I also smell a huge AMLA case here.
1. Why do they use your friend's account and not a formal company account? Just because it's online marketplace give them no right to use personal account.
2. What is your friends role in this whole business? Does your friend even know who the other person is? Receiving 10% based on sales as employee? What a nice life. Business partner? Then time to show all documents.
3. Sabah. A foreigner needs to find someone from Sabah to do accounting using personal account.

I'd be more worried about AMLA than paying tax at this point.

Your friend should be VERY WORRIED about this. Good luck.