This downloadable resource accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and consists of a free self-assessment for businesses unsure whether Malaysia’s Online Safety Act 2025 applies to them, covering licensing, product features, private messaging, child users and contractual exposure.

The Risk Mitigation Code and the Child Protection Code have been in force since 1 June 2026. The Online Safety (Online Safety Plan) Regulations 2026 have been in force since 1 July 2026, and licensed providers must submit their Online Safety Plans by 28 December 2026. Platforms, app stores and payment partners are already passing these standards down into their commercial contracts. So the question “does ONSA apply to us?” is now being asked in diligence questionnaires and contract negotiations, not only by regulators.

We built the ONSA Applicability Self-Assessment to help businesses move from an assumption to a documented answer. It covers five areas.

1. Your licensing status under the CMA 1998

The ONSA applies to holders of an Applications Service Provider, Content Applications Service Provider or Network Service Provider licence under the Communications and Multimedia Act 1998. This is the gateway question, and it is less certain than businesses expect. A licence may have been obtained years ago for a different product line. It may sit in a subsidiary that nobody in the current management team remembers. Some providers are also deemed to be registered without ever applying: an Internet Messaging Service or Social Media Service with eight million or more users in Malaysia is likely to be deemed registered under section 46A of the CMA 1998.

2. What your product actually lets users do

Businesses tend to describe themselves by commercial category: “we’re a payments company”, “we’re a marketplace”. The licensing framework looks instead at functionality. Can users message one another? Can they post listings, reviews, profiles or images that others can see? Do you run community features or carry third-party advertising, even as a secondary part of the product? A feature launched in the last twelve months may have changed the answer without anyone noticing.

3. Whether the private messaging exclusion really helps you

The ONSA does not apply to the private messaging feature of a service. This exclusion is often read too widely. It attaches to the feature, not to the service, and it covers only communications to a specific and limited number of recipients chosen by the user. Feeds, open groups and discoverable profiles running alongside that feature are a separate question.

4. Child users

The ONSA defines a child as anyone under 18. The test is not whether your terms of service allow children, but whether your service is likely to be accessed by them. Age limits stated in your terms and age limits enforced in practice are different things, and the Child Protection Code is concerned with practice.

5. Indirect and contractual exposure

This is the part that catches most businesses. Even where the ONSA does not apply to you directly, its requirements reach you through:

• contracts with licensed partners;
• MCMC’s power to instruct network service providers to restrict access to content; and
• the questions asked on a funding round or acquisition.

Content on financial fraud, such as scam listings, fake investment offers and fraudulent advertisements, is “priority harmful content” under the ONSA. Any service where such content could appear has a reason to look closely.

What you get

The self-assessment sets out 25 Yes / No / Unsure questions across these five areas. It then gives a results table that places your answers in one of five bands:

• Directly regulated
• Licensing position unresolved
• Indirectly exposed
• Process gap
• Assessment required

Each band comes with a practical next step. The assessment treats “Unsure” as a legitimate answer, because the questions a business cannot answer are usually the ones that matter most. It also encourages you to record who answered each question and when. If your position is challenged later, that contemporaneous record is often more useful than the conclusion itself.

It takes about 20 minutes. It works best when completed by someone from product and someone from legal or compliance together.

Download the ONSA Applicability Self-Assessment

Enter your details below and we’ll email you a copy of the self-assessment.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ Duties of Licensed Service Providers under the Online Safety Act 2025 | ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025 | ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025 | ↗ Risk Mitigation Code and Child Protection Code.

Related resources (downloads): ↗ Harmful Content Escalation & Takedown Playbook.