A short test for Malaysian platforms, marketplaces, fintechs and any business whose users can post, list, review or message one another.

A fraudulent advertisement appears on your platform on a Friday evening. By Monday, users in Malaysia are telling your support team that they have lost money, a journalist has called, and a licensed platform you integrate with is asking to see your takedown procedure.

There are three questions which determine how that week goes: who in your business assesses the report, what standard they apply, and how quickly the content becomes inaccessible. For many businesses, the honest answer today is that nobody is quite sure. That is the gap the Online Safety Act 2025 is designed to close and the reason it is worth understanding even if you are confident it does not apply to you.

Three signs this may already be your problem

Before the detail, there are three quick indicators:

1. Users can post, upload, list, review or comment on something that other users can see.
2. Users can communicate with one another through your service beyond private messages to people they have chosen — for example in open groups, channels, comment threads or broadcasts.
3. You have received complaints about scams, fraudulent listings, impersonation or abusive content – or you would not reliably know if you had.

If any of these apply, the question is no longer whether the Online Safety Act 2025 is relevant to you. It is whether your licensing position, your contracts with licensed partners, and your takedown process would hold up if someone asked to see them – a regulator, an investor, or a platform partner. That question is considerably easier to answer now than in the week after an incident.

What is the Online Safety Act 2025?

The Online Safety Act 2025 (“ONSA”) came into force on 1 January 2026. It regulates harmful content online and imposes duties on applications service providers, content applications service providers and network service providers licensed under the Communications and Multimedia Act 1998 (“CMA 1998”). These are enforceable obligations backed by financial penalties of up to RM10 million and criminal fines.

Purpose of the ONSA

The ONSA was introduced to address harmful content by placing clear responsibilities on licensed service providers. ONSA helps build public trust by ensuring licensed service providers take action to prevent harm, detect and respond to harmful content, and create a safer online environment for all users in Malaysia.

Who does the ONSA apply to?

The ONSA applies to service providers holding any of the following licences under the CMA 1998:

• an Applications Service Provider (“ASP”) licence;
• a Content Applications Service Provider (“CASP”) licence; or
• a Network Service Provider (“NSP”) licence.

Since 1 January 2026, internet messaging and social media services with eight (8) million or more users in Malaysia have been deemed registered as ASP(C) licensees^[1], without going through formal registration — which brings them within the ONSA. In January 2026 the Communications Ministry said it was studying whether to revise that threshold.^[2]

Note: “Internet Messaging Services” are defined as an applications service which utilises Internet access service that enables a user to communicate any form of messages with another user; while “Social Media Services” are defined as an applications service which utilises Internet access service that enables two or more users to create, upload, share, disseminate or modify content^[3].

The ONSA does not apply to:

• individual users; or
• the private messaging feature of any applications service and content applications service.

Note: A “private messaging feature” means a feature that allows a user to communicate a content to a specific and limited number of recipients determined by the user and may contain any other characteristics as may be prescribed. Importantly, the exclusion applies to the private messaging feature; other features of the same service may still fall within ONSA.

Extra-territorial application:

The ONSA applies both within and outside Malaysia, including to a person located outside Malaysia where that person provides any applications services, content applications services, or network services in Malaysia and is a licensee under the CMA 1998.

What do the ONSA duties require?

Licensed ASPs and CASPs must implement proportionate, risk-based measures to mitigate user exposure to harmful content, publish safety guidelines, provide tools and settings that let users manage their own safety, make it straightforward to report harmful content and obtain assistance, take particular measures for child users, and prepare an online safety plan documenting how all of this is done. Licensed NSPs are not subject to these duties. When Malaysian Communications and Multimedia Commission (“MCMC”) instructs them in writing, they must block access to harmful content hosted outside licensed services^[4], and they must comply with MCMC’s directions^[5]. They may also be required, by notice, to preserve or disclose communications data for investigations.

“Harmful content” is defined in nine categories, including child sexual abuse material, content on financial fraud, and categories associated with harassment, terrorism, violence and indecency. “Priority harmful content” is the subset consisting of child sexual abuse material and content on financial fraud and is subject to stricter treatment under ONSA.

The ONSA also sets out what licensed ASPs and CASPs must do when content is reported, and how fast^[6]. A report must be acknowledged within one hour of reaching the provider’s official reporting channel, then assessed, with its status notified to the user in writing, within 12 hours of that acknowledgement. Content the provider considers to be priority harmful content must be made inaccessible immediately^[7]; other harmful content may be made inaccessible while it is assessed, and must be made permanently inaccessible once it is confirmed as harmful^[8].

The consequences are significant. A licensed platform that breaches its Part III duties faces a financial penalty of up to RM10 million^[9]. Missing the deadline to make confirmed content permanently inaccessible — one hour for priority harmful content, 12 hours for other harmful content — is an offence carrying a fine of up to RM1 million^[10]. Failing to comply with a written MCMC takedown instruction or a direction is an offence carrying a fine of up to RM1 million, plus up to RM100,000 for every day it continues after conviction^[11]. Where a company commits an offence, its directors, compliance officers and managers may be charged alongside it, and are deemed guilty if it is convicted unless they prove it happened without their knowledge, or without their consent or connivance despite taking all reasonable precautions and exercising due diligence^[12].

For the detail, see our accompanying notes:

• ↗ Duties of Licensed Service Providers under the Online Safety Act 2025
• ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025
• ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025

“We are not licensed” is not the end of the analysis

Even where ONSA does not apply directly, it may still affect how a business operates online or interacts with regulated service providers.

Contractual requirements may flow-down. Licensed service providers may reflect their online-safety requirements into their contracts with vendors, developers, and other businesses that support or integrate with their services. An unlicensed business may therefore encounter ONSA-related requirements through its contracts, even where it is not itself directly regulated under ONSA.

The licensing question is not always obvious. Businesses providing communications, community, content-sharing or similar functionality should not assume they sit outside the CMA 1998 licensing framework simply because they do not think of themselves as a social media company. A property or automotive marketplace, a recruitment platform, a social-commerce app, a gaming service with in-game chat, an e-wallet or investment platform with a community or referral feed, and a customer forum attached to an e-commerce business may each involve functionality that requires analysis. What matters is what the service actually does, not how it is described in the pitch deck. For most services below the eight million user threshold, the likely answer is that the ONSA does not apply directly, but that is a conclusion to reach and record, not assume.

Financial fraud content is expressly in scope. “Content on financial fraud” is listed as both harmful content and priority harmful content under the ONSA. Harmful content available online outside the service of a Licensed ASP or CASP may also be reported to MCMC, which must, if it determines the content is harmful, instruct the relevant Licensed NSP to block access to it. An unlicensed service may therefore be affected by ONSA even though the statutory instruction is directed to the Licensed NSP rather than the unlicensed business itself.

The regulatory framework is still developing. The Online Safety (Period) Regulations 2025, which set the response deadlines, came into force with the ONSA on 1 January 2026, alongside three other sets of regulations.^[13] The Risk Mitigation Code and Child Protection Code were published on 22 May 2026 and took effect on 1 June 2026, and the Online Safety (Online Safety Plan) Regulations 2026 followed on 1 July 2026: licensed platforms must submit their first Online Safety Plans by 28 December 2026 and appoint an Online Safety officer.^[14] The Codes are prescriptive in a way the ONSA itself is not: licensed social media services likely to be accessed by children must verify age against Government-issued or equivalent records so that only users aged 16 and above may register, paid advertisements for goods or services may be permitted only from advertisers verified against Government-issued records (or, where that is not feasible, equivalent foreign records), and generated or manipulated images, audio or video likely to falsely appear authentic must be clearly labelled.^[15] Businesses operating online should therefore continue to monitor regulatory developments and, where relevant, consider whether their reporting, moderation and escalation processes remain appropriate.

For the detail, see our accompanying note: ↗ Risk Mitigation Code and Child Protection Code.

MCMC’s information powers reach beyond licensees. MCMC can require any person it reasonably believes holds information or documents relevant to its functions under the ONSA to produce them^[16]. Failing to comply is an offence carrying a fine of up to RM1 million, plus up to RM100,000 for every day it continues after conviction.

Where this tends to surface commercially

In practice, online safety rarely arrives as a standalone regulatory question. It surfaces in the middle of something else, usually at the least convenient moment:

• Funding and M&A diligence – an investor or acquirer asks how user-generated content, fraud reports and child users are handled, and asks to see the documentation.
• Contract negotiations – a licensed platform, app store, telco or payment partner requires moderation, reporting and takedown commitments, frequently backed by indemnities.
• Regulatory or licensing review – the business is asked to explain its position under the CMA 1998 and cannot do so quickly or consistently.
• After an incident – the absence of a documented process becomes the story, in front of users, partners and sometimes the press.

Each of these is faster, cheaper and less damaging to deal with if the position has already been worked out. Arriving at a considered position in advance costs a fraction of constructing one under deadline pressure, in front of an investor, a partner or a regulator.

Five questions to put to your team this week

These five questions will give most management teams a useful starting point:

1. Do we hold, or are we deemed to hold, an ASP, CASP or NSP licence under the CMA 1998? If nobody can answer this readily, that is itself something to investigate.

• Does our service allow users to communicate with each other or publish or share content that other users can see? If so, what parts of the service fall within ONSA, and does any relevant functionality fall within the private messaging feature exclusion?

• If a user reported harmful content today, what would happen, who would decide, and how long would it take?

• Is our service likely to be accessed by users under 18, and have we designed the service with those users in mind? ONSA defines a child as a person under 18 and requires Licensed ASPs and CASPs to implement specific child-safety measures.

• Do our platform, app store or other service-provider contracts impose content moderation, reporting or takedown obligations on us?

If you could not answer two or more of these with confidence, that is a useful result rather than a comfortable one. Our ONSA Applicability Self-Assessment works through the same questions in structured form – licensing status, in-scope functionality, the private messaging exclusion, child users and contractual exposure – and is designed to be completed by your own team in under an hour. It treats “unsure” as a legitimate answer, because the questions a business cannot answer are usually the ones that matter. Download it free ↗ here.

A useful test of ONSA readiness is not simply whether the business has detailed policies, but whether the relevant teams can explain clearly what happens when harmful content is identified or reported, who is responsible for the decision, and how quickly action must be taken. If the answer to the Friday evening scenario above is a pause, that is the work to be done.

Our Harmful Content Escalation & Takedown Playbook is designed to help with exactly that work – download it free ↗ here.

Speak to Our Partner

Ong Wei Jie

wei.jie.ong@joclawyers.com

JOC advises digital platforms, marketplaces, fintechs and technology businesses on Malaysian communications, content and data regulation. Speak to our Partner for advice on the Online Safety Act 2025, platform regulation and related commercial compliance matters.

Send Us a Message

Book an Appointment

This article is current as at 30 September 2026 and reflects the position at that date. It is provided for general information only and does not constitute legal advice or create a solicitor-client relationship. You should obtain advice on your specific circumstances before acting or refraining from acting on anything in this article. JOC accepts no liability for any loss arising from reliance on it. For further information, please contact hello@joclawyers.com.

References:

[1] Communications and Multimedia Act 1998, s 46A.

[2] Bernama, “Communications Ministry Mulls Revising Social Media User Threshold Following AI Grok Issues” (15 January 2026).

[3] Communications and Multimedia (Licensing) Regulations 2000, reg 2, as amended by the Communications and Multimedia (Licensing) (Amendment) (No. 2) Regulations 2024 [P.U.(A) 205/2024].

[4] Online Safety Act 2025, s 25(1)(b).

[5] Online Safety Act 2025, s 30.

[6] Online Safety Act 2025, ss 22 and 23, read with the Online Safety (Period) Regulations 2025 [P.U.(A) 465/2025].

[7] Online Safety Act 2025, s 22.

[8] Online Safety Act 2025, s 23.

[9] Online Safety Act 2025, s 39.

[10] Online Safety (Period) Regulations 2025 [P.U.(A) 465/2025], reg 3.

[11] Online Safety Act 2025, ss 23(9), 25(4) and 30(9).

[12] Online Safety Act 2025, s 73.

[13] Online Safety (Period) Regulations 2025 [P.U.(A) 465/2025]; Online Safety (Fees) Regulations 2025 [P.U.(A) 466/2025]; Online Safety (Form of Undertaking) Regulations 2025 [P.U.(A) 469/2025]; Online Safety (Online Safety Appeal Tribunal) Regulations 2025 [P.U.(A) 478/2025].

[14] Online Safety (Online Safety Plan) Regulations 2026 [P.U.(A) 244/2026].

[15] MCMC, Risk Mitigation Code and Child Protection Code, issued under s 80 of the Online Safety Act 2025 (published 22 May 2026; effective 1 June 2026).

[16] Online Safety Act 2025, s 32.