidance is specific about the first row: when an agency offers to run an audit, grant read access to Search Console at that stage and not write access. In Search Console terms that is the Restricted user role. Almost nobody in Malaysia does this, and it costs nothing.
Done looks like: you log into all four accounts with your own credentials, and the agency appears as a user in each.
Common mistake: letting the agency create the properties because it is faster. Search Console retains Performance data for 16 months on a rolling basis and permanently deletes anything older, with no way to recover it. Lose the property and you lose up to 16 months of query, click and position history. At a RM3,000 retainer, that is RM51,840 of work whose evidence walks out with the vendor.
Question 11: What is your data processing clause?
Quick Answer: Ask what happens to customer data they can access, and require a breach-notification clause in writing. Under the amended PDPA you are the controller and they are the processor, and the deadline lands on you.
The Personal Data Protection (Amendment) Act 2024, which amends Act 709, came into force in stages during 2025. Data processors now carry direct obligations under the Act. A data controller must notify the Commissioner within 72 hours of becoming aware of a breach and inform affected individuals within seven days where significant harm is likely. Maximum penalties rose to RM1 million and up to three years’ imprisonment, and directors can carry personal liability unless they can show the offence happened without their knowledge and that they exercised due diligence.
Your agency will touch your GA4 data, possibly your CRM, and often your enquiry inbox. If they suffer a breach and tell you three weeks later, your 72 hours expired without you knowing.
Done looks like: a contract clause requiring the agency to notify you of any breach fast enough for you to meet your own 72-hour obligation.
Common mistake: assuming this is only for large companies. The data protection principles apply regardless of business size. The DPO appointment threshold is what varies.
Question 12: What is the notice period, and what do I keep?
Quick Answer: Ask for the exit terms before you ask for a discount. You want a defined notice period, ownership of all content produced, and a written handover list.
The clauses to fix at signing:
- Notice period stated in days, with no automatic annual renewal that renews silently.
- Content ownership transferring to you on payment, not on termination in good standing.
- A handover obligation covering account access removal, documentation and any tools holding your data.
- No clause requiring you to keep links to the agency’s own site.
Done looks like: you can describe, in one sentence, exactly what you walk away with and how long it takes.
Common mistake: negotiating price hard and exit terms not at all. Price is recoverable. A twelve-month auto-renew with a Business Profile you do not own is not.
Key takeaway on Phase 4: the Four Account Test, a breach clause and a notice period. Fifteen minutes of contract reading against a decision that runs to RM38,880 over a year.
How to know the vetting worked
Quick Answer: Good vetting shows up in the first sixty days, not the first six months. Watch for four early signals, all visible before any ranking changes.
| Signal | When | What it means |
|---|---|---|
| You logged into all four accounts yourself in week one | Week 1 | The Four Account Test held under real conditions |
| The first monthly report matches the sample you were shown | Month 1 | Reporting was a commitment, not a pitch |
| The deliverable counts in month one match the schedule | Month 1 | The proposal was scoped, not decorated |
| The named person from question 5 is the person emailing you | Month 1 to 2 | The account was not handed down after signing |
| Search Console impressions begin moving | Month 2 to 3 | Work is reaching the index |
Leading signals are the first four. Only the fifth is a performance metric, and it is the last one to appear.
Key takeaway: four of the five signals have nothing to do with rankings. If the first four fail, escalate in month two rather than waiting for month nine to prove it.
Troubleshooting: when vetting goes wrong
The agency refuses to give an hour estimate. This is common and usually framed as protecting a methodology. Reframe it: you are not asking how they work, you are asking what you are buying. If the refusal holds, price the retainer at the top of the plausible hour range and see whether it still makes sense. Often it does not.
They insist on creating the Search Console property themselves. Sometimes this is genuine convenience and sometimes it is retention by hostage. Either way the fix is the same. Create it yourself, verify ownership with an HTML file or DNS record, then add them. If they cannot work as a Full user, ask what specific action requires ownership, and get the answer in writing.
Your previous agency still has access and you cannot remove them. Removing a delegated owner from Search Console does not automatically remove their verification tokens, and a token left in place can be used to regain ownership. Search Console’s users and permissions page shows verification tokens for current and previous users. Remove the token, not only the user. For Google Business Profile, transfer primary ownership to your own account first, then remove the old owner, and expect the seven-day waiting period on any newly added owner.
Everything checked out and it still failed. Vetting reduces the failure rate. It does not eliminate it, because SEO outcomes depend on competition and on your own speed of approval as much as on the agency. If impressions are flat at month three with deliverables shipping on schedule, the problem is usually targeting rather than effort. That is a strategy conversation, not a termination.
The proposal is fine but the price is not. Vetting tells you whether an agency is real. It does not tell you whether the number is fair. The full buyer’s guide to hiring an SEO agency in Malaysia carries the retainer bands, the cost drivers and the in-house comparison.
Do this today
Open a browser and run question 1 and question 2 on whichever agency is currently closest to signing. SSM e-Info for the registration number, MySST for the tax status. That is twelve minutes and it either clears them or it does not.
Then, before you sign anything, create the four accounts in your own name. It is the only step on this page that gets harder every month you delay.
If you want a paid diagnostic as the final test, budget RM1,500 to RM5,000, which is 4.2% of a twelve-month RM3,000 commitment. Our comparison of agencies that sell standalone SEO audits covers who delivers that as a defined document, and if half of that spend can come from elsewhere, check which Malaysian SME grants are currently open.
No agency named anywhere on this site pays for placement, and we have no commercial relationship with any provider referenced in this guide.
Frequently asked questions
How long does it take to vet an SEO agency in Malaysia? About 170 minutes per agency, or roughly 8.5 hours across a shortlist of three. Phase 1 verification takes 20 minutes, checking the work takes 45, reviewing deliverables takes 60, and the contract and access review takes 45. Cash cost is RM15 to RM25 in SSM document fees. Everything else is free.
Can I check a Malaysian SEO agency for free? Mostly yes. The MySST registration status lookup, MyInvois validation, WHOIS, and all Google account role checks are free. Only the SSM company profile costs money, at RM15 to RM25 for a non-certified copy, and the basic registration and status search is free once you have an e-Info account.
What is the Four Account Test? Search Console, GA4, Google Business Profile and the domain registrar must all sit in accounts you own, with the agency added as a user. It matters because Search Console keeps only 16 months of performance data on a rolling basis and deletes the rest permanently. Lose the property, lose the history.
What if I already signed and the agency owns my accounts? Fix it now rather than at termination. Verify Search Console ownership yourself using an HTML file or DNS record, then remove leftover verification tokens rather than only removing the user. For Google Business Profile, transfer primary ownership to your own account and allow for the seven-day waiting period on newly added owners.
Should an agency charge me 8% SST? Only if they are registered. The standard rate has been 8% since 1 March 2024, and registration is required above RM500,000 in annual taxable turnover. Check the number free on the Royal Malaysian Customs MySST registration status inquiry. If it returns No Record Found and your invoice shows a tax line, ask before paying.
Can an SEO agency guarantee first page rankings? No. Google’s hiring documentation states that no one can guarantee a number one ranking and warns against agencies claiming a special relationship with Google. Guarantees are usually met on keywords with no meaningful search volume. Treat a ranking guarantee as grounds for removing that agency from the shortlist.
