Malaysia Imposes Licensing Requirements for Cloud Service Providers

Posted by Written by Ayman Falak Medina Reading Time: 3 minutes

Effective from January 1, 2022, Malaysia has imposed a licensing requirement on the provision of cloud services, although it will only be enforced from April 1, 2022.

The new rule, which was introduced by the Malaysian Communications and Multimedia Commission (MCMC), aims to co-develop standard operating procedures surrounding cloud services particularly around data protection, security, and protection with the industry.

What was the approach of previous regulation towards cloud service providers in Malaysia?

Malaysia’s Communications and Multimedia Act of 1998 (CMA) and the Communications and Multimedia Regulations of 2000 were the primary legislation that regulated Malaysia’s communications and multimedia industry.

The CMA regulated cloud service providers from the perspective of integrity, security, and reliability but did not specifically require cloud service providers to be licensed in Malaysia. There were two main categories of CMA licenses:

  • Individual licenses – these were granted to providers of services or facilities where there was a high degree of regulatory control with a validity period of up to 10 years. There are also foreign shareholding restrictions on this license category.
  • Class licenses – these were granted to providers of services that were niche in nature and had to be renewed annually. There is no foreign shareholding restriction on this license category.

There are in turn, four sub-categories of licensable activities under the CMA:

  1. Network facility providers;
  2. Network service providers;
  3. Application service providers; and
  4. Content application service providers.

Find Business Support
WE COMPANIES OF ALL SIZES THROUGHOUT THE TECHNOLOGY LIFECYCLE OF THEIR OPERATIONS
Under the new licensing requirements, the MCMC will regulate cloud services under the application service providers class (ASP (C)) license. The ASP (C) license does not impose any foreign shareholding restrictions and if granted, will need to be renewed annually.

Which cloud service providers need a license in Malaysia?

The MCMC issued an advisory notice and information paper that defines ‘cloud service’ as any service made available to end-users on-demand via the internet from a cloud computing provider’s server.

It also states that an ASP (C) license is required for:

  • A locally incorporated company providing Platform as a Service (PaaS) or Infrastructure as a Service (IaaS) to users in Malaysia;
  • A locally incorporated company providing PaaS or IaaS services for resale by an agent to users in Malaysia; and
  • A local data center that assists foreign cloud service providers in their PaaS and IaaS services to users in Malaysia.

Providers of Software as a Service (SaaS) are not required to obtain a license.

Foreign cloud service providers that provide IaaS or PaaS services but do not have a presence in Malaysia and do not use local data centers are not required to obtain an ASP (C) license. This is also the case with foreign cloud service providers that have local branches in Malaysia but not a locally incorporated companies.

Other conditions where an ASP (C) license is not required include:

  • A foreign company provides cloud services through a local data center, where the local data center has already been licensed by the MCMC to provide cloud services; and
  • An agent that resells PaaS or IaaS services where the PaaS or IaaS services are obtained from a company licensed under the MCMC.

Find Business Support
WE PROVIDE BUSINESSES WITH IT AND IS ADVISORY, PROJECT MANAGEMENT, AND SUPPORT SERVICES
Current ASP (C) license holders that are providing cloud services can continue to do so under their current license. However, they will need to include the provision of cloud services as one of their business activities during the renewal of their license.

 

What plans does Malaysia have in place to become a digital economy leader?

Malaysia’s licensing requirements for cloud service providers are part of the government’s initiative to accelerate the country’s transformation towards a technologically-advanced economy as envisioned in the Malaysia Digital Economy Blueprint.

The blueprint outlines 48 national initiatives and 28 sectoral initiatives that aim to attract over 70 billion ringgit (US$16 billion) in foreign and domestic investments in Malaysia’s digital economy by 2030, transforming the country into a net exporter of homegrown digital solutions and technologies. The digital economy could make up some 22.6 percent of the country’s GDP and create 500,000 jobs by 2025.

The blueprint will be implemented in three phases:

Phase 1 (2021 to 2022)

Accelerating and strengthening the digital foundation needed to adopt the roll-outs for the upcoming Phases 2 and 3.

Phase 2 (2023 to 2025)

Drive digital transformation and inclusion across all levels of businesses and across the population.

Phase 3 (2026 to 2030)

Position Malaysia as an exporter of digital products and solutions.

ASEAN Briefing is produced by Dezan Shira & Associates. The firm assists foreign investors throughout Asia and maintains offices throughout ASEAN, including in Singapore, Hanoi, Ho Chi Minh City, and Da Nang in Vietnam, Munich, and Esen in Germany, Boston, and Salt Lake City in the United States, Milan, Conegliano, and Udine in Italy, in addition to Jakarta, and Batam in Indonesia. We also have partner firms in Malaysia, Bangladesh, the Philippines, and Thailand as well as our practices in China and India. Please contact us at asia@dezshira.com or visit our website at www.dezshira.com.