Malaysia Update: Cloud Service Providers to Be Licensed Starting 1 January 2022

Introduction

On 16 October 2021, the Malaysian Communications and Multimedia Commission (“MCMC”) released an advisory notice titled “Cloud Service Regulation Introduced to Increase Accountability for User Data Security and Sustainability of Services” (“Advisory Notice”). This announces MCMC’s intention to require eligible cloud service providers to obtain an applications service provider class licence (ASP(C)) (“Licence”) starting 1 January 2022.

Purpose 

MCMC’s decision to officially regulate cloud service providers arose from concerns about data safety in view of the increasing adoption of cloud services by consumers and public agencies. By issuing licences, MCMC can take part in ensuring that cloud service providers maintain a high level of data security, privacy, protection and flows for the benefit of the consumers and public agencies while at the same time promoting easy market access and industry growth.

Who Should Apply

The Advisory Notice defines cloud services as “any service made available to end users on demand via the Internet from a cloud computing provider’s server”. This broad definition suggests MCMC intends to cast its regulatory net as wide as possible. But MCMC has clarified that “web hosting” and “client server”, both of which are exempt from getting a class licence under the Communications and Multimedia (Licensing) (Exemption) Order 2000 (“Exemption Order”), would remain as exempted applications services.

It is worth noting that the Exemption Order defines “web hosting or client server” as “an applications service which provides for the operation or maintenance of servers for persons who wish to present a web or electronic-commerce presence”. As web hosting and client server services may well be provided over the internet on demand, the key difference appears to lie in whether such services are provided to end users.  If they are, then the service providers would be regarded as providing “cloud services” within MCMC’s definition and should obtain the Licence. If the services are only made available in a B2B setting, then they arguably do not fit MCMC’s definition and may be provided without the Licence.

Not every cloud service provider is required to obtain the Licence, and MCMC outlines the following three scenarios to aid understanding:

1.Company A is a locally incorporated company providing cloud service applications to end users. Company A should obtain the Licence.

2.Company B does not have any local presence but is providing cloud service applications through a local data centre, Company C, to end users. Company C needs to obtain the Licence.

3.Company D does not have local presence and does not provide cloud service applications through local data centre to end users. Company D may be required to be registered under the ASP (C) licence and therefore will not be given any regulatory protection to both the user and provider of the service.

The phrase “local presence” is not defined. But by virtue of the wording of scenario 1, it may be understood to refer to entities that are not incorporated in Malaysia.

Scenario 1 is self-explanatory, and Scenario 2 is interesting: if a company provides cloud services through local data centres, it is the company behind the local data centres that needs to obtain the licence. This position appears to conflict with MCMC’s public statement as reported by BERNAMA, the news agency of the Malaysian government, that “companies that provide cloud services … through a data centre in Malaysia” would be required to obtain the Licence.

Scenario 3 also poses some uncertainty. In essence, a cloud service provider who neither has local presence nor provides its cloud services through local data centres may be required to obtain the Licence. This suggests MCMC may assess the eligibility of such cloud service providers (e.g. a foreign company providing cloud services to consumers in Malaysia through data centres not located in Malaysia) on a case-to-case basis, and no criteria have been made available yet.

Application for Licence

If licence is required, an application can be made by submitting the following to MCMC’s licensing department:

1.Two copies of Form D;

2.Registration fee of RM2,500.00;

3.Details as per the checklist for class licence application;

4.Statutory forms under the Companies Act 2016;

5.Company profile and organisation chart; and

6.Brief description of type of services being provided (in this case, cloud services).

There will be no restriction on foreign shareholding to obtain the Licence. There will also be a waiver on contribution to MCMC’s Universal Service Provision (USP) programme, an initiative to provide collective and individual access to basic telephony and internet services throughout the country.

According to MCMC, the registration process will take 14 days for new registration (which lasts for one year) and 7 days for annual re-registration application.

Conclusion

MCMC took the opportunity to highlight in the Advisory Notice that providing licensable activities without a licence is an offence under the Communications and Multimedia Act 1998. If anything, this signifies MCMC’s commitment to ensuring that the new requirements would be adhered to, including pursuing the enforcement route. In light of the uncertainty as highlighted above, cloud service providers are encouraged to consult their legal advisors or MCMC as to how this Advisory Notice may impact them and their services.

By Lee Lin Li & Low Kok Jin, Tay & Partners, Malaysia, a Transatlantic Law International Affiliated Firm.

For further information or for any assistance please contact malaysia@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom