In low strain rate regions, extrapolation of incomplete instrumental earthquake records is a limitation for probabilistic seismic hazard analysis (PSHA). This limitation can be addressed by incorporating geologic and geodetic data into fault-based seismogenic sources, although it is not always clear how on-fault magnitude-frequency distributions should be described and, if the seismogenic layer is especially thick, how these sources should be extrapolated down-dip. We explore these issues in the context of a new PSHA for Malawi, where regional extensional rates are 0.5-2 mm/yr, the seismogenic layer is 30-40 km thick, the instrumental catalog is ~60 years long, and fault-based sources were recently collated in the Malawi Seismogenic Source Database. Furthermore, Malawi is one of several countries along the East African Rift where exposure to seismic hazard is growing, but PSHA typically considers instrumental records alone. We use stochastic event catalogs to explore different fault-source down-dip extents and magnitude-frequency distributions. These indicate that hazard levels are highest for a Gutenberg-Richter on-fault magnitude-frequency distribution, even at low probabilities of exceedance (2% in 50 years), whilst seismic hazard levels are also sensitive to how relatively short (<50 km) fault sources are extrapolated down-dip. For sites close to fault sources (<40 km), seismic hazard levels are doubled compared to previous instrumental-seismicity based PSHA in Malawi. Cumulatively, these results highlight the need for careful fault source modelling in PSHA of low strain rate regions, and the need for new fault-based PSHA elsewhere in East Africa.