A Chinese SaaS vendor signs its first Malaysian enterprise customer. A Shenzhen hardware group decides to host its IoT platform on a Cyberjaya data centre. A Hangzhou app studio hits a million Malaysian users and starts selling in-app subscriptions. None of them think of themselves as a telecommunications company, and none of them expect to need a licence from the Malaysian Communications and Multimedia Commission (MCMC). Yet the Communications and Multimedia Act 1998 (Act 588) does not licence "telcos" — it licences activities, and the list of licensable activities has been quietly widened to include cloud services since 2022 and internet messaging and social media services since 2025. On 1 January 2026, MCMC applied the deeming provision in section 46A to bring every messaging and social media platform with eight million or more Malaysian users inside the licence perimeter automatically. This guide sets out the whole licence map: the four categories, the difference between an individual licence and a class licence, the eligibility rule that quietly disqualifies a branch office, the actual fees and timelines, and how to work out — in one pass — whether what you are selling in Malaysia is licensable, class-licensable, or exempt.
Why the CMA catches software companies at all
The CMA was drafted around a convergence idea: networks, services and content should sit under one technology-neutral statute rather than under separate telecoms and broadcasting laws. The practical consequence is that the Act's licence categories are defined by function, not by industry label. If you provide something that functions as an "applications service" to end users in Malaysia, you are within the framework, whether your company describes itself as a telco, a cloud provider, an app developer or a manufacturer with a connected-device platform.
Two features of the regime matter more than anything else for a foreign-invested company:
- There is no "small operator" exemption based on revenue or headcount. The test is what activity you carry on, not how big you are. A two-person Sdn. Bhd. reselling cloud storage is in the same class as a hyperscaler.
- Licensing is tied to local presence, and local presence has a precise legal meaning. A registered branch of a foreign company does not qualify. This single rule reshapes the corporate structure of most China-to-Malaysia digital projects.
Operating a licensable activity without the licence is an offence under section 126 of the CMA: on conviction, a fine of up to RM500,000, imprisonment of up to five years, or both, plus a further fine of RM1,000 for every day the offence continues after conviction.
The four licence categories
Everything under the CMA falls into one of four categories. Getting the category right is the entire exercise, because the category determines whether you need a ministerial licence costing six figures a year or a RM2,500 annual registration.
| Category | What it covers | Typical holder | Licence type available |
|---|---|---|---|
| Network Facilities Provider (NFP) | The physical layer — earth stations, fixed links and cables, radiocommunications transmitters, satellite hubs and control stations, space stations, submarine cable landing centres, towers, poles, ducts and pits | Tower companies, fibre owners, satellite operators, submarine cable consortia | Individual or class |
| Network Service Provider (NSP) | Carriage — bandwidth services, broadcasting distribution, cellular mobile services, space services, switching services, gateway services, access applications service | Mobile operators, fixed carriers, satellite service providers | Individual or class |
| Applications Service Provider (ASP) | Services delivered over a network to end users — PSTN and IP telephony, public cellular services, public payphones, public switched data, directory services, internet access, messaging services, internet messaging services, social media services, and cloud services | ISPs, VoIP providers, messaging platforms, social media platforms, cloud and hosting providers | Class only — there is no individual ASP licence |
| Content Applications Service Provider (CASP) | Content — satellite broadcasting, subscription broadcasting, terrestrial free-to-air television, terrestrial radio broadcasting | Broadcasters, pay-TV operators, radio stations | Individual or class |
Note the asymmetry in the third row. MCMC's licensing guidebook records "not applicable" against the individual-licence column for ASP. Every applications service that is licensable is licensable as a class licence — the cheap, administrative, annually renewed registration. That is good news for software companies, and it is the reason the ASP(C) licence has become the default instrument for regulating the digital economy in Malaysia.
Individual licence, class licence, exempt: three different worlds
The CMA's licence tiers are not degrees of the same thing. They are separate regimes with different eligibility rules, different decision-makers and different orders of cost.
| Individual licence | Class licence | Exempt / unlicensed | |
|---|---|---|---|
| Nature | Granted by the Minister on MCMC's recommendation; a discretionary instrument with standard and special conditions | Registration — an administrative process, not a grant of discretion | No filing at all |
| Application fee | RM10,000 per licence (non-refundable) | — | — |
| Approval fee | RM50,000 per licence | — | — |
| Registration fee | — | RM2,500 per licence, payable yearly | — |
| Annual licence fee | Greater of RM100,000 per licence or 0.5% of gross annual turnover, on each anniversary | Included in the RM2,500 annual registration | — |
| Renewal | Processing and renewal fee RM25,000 | Re-register each year | — |
| Validity | 10 years from grant (Regulation 11(1), Licensing Regulations 2000) | One calendar year (Regulation 25(5)) | — |
| Processing time | MCMC evaluates, then recommends to the Minister; the Minister is deemed to have refused if no decision within 30 days of receiving the recommendation | 14 days for new registration, 7 days for annual re-registration, from complete submission | — |
| Financial gates | Paid-up capital RM2,000,000 (NFP/NSP) or RM500,000 (CASP); net tangible assets of at least RM500,000 per the latest audited accounts; 30% Bumiputera shareholding | None published | — |
| Other conditions | Roll out the activity within 12 months of the licence; submit audited accounts to MCMC within 3 months of financial year end; permit interconnection; file the annual return of net revenue for Universal Service Provision | Standard class licence conditions published by MCMC for each of NFP(C), NSP(C), ASP(C) and CASP(C) | — |
The eligibility rule that ends most plans: no foreign company, no branch
This is the provision that reorganises corporate structures, and it applies to both tiers.
For an individual licence, MCMC's guidebook lists the persons who are ineligible to apply: a foreign company as defined under the Companies Act 2016 (Act 777); an individual or sole proprietorship; and a partnership. Only a locally incorporated company can hold one.
For a class licence, Regulation 23(1) of the Communications and Multimedia (Licensing) Regulations 2000 makes two classes of person ineligible to be registered: a foreign individual who is not a permanent resident, and a foreign company as defined under the Companies Act 2016. The Minister may, for good cause or in the public interest, permit either to apply under Regulation 23(2) — a route that exists but is exceptional and requires meeting conditions MCMC sets case by case.
"Foreign company as defined under the Companies Act 2016" is the key phrase. It captures the registered branch of an overseas company — the structure many Chinese groups choose first because it looks lighter than a subsidiary. MCMC's cloud FAQ says so directly: a local branch of a foreign person does not fall within "local presence", because a branch is still regarded as part of the foreign person, and registering it would be inconsistent with Regulation 23.
The practical consequence is simple and expensive to discover late: if any part of what you sell in Malaysia is a licensable activity, the licence holder has to be a Malaysian-incorporated Sdn. Bhd. If you have already set up a branch, see our comparison of the two structures in branch registration versus a subsidiary, and expect to incorporate before you can register.
Cloud services: the rule that has been in force since 2022
MCMC brought cloud services inside the ASP(C) licence with effect from 1 January 2022, with a voluntary grace period to 31 March 2022 and full force from 1 April 2022. Four years on, it is still the single most commonly missed licence among foreign technology companies operating in Malaysia — partly because the drafting is deliberately light-touch, and partly because "we are not a telco" remains the instinctive answer.
MCMC's working definition is broad: cloud services means any service made available to end users on demand via the internet from a cloud computing provider's server. An "end user" can be a natural or artificial person — so selling only to banks and enterprises, with no consumer product at all, does not take you outside the definition.
Who must register is decided by a local presence test, and MCMC's own illustrations are worth reproducing because they answer most real cases:
| Scenario | MCMC's position |
|---|---|
| Company A is locally incorporated and provides cloud services to end users | Must register as an ASP(C) licensee |
| Company B is not locally incorporated but provides cloud services through a local data centre, Company C | Company C must register — the local entity provisioning the foreign provider's services is the licensable person |
| Company D is not locally incorporated and does not provide cloud services through any local data centre | No registration required |
| Company E is not locally incorporated but has a local branch | The branch cannot register — a branch is not local presence |
Two boundaries are worth noting. First, web hosting and client-server activity remains exempt under the Communications and Multimedia (Licensing) (Exemption) Order 2000 — the light-touch approach deliberately left it alone, so a pure hosting reseller is not dragged in. Second, MCMC applies a zero weightage factor to revenue received from cloud service activities, which matters for how licence-related revenue calculations treat that income stream.
Registration itself is undemanding: two copies of Form D of the Third Schedule to the CMA, the RM2,500 annual registration fee, the registration notice checklist, statutory forms under the Companies Act 2016, a company profile and organisation chart, and a brief description of the services provided. Fourteen days for a new registration, seven for annual re-registration.
If your Malaysian footprint is a data centre rather than a software product, the licence is only one layer of a much larger approval stack — power, water and sustainability conditions now dominate. See our guide to Malaysia's 2026 data centre approval rules.
Internet messaging and social media: the 8-million deeming
The most visible use of the ASP(C) licence has been the platform licensing framework. Since 1 January 2025, providers of internet messaging services and social media services with eight million or more users in Malaysia have been required to hold an ASP(C) licence. The obligation is threshold-gated: below the threshold, the requirement is not triggered by this determination.
On 1 January 2026, MCMC moved to the next stage and applied the deeming provision under section 46A of the CMA: qualifying providers are now deemed to be registered ASP(C) licensees rather than being left to apply. MCMC named the platforms captured — WhatsApp, Telegram, Facebook, Instagram, TikTok and YouTube — and framed the move as ensuring large-scale providers operate within Malaysia's legal and regulatory framework in an orderly and consistent way, consistent with international practice on large online platforms.
For a Chinese app company the reading is nuanced, and worth being precise about:
- Below eight million Malaysian users, the messaging/social media determination does not compel you to hold an ASP(C) on that basis alone. It does not follow that you are outside the CMA — check whether anything else you provide (cloud, internet access, messaging services generally) is a listed class activity.
- Approaching eight million, treat the licence as a planning item, not a compliance afterthought. The licence holder must be a locally incorporated company, which means the entity, its directors and its statutory records need to exist well before the threshold is crossed.
- Deemed registration is not a waiver. A deemed licensee carries the full set of licence conditions and the statutory duties that ride on the licence — including the Online Safety Act obligations below.
The Online Safety Act 2025 rides on the licence
The Online Safety Act 2025 (Act 866) came into force on 1 January 2026, and its scope is defined by reference to the CMA: it applies to service providers licensed under Act 588 — licensed application service providers, content applications service providers and network service providers, collectively the licensed service providers. Because the eight-million platforms are deemed ASP(C) licensees, they are within the Act automatically.
The duties are operational, not merely declaratory. Licensed applications service providers and content applications service providers must implement safety measures, publish guidelines for users, make available a mechanism enabling users to report harmful content, and prepare an online safety plan. Non-compliance with the prescribed duties carries a financial penalty reported at up to RM10 million, and MCMC has powers to investigate, issue directions and enforce.
What is exempt — and why that list is the first thing to check
MCMC's licensing framework also publishes what is not licensable, and for many software businesses the answer lives here. Within the applications service category, the exempt or unlicensed activities include:
- Electronic transaction service
- Interactive transaction service
- Networked advertising boards and Cineplex
- Web hosting or client server
On the network side, incidental network facilities, private network facilities, broadcasting and production studios, LAN services, incidental network services and private network services are exempt; and within content applications, internet content applications services are exempt.
An e-commerce platform whose service is a transaction service, or a corporate website host, may well sit entirely in this column. The analysis is worth doing properly and in writing — it is the difference between an annual RM2,500 filing and no filing at all, and it is the document you want on file if MCMC ever asks.
Five scenarios, five answers
| What you are doing in Malaysia | Likely position | What to do |
|---|---|---|
| Selling a SaaS product from China to Malaysian customers, no Malaysian entity, no Malaysian data centre | Outside the registration requirement on MCMC's local-presence test | Document the analysis; revisit the moment you incorporate locally or move workloads onshore |
| Malaysian Sdn. Bhd. reselling or provisioning cloud services to local customers | ASP(C) licence required | Register with MCMC; budget RM2,500 a year and a yearly re-registration |
| Foreign cloud provider serving Malaysia through a Malaysian data centre partner | The local data centre entity is the licensable person | Put the obligation into the hosting contract; confirm your partner's ASP(C) is current |
| Messaging or social media app crossing eight million Malaysian users | ASP(C) plus Online Safety Act duties | Incorporate a Malaysian company ahead of the threshold; build the safety plan and reporting mechanism before, not after |
| Building or owning towers, fibre, or operating as a carrier | Individual NFP and/or NSP licence | Plan for RM2 million paid-up capital, RM500,000 net tangible assets, 30% Bumiputera shareholding and RM100,000+ per licence per year |
What to do next
Work the problem in this order. First, write down every service you will actually supply to users in Malaysia and map each one against the NFP / NSP / ASP / CASP tables above — including the exempt column. Second, decide where the Malaysian entity sits, because a branch cannot hold a licence and incorporating later is slower than incorporating now. Third, price the tier: RM2,500 a year is a rounding error, while an individual licence is a six-figure annual commitment plus capital and shareholding gates. Fourth, look past the licence to what rides on it — online safety duties, cyber security obligations, data protection.
ONEKEY BIZ handles the whole chain for China-based technology groups entering Malaysia: incorporating the Sdn. Bhd. that will hold the licence, preparing the Form D submission and supporting documents, and coordinating the annual re-registration alongside your company secretarial and tax filings. If you are still deciding whether Malaysia Digital status is the better wrapper for your digital business, read our guide to MDEC's Malaysia Digital framework first — the two regimes answer different questions and are frequently confused.
Tell us what you are launching and we will map the licence position in writing before you commit to a structure. Start with a free consultation, or see how we handle Sdn. Bhd. incorporation for technology groups.
Frequently asked questions
Can our Malaysian branch office hold an MCMC class licence?
No. Regulation 23(1) of the Communications and Multimedia (Licensing) Regulations 2000 makes a foreign company as defined under the Companies Act 2016 ineligible to be registered as a class licensee, and MCMC's cloud licensing FAQ states expressly that a local branch of a foreign person is not "local presence" because the branch is still regarded as part of the foreign person. The same exclusion applies to individual licences. If any activity you carry on in Malaysia is licensable, the licence holder must be a Malaysian-incorporated Sdn. Bhd. The Minister may permit an exception under Regulation 23(2), but it is discretionary and conditional.
We sell SaaS from China to Malaysian customers with no local entity. Do we need to register?
On MCMC's published local-presence test, no. Its cloud FAQ illustration is direct: a company that is not locally incorporated and does not provide cloud services through any local data centre is not required to register as an ASP(C) licensee. Two things change that answer — incorporating a Malaysian company that provisions the service, or delivering through a Malaysian data centre, in which case the local data centre entity is the licensable person. Document the analysis, and revisit it the moment either fact changes.
How much does an ASP(C) class licence actually cost and how long does it take?
The registration fee is RM2,500 per licence, payable yearly, and the registration is valid for one calendar year under Regulation 25(5) — so it is re-registered annually. MCMC processes a new registration within 14 days and an annual re-registration within 7 days from receipt of complete information. The submission is Form D of the Third Schedule in duplicate, the fee, the registration notice checklist, statutory forms under the Companies Act 2016, a company profile and organisation chart, and a description of the services provided. Compare that with an individual licence: RM10,000 application fee, RM50,000 approval fee, and an annual fee of RM100,000 per licence or 0.5% of gross annual turnover, whichever is greater.
Our app is well below eight million Malaysian users. Are we outside the CMA entirely?
Not necessarily. The eight-million figure is the threshold in the determination covering internet messaging and social media services — below it, that particular obligation is not triggered. It says nothing about the other listed applications services. If you also provide cloud services, internet access, messaging services or any other activity in the ASP class list from a Malaysian entity, the ASP(C) requirement can arise independently of user numbers. Map every service you supply against the class list rather than relying on a single headline threshold.
Related services
We handle the process described in this article end-to-end.
- Sdn. Bhd. IncorporationRegister a private limited company (Sdn. Bhd.) with SSM end-to-end.
- Annual Return (Section 68)Lodge your company’s yearly annual return with SSM on time.
- Appointment / Resignation of DirectorUpdate your board — appoint or resign directors (Section 58/201).
Sources & references
- MCMC — Licensing Guidebook 2025 (Licence Application Procedure and Licensing Criteria)
- MCMC — Class Licence: NFP, NSP, ASP & CASP
- MCMC — Individual Licence: NFP, NSP & CASP
- MCMC — FAQ on Licensing Cloud Service Providers
- MCMC — Regulatory Framework for Internet Messaging and Social Media Service Providers
This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.