Failure to comply with Malaysia’s new Online Safety Act risk code could lead to enforcement action and penalties of up to RM10 million.
PUTRAJAYA: Failure to comply with the requirements under the Risk Mitigation Code (RMC), as part of the obligations of licensed service providers under Part III of the Online Safety Act 2025 (ONSA), may result in enforcement action, including fines or financial penalties of up to RM10 million.
The Malaysian Communications and Multimedia Commission (MCMC) explained this in its Frequently Asked Questions (FAQ) document relating to the RMC, which will come into effect on June 1.
According to the document, the RMC sets out the steps that must be taken by online service providers under Section 13 of the ONSA to reduce the risk of consumers being exposed to harmful online content on their services.
“This includes assessing the risk of harmful content and implementing measures to mitigate that risk, thereby ensuring that their services are safe for users.
“Licensed service providers must develop user safety policies, community standards, community guidelines and/or terms of service and ensure that they are enforced fairly and consistently to reduce the risk of users being exposed to harmful content,” according to the FAQ.
In a statement, MCMC announced that two new codes under the ONSA, namely the Child Protection Code (CPC) and Risk Mitigation Code (RMC), will take effect on June 1, requiring digital platforms to take stricter action against harmful content and better protect children online.
It said the codes were developed following engagement sessions with industry players, civil society organisations and stakeholders, including a public consultation held from Feb 12 to March 31.
Under the RMC, the harmful content refers to child sexual abuse material (CSAM), financial fraud, obscene and indecent content, as well as content that may cause harassment or distress.
Also, content that may incite violence or terrorism, content that may induce a child to cause harm to himself, content that may promote feelings of ill‑will or hostility amongst the public, and content that promotes the use or sale of dangerous drugs.
According to the FAQ, licensed service providers must also test and adapt algorithmic systems, including recommendation systems, to mitigate the risk of users being exposed to harmful content on their services.
“This recognises that algorithmic curation can amplify or reduce harmful content exposure,” it said.
In an effort to curb online fraud, MCMC also stipulates that paid-for advertisements for goods or services may only be allowed if they come from advertisers (businesses or organisations) or users verified against government-issued records. This aims to reduce fraud and misuse of advertising for harmful activities.
MCMC said it may revoke, vary, revise or amend the whole or any part of the RMC from time to time, whenever necessary.
ONSA, effective Jan 1, 2026, aims to make the Internet environment safer, especially for children and families, by setting clear responsibilities for online platform providers who do not just delete content after it goes viral, but rather detect, prevent and act faster on content that is harmful.
