What a JMB inherits from the developer.

What actually crosses at handover?

One section defines the transfer. Section 15(1)(a) of the Strata Management Act 2013 requires the developer, before its management period expires, to “transfer all balances of moneys in the maintenance account and the sinking fund account” to the joint management body. Section 15(3)(f) requires delivery of “all warranties, manuals, schematic drawings, operating instructions, service guides, manufacturer’s documentation and other similar information in respect of the construction, installation, operation, maintenance, repair and servicing of any common property”. Regulation 11 of the Strata Management (Maintenance and Management) Regulations 2015 puts the handover itself on Form 4.

Section text quoted here is the Unannotated Statutes of Malaysia reproduction, incorporating amendments to 1 June 2015; check the gazetted text before relying on it.

Against that, the published guidance is thin. Across the Malaysian developer-to-JMB handover guides this piece measures against, the whole coverage of security systems is one line — keys, access cards, and security system codes for common areas. The nearest any gets is “equipment manuals”. None breaks an inventory down by system, or mentions an administrator account, a licence key or a retention setting. What transfers is not equipment but an obligation to keep a system watched, serviced and documented — the wider position for Kuala Lumpur high-rise buildings.

Who is the body doing the asking?

Commentary describes the joint management body as a temporary management body formed under section 17 of the Strata Management Act 2013, between the developer and the eventual management corporation. Two of its features change how a request should be written.

The first is that it is a legal person. On establishment the JMB is “a body corporate having perpetual succession and a common seal”. A request for drawings and credentials comes from a corporate body with a statutory duty of its own, not from a residents’ group.

The second is awkward. Section 17(4) states that “the joint management body shall comprise the developer and the purchasers”. The developer is a constituent member of the body it owes the handover to, and it sits in the meetings that decide what to ask for. Hence: every item in writing, and minute the reply.

How long does a new JMB actually have?

Two clocks run and neither is ninety days. Section 7(2) defines the developer’s management period as running from delivery of vacant possession “until one month after the establishment of the joint management body or such other time as may be extended by the Commissioner”. Handover is due before it expires: one month from establishment.

Section 17(1)(b) sets the second clock. The body is established on convening its first annual general meeting, “if vacant possession is delivered after the commencement of this Act, not later than twelve months from the date of delivery of vacant possession of a parcel to a purchaser”. The handover guides all repeat that twelve-month rule; quote section 17(1)(b) itself, which is where it comes from. Section 18(3) requires written notice of that meeting not less than fourteen days beforehand, and section 18(4) an annual budget placed before it.

So the ninety days of the title is practice, not statute. Nothing in the Act or the Regulations 2015 describes a thirty, sixty or ninety day sequence, and the only time-bound instruction in those guides is a passing phrase about getting the records in order in the first month. Ninety days is convention: long enough to find what is missing, short enough that the original contractor is reachable.

The register to send, in writing

The object worth building in week one is a register: one line per item, hook beside it. A request citing section 15(3)(f) and naming the CCTV, access control and intercom documentation is harder to ignore than one asking for the security files. The hook column reports the source; the strength column is this piece’s reading.

Check every row against the completed Form 4 — the prescribed handover form under regulation 11. Ask for a signed copy first: it records what the developer says it handed over. Half have no statutory hook this piece could verify.

The items no handover guide asks for

Those guides do cover documents in the general sense. One requires building plans, as-built drawings and certificates of completion; another warranties and guarantees for plant, equipment and construction works; a third an inventory of common-property movable assets and contracts in force. All of it sits at building level, never broken down to a system.

What falls through is administrative control. A recorder, a door controller and a management application each have an account that can add a camera, change a retention setting, export footage or lock everyone else out. If those accounts stay with the outgoing contractor, the building owns hardware it cannot administer. Licences behave the same way: software registered in a contractor’s name is a dependency that survives the contract.

Where the Act stops short

Section 15(3)(b) is the provision usually described as a right to as-built drawings, and it is narrower than that. It requires any document in the developer’s possession indicating, as far as practicable, the actual location of any pipe, wire, cable, chute or duct “if the developer has reason to believe” it is not located as shown on an approved plan. The duty turns on the developer’s own belief. There is no unconditional statutory right to as-built ELV cable routing, and a committee should ask knowing that.

Section 15(3)(f) has the opposite shape: broad, and generic. It reaches “any common property” and names no system, so the request must do the naming — the controllers, the door stations, the riser cupboards and the head end, the rack where the recorders live. Terms are in the glossary. That naming is the discipline that makes a scope of works comparable across three bidders.

Those guides have a blind spot. They name certificates of fitness, Bomba compliance, lift certificates and statutory approvals, and name none attaching to a security installation or to the act of recording. Whether one exists in Malaysian law is a question this piece cannot settle; what can be said is that no published guide names one, which is why the register above does more work than for a fire pump.

What does the Act mean by security services?

Section 23(3)(b) makes the maintenance account available for “paying for the expenses incurred in providing cleaning services for the common property, security services and amenities for the occupiers of the building”. The Act does not define security services anywhere, or say whether equipment sits inside the term or only manpower. It is the provision a managing agent points at when a camera repair reaches the fee.

A draft code of practice published for Malaysian private security agencies lists what licensed agencies provide, from unarmed guard and escort services through to central monitoring system and building automation system. That is an industry document, not the Act, and settles nothing — but the trade reads security services as covering systems, not only people.

The adjacent paragraph does not close the gap. Section 23(3)(f) puts “carrying out inspection of all electrical wiring systems of the common property and replacing or repairing any faulty wiring systems” on the same account. Whether ELV cabling counts as electrical wiring is stated nowhere here. Malaysian electricity law defines extra low voltage as a voltage “normally not exceeding 50 volts alternating current or 120 volts direct current” — the class most readily argued out of an electrical clause. Nor does construction law settle it: the CIDB Act defines construction works to include “any electrical, mechanical, water, gas, petrochemical or telecommunication works” and names no security, CCTV or ELV work.

What if the developer simply does not comply?

This is the sentence no handover guide carries. Section 15(4) says a developer who fails to comply commits an offence, liable on conviction “to a fine not exceeding two hundred and fifty thousand ringgit or to imprisonment for a term not exceeding three years or to both”, and, for a continuing offence, “to a further fine not exceeding five thousand ringgit for every day or part thereof during which the offence continues after conviction”. The duty does not lapse when the project team moves on.

Section 15(2) closes the accounting side: where only unaudited accounts were handed over, audited accounts are due not more than three months after the management period expires. Let that date pass and the cleanest evidence of what the funds held is gone.

• Cite the section, not the grievance. 15(3)(f) for documentation, 15(3)(b) for cable routes, 18(4) for the budget.
• Put a reply-by date on it. The Act sets no period, so the body sets its own and minutes it.
• Name the consequence once. Section 15(4) is a criminal provision — not something the body prosecutes itself, but the reason the duty binds. The routes a JMB can start on its own are below.
• Copy the Commissioner of Buildings — appointed under section 4(1) by the State Authority per local authority area, so a council office.

Escalation, and who actually hears it

Beyond a letter there are two routes, doing different things. Under section 86(1), where the Commissioner is satisfied after due inquiry on a complaint that maintenance and management is not being carried out satisfactorily, one or more persons may be appointed to act as managing agent for a specified period. That is an intervention in how the building is run, not a remedy for a drawing.

The remedy for a missing drawing is the Strata Management Tribunal. Part 1 of the Fourth Schedule lists the claims it may hear, and the research behind this piece records an order compelling a developer or a joint management body to supply information or documents among them. Separately, where a dispute has a money value, commentary puts the Tribunal’s jurisdiction at claims not exceeding RM250,000 — a ceiling on amounts claimed, not on an order to produce a document.

Can a JMB inherit a contract it could not have signed?

Section 21(3) is unambiguous: “the joint management body shall not enter into any contract relating to the maintenance and management of any building or land intended for subdivision into parcels and the common property in the development area for any period exceeding twelve months”. A developer’s three-year CCTV maintenance agreement, passed across at handover, is something the JMB could not lawfully have signed. Nobody connects that section to building systems; test it against the contracts.

The cap binds a JMB under Part IV; there is no equivalent limit on a management corporation under Part V, so the same agreement may be ordinary in the hands of the body that follows. An inherited long agreement is one to renegotiate at the next boundary, the moment to fix what a maintenance contract should actually cover.

Re-tendering it: a duty with no method

By-law 3(7) in the Third Schedule to the Regulations 2015 requires the management body to “set up, manage and maintain proper procurement procedures and tender process in a fair and transparent manner” for all purchases, acquisitions or awards of contracts connected with the common property. It prescribes no number of quotations, no threshold and no method. The duty is real and the standard self-set, which is why the scope is written before prices are compared.

Where the building appoints an agent rather than a contractor, regulation 21(1) adds a formality: a JMB that secures the services of any person or agent to undertake the maintenance and management of the common property must enter into a management agreement with that agent. That addresses a managing agent, not a trade contractor, so it does not dictate a CCTV contract — but it sets the habit the Act expects.

Authority to spend sits with the body. Section 21(2)(c) gives the JMB power “to authorize expenditure for the carrying out of the maintenance and management” of the common property, and section 22(1) makes the committee’s exercise of it “subject to any restriction imposed or direction given by the joint management body at a general meeting”. A full-text search of the Act and the Regulations 2015 for a ringgit ceiling returns nothing. Whatever limit a committee believes it is under, its own owners imposed it.

Who is the data controller for the recordings?

Start with the limit, because it governs what follows. The Personal Data Protection Act 2010 applies to processing “in respect of commercial transactions”, and nothing in that Act, in the Strata Management Act 2013 or in any guideline read here states whether a joint management body collecting resident and visitor data is engaged in one. Whether the Act reaches a JMB at all is unsettled, and a committee that has minuted an answer is better placed than one that never did.

If it applies, a JMB that inherits a CCTV system inherits a personal data processing operation, and no handover guide asks about it. The Personal Data Protection (Amendment) Act 2024 — Act A1727, royal assent 9 October 2024 — inserted section 12a, under which “a data controller shall appoint one or more data protection officers who shall be accountable to the data controller for the compliance with this Act”, and section 12b, requiring a controller with reason to believe a breach has occurred to notify the Commissioner as soon as practicable. Failing to notify is an offence. Both came into force on 1 June 2025.

The regulator has named the technology. Its guideline on appointing a data protection officer states that activities involving CCTV “would be considered as carrying out activities that may constitute” what it calls “regular and systematic monitoring” — one of three alternative conditions, the others being personal data exceeding 20,000 data subjects and sensitive personal data exceeding 10,000. The trigger is not a headcount. A1727 also added biometric data to sensitive personal data, defined as data “resulting from technical processing relating to the physical, physiological or behavioural characteristics of a person” — so a fingerprint reader is a question for the inventory.

How long may the footage be kept?

Section 10 of the Personal Data Protection Act 2010 says personal data “shall not be kept longer than is necessary for the fulfilment of that purpose” and puts a duty on the holder to ensure it is destroyed or permanently deleted once no longer required. It names no number of days, and the research behind this piece found no other retention rule in Malaysian statute bearing on CCTV footage. The period a building runs is a decision it must make and record.

On breaches the timing is fixed, for the breaches the guideline makes notifiable at all — those causing or likely to cause significant harm. The data breach notification guideline requires notification within seventy-two hours, and requires a controller that misses it to submit a written notice “detailing the reasons for the delay”. A building whose recorder is reachable from the internet on a default password has a route to that letter.

Recordings are also the evidence base for by-law enforcement. Commentary puts the fines a management corporation may impose at up to RM200 per by-law violation — a Part V power, not a JMB one — and a recording is often the only evidence that survives the argument.

A condition baseline, and where the money comes from

By-law 3(1) in the Third Schedule to the Regulations 2015 requires the management body to “maintain in a state of good and serviceable repair, and, where necessary, renew or upgrade, the fixtures and fittings, lifts, installations, equipment, devices and appliances” used by occupiers of two or more parcels. Upgrading appears as a duty, not a power, and starts on day one against equipment nobody on the committee chose. A record of condition made in the first weeks separates what was inherited from what came after — the discipline governing taking over another contractor’s system.

Funding splits two ways. Section 23(3)(b) puts security services on the maintenance account. Section 24(2)(c) puts “the renewal or replacement of any fixture or fitting comprised in any common property” on the sinking fund, and section 24(2)(e) closes that list with “any other capital expenditure as the joint management body deems necessary”. The list is open, which changes the question from whether a security system is on it to whether the spend is capital — the subject of maintenance fee or sinking fund.

The reserve is thinner than the job. Section 25(4) fixes the sinking fund contribution at “ten per cent of the Charges” unless a general meeting determines otherwise, never below it. The route to a capital spend is the budget, not an invoice: a High Court ruling reported by a Malaysian law firm — decided under the strata legislation that preceded the 2013 Act, and described by that firm as still being applied — holds that a management body “cannot levy the Defendant for all these charges separately, but it will have to be covered by the Management Fund”. A committee that finds a failing system in month two faces a meeting.

What the first ninety days are actually for

One finding sits under all of it. Piza, Welsh, Farrington and Thomas, in a forty-year systematic review in Criminology & Public Policy, put the overall odds ratio at 1.141 — crime down approximately 13 per cent against control areas. Across residential evaluations it was approximately 12 per cent; across housing schemes it was not significant at all, at 1.028. A ratio above 1 means less crime where cameras were.

The split that matters is not the setting but the watching. Schemes with active monitoring — 54 of them — showed a significant reduction in crime, at an odds ratio of 1.172; passively monitored systems showed non-significant effects across all three of the review’s meta-analyses. These are pooled evaluations of car parks, town centres, transport and housing, none Malaysian, and the comparison is between monitoring styles, so it does not test maintenance. That a system with no drawings or credentials is harder to watch is this piece’s reasoning.

1. Ask for the completed Form 4, then send the register — every item, its section, a reply-by date.
2. Recover the credentials. Administrator accounts and licences, then change them.
3. Record the condition. An as-found inventory — what is installed, where, in what state, and what could not be seen.
4. Read every contract in force against section 21(3).
5. Minute the data decisions. Who holds recordings, how long, who releases them.

Occhio Tec is an Extra Low Voltage systems contractor in Kuala Lumpur, established 2010. It designs, installs and maintains CCTV, access control, video intercom, structured networking and perimeter intrusion systems, with a niche in the mid-high to high-end condominium market in Mont Kiara, Bangsar and KLCC, and takes over systems another contractor installed. What a building inherited depends on what survived, which a site survey establishes. More in Insights.