Communications and Multimedia Content Forum of Malaysia conducts public consultation on proposed Gaming Sub-Code
12 October 2026
On 9 September 2026, the Communications and Multimedia Content Forum of Malaysia (“CMCF”) issued a public consultation paper on the proposed Gaming Sub-Code 2026 (“Sub-Code”) (“Paper”). Stakeholders and members of the public are invited to submit written feedback by 24 October 2026.
This article summarises the core approaches set out in the Paper.
Background
The Sub-Code will supplement the existing Malaysian Communications and Multimedia Content Code registered under the Communications and Multimedia Act 1998 (“CMA”) by providing standards specifically for online games and gaming services. The Sub-Code will only take effect upon registration by the Malaysian Communications and Multimedia Commission under section 95(2) of the CMA. Compliance with a registered industry code is voluntary. However, under section 98(2) of the CMA, such compliance constitutes a statutory defence to legal proceedings.
The Sub-Code seeks to address online games that combine traditional gameplay with modern interactive mechanisms such as user-generated content (“UGC”), livestreaming, and interactive features such as social networks and user communications.
The Sub-Code adopts a risk-based and proportionate approach. The expected level of safeguards depends on factors such as the nature of the gaming service, the degree of control exercised by the relevant party, the likelihood of access by children, and the likelihood and severity of potential harm.
Scope and risk-based approach
The Sub-Code seeks to regulate content made available through online games and gaming services, including connected features that may affect user safety, monetisation, advertising, user interaction, content accessibility, or account security.
The Sub-Code adopts a shared responsibility approach, where obligations are shared across the value chain proportionately, to those involved in the development, publication, operation, distribution, promotion, or monetisation of online games and gaming services.
The Sub-Code will not apply to:
- offline games that do not have online, connected, interactive, monetised, advertising, or network-enabled functionality;
- games that do not provide online monetisation, user interaction, advertising, livestreaming, UGC, or other network-enabled interactive services; and
- unregulated or illegal online platforms
Risk assessment
Operators and publishers will be expected to take reasonable steps to assess the level of risk presented by a gaming service. The Sub-Code provides that the likelihood and the severity of the harm should be considered, along with other factors such as the likelihood that children will access the gaming service and the nature and extent of user interaction and UGC.
User safety and child protection
High-risk features and UGC
While the Sub-Code does not seek to ban outright high-risk features such as direct communication with unknown users, location-sharing, real-money purchases or paid randomised reward mechanisms, and unmoderated UGC environments it does require reasonable and proportionate measures to mitigate risks be undertaken. Such measures include age assurance, parental controls, access restrictions, warnings, reporting tools and moderation.
Age-appropriate design and child protection
The sub-Code distinguishes between age classification and age assurance.
Where a gaming service or feature presents a significant risk of serious harm to children, highly effective age assurance (i.e. age signals obtained from a recognised age assurance provider, including through platform-level age assurance) should be implemented. On the other hand, a low-risk gaming service may rely on age declarations.
The Sub-Code also proposes protective default settings for child accounts, and parental or guardian consent will be required before higher-risk settings may be enabled.
Moderation and user interaction
The Sub-Code will require operators of gaming services with user interaction features to take appropriate safeguards against harmful conduct including harassment, bullying, threats, grooming, sexual exploitation, scams, phishing, and account theft.
Account integrity and safety
The Sub-Code will require operators to take reasonable and proportionate measures to safeguard account integrity, including against unauthorised access, account sale and transfer, fraud and scams.
Monetisation and commercial practices
Responsible monetisation and transparency
Operators will be expected to provide clear information on the real-money cost of purchases, recurring payments, expiry dates, material limitations, and the effect of purchases on gameplay.
For randomised reward mechanisms, including loot boxes or gacha mechanics, there must be disclosure of the presence of such mechanism and probabilities of obtaining available outcomes. Additional spending controls are proposed for child accounts, including default spending limits and parental controls.
Advertising and creator promotions
Commercial communications should be clearly identifiable as advertising or sponsored content. The Sub-Code also proposes additional protections for children, including restrictions on personalised advertising using personal data collected within the gaming service. Gaming content creators will be expected to disclose sponsored or paid arrangements and avoid misleading claims.
Operator responsibilities
Operators will be expected to incorporate “safety-by-design” principles throughout the lifecycle of their gaming services. Operators of gaming services that are likely to be accessed by children will also be expected to conduct a written child safety risk assessment at least annually and within 30 days of any material changes to the gaming service.
For gaming services that enable communication or interaction between users, the operators must designate a gaming safety officer to be responsible for child safety.
Feedback sought
Briefly, the CMCF is seeking feedback on the following key points:
- Overall approach and scope: Whether the Sub-Code provides a clear, proportionate framework for responsible gaming while balancing user protection, industry growth, and innovation.
- Age assurance and child protection: The practicality of age checks, age ratings, age-assurance standards, and alternative verification methods for children without identity documents.
- Children’s accounts and parental controls: The suitability of default settings, communication and feature restrictions, parental consent, spending controls, and supervised gaming.
- Disclosure and transparency: Whether users and parents receive sufficient information on age ratings, safety risks, monetisation, advertising, user interaction, and complaints.
- Responsible monetisation and randomised rewards: The adequacy of safeguards for in-game purchases, virtual currencies, randomised rewards, spending limits and trading systems, including cost and probability disclosures.
- Advertising and creator promotions: The suitability of requirements for in-game advertising, child-directed ads, personalised advertising restrictions, and disclosure of paid promotions.
- User interaction and moderation: The effectiveness of safeguards against harassment, bullying, grooming, exploitation, scams and other harmful conduct, including reporting and moderation tools.
- Accounts, safety, and complaints: The proportionality of safety-by-design measures, risk assessments, safety officers, incident response, complaints handling, recordkeeping, and transparency reporting.
- Responsibility and implementation: Whether obligations are appropriately allocated among industry participants and whether transition periods, implementation thresholds, and regular reviews are needed.
- Overall feedback and industry considerations: Whether there are any gaps, unclear or impractical requirements, implementation challenges, preparation time, and support needed by industry participants.
Further information
This article has been prepared with the assistance of Senior Associate Ng Hong Syuen.