MCMC’s announcement: Deemed registration of large internet messaging and social media service providers in Malaysia

18 December 2025

On 15 December 2025, the Minister of Communications and the Malaysian Communications and Multimedia Commission (“MCMC”) issued a Ministerial Declaration on the Dispensation with the Formality of Registration under the Applications Service Provider Class Licence, Declaration No. 87 of 2025 (“Declaration”), alongside a media statement, announcing that all internet messaging and social media service providers with at least eight million users will be deemed to be registered as applications service provider class (“ASP(C)”) licensees under the Communications and Multimedia Act 1998 (“CMA”) effective 1 January 2026. This “deemed registration” will occur through a dispensation of formalities under section 46A of the CMA (“Deeming Provision”).

This article summarises the Declaration and the effects of the Deeming Provision.

Background

The Deeming Provision arises from an amendment to the CMA, specifically the introduction of section 46A, which came into force on 11 February 2025. This new section empowers the Minister to dispense with the formal registration requirement for a class licence by way of a ministerial declaration. Once invoked, the Deeming Provision deems any affected person to be registered as a class licensee subject to the relevant obligations under the CMA, even if the person has not submitted a licence application to MCMC.

This legislative change addresses a regulatory gap in enforcing Malaysian laws against large digital platforms operating remotely from outside the country. Following the introduction of a broader regulatory framework for social media and internet messaging services on 1 January 2025, requiring platforms with at least eight million users in Malaysia to obtain an ASP(C) licence from MCMC, the Deeming Provision serves as a targeted measure to capture non-compliant large digital platform providers. Its purpose is to ensure that all major platforms operating in Malaysia, regardless of physical presence, are subject to the nation’s regulatory framework and are held accountable for maintaining and strengthening online safety in Malaysia.

Declaration and the implications of deemed registration

Pursuant to the Declaration, internet messaging service providers and social media service providers with at least eight million users will be deemed to be registered as ASP(C) licensees under the CMA from 1 January 2026, without the need to go through a formal registration process. The deemed registration remains effective unless cancelled, and applies to major platforms such as WhatsApp, Telegram, Facebook, Instagram, TikTok and YouTube.

Internet messaging and social media service providers that are already registered as an ASP(C) licensee will remain registered and will only be deemed registered after the expiry of their existing one-year registration. Accordingly, such service providers are not required to re-register under the class licence upon its expiry.

Once deemed registered, the affected service providers will be treated in law as ASP(C) licensees, and must comply with:

Consequences of non-compliance

Non-compliance may constitute an offence under the CMA, exposing service providers and their officers to regulatory and legal actions including fines and imprisonment. In addition, failure to comply with MCMC’s directions requiring service providers’ compliance with these obligations may attract financial penalties imposed by MCMC under the CMA.

What this means for affected service providers and next steps

As immediate next steps, and prior to 1 January 2026, affected service providers are required, among other things, to:

  • appoint a local representative in Malaysia (for foreign individuals or companies), who will serve as the point of contact to facilitate communications between the service providers and MCMC, and notify MCMC of the same. There is no need to establish a physical office in Malaysia but the appointment of a local representative is mandatory;
  • ensure compliance with the CMA and its subsidiary legislations, as well as regulatory instruments issued under the CMA. For example, the Standard Conditions and notices issued by MCMC to the affected service providers; and
  • as a matter of best practice, comply with the Code of Conduct (Best Practice) for Internet Messaging Service Providers and Social Media Service Providers.

Additionally, once the Online Safety Act 2025 comes into force, affected service providers must comply with prescribed duties applicable to ASP(C) licensees. For instance, issuing user guidelines, providing sufficient tools and settings to enable users to manage online safety, and establishing a mechanism for users to report harmful content. The Online Safety Act 2025 is anticipated to come into force early 2026.

Further information

This article has been prepared with the assistance of Senior Associate Ng Hong Syuen.