A Growing Security Gap in Tenant Management
Unit owners register tenants, very few remove them when tenants leave. The result is a resident database full of people who no longer live in the building but still hold active building entry QR codes, can still book facilities, and still receive community notices meant for residents.
This is not an administrative inconvenience. It is a security and governance gap that widens with every tenant turnover.
How the List Gets Polluted
The pattern is simple. An owner rents out a unit and registers the tenant with management so they can access the resident app. When the tenant leaves and a new one moves in, the owner registers the new tenant. But nobody removes the old one.
There is no malice in this. Owners do not think of tenant removal as their job. Management offices have no trigger telling them a tenancy has ended. Without a tenancy agreement on file, there is no expiry date, no prompt, no reason for anyone to act.
Now consider a 500-unit development where 30 per cent of units are rented. If each rented unit turns over just once in three years, that is 150 former tenants still sitting in the system with live credentials. Former tenants who can walk into the building using their QR code. Former tenants who can book the function hall, the gym, the BBQ pit. Former tenants who might return for reasons they should not.
The list only grows. It never shrinks.
The Risk Nobody Sees Until It Surfaces
When an expired tenant uses their QR code to enter the building months after moving out, the guard has no reason to stop them. The system shows them as a registered resident. If that person enters the building and something happens, management has a serious problem: they granted access to someone who had no legitimate reason to be there, and they had no record showing the tenancy had ended.
The same database feeds every other function. Notices about water disruption or emergency drills go to people who moved out last year. Facility bookings are used by non-residents. Visitor approval requests routed to a tenant who left six months ago. The system still treats them as current because nobody told it otherwise.
As we explored in How JMBs and MCs Can Use iNeighbour to Handle Defaulters Effectively Without Overdoing It, enforcement depends on reliable data. The same principle holds here. You cannot manage occupancy if your occupancy records do not reflect reality.
The Law Already Requires This
Most management offices do not realize they have legal backing to demand tenancy documentation. Under the Third Schedule of the Strata Management (Maintenance and Management) Regulations 2015, parcel owners are required to notify the management corporation of any lease or creation of interest in their parcel, for entry into the strata roll.
Strata Management (Maintenance and Management) Regulations 2015 – Third Schedule, Clause 10
The enforcement mechanism is weak. Section 70 of the SMA 2013 caps the fine for a by-law breach at RM200, which does little to deter an owner collecting thousands in monthly rent. However, the legal obligation gives management bodies the authority to set a clear SOP: no tenancy agreement, no tenant access to the resident app. The gap was never in the law. It was in the mechanism to act on it.
From Policy to System
This is where iNeighbour changes the equation. The Lease module requires a tenancy agreement before a tenant profile can be created. That agreement carries an expiry date. When the date approaches, the system prompts the management office that action is needed.
It does not auto-remove tenants. It does not override management decisions. What it does is make the invisible visible. Management can see which tenancies are expiring, which have expired, and which units need follow-up. What they do next depends on their SOP. Some will contact the owner to confirm renewal. Some will suspend access pending a new agreement. The system gives them the information. They decide the response.
For communities that pair this with a clear SOP, the effect compounds. The resident database stays current. Access credentials stay valid only for people who should have them. And the management office shifts from discovering problems after something goes wrong to preventing them before they start.
The Difference Between a List and a Record
A resident list tells you who registered. An occupancy record tells you who is supposed to be there right now. Most strata communities run on the first and assume it is the second. It is not.
The question every JMB and MC should ask is not how many tenants are in the system. It is how many of them still live in the building.