Subsequent to our client alert issued on 29 July 2024, the licensing framework for internet messaging services and social media services was gazetted on 1 August 2024.
With effect from 1 January 2025, internet messaging services and social media services providers (collectively, “Service Providers“) with 8 million or more users in Malaysia, must hold an applications service provider class licence (“ASP(C) Licence“) pursuant to the Communications and Multimedia Act 1998 (“CMA“) in order to make available their services into Malaysia.
Contents
- What are “internet messaging services” and “social media services”?
- Is everyone caught?
- How to apply?
- What are the consequences of non-compliance?
- What are the obligations of an ASP(C) licensee?
- Concluding remarks
What are “internet messaging services” and “social media services”?
Under the newly gazetted Communications and Multimedia (Licensing) (Amendment) (No. 2) Regulations 2024 and Communications and Multimedia (Licensing) (Exemption) (Amendment) Order 2024:
- “social media services” are defined as an applications service which utilizes Internet access service that enables 2 or more users to create, upload, share, disseminate or modify content; and
- “internet messaging services” are defined as an applications service which utilizes Internet access service that enables a user to communicate any form of messages with another user.
Is everyone caught?
The new licensing regime will only apply to Services Providers if they have 8 million or more users in Malaysia. Based on the FAQ issued by the Malaysian Communications and Multimedia Commission (“MCMC“) on 1 August 2024, this figure will be quantified by MCMC primarily from the data it receives from its official surveys (including MCMC’s Internet User Survey), as well as other publicly available and reliable data points.
How to apply?
Similar to the cloud licensing framework introduced in 2021, the licensing of Service Providers via an ASP(C) Licence allows for a light-touch regulatory approach by MCMC, balancing regulatory oversight without stifling innovation. To apply for an ASP(C) Licence, a Service Provider must:
- be a locally incorporated entity (unless otherwise permitted by the Communications Minister);
- pay an annual registration fee of RM 2,500; and
- submit the requisite documents to MCMC as per the class licence application checklist (e.g., application form, company profile, information of the service and others).
There is no restriction on foreign equity shareholdings, and the validity period for the ASP(C) Licence is 1 year.
What are the consequences of non-compliance?
Failure to comply may result in Service Providers being liable to fines up to RM500,000 and/or imprisonment for a term up to 5 years. A further fine of RM1,000 for every day or part of a day during which the offence is continued after conviction, can also be levied. Directors, officers or persons in management of a body corporate who has failed to comply with the licensing requirement, can also be deemed liable.
What are the obligations of an ASP(C) licensee?
As an ASP(C) licensee, Services Providers are required to comply with, amongst others:
- the provisions of the CMA, its subsidiary legislation and any other instruments, guidelines or regulatory policies issued under the CMA. This include having to:
- use best endeavours to prevent its application services from being used in or in relation to the commission of any offence under any law of Malaysia;
- provide assistance to MCMC or any other authority in preventing the commission or attempted commission of an offence in Malaysia; and
- possibly make contributions to the Universal Service Provision Fund;
- any directions issued by MCMC pursuant to Section 51 of the CMA (which allows MCMC to issue directions for any person to comply with the CMA, its subsidiary legislation or any other licence conditions);
- the standard licence conditions attributable to the ASP(C) Licence; and
- the requirements under the Malaysia Personal Data Protection Act.
Are there compliance requirements in the interim up to 1 January 2025?
While Service Providers have a grace period of 5 months (starting from 1 August 2024) to apply for the ASP(C) Licence, MCMC has asked that Service Providers use best efforts to combat online harm on their platforms such as cyberbullying, online scams and gambling, and child sexual abuse material, even in the interim.
In line with practices in other jurisdictions, MCMC has indicated that it will be looking to roll out more outcome based guidelines setting out specific conduct requirements and key obligations of Service Providers moving forward. These guidelines will be developed by MCMC through public consultation in the coming months and will detail robust policies and measures for user data protection, child safety, addressing online harm, content moderation, advertising transparency, safeguarding minors, simplifying complaint procedures, managing deepfakes and harmful AI-generated content, and regular reporting measures.
Concluding remarks
The new licensing regime in Malaysia represents a significant shift in the regulatory landscape for Service Providers, which underscores the Madani Government’s commitment to ensuring a safe and regulated digital environment.
Service Providers seeking to continue making available its services in Malaysia will need to gain a comprehensive understanding of the new licensing requirements and application procedures, as well as the emerging regulatory responsibilities. Those impacted should also seek to participate in dialogues with MCMC to provide feedback and contribute to the formulation of the upcoming guidelines on conduct requirements.
As the digital landscape continues to evolve, online service providers are encouraged to remain vigilant and to strategically navigate the regulatory landscape to ensure continued compliance and success in the Malaysian market.
