From 1 January 2025, companies providing internet messaging services and/or social media services (“Applications Service Providers”), and which have 8 million or more users in Malaysia, must obtain an Applications Service Provider class licence (“ASP(C) Licence”) to comply with their regulatory requirements under the Communications and Multimedia Act 1998 (Act 588) (“CMA”). The new requirements aim to regulate online services to protect the safety of users, especially in relation to online harms of violence, child exploitation, scams, gambling, bullying and harassment.
A. Key Definitions
The new requirements regulate the following types of services:
- Internet Messaging Services: An applications service which utilises Internet access service that enables a user to communicate any form of messages with another user. This may include common internet messaging services such as WeChat, Telegram, WhatsApp and other services.
- Social Media Services: An applications service which utilises Internet access service that enables two or more users to create, upload, share, disseminate or modify content. This may include Facebook, Instagram, Tik Tok, and other services.
Relevant definitions under the CMA and its subsidiary legislation include the following:
- Internet Access Service: An applications service whereby a person is able to access Internet services and applications in conjunction with either a dial-up connection or a direct connection.
- Applications Service: A service provided by means of, but not solely by means of, one or more network services.
B. Scope of Application
Under the new regulatory framework, only Applications Service Providers with 8 million or more users in Malaysia are obliged to obtain the ASP(C) licence. The Malaysian Communications and Multimedia Commission (“MCMC”) will primarily rely on the data derived from the official surveys it uses to determine the number of Malaysian users of an Applications Service Provider, though it will also consider other sources of data which are publicly available and reliable.
The ASP(C) licence is valid for one year from the date of its registration, and Applications Service Providers must re-apply for a new ASP(C) licence after the expiry of the previous licence as long as they continue to have 8 million or more users in Malaysia.
C. Key Obligations
Any Applications Service Provider holding an ASP(C) licence will be subject to licensing conditions and other requirements including:
- the licensee must comply with the provisions of the CMA;
- the licensee must comply with the provisions of the Personal Data Protection Act 2010;
- the licensee must comply with the provisions of any subsidiary legislation made, or other instruments, guidelines or regulatory policies issued, under the CMA;
- the licensee must use their best endeavours to prevent the applications services from being involved in the commission of an offence in Malaysia;
- the licensee must comply with the numbering and electronic addressing plan issued under the CMA;
- the licensee must comply with any relevant consumer codes under the CMA; and
- the licensee must indemnify the Minister of Communications and the MCMC against any claims or proceedings arising from any breaches or failings on the part of the licensee.
The Minister of Communications may also include additional conditions within any specific ASP(C) licence on a case-by-case basis.
D. Penalties & Enforcement
Any qualifying Applications Service Provider who fails to obtain an ASP(C) licence commits an offence and shall, on conviction, be liable to:
- a fine of up to 500,000 ringgit (~USD 11,100); and/or
- to imprisonment for a term not exceeding five years;
and shall also be liable to a further fine of 1,000 ringgit (~USD 220) for every day after conviction that it fails to obtain the licence.
E. Conclusion
Based on media reports, licensing applications have already been submitted by platforms such as Telegram, WeChat and TikTok (see here and here). Meta is also in the process of a licensing application (see here and here). The MCMC is also evaluating whether various platforms that have not registered are subject to the licensing regime.
With the MCMC publicly stating that it will continually assess the status of platform providers who have not obtained the requisite licensing (see here), and since a failure to comply with the new regulations carries significant penalties, companies providing messaging or platform services in Malaysia to 8 million or more users, or who intend to offer such services in Malaysia, should carefully review their operations to determine whether the new requirements apply to them.
Click here to refer to the CMA, its subsidiary legislation and recent amendments.
The information provided above does not, and is not intended to, constitute legal advice pertaining to the Malaysian licensing regime under the CMA and its subsidiary legislation; information, content, and materials stipulated above is based on our reading of the amendments and are for general informational purposes only.
Social Media cookies collect information about you sharing information from our website via social media tools, or analytics to understand your browsing between social media tools or our Social Media campaigns and our own websites. We do this to optimise the mix of channels to provide you with our content. Details concerning the tools in use are in our Privacy Notice.