This note forms part of our series on Malaysia’s Online Safety Act 2025. It accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and sets out in detail what the ONSA requires of licensed service providers.

If your business does not hold a licence, these duties still deserves attention. They are the standard that licensed platforms, app stores and payment partners are likely to push down into their vendor and integration contracts, and the benchmark an investor or acquirer is likely to apply when asking how you handle user-generated content and fraud reports. Reading them as a description of “what good looks like” is more useful than reading them as a list of obligations that belong to someone else.

Part A: Duties of Licensed ASPs and CASPs

Under Part III (sections 13 to 20) of the Online Safety Act 2025 (“ONSA”), licensed applications service providers (“Licensed ASPs”) and licensed content applications service providers (“Licensed CASPs”) are required to:

1. Implement measures to mitigate risk of exposure to harmful content (section 13), as specified in the code issued by MCMC under section 80 (now the Risk Mitigation Code, in force since 1 June 2026). Alternative measures may be implemented if the provider satisfies MCMC that they would better mitigate the risk of users being exposed to harmful content. However, the measures implemented shall not unreasonably or disproportionately limit a user’s expression.
   
2. Issue guidelines to users (section 14), which shall include: a description of measures implemented by the licensed ASPs and CASPs; and terms of use as a guide to users when using the service of the licensed ASPs and CASPs. Such guidelines must be made available on their services, be clear, easily accessible and understood, and regularly updated.
   
3. Provide sufficient tools and settings for users to manage their online safety (section 15), including tools that allow users to prevent or limit other users from identifying, locating, or communicating with them on the service.
   
4. Provide a mechanism for reporting harmful content available on their services (section 16).
   
5. Provide a user assistance mechanism (section 17) that is easily accessible to all types of users and responsive at all times. The mechanism must enable users to:
   
   • raise concerns relating to online safety, including the measures implemented by the provider;
   • obtain information on the online safety mechanisms available on the service within seven days of the request (Online Safety (Period) Regulations 2025, item 1); and
   • make inquiries.
     
6. Protect the online safety of child users (section 18), by implementing the measures specified in the applicable code, or alternative measures where the provider satisfies MCMC that those measures would better ensure the safe use of its service by child users. These measures must include measures for the safe design and operation of services that are, in the provider’s opinion, likely to be accessed by child users, including measures to:
   
   • prevent a user identified as a child from accessing content suspected to be harmful;
   • limit the ability of an adult user from communicating with a child user;
   • limit features that increase, sustain or extend the use of its service by a child user;
   • prevent an adult user from viewing the personal information of a child user available on its service; and
   • control personalized recommendation systems suitable for child users.
     
     These duties are now supplemented by the Child Protection Code, in force since 1 June 2026.
     
7. Establish a mechanism for making priority harmful content inaccessible to all users (section 19).
   
8. Prepare an Online Safety Plan (section 20) setting out their compliance with the duties under Part III, which shall be made available on the relevant services, easily accessible and regularly updated. It must not contain any user’s personal information, and a copy must be submitted to MCMC. The Online Safety (Online Safety Plan) Regulations 2026, in force since 1 July 2026, prescribe the Plan’s form. A copy must reach MCMC within 180 days of 1 July 2026 (by 28 December 2026), or, for providers licensed later, within 180 days of the licence taking effect. An updated copy is then due annually and whenever the service or its compliance duties change materially. Providers must also appoint one or more Online Safety officers, and any breach of the said regulations is an offence carrying a fine of up to RM1 million.

A licensed ASP or CASP that fails to comply with a Part III duty faces a financial penalty of up to RM10 million, recoverable as a civil debt (section 39). MCMC must issue a notice of non-compliance stating the penalty; the provider must pay it or apply for a review by way of representation, and the review decision can be appealed to the Online Safety Appeal Tribunal (sections 37, 38 and 41). Before any notice is issued, the provider may give an undertaking to comply, in the prescribed form (section 36).

Part B: Duties of Licensed NSPs

Licensed network service providers (“Licensed NSPs”) are not subject to the Part III duties imposed on Licensed ASPs and CASPs under the ONSA. However, they are subject to other obligations under the ONSA, such as to:

1. Comply with a written instruction from MCMC to restrict the relevant parts of its network service so as to make harmful content permanently inaccessible, and notify MCMC in writing of the action taken.
   
2. Comply with directions issued by MCMC concerning compliance with the ONSA.
   
3. Provide relevant information and allow inspections to ensure compliance with ONSA.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025 | ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025 | ↗ Risk Mitigation Code and Child Protection Code.

Free resources (downloads): ↗ ONSA Applicability Self-Assessment | ↗ Harmful Content Escalation & Takedown Playbook.