Malaysia's Online Safety Act 2025 came into force on 1 January 2026, after being passed by Parliament in 2024 and gazetted in May 2025. It regulates harmful online content and imposes new duties on application service providers and content application service providers — a category that can include live streaming and content platforms with a Malaysian user base or operational footprint, depending on how the Act's implementing regulations classify specific business models.
What the Act Actually Covers
The Act defines several categories of harmful content, including child sexual abuse material, financial fraud content, and content likely to cause harassment, distress, fear, or alarm, or to incite violence or terrorism. Of these, content involving child sexual abuse material and financial fraud are designated as "priority harmful content" — meaning they carry the strictest response obligations for covered service providers.
The Act imposes duties on application service providers (ASPs) and content application service providers (CASPs), including requirements to implement measures that reduce users' risk of exposure to harmful content and to provide a reporting mechanism for users to flag violations.
Why This Matters for Live Streaming, Cam, Subscription, and Adult Toy Platforms Specifically
Two things make this relevant to the merchants WebPays works with:
Platform classification. Depending on how your business model is structured — a hosted content platform, a streaming service, a marketplace connecting users — you may fall under the Act's definition of an ASP or CASP if you have a sufficient connection to Malaysia. This is a separate legal question from your payment processing relationship, and one worth confirming directly with counsel given how recently the Act has commenced. Adult toy e-commerce businesses without hosted content components are less likely to fall under these specific definitions, though this depends on your exact business structure.
Compounding compliance obligations. The Act sits alongside — not instead of — Malaysia's existing restrictions on pornographic content distribution, MCMC's content-blocking authority, and the Personal Data Protection Act's data-handling requirements. Adult and streaming platforms with any Malaysian connection now need to think through content moderation obligations, data protection obligations, and payment compliance obligations as three related but distinct workstreams.
What This Doesn't Change
The Act doesn't alter the underlying fact that pornographic content remains illegal to sell, distribute, or possess within Malaysia — it adds a new content-safety and harm-reduction layer on top of existing law, focused primarily on categories like child sexual abuse material, fraud, and content inciting harm, rather than creating a new pathway for adult content distribution domestically.
Why the Act Exists
The Act follows years of increasing regulatory attention on online harms globally, and Malaysia's version sits alongside similar legislative efforts in other jurisdictions aimed at making platforms more directly accountable for content moderation. Its passage through Parliament in 2024 and the roughly seven-month gap between gazetting (May 2025) and commencement (January 2026) gave covered service providers a runway to prepare compliance mechanisms before enforcement began.
Practical Steps for Platform Operators
Confirm whether your specific business model falls under the Act's ASP/CASP definitions, given your actual Malaysian connection
Review your content moderation and reporting mechanisms against the Act's requirements
Coordinate compliance across teams — content moderation, data protection (PDPA), and payment/financial compliance are now three interacting obligations
Monitor for implementing regulations and enforcement guidance, since the Act only commenced in January 2026
How This Connects to Payment Processing With WebPays
WebPays underwrites live streaming, live cam, adult subscription, and adult toy merchants with Malaysian exposure, and increasingly wants to understand a platform's broader regulatory posture, not just its payment compliance — a platform that can demonstrate awareness of and compliance with content-safety obligations under the Online Safety Act is in a stronger position during underwriting than one that treats payment compliance as an isolated checkbox.
Frequently Asked Questions
When did the Online Safety Act 2025 actually take effect?
It came into force on 1 January 2026, after passing Parliament in 2024 and being gazetted in May 2025.
Does the Act apply to platforms with no Malaysian office or incorporation?
Potentially, if the platform has a sufficient Malaysian user base or connection — the exact threshold depends on the Act's implementing regulations, worth confirming directly with counsel given how new the law is.
Is adult content itself newly regulated under this Act?
The Act's primary focus is on categories like child sexual abuse material, fraud, and content inciting harm or violence, rather than creating new rules specifically for legal adult content. Existing restrictions on pornography distribution within Malaysia remain separately in force under the Penal Code.
Does an adult toy e-commerce business need to worry about this Act the same way a streaming platform does?
Generally less directly, since the Act's ASP/CASP framework centers on hosted content and application services rather than physical product e-commerce — but confirm your specific business structure with counsel rather than assuming exemption.
Does compliance with the Online Safety Act affect payment processor approval with WebPays?
Not directly as a payment-specific requirement, but demonstrating broader regulatory awareness can strengthen a merchant's underwriting profile.
Comments
Log in or sign up to join the conversation.