On 16 October 2021, the Malaysian Communications and Multimedia Commission (“MCMC”) published an Advisory Notice on cloud service regulation (“Advisory”) which contains a set of Frequently Asked Questions (“FAQ”) regarding the proposed regulation of cloud services by MCMC. Subsequently, on 17 December 2021, MCMC published a revised FAQ and an Information Paper on regulating cloud services (“Information Paper”) to provide further clarification on the regulatory framework for cloud services.
 
The licensing requirement for cloud services as prescribed under the Advisory came into effect on 1 January 2022, with a grace period from 1 January 2022 to 31 March 2022. The regulation will be fully enforced from 1 April 2022.
 
The Advisory is available here; and the Information Paper is available here.

Introduction
 
MCMC’s intention to regulate cloud services stems from concerns regarding data safety and trust as well as the potential regulatory loopholes and the lack of protection for data stored in the cloud. MCMC intends that, by adopting a licensing requirement as the approach to regulate cloud services, MCMC will have the flexibility to issue technical standards and co-develop such standards with the industry, and ensure cloud service providers will maintain a high level of data security, privacy and protection, and provide legal protection for consumers and public agencies.
 
MCMC intends to adopt a light touch approach in regulating cloud services by licensing cloud services under the Applications Service Provider Class licence (“ASP (C)”) category.
 
Scope of the licence requirement
 
For the purposes of regulating cloud services, MCMC has defined “cloud services” as:
 
“any service made available to end users on demand via the Internet from a cloud computing provider’s server”
 
The Advisory further clarifies that the provision of web hosting and client server activities remains exempted from the ASP (C) licensing requirement.
 
Local presence requirement
 
The Advisory states that persons that provide cloud services and possess local presence are required to register under the ASP (C) licence, as are providers of cloud service applications that do not have a local presence but provide such services through a local data centre. The Advisory also states that a cloud service application provider is not required to register under the ASP (C) licence if it has no local presence and does not provide such services through a local data centre.¹ 
 
The Information Paper provided some further clarity in relation to the local presence requirement. The Information Paper stipulates that a company which is not locally incorporated but has a local branch is not required to obtain an ASP (C) licence. Therefore, it appears that the licensing requirement would only apply to cloud service providers that are locally incorporated or established in Malaysia, and local branches of cloud service providers would not be subject to the licensing requirement.  
 
Activities which are not licensable
 
The Information Paper clarifies that the licensing requirement would not apply to “software and solutions providers that rely on other cloud service platforms and infrastructure”. The Information Paper also provides that resellers that are merely reselling cloud service products, who do not possess any control of such products, would not be required to obtain an ASP (C) licence.
 
Licence application and licensee obligations
 
Applicants will have to submit the ASP (C) licence application to MCMC together with the necessary supporting documents and registration fee, as well as comply with the licensee obligations under the ASP (C) licence once the licence is issued. At present, there are no foreign shareholding restrictions applicable for the ASP (C) licence and specifically for cloud service, licensees will not be required to contribute to the USP fund, which is a fund aimed at promoting widespread availability and usage of network services and/or applications services throughout Malaysia. 
 
The Advisory also makes it clear that persons who provide licensable activities prior to obtaining the requisite licence are committing an offence under the Communications and Multimedia Act 1998.
 
Cloud service providers are strongly encouraged to examine, without delay, whether their activities may require an ASP (C) licence, and to commence application process if necessary.
 
As for existing ASP (C) licence holders, these licence holders may provide or continue providing cloud services under their existing ASP (C) licences, but would be required to include cloud service activities during the annual re-registration of their licence.
 
*  This alert has been issued in place of our earlier Alerts dated 22 October 2021 and 10 November 2021 respectively as a result of amendments made by the MCMC to the Advisory issued on 15 October 2021 and the subsequent publication of the Information Paper.
 
Please contact Charmayne Ong (co@skrine.com), Jillian Chia (jc@skrine.com) or Natalie Lim (natalie.lim@skrine.com) if you have any questions on the Advisory and Information Paper.
 

---

¹ The earlier version of the Advisory stated that cloud service applications providers may be required to register under the ASP (C) licence if they do not have local presence and do not provide the cloud service applications through a local data centre.