Malaysian Communications and Multimedia Commission (MCMC)

The Malaysian Communications and Multimedia Commission (MCMC) — in Malay, Suruhanjaya Komunikasi dan Multimedia Malaysia (SKMM) — is Malaysia's statutory regulator for the communications and multimedia industry, established in 1998 to supervise the country's converged telecommunications, broadcasting and online sectors. Since the 2020s its remit has expanded into platform accountability and online safety, making it a central institution in Malaysia's response to AI-generated harms such as deepfakes, scam content and coordinated manipulation.^[1][2]

History and mandate

The Commission was created in the late 1990s in a wave of convergence-driven regulatory reform, formed on 1 November 1998 under the Malaysian Communications and Multimedia Commission Act 1998 (Act 589) and operating with powers set out in the Communications and Multimedia Act 1998 (Act 588); it took over functions from the former Malaysian Telecom Department.^[2] Its mandate spans advising the Minister on national policy objectives, implementing and enforcing communications and multimedia law, supervising industry activity, promoting industry development and self-regulation, managing spectrum, numbering and electronic addressing, and protecting consumers; in 2001 the role widened to include postal and courier services and licensing of certification authorities under the Digital Signature Act 1997. Its headquarters are in Cyberjaya.^[2]

Regulating the digital sector

Licensing is central to MCMC's toolkit: service providers operate under the CMA licensing framework, and from 1 January 2025 providers with at least eight million Malaysian users — covering major social media and messaging platforms — were required to hold applications service provider class licences through a deemed-registration mechanism.^[3] The Online Safety Act 2025, in force from 1 January 2026, layered statutory duties on top: platforms must reduce users' exposure to harmful content, provide reporting tools, protect child users with safe-by-design measures, prepare online safety plans, and meet response deadlines as short as one hour for priority content such as child sexual abuse material and financial fraud, under penalties affecting companies and officers. Age assurance for younger users is implemented through methods such as MyKad, passports and MyDigital ID.^[3]

Enforcement volumes show the load. Close to 225,000 pieces of deepfake, fraudulent and scam content were removed from cyberspace at MCMC's request between 2022 and 2025, as scams exploiting synthetic media — including fake videos of the Prime Minister, public figures and the King — multiplied.^[4] In June 2026 the Commission opened consultation on amendments to the CMA intended to modernise its enforcement powers, covering investigative tools, electronic addressing and spectrum administration.^[5]

AI governance and deepfakes

MCMC's position is that AI misuse — including digital manipulation of images to produce obscene, offensive or harmful content — is an offence under existing law, and that scams remain prosecutable under the Penal Code regardless of AI use.^[4] Its most prominent AI-related test arrived in September 2026, when Anthropic reported disrupting a commercial election-manipulation platform aimed at Malaysia; MCMC said it took the matter seriously, that activities of that nature do not form part of its functions or mandate, and that it was examining the report and seeking information before deciding on action.^[6] The Commission also sits within the wider governance stack now taking shape: Malaysia has consulted publicly on a proposed AI Governance Bill setting lifecycle responsibilities for AI developers and deployers and incident reporting, under a stated two-pronged approach of enforcing existing laws while the new framework is drafted.^[4][7]

>See Also

• AI Regulation Malaysia
• Malaysia AI Governance Framework
• National AI Office Malaysia
• CyberSecurity Malaysia
• Deepfake
• AI and Elections