This article first appeared in Forum, The Edge Malaysia Weekly on December 23, 2024 - December 29, 2024

Amid escalating concerns about online harm in the country, the Malaysian Communications and Multimedia Commission (MCMC) has introduced a regulatory framework for social media services and internet messaging service providers. This initiative signals a pivotal shift in digital safety, accountability, and the broader digital ecosystem. It aims to tackle pressing issues such as user safety, harmful content moderation and the protection of vulnerable groups. With the introduction of the licensing regime, businesses operating in the digital space will need to navigate new compliance requirements, underscoring the evolving expectations in the country’s digital ecosystem.

Prior to the introduction of this regulatory framework, service providers were exempted from obtaining a licence pursuant to the Communications and Multimedia (Licensing) (Exemption) Order 2000. Under the new regulations, however, service providers with at least eight million users in Malaysia are required to obtain an Applications Service Provider Class (ASP(C)) Licence from the MCMC. Social media and messaging platforms, including Facebook, Instagram, TikTok, WhatsApp and Telegram, are expected to comply with this framework within the five-month grace period from Aug 1, 2024. Providers failing to secure the ASP(C) Licence by Dec 31, 2024 may face penalties and enforcement actions.

The Malaysian government’s efforts to regulate such service providers are part of a broader global trend to address online harm and ensure online safety. Other countries in Asia-Pacific, such as Singapore, Indonesia, Thailand and India have also implemented similar regulations to tackle these challenges. The Malaysian government’s new regulatory framework combines measures such as licensing requirements, content moderation and user reporting mechanisms to achieve its objectives.

On Aug 1, 2024, the MCMC gazetted a new regulatory framework for social media services and internet messaging service providers. This framework represents a landmark shift in the country’s digital regulation landscape, aligning with global regulatory trends, such as the European Union’s Digital Services Act (DSA) and the Digital Markets Act (DMA). These frameworks seek to enhance platform accountability and protect users, addressing challenges such as misinformation, cyberbullying, scams and harmful or illegal material.

This regulatory framework represents a significant step in supporting the country’s digital transformation journey by enhancing safeguarding measures, promoting data privacy and fostering a secure digital ecosystem. While presenting new challenges, this framework provides businesses an opportunity to drive innovation, foster trust and shape a safer, more inclusive digital future for Malaysia.

Key obligations of the regulatory framework include:

(i)    Licensing requirement: Platforms with a substantial Malaysian user base must apply for an ASP (C) Licence. The application must be submitted by Dec 31, 2024;

(ii)   Local incorporation: Service providers must be locally incorporated in Malaysia to meet the licensing requirements, which may present challenges for foreign-based companies;

(iii)  Content moderation and safety: Platforms are required to implement robust content moderation measures to address harmful content such as misinformation, cyberbullying and illegal material. This includes having processes to handle user complaints and ensure prompt removal of flagged content; and

(iv)  Reporting obligations: Platforms must submit regular reports to the MCMC, detailing their compliance with content moderation and safety protocols.

Service providers within the scope must establish a locally incorporated entity in Malaysia, presenting challenges such as navigating tax and legal requirements, structuring legal entities and managing associated administrative and operational costs. These include compliance with corporate laws, incorporation fees and set-up expenditure, all of which require careful strategic planning.

Additionally, companies will need to ensure they have the appropriate systems in place to monitor and remove harmful content, including the appointment of a local content moderation team. They will also need to have infrastructure in place to support reporting, respond to user reports and flags, and establish and enforce clear limits on the use of personal data in advertising.

The requirements related to conducting risk assessments will also necessitate the development of policies, risk models and related monitoring and reporting systems. All of which will require the implementation of appropriate governance, oversight and controls.

Companies that are not yet within the scope of the framework will also have to consider if expansion within the Malaysian market will lead to future licensing requirements, or if the MCMC will expand the scope of application at a future date, and what this will mean for their business.

To meet the complexities and challenges that come with navigating new regulatory frameworks, it is crucial for global platforms to have strong digital regulations capabilities to ensure a smooth and successful implementation process.

Dr Justin Ong is Deloitte Southeast Asia’s Regulatory and Financial Risk leader

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's App Store and Android's Google Play.