By: Christian Brooks – SeaPRwire
How the story usually gets told
The version that circulates goes like this. Malaysia decided that big social platforms had been operating in the country without permission for long enough, set a threshold of eight million local users, told anyone above it to apply for an Applications Service Provider Class licence — ASP(C), in the Communications and Multimedia Act 1998 framework — and switched the requirement on at the start of 2025. TikTok and WeChat complied and were licensed. X said it was below the line. YouTube argued about which category it belonged in. Order was restored.
It is a tidy story and it contains a real event. The Malaysian Communications and Multimedia Commission announced the framework in mid-2024 with a 1 January 2025 start date, and the licences did start appearing at the beginning of that year.
What the tidy version leaves out is that almost every number in it is unreviewable from the outside. Not wrong. Unreviewable. There is a difference, and the difference is the whole subject of this piece.
Eight million, counted by whom?
Start with the threshold itself.
Eight million users in Malaysia. It sounds precise. It is the kind of figure that reads like a measurement and functions like a policy choice. Which is fine — thresholds are always policy choices — but it does raise the question that nobody in the public record has answered: counted how, by whom, and as of when?
- Monthly active users, or registered accounts?
- Accounts registered with a Malaysian phone number, or accounts observed accessing from Malaysian IP ranges?
- Deduplicated across devices, or counted per device?
- Measured by the platform, by the regulator, or by a third-party panel?
Each of these choices moves a platform across the eight million line. A service with 6 million monthly actives and 11 million dormant registrations is above the threshold under one definition and safely below it under another. The distinction is not academic, because the licence obligations that follow are operational and expensive: age verification, local moderation capacity, response times on harm reports.
If MCMC published its counting methodology, this would be a paragraph instead of a section. It has not, at least not in a form that lets anyone reproduce the arithmetic.
What X told the regulator
The X case is the cleanest illustration, because it is the one where a platform publicly disputed the count.
X’s position, as reported at the start of 2025, was that it did not meet the threshold in Malaysia — citing a user figure of roughly 5.71 million from its own early-2024 reporting. MCMC responded that it was verifying the claim. The platform was not licensed at the point the requirement took effect.
Pause on the structure of that exchange. The regulated party supplies the number. The regulator checks the number. The number determines whether the party is regulated at all. That is not a crazy arrangement — self-reporting with audit behind it is how a lot of financial regulation works — but it only produces trust when the audit produces a published result.
So: has MCMC confirmed or rejected X’s figure? Not in any document I can find. Did X update the number? Not publicly. The file appears to have stopped at “we are verifying.”
Meanwhile Google, for YouTube, took a different route entirely: rather than disputing the user count, it raised a classification question about whether video-sharing sits inside the licensing category as drafted. Telegram was reported to be at the final stage of the process. Meta was reported to have started applications for Facebook, Instagram and WhatsApp. Some of these platforms are almost certainly above eight million Malaysian users; none of them seems to have been measured into or out of the regime on the public record.
Licence conditions still unposted
Here is the gap that matters most for anyone actually trying to comply.
An ASP(C) licence is not a badge. It comes with conditions, and those conditions are what a platform has to build against. Reporting on the framework describes the obligations in general terms: age verification with no access for under-13s, local content moderation teams able to respond to harm reports within 24 hours, proactive flagging of undisclosed sponsored content.
Those are specific-sounding. They are also, as far as I can establish, paraphrases rather than published conditions. What is missing:
- The actual text of the licence conditions, per platform.
- Whether the conditions differ between a messaging service and a short-video service.
- The 24-hour response clock: measured from what event, against which categories of report, with what exemption.
- The audit cadence, and whether audit findings are ever published.
- The penalty schedule, and what triggers a suspension rather than a fine.
This is not an accusation of secrecy for its own sake. Regulators routinely publish conditions and routinely withhold commercially sensitive detail. But a framework whose obligations are known mainly through secondary summaries produces a predictable outcome: platforms build to the summary, creators guess at the rest, and enforcement becomes unpredictable for everyone.
A tragedy, then a timetable
The licensing push did not arrive out of a policy seminar.
The death of a young Malaysian TikTok creator, widely reported under the name Esha and attributed to sustained online harassment, produced an immediate government response in 2024 and is the event most often cited as the catalyst for both the ASP(C) framework and the strengthened penalties in the CMA 1998 amendment.
It is worth being careful here, because tragedies get used to justify instruments that would not survive on their own merits. The question is not whether the response was sincere. The question is whether the instrument actually addresses the failure.
Platform licensing does two things in principle. It gives the regulator a lever — a licence can be suspended — and it forces platforms to stand up local moderation capacity. Both are real.
What licensing does not automatically do is produce a record. If a platform’s local moderation team handled 40,000 harm reports last year, how many were cyberbullying, how many took longer than 24 hours, how many resulted in account action, and how many appeals succeeded? That is the data that would tell you whether the lever is being pulled. It is also the data that no regulator in the region publishes as a matter of course.
Where the enforcement record is thin
Malaysia’s enforcement record is not empty. It is just pointed at individuals rather than platforms.
The case usually cited involves a Malaysian influencer couple and roughly RM740,000 in funds frozen in mid-2024 in connection with an investigation into an alleged online donation scam. A separate line of enforcement has gone after undisclosed advertising: creators presenting paid endorsements as personal experience, particularly in the slimming and health product categories, where the Medicine Advertisements Board approval regime applies and where claims about treating or preventing disease are prohibited without substantiation.
There is also a body of commercial disputes grounded in the same activities — a brand using an influencer’s image beyond the scope of a contract, for instance, which is a copyright and licensing question rather than a platform question.
Notice what all of these have in common. They are downstream. They catch a person after the content has run. They do not tell you anything about whether the platform surfaced or suppressed the content, how fast it responded to a report, or whether a disclosure requirement was enforced at scale.
- Individual creators: visible enforcement, financial penalties, reputational consequences.
- Brands and agencies: contract disputes, occasional damages.
- Platforms: licensing status changes, and essentially no published service-level record.
A regulator can argue that the first two are the deterrent and the third is the plumbing. A reader trying to assess whether the regime works cannot, because the third row is blank.
There is a second asymmetry worth naming. Enforcement against individuals is cheap, fast and visible, which makes it attractive to a regulator under political pressure after a high-profile case. Enforcement against a platform is slow, technical and usually settled in a meeting rather than a courtroom. The first produces a press release. The second produces a compliance roadmap. A regime that optimises for the visible case will keep producing the visible case, and the platform-level behaviour it was supposedly built to change will keep drifting out of frame.
That is not an argument against charging individuals who break the rules. It is an argument about what the enforcement mix tells you about what a regulator is actually optimising, and in Malaysia’s case the mix still looks like the one that existed before the platforms were licensed at all.
Malay-language conversion, and the number behind it
One statistic circulates constantly in Malaysian creator marketing: Malay-language content converts better than English. The figure most often attached to it is a 23% higher average engagement rate on Malay-language video, attributed to TikTok’s own data.
It is probably directionally true. Malaysia’s population is majority Malay-speaking, code-switching between Malay and English is normal in urban areas, and a creator speaking the language of the majority audience will usually do better.
It is also a platform-published number, and it is used by agencies to justify budgets. That should prompt the same question as the eight million threshold: what is the denominator, over what period, across how many accounts, and was it measured on engagement rate or on something closer to money?
The commercially relevant figure is not engagement. It is order value per thousand views, and return rate, and the cost of a Malay-language content team against the lift. None of those appear in the publicly repeated statistic. A 23% engagement lift on a category with a 4% conversion rate is a different business from a 23% lift on a category converting at 0.4%.
The same caution applies to the market-size numbers. TikTok was reported at more than 18 million Malaysian users in 2025 with daily usage above 75 minutes, both from third-party digital reporting rather than from the platform’s audited disclosures. Those are the best numbers available. They are also self-selected into the reporting that everyone cites, which is how a figure becomes true by repetition.
SIRIM, LHDN, and the paperwork underneath
The part of Malaysian content commerce that is genuinely well-documented is the boring part.
Selling electronics into the country means SIRIM certification, with specific standards such as MS1865 for certain product categories. Skipping it does not produce a takedown notice; it produces a delisting and, potentially, a seizure.
Taking money from brand work means declaring it. The Inland Revenue Board’s position is that influencer income is income, including in-kind: the PR product, the hotel stay, the voucher. Form B exists for a reason, and the creator who logs only cash is building a problem.
Disclosure rules are more prescriptive than most creators assume. The working guidance across platforms in Malaysia:
- Instagram: the built-in Paid Partnership tag plus an #Ad or #Sponsored marker — the tag is not a substitute for the marker.
- TikTok: explicit commission disclosure for affiliate content, a stricter standard than for ordinary posts.
- YouTube: spoken and on-screen disclosure inside the video itself, ideally within the first two minutes; a description line alone does not satisfy the requirement.
- Health and slimming claims: substantiation, and in some categories Medicine Advertisements Board approval before any efficacy claim runs.
Payments and logistics are equally local and equally unromantic. A Malaysian storefront that does not support GrabPay and Touch ‘n Go is leaving orders on the table; one that does not plan around Ramadan and Hari Raya is planning wrong.
All of this is checkable, which is exactly why it is worth more than the headline numbers. It is the layer where being wrong costs money immediately.
The 2025 amendment, read closely
Alongside the licensing framework came amendments to the Communications and Multimedia Act 1998, described in coverage as strengthening penalties. That phrase does a lot of work and deserves picking apart, because “stronger penalties” can mean several different things and only one of them changes behaviour.
Penalties can rise for the same conduct, which matters mainly if the old penalty was small enough to be written off as a cost of doing business. They can extend to new categories of conduct, which matters more. They can attach to new duty-holders, which matters most of all, because shifting liability from the individual poster to the platform is what actually changes what a platform builds.
The licensing framework does the third thing structurally: a platform that can lose its licence for systemic failure will spend money differently from one that faces occasional fines. What is not clear from the public record is how the amendment interacts with the licence conditions — whether a breach of a condition is itself an offence, or whether the regulator’s route is suspension first and prosecution only for the underlying content.
That sequencing is the whole ballgame for a platform’s legal team. Fine-then-suspend and suspend-then-fine produce completely different risk models, and they produce them before a single ringgit changes hands.
Anyone who tells you the amendment “cracked down” on online harm should be asked which of the three it did. The answer, on the evidence available, is some of the first and an unclear amount of the third.
Platform incentives changed, and not where creators expect
The under-discussed consequence of licensing is that it realigns the platform against the creator.
Before January 2025, an undisclosed sponsored post was a disagreement between a creator and a regulator, with the platform as venue. After licensing, the platform has skin in the game: keeping an ASP(C) licence requires demonstrable enforcement, and a visible pattern of undisclosed paid content is evidence that it is not enforcing.
So the platforms now have a reason to surface the very thing that creators would rather stayed quiet. Reporting on the regime describes exactly this — proactive flagging of non-disclosed sponsored content as a licence obligation. A creator who treats disclosure as optional is no longer only betting against MCMC. They are betting against the platform’s own compliance team, which has a licence to protect and no particular loyalty to any individual account.
- Age verification: no access for under-13s, which changes how a creator can address a young audience and how a brand can target one.
- Local moderation with a response clock: the platform must be able to act on a harm report inside a day, which means more automated enforcement and less discretion.
- Proactive flagging of undisclosed ads: the platform’s incentive is to over-flag, not under-flag.
- Record-keeping: audit trails exist because the regulator may ask for them, and they cut both ways.
That is a real change, and it is the part of the framework most likely to actually alter day-to-day practice. It is also, again, known through summaries rather than through published conditions.
Three questions a brand should put in writing
For the companies paying for Malaysian creator campaigns, the practical response is unglamorous: move the ambiguity into the contract.
Most disputes in this area are not about whether a rule was broken. They are about who carried the risk of the rule being unclear. A brand that specifies the obligation and pays for the compliance step has a very different position from one that sends a product and a brief and assumes the creator handled it.
- Who files the disclosure, and where? Name the platform, the mechanism, and the wording. “Comply with local law” is not a specification.
- Who holds the substantiation file? For health, slimming and any claim adjacent to a medical condition, the evidence must exist before the content runs, not after a complaint.
- What happens to usage rights after the campaign? The image-reuse disputes in this market are contract disputes. Scope, territory, duration and paid amplification should each be a separate line.
None of this requires knowing the licence conditions. It requires accepting that they are unspecified and pricing that in.
What the takedown numbers would need to look like
It is worth being concrete about what a real platform-level record would contain, because “transparency report” has become a phrase that means almost anything.
A useful Malaysian platform record would be small. Five lines, published quarterly, per licensed platform:
- Reports received, split by category — harassment, fraud, child safety, intellectual property, everything else.
- Median and 90th-percentile time to first action on a harm report, with the clock defined.
- Items removed or restricted, as a count and as a share of reports received.
- Appeals filed, and appeals successful.
- Referrals to MCMC or to the police.
That is the entire list. It is not commercially sensitive in any meaningful way; every large platform already computes most of these internally. The reason it does not get published in this form is that each line invites a comparison the platform would rather not have, and the regulator has not made it a licence condition.
Without those five lines, every claim about whether the regime works is unfalsifiable. A platform can say it removed a great deal of harmful content, and nobody can check whether it removed content that was harmful or content that was merely inconvenient. A regulator can say enforcement has tightened, and nobody can check against what baseline.
This is not specific to Malaysia. It is the standard condition of platform regulation almost everywhere: the instrument is built, the obligation is real, and the measurement is left to the regulated party’s goodwill. Malaysia’s distinction is that it built a licensing lever, which means it could attach publication duties to the licence — and, on the evidence available, has not done so in any visible way.
The indicator to watch
If you want to know whether this regime is working, do not watch the licence list.
Watch for MCMC publishing a user-count methodology, even a thin one. Watch for the licence conditions appearing as text rather than as summary. Watch for the first published set of platform-level response statistics — reports received, resolved within 24 hours, appealed, overturned.
Until at least one of those appears, the honest position is that Malaysia built a real instrument and has not yet shown anybody the readings. The licensing is not theatre. The missing scorecard is what keeps it from being evidence.
And the eight million figure, which started all of this, remains what it has been since the day it was announced: a number that decides who is regulated, arrived at by a process nobody outside the commission can inspect.