Malaysia: technology regulation at a glance

Framework: Capital Markets and Services Act 2007 (CMSA) read with the Capital Markets and Services (Prescription of Securities) (Digital Currency and Digital Token) Order 2019 and the Securities Commission Malaysia (SC) Guidelines on Digital Assets; Bank Negara Malaysia (BNM) exercises payment-system and monetary oversight in a co-regulatory 'dual model' with the SC.

Digital assets are legal in Malaysia and comprehensively regulated. Since January 2019 the SC has classified qualifying digital currencies and tokens as 'securities', bringing exchanges (DAX), token offerings (IEO) and digital asset custodians (DAC) into a mandatory registration regime, most recently tightened via revised Guidelines on Digital Assets that took effect 20 May 2026 and further clarifications on digital asset broking by CMSL holders in January 2026. Cryptocurrencies are not legal tender (only the ringgit is), but BNM's Digital Asset Innovation Hub is piloting ringgit-denominated stablecoins and tokenised deposits, with formal stablecoin guidance expected by end-2026.

Framework: AI Governance Bill (public consultation July 2026) under the National AI Office / AI Malaysia Berhad (Ministry of Digital); currently backed by the voluntary National Guidelines on AI Governance and Ethics (AIGE, 2024) and the National AI Roadmap 2021-2025

As of October 2026 Malaysia has no comprehensive AI law in force. Governance rests on voluntary instruments — the MOSTI National Guidelines on AI Governance and Ethics (AIGE, Sep 2024), the National AI Roadmap 2021-2025, sectoral guidance from Bank Negara Malaysia and the Securities Commission, and the Personal Data Protection (Amendment) Act 2024 — while the National AI Office (institutionalised as AI Malaysia Berhad in July 2026) ran a public consultation on a proposed horizontal AI Governance Bill (closed 31 July 2026) that is expected to be tabled by late 2026 or early 2027.

Framework: Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727); enforced by the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP) under the Ministry of Digital.

Malaysia has a comprehensive, GDPR-style data-protection regime: the Personal Data Protection Act 2010 governs the processing of personal data in commercial transactions and is overseen by the Personal Data Protection Commissioner. The Personal Data Protection (Amendment) Act 2024 substantially modernised the law, with provisions commencing in three phases on 1 January, 1 April and 1 June 2025, adding mandatory breach notification, DPO appointment, data portability, biometric data as sensitive data, and higher penalties.

Framework: Financial Services Act 2013 (FSA) and Islamic Financial Services Act 2013 (IFSA), administered by Bank Negara Malaysia (BNM); Consumer Credit Act 2025 (BNPL) under the Consumer Credit Oversight Board (CCOB)

Malaysia operates a clear, mature licensing/approval regime for digital payments and fintech, anchored in the FSA/IFSA 2013 and supervised by the central bank, Bank Negara Malaysia. Payment system operators, e-money issuers and merchant acquirers require BNM approval or registration; the country also runs a national real-time payments infrastructure (DuitNow/PayNet), has licensed five digital banks, and as of March 2026 brought buy-now-pay-later under the new Consumer Credit Act 2025.

Framework: DE Rantau Nomad Pass, administered by the Malaysia Digital Economy Corporation (MDEC) under Malaysia's Ministry of Digital; immigration passes governed by the Malaysian Immigration Department (Jabatan Imigresen Malaysia).

Malaysia operates a dedicated digital-nomad visa, the DE Rantau Nomad Pass, launched by MDEC in 2022 for foreign remote workers and freelancers serving non-Malaysian clients/employers. The pass grants up to 12 months of stay (renewable) with multiple entry. Separately, the My Second Home (MM2H) programme offers longer-term, investment/deposit-based residency for relocators.

Framework: Online Safety Act 2024 (Act 866, in force 1 Jan 2026) plus social-media/messaging class-licensing under the Communications and Multimedia Act 1998 (CMA 1998), enforced by the Malaysian Communications and Multimedia Commission (MCMC).

Malaysia now has a dedicated, comprehensive online-safety statute: the Online Safety Act 2024 (Act 866) received Royal Assent on 6 May 2025 and took effect on 1 January 2026, imposing duties on online platforms and licensed providers to curb harmful content, with a strong child-protection focus. This sits alongside an MCMC class-licensing regime (effective 1 Jan 2025) requiring social-media and internet-messaging platforms with 8 million-plus Malaysian users to hold an ASP(C) licence, plus longstanding broad content-control and blocking powers under CMA 1998 (notably s.233).

Framework: Cyber Security Act 2024 (Act 854), administered by the National Cyber Security Agency (NACSA), supplemented by sector-specific rules and the Personal Data Protection Act (PDPA) for personal-data breaches.

Malaysia has a comprehensive, dedicated cybersecurity law: the Cyber Security Act 2024 (Act 854), which came into force on 26 August 2024 together with four subsidiary regulations. It establishes a National Cyber Security Committee, empowers the Chief Executive of NACSA, and imposes mandatory risk assessments, audits, incident reporting and service-provider licensing focused on National Critical Information Infrastructure (NCII). Separately, the amended PDPA introduced a mandatory personal-data breach-notification regime effective 1 June 2025.

Framework: Companies Act 2016 (administered by the Companies Commission of Malaysia, SSM); foreign-equity policy overseen by MIDA; sector licences such as the Wholesale, Retail & Trade (WRT) licence governed by the Ministry of Domestic Trade and Cost of Living (KPDN) under the Guidelines on Foreign Participation in Distributive Trade Services 2020.

A foreigner can own 100% of a Malaysian private limited company (Sdn Bhd) in most sectors, and incorporation through SSM is fast (typically 1-3 working days) with no minimum paid-up capital (RM1 suffices). The friction for foreigners is structural rather than at incorporation: every company needs at least one director ordinarily resident in Malaysia and a licensed company secretary, and many regulated/service activities impose sector-specific equity caps, approvals, or substantial capital floors (e.g. RM1 million for wholesale/retail trade).