This note forms part of our series on Malaysia’s Online Safety Act 2025. It accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and covers the two subsidiary codes that give the ONSA duties their operational detail.

On 22 May 2026, the Malaysian Communications and Multimedia Commission (“MCMC”) published the Risk Mitigation Code (“RMC”) and Child Protection Code (“CPC”) under section 80 of the Online Safety Act 2025 (“ONSA”). Both the RMC and CPC (“Codes”) took effect on 1 June 2026.

The Codes are where the ONSA stops being a statement of principle and turns the duties into specific engineering and governance work: annual risk assessments by a qualified team, verified advertisers, labelled synthetic media, an internal assurance function reporting to the audit committee or governing body, and age verification for licensed social media services likely to be accessed by children. They are also the clearest signal yet of the direction of travel, and a likely template for the commitments licensed partners will ask for in commercial contracts. Providers may adopt alternative measures if they satisfy MCMC that those measures work better (ONSA sections 13(2) and 18(2)).

The Codes provide more detail on how licensed applications service providers and licensed content applications service providers (“Licensed Service Providers”) are expected to discharge their duties under the ONSA.

The Online Safety (Online Safety Plan) Regulations 2026 came into force on 1 July 2026, and licensees have 180 days from that date — by 28 December 2026 — to submit their plans. The said regulations prescribe the plan’s form: for each code, the provider must describe the measures implemented and justify any alternative measures with evidence or internal assessment. Providers must also appoint one or more Online Safety officers.

Part A: Risk Mitigation Code

1. Risk Assessment
   
   The RMC requires Licensed Service Providers to conduct suitable and sufficient harmful content risk assessment of their services.
   
   The assessment must take into account factors such as:
   
   • the demographics of users in Malaysia;
   • the design, features and functionality of the service that may increase exposure to harmful content;
   • current and emerging trends in online behaviour and associated threats; and
   • use of the platform during periods of heightened risk, including national crises, disasters and state or federal elections.
     
     To carry out harmful content risk assessment of their services, the Licensed Service Providers shall:
     
   • ensure that there is a skilled and qualified risk assessment team established that is conducting harmful content risk assessment of the service;
   • ensure that where the service or any part of the service is likely to be accessed by child users, the risk assessment team includes expertise on child online safety;
   • review and update the harmful content risk assessment annually, to ensure that it remains up to date, suitable and sufficient for the purpose of implementing measures to mitigate the risk of users being exposed to harmful content;
   • prepare and maintain a written record, in a clear and readily comprehensible form of all harmful content risk assessment conducted, including the methodologies applied and the findings and outcomes of each assessment; and
   • ensure that all personal data collected and processed for the purpose of harmful content risk assessment are collected and processed with due regard to the privacy of users and the rights of users to their personal data, in accordance with the Personal Data Protection Act 2010.
     
2. Risk Mitigation
   
   Based on the findings of the harmful content risk assessment, Licensed Service Providers must implement proportionate and effective measures covering several areas:
   
   1. Content management and moderation: Establish systems and procedures for reporting, identifying, assessing, and removing harmful content. Have policies for dealing with users who communicate harmful content, which may include warnings, restrictions, suspension or termination of accounts for repeat offenders.
      
   2. User empowerment and controls: Users must be given tools and settings that allow them to manage their online safety, including controls over search and recommendation outputs and account interactions. Providers must also implement education and awareness measures and protect the anonymity and confidentiality of users who report harmful content.
      
   3. Child safety: Implement specific measures to ensure the safe use of services by child users.
      
   4. Safe design:
      
      • ensure that content can only be communicated by registered user
      • permit paid advertisements for goods or services only from advertisers or users verified against Government-issued records (for companies, incorporation or registration documents; for individuals, NRIC, passport or work permit), or equivalent foreign records where Malaysian verification is not feasible;
      • test and adapt algorithmic and recommendation systems to reduce exposure to harmful content;
      • ensure that generated or manipulated images, audio or video that may falsely appear authentic are clearly distinguishable through prominent labels or markings; and
      • assess new features and functionality for harmful-content risks before deployment.
        
   5. Safety policies: Develop and consistently enforce user-safety policies, community standards, guidelines or terms of service, and maintain clear internal procedures for reporting to the relevant enforcement agencies. The policies must be visible, easily accessible, regularly updated and written in clear, user-friendly language.
      
      The RMC also requires Licensed Service Providers to establish an internal assurance function to continuously monitor the effectiveness of their risk mitigation measures, with regular reporting to the provider’s audit committee or governing body.

Part B: Child Protection Code

The CPC sets out measures that Licensed Service Providers must implement to ensure the safe use of their services by child users:

1. Age verification: Licensed service providers offering a social media service likely to be accessed by child users must implement effective age-verification measures, so that only users identified as 16 and above can register and access age-appropriate features (para 3.1). Age must be verified against records issued by the Government of Malaysia, such as NRIC, passport or birth certificate, or equivalent records from a competent foreign authority (para 3.2). Data collected for verification must be limited to what is necessary and not kept longer than needed (para 3.3). MCMC announced on 1 June 2026 that the requirement applies to licensed platforms including Facebook, Instagram, TikTok and YouTube, with existing users verified progressively over up to six months.
   
2. Content moderation: Providers must have systems to detect and remove harmful content affecting child users, provide accessible reporting mechanisms for children and parents, take steps to prevent repeated exposure to harmful content, and respond promptly to removal requests from MCMC or other enforcement agencies.
   
3. Parental controls: Parents must be given clear and accessible tools to monitor and manage a child user’s online activities, including settings and limits appropriate to the child’s age and development.
   
4. Privacy and safety settings: Child users must benefit from age-appropriate and/or highest-level default privacy settings. Providers must also restrict unwanted adult-to-child communications and avoid manipulative design features that encourage compulsive or prolonged use.
   
5. Search and recommendation systems: Providers must take proportionate steps to ensure that safe-search functions are on by default for child users, that harmful content is filtered from results, and that recommendation systems and algorithms do not display, promote or recommend harmful content to them (para 7.2).

Because the Codes specify how the ONSA section 13 and section 18 duties are met, failing to follow them without MCMC-approved alternatives can breach a Part III ONSA duty, with a financial penalty of up to RM10 million.

Next step

The subsidiary legislation under the ONSA is still developing, and measures that read as forward-looking today are likely to appear as contractual requirements tomorrow. We help businesses run a gap analysis against the RMC and CPC, prepare or review an Online Safety Plan, and assess where alternative measures can be justified to MCMC.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ Duties of Licensed Service Providers under the Online Safety Act 2025 | ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025 | ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025.

Free resources (downloads): ↗ ONSA Applicability Self-Assessment | ↗ Harmful Content Escalation & Takedown Playbook.