Malaysia | Cloud Services Licensing Update

Subsequent to our previous update on the same subject matter in October 2021 available here (“Previous Update”), the Malaysian Communications and Multimedia Commission (“MCMC”) had on 17 December 2021 published the following further guidance on the regulation of cloud services in Malaysia

  • Information Paper on Regulating Cloud Services; and
  • Frequently Asked Questions on Licensing Cloud Service

No Amendment to the Existing Legislation

As noted in the Previous Update, cloud service providers are required to obtain applications service provider class licence (“ASP Class Licence”) under the Communications and Multimedia Act 1998 (“CMA“) for the provision of cloud services.

In this regard, MCMC confirmed that the legal basis for licensing stems from Regulation 30(1)(j) of the Communications and Multimedia (Licensing) Regulations 2000 (“Licensing Regulations”), as extracted below:

Regulation 30(1). A person who provides any or all of the following applications service may be registered as an applications service provider class licensee:

(j) such other applications service which are not exempt under the [CMA] or not listed in this subregulation.

As such, there will not be any addition or amendments to the existing provisions of the CMA or Licensing Regulations to specifically address the licensing of cloud service providers.

Software Providers Excluded

Cloud services can generally be categorised into three types based on current market trends and offerings:

  • Software as a Service (SaaS);
  • Platform as a Service (PaaS); and
  • Infrastructure as a Service (IaaS).

MCMC’s Advisory Notice dated 15 October 2021 defined cloud service as “any service made available to end users on demand via the Internet from a cloud computing provider’s server”.

The broad definition of “cloud services” is to ensure that it will be sufficiently wide to cover various forms of cloud services provided to end users. Notwithstanding this definition, MCMC acknowledges the possibility of service providers providing software and solutions through cloud services platform and infrastructure of other service providers.

On the basis that the provision of software and solutions is not a licensable activity under the CMA, MCMC has clarified that “pure software providers” will not be subject to the licensing requirements applicable to cloud service providers.

Resellers Excluded

Further, resellers of cloud services are not required to be licensed if such resellers merely resell the cloud services offered by other service providers and has no control over the cloud service products. It will be the service provider actually offering the cloud services that will be required to be licensed.

Local Presence

Based on MCMC’s latest guidance, the following entities would

be required to be licensed as cloud service providers:

  • locally incorporated companies providing cloud services to end users; and
  • locally incorporated companies operating local data centres through which services of foreign cloud service providers are

Grace Period

Although the licensing requirements have come into force from 1 January 2022, MCMC has granted a grace period until 31 March 2022 for stakeholders to manage their affairs, only after which the new licensing requirements will be enforced from 1 April 2022.

Further, existing ASP Class Licence holders that are providing other forms of applications service other than cloud services will be allowed to provide cloud services under their existing ASP Class Licence but will be required to include the provision of cloud services within the scope of their ASP Class Licence upon re-registration of their licence upon expiry in the following year.

As it is an offence under the CMA to provide licensable services without a licence, cloud service providers should review their services to determine if an ASP Class Licence is necessary.

Get in touch

Christina S. C. Kow

Partner / Head, Financial Services / Head, Islamic Finance / Personal Data Protection & Privacy Law / Technology, Media & Telco
Read more

Karen Abraham

Partner / Head, Intellectual Property / Head, Japan Desk / Technology, Media & Telco / Personal Data Protection & Privacy Laws / India Desk
Read more

K. Shanti Mogan

Partner / Head, Arbitration & Mediation / Head, Competition Law & Antitrust / Dispute Resolution / Personal Data Protection & Privacy Laws / Regulatory Compliance & Enforcement / Technology, Media & Telco /
Read more