Regulatory Framework for Internet Messaging Service and Social Media Service Providers

As part of the Malaysian’s Government push to combat cybercrime offences, the Malaysian Communications and Multimedia Commission (“MCMC”) had on 1st August 2024 issued the Information Paper and FAQ on Regulatory Framework for Internet Messaging Service and Social Media Service Providers (“Information Paper” and “FAQ” respectively).

The new regulatory framework requires internet messaging service and social media service providers (collectively the “Service Providers”) with 8 million or more users in Malaysia to register for an Application Service Provider Class Licence (“ASP (C) Licence”) under the Communications and Multimedia Act 1998 (“CMA”).

The existing subsidiary legislation has been amended for the following definitions:

We set out below some key points:

  • Service Providers are given a grace period of 5 months, and will be required to obtain an ASP (C) Licence by 1st January 2025 (“Effective Date”).
  • In quantifying the number of Malaysian users of the Service Providers, MCMC will rely on data from its official surveys, and will also take into account other publicly available and reliable data points;
  • The ASP (C) Licence will only be valid for 1 year, and Service Providers are required to re-apply yearly, so long as they meet the 8 million or more users threshold;
  • Service Providers are required to establish a locally incorporated entity as part of the registration process (unless exempted on a case-to-case basis). MCMC has stated that they will not impose any restriction on foreign shareholding; and
  • Service Providers are required to comply with the standard licence conditions applicable for all ASP (C) Licensees, the CMA, the Personal Data Protection Act 2010, and relevant subsidiary legislations.

Pursuant to MCMC’s aim ‘to foster a trusted and safe online environment’, they are looking to develop comprehensive guidelines detailing conduct requirements and key obligations for Service Providers. Proposed key requirements include requiring Service Providers to have ‘robust’:

  • Policies and measures for the protection of user data;
  • Content moderation and policies and measures in place;
  • Child safety measures including age assurances to restrict minors under the age of 13 from accessing the platforms.
  • Transparency in advertising and restriction of advertisement promoting scams; and
  • Measures to safeguard minors from harmful content and misleading advertisements.

(*For further information, interested readers may access the Information Paper here, while the FAQ may be accessed here)

After the Effective Date, Service Providers found operating without an ASP (C) Licence, may on conviction, be liable to a fine not exceeding RM500,000 or 5 years imprisonment, or both. Additionally, for continuing offences, there shall also be a further fine of RM1,000 for every day or part of a day, during which the offence is continued after conviction.

As the MCMC is looking to develop comprehensive guidelines detailing conduct requirements and key obligations for Service Providers, we will look to providing updates on the same in due course.