On 29 July 2024, we have published an article titled “Urgent Compliance Alert: Malaysia’s New Regulatory Framework for Social Media Services and Internet Messaging Services” which highlighted that the Malaysian Communications and Multimedia Commission (“MCMC”) would introduce a new regulatory framework on 1 August 2024. This framework requires companies providing internet messaging services or social media services with at least eight million registered users in Malaysia to apply for an Applications Service Providers Class Licence under the Communications and Multimedia Act 1998.

On 1 August, the Regulatory Framework for Internet Messaging Service and Social Media Service Providers has been officially introduced, along with the Communications and Multimedia (Licensing) (Exemption) (Amendment) Order 2024 and the Communications and Multimedia (Licensing) (Amendment) (No. 2) Regulations 2024. Rather than reproducing the entire framework, this article highlights the ten most crucial points that all general counsels from companies providing internet messaging services or social media services should note.

1. 1. Status of the Regulatory Framework
2. The regulatory framework for internet messaging and social media services is gazetted on 1 August 2024 and it will officially come into effect on 1 January 2025.
3.  
4. This provides companies with a clear timeline to ensure compliance with licensing requirements. With a five-month grace period before the enforcement date, companies should use this time effectively to meet the licensing requirements. This period should be adequate for preparing and addressing any necessary compliance measures, provided that efforts are well-coordinated and timely. It is crucial that companies begin their preparations promptly to avoid any last-minute issues and to ensure full compliance by the deadline.
5.  
6. 2. Compulsory Licensing Requirement
7. With the enforcement of this framework, all internet messaging service providers or social media service providers with at least eight million registered users in Malaysia must apply for an Applications Service Provider Class Licence (“ASP (C) Licence”) under the Communications and Multimedia Act 1998 (Act 588). The framework explicitly applies only to internet messaging and social media service providers and will not affect end users.
8.  
9. 3. Definitions of Internet Messaging Service and Social Media Service
10. The law currently defines “internet messaging service” as an applications service that utilizes internet access service enabling a user to communicate any form of message with another user. “Social media service” is defined as an applications service that utilizes internet access service enabling two or more users to create, upload, share, disseminate, or modify content.
11.  
12. Companies must evaluate their offerings to determine whether their products or services fall within these definitions. Given the evolving nature of technology, it is important for companies to continuously reassess their services to ensure they remain compliant with these definitions. Regular evaluations will help ensure that any changes in technology or service offerings are promptly addressed and that compliance is maintained.
13.  
14. 4. Calculation of 8 Million Users
15. The MCMC will primarily use data from its official surveys, including MCMC’s Internet User Survey, to quantify the number of Malaysian users. It will also consider other publicly available and reliable data points.
16.  
17. Companies that fall within the definitions of social media services or internet messaging services must conduct their own assessments to determine whether their user base in Malaysia meets or exceeds the 8 million threshold. It is essential for these companies to regularly monitor and verify their user statistics to ensure compliance with this requirement.
18.  
19. 5. Incorporation of Local Companies
20. A key requirement to apply for an ASP (C) Licence is the incorporation of a local company. However, the Minister has the discretion to allow a foreign company to be registered as a class licensee on a case-by-case basis. That said, it is important to emphasise that this discretion is fully at the Minister’s discretion. For foreign companies providing internet messaging services or social media services, it is advisable to incorporate a local company to obtain the ASP (C) Licence. This approach can help avoid unnecessary complications and ensure smoother compliance with licensing requirements.
21.  
22. 6. Foreign Shareholding Requirement
23. A frequently asked question is whether there is a foreign shareholding restriction. Currently, there are no foreign shareholding restrictions for ASP (C) Licences. This absence of restrictions aligns with the ‘light-handed’ approach adopted to promote industry growth and development by facilitating easier market access.
24.  
25. 7. Validity Period of the Licence
26. The validity period for the ASP (C) Licence is one year, with a yearly renewal requirement as long as the provider has eight million or more users in Malaysia.
27.  
28. With such annual renewal process, companies are compelled to stay current with regulatory changes and evolving compliance best practices.
29.  
30. 8. Consequences of Non-Compliance
31. Internet messaging and social media service providers have a grace period of five months, from 1 August 2024 to 1 January 2025, to apply for the ASP (C) Licence. Starting 1 January 2025, operating without a licence will result in penalties, including fines not exceeding RM500,000 or five years of imprisonment, or both. Service providers will also face an additional fine of RM1,000 for each day the offence continues after conviction.
32.  
33. The stringent penalties for non-compliance highlight the seriousness with which the MCMC views adherence to the new framework, and this serves as a stark reminder for organisations to prioritise compliance as a core component of their licensing strategies.
34.  
35. 9. Activities During the Grace Period
36. Between 1 August 2024 and 1 January 2025, the MCMC will develop comprehensive outcome-based guidelines detailing the conduct requirements and key obligations for internet messaging and social media service providers. Proposed key conduct requirements include policies for user data protection, child safety measures, addressing online harm, content moderation, advertising transparency, complaint procedures, and measures to manage deepfakes and harmful AI-generated content.
37.  
38. 10. Recommendations for General Counsels
39. To ensure compliance, general counsels should take the following steps:
40.  
41. Step 1: Assess and Confirm Service Applicability
42. Evaluate whether your company falls under the new definitions of social media services or internet messaging services. This assessment is critical to determine regulatory obligations and potential impacts on operations.
43.  
44. Step 2: User Base Evaluation and Documentation
45. Conduct a thorough evaluation and documentation of your user base in Malaysia. Confirm whether your platform surpasses the eight million user threshold which triggers the licensing requirement.
46.  
47. Step 3: Develop a Compliance Strategy
48. Given the tight compliance timeframe, initiate discussions with lawyers familiar with TMT law to apply for the ASP (C) Licence before the deadline of 1 January 2025. The MCMC has identified major providers like Facebook, Instagram, TikTok, WhatsApp, Telegram, WeChat, X, and YouTube as potentially falling under this framework, subject to having eight million or more users in Malaysia.

Conclusion

In conclusion, the introduction of Malaysia’s new regulatory framework for internet messaging services and social media services marks a significant shift in the digital landscape. With mandatory licensing requirements, local incorporation expectations, and stringent penalties for non-compliance, the stakes are high for service providers operating in Malaysia. The five-month grace period offers a crucial window for companies to align their operations with these new regulations, and therefore, general counsels and compliance officers must act swiftly and decisively, leveraging this time to conduct thorough assessments, develop robust compliance strategies, and implement necessary changes.

Should you require assistance with obtaining the ASP (C) Licences, our team can help you navigate this regulatory environment with expert insight and strategic planning. We are well-versed in the nuances of Malaysian technology and communications law and can provide the guidance necessary to ensure your platform is fully compliant ahead of the deadline. We have an in-depth understanding of the technology regulatory requirements and are poised to assist in obtaining the requisite ASP (C) Licences.

For further information on how we can assist you in this transition, please contact us directly.

Note: On Monday, August 5, our Technology Practice Group Partners, Ong Johnson and Lo Khai Yi were invited by Malaysia’s No. 1 Business Radio Station, BFM 89.9, to shed light on Regulatory Framework for Internet Messaging and Social media Service Providers that’s set to take effect on January 1, 2025. Read the news here.

About the authors

Ong Johnson
Partner
Head of Technology & Corporate Practice Group
Transactions and Dispute Resolution, Technology,
Media & Telecommunications, Intellectual Property,
Fintech, Privacy and Cybersecurity
johnson.ong@hhq.com.my

.

Lo Khai Yi
Partner
Co-Head of Technology & Corporate Practice Group
Technology, Media & Telecommunications, Intellectual
Property, Corporate/M&A, Projects and Infrastructure,
Privacy and Cybersecurity
ky.lo@hhq.com.my.

.

Nicole Shieh E-Lyn
Associate
Technology & Corporate Practice Group
Technology, Media & Telecommunications, Transactions and 
Dispute Resolution, Fintech, Privacy and Cybersecurity
nicole.shieh@hhq.com.my

More of our Tech articles that you should read:

• • Understanding the Role of Data Protection Officer Under the Personal Data Protection (Amendment) Bill 2024
• • The Hidden Perils of Software Subscriptions: Are High Early Termination Fees a TMT Litigation Time Bomb?
• • Navigating Competition Law in the Expanding Technology Industry: A Focus on Hardcore Horizontal Restrictions