Malaysian MNO Regulatory Landscape: Licensing,
Enforcement and Emerging Risk
Malaysia's mobile regulatory environment is in active transition. The end of Digital Nasional Berhad's 5G single-wholesale monopoly on 31 December 2024 — replaced by a dual-network model with U Mobile selected as the second operator in November 2024 — is the most structurally significant change the sector has seen in years.
MCMC issued 279 Quality of Service directives to the four major operators in 2025 alone, with YTL Communications receiving 154 of them, and warned of fines up to RM500,000 per instance if shortfalls persist. The regulator is watching, and the volume of directives is rising fast.
What makes this market complicated right now is the gap between the framework on paper and the enforcement reality on the ground. Spectrum assignments, access pricing, and QoS standards all exist — but enforcement has been uneven: zero directives were issued in 2024 due to internal approval delays, then 547 in the first seven months of 2025. Meanwhile, licensing fee schedules, processing timelines, and the detailed mechanics of foreign ownership compliance are not publicly documented in any source Ren could verify. That opacity is itself a risk — operators cannot price regulatory exposure they cannot see.
The Communications and Multimedia Act 1998 is the single regulatory instrument that governs everything.
Every licence, every enforcement action, every fine — all flow from one 1998 statute and the regulator it created.
Malaysia's telecoms sector runs on a single piece of primary legislation: the Communications and Multimedia Act 1998 (CMA). Everything else — spectrum assignments, licensing categories, quality of service standards, consumer protection, and enforcement powers — derives from it. The Malaysian Communications and Multimedia Commission (MCMC) is the CMA's enforcement arm, operating under the Ministry of Communications. There is no separate mobile-specific statute and no regional regulator for Sabah or Sarawak: MCMC's authority is federal and uniform across all three territories.[ICLG]
Primary legislation governing all telecoms activity in Malaysia. Grants MCMC licensing, spectrum, and enforcement powers. Applies uniformly across Peninsular Malaysia, Sabah, and Sarawak.
Caps wholesale prices for mobile origination, termination, and interconnect services. No amendment published as of April 2026. Renewal or replacement due by end-2026.
Sets performance benchmarks for download speeds, latency, packet loss, service availability, web browsing, and video streaming. Basis for 279 directives issued in 2025.
Governs spectrum assignment process. MCMC holds discretion to assign via fixed-price application, preferential rights, auction, or tender. No post-2023 spectrum auction has been publicly documented.
Platforms with 8 million+ Malaysian users are automatically deemed licensed Application Service Providers. Imposes obligations on platforms, not MNOs directly — but may create indirect network access compliance duties.
Under the CMA, operators hold one of two licence types. Individual licences are issued by the Minister of Communications for activities requiring high regulatory oversight — typically for operators running national network infrastructure. They run for 5 to 10 years and cannot be transferred or assigned without prior ministerial approval. Class licences apply a lighter-touch approach for lower-risk activities. Spectrum and apparatus assignments sit alongside these licence categories and are governed separately by the Communications and Multimedia (Spectrum) Regulations 2000, with MCMC holding discretion over whether assignments are made by fixed-price application, auction, tender, or reissuance.[ICLG]
The Mandatory Standard on Access Pricing (MSAP), last issued in March 2023, caps prices for mobile origination, termination, and interconnect services through 2026. No amendment to the MSAP has been published as of April 2026. The Mandatory Standards for Quality of Service (MSQoS) for wireless broadband — established under Determination No. 2 of 2023 — set the benchmarks that triggered the 2025 wave of enforcement directives. These two instruments together define the commercial and technical floor every operator must meet.[ICLG]
The licence structure is well-defined in law but the cost and timing are not publicly documented.
Operators and new entrants cannot price their licensing burden from public sources alone — that opacity is a structural compliance risk.
Malaysia's licensing framework divides operators into two tracks under the CMA. Individual licences cover activities requiring high regulatory control — operating a national mobile network sits in this tier. They are issued by the Minister of Communications, not MCMC directly, run for 5 to 10 years, and are non-transferable without prior ministerial approval. Any change in substantial shareholding must also be notified to the Minister.[ICLG] Class licences apply lighter regulation to lower-risk activities and are administered by MCMC.
The critical gap in what is publicly available: no official MCMC schedule of application fees, annual fees, or renewal fees for any MNO licence tier could be verified from public sources as of April 2026. MCMC's Licensing Guidelines and the Communications and Multimedia (Licensing) Regulations — which contain this detail — require direct consultation with MCMC or a local legal adviser. Regulatory affairs teams should not assume that fees published in third-party guides are current. The same applies to processing timelines: MCMC has not published formal service level commitments for licence application turnaround in any publicly available document found during this research.
In 2025, MCMC introduced a new mandatory standard under Sections 55 and 104(1)(b) of the CMA to tighten prepaid SIM card registration requirements.[ICLG] The scope and enforcement detail of this standard were not available in public sources. However, for MNOs with large prepaid subscriber bases — CelcomDigi and Maxis both operate at scale here — it is a live compliance obligation that requires verification against the official MCMC determination rather than secondary reporting.
The move from a single-wholesale 5G model to a dual-network structure is the biggest regulatory change in years.
U Mobile's selection as the second 5G operator ended DNB's monopoly — but the obligations that come with the new structure are still being defined.
Malaysia originally chose a single-wholesale-network model for 5G, with Digital Nasional Berhad (DNB) as the sole builder and operator of 5G infrastructure. Other MNOs would access the network wholesale rather than build their own. That model ended on 31 December 2024, when DNB's exclusive status expired. In November 2024, MCMC selected U Mobile as Malaysia's second 5G network operator — a significant structural shift that means two separate 5G networks will now coexist.[SoyaCincau]
DNB's network reached 82.4% Coverage of Populated Areas (COPA) and was upgraded to 5G Advanced (5G-A) by Ericsson in February 2025.[SoyaCincau] U Mobile is building its standalone 5G network in partnership with Huawei and ZTE, launched commercial services in early 2026, and has publicly committed to reaching 80% COPA by the second half of 2026. Its buildout plan targets approximately 9,000 sites, compared to DNB's roughly 7,000.[The Edge Malaysia]
The regulatory complication: existing MNOs (CelcomDigi, Maxis, YTL) continue renting spectrum from DNB under wholesale access arrangements, while U Mobile builds its own. This creates asymmetric cost and investment structures across the sector. MCMC has not published a formal framework detailing what densification obligations apply to which operator under the dual-network model, nor how coverage targets for the second network will be enforced. The Malaysian government has stated it remains open to Chinese technology firms — including Huawei and ZTE — in the 5G rollout, a stance confirmed by the Ministry of Communications in 2025.[Komunikasi.gov.my]
MCMC's enforcement is concentrated on Quality of Service — and YTL Communications is the primary target.
279 directives in seven months tells you the regulator is serious. YTL's 154 of them tells you who is furthest from the line.
MCMC's enforcement record between 2022 and mid-2025 shows a clear instrument: the Mandatory Standards for Quality of Service (MSQoS) for wireless broadband, issued under Determination No. 2 of 2023. This is the basis for every compliance directive issued to the four major MNOs. The pattern of issuance reveals something important about how MCMC actually operates: 229 directives in 2022, 208 in 2023, zero in 2024 (attributed to internal approval delays), then 547 in the first seven months of 2025 — a catchup enforcement surge.[The Malaysian Reserve]
The 279 directives issued as of 30 July 2025 broke down as follows: YTL Communications received 154, U Mobile 27, CelcomDigi 50, and Maxis 10.[The Star] YTL's disproportionate share — 55% of all directives — is the most significant enforcement signal in the dataset. YTL operates the Yes 4G/5G brand and has a smaller network footprint than CelcomDigi or Maxis, which likely explains the concentration. Directives targeted download speeds, latency, packet loss, service availability, web browsing access times, and video streaming performance. Enforcement identified lapses in both urban and rural areas.
Critically, no fines had been issued as of the July 2025 announcement. MCMC framed the directives as improvement orders, with the RM500,000-per-instance fine under the CMA as the next escalation step if operators failed to remediate within stipulated timeframes.[The Vibes] No enforcement actions were identified for spectrum violations, foreign ownership breaches, or access pricing non-compliance — the entire documented enforcement record relates to service quality. That does not mean those other areas are unmonitored, but it does mean the only verified enforcement instrument in recent years is the QoS directive regime.
IPv6 migration and digital identity expansion are the two concrete obligations heading toward MNOs by 2028.
No CMA amendment or new spectrum framework is confirmed for 2026–2027 — but two infrastructure mandates are real and dated.
The most important thing to say about pending regulation is what is not there. No proposed CMA amendment, no new spectrum framework, and no AI or data governance law specific to telecoms is confirmed for 2026 or 2027 in any source Ren could verify. The pipeline is thinner than the current enforcement intensity might suggest. What does exist are two concrete, dated mandates and several indirect pressures that will touch MNOs without being aimed at them.[ISIS Malaysia]
The IPv6 migration mandate is the largest confirmed infrastructure obligation. Following MCMC's October 2024 public consultation on 100% IPv6 adoption, the transition window opens in 2025 with full completion required by 2028. This builds on earlier instruments — Commission Direction No. 2 of 2015 required IPv6 enablement for Network Service Providers, and MCMC MTSFB TC T013:2019 mandated IPv6 certification for equipment from July 2020.[my6.my] The 2028 deadline means operators have a three-year window, but network-wide protocol migration at this scale requires capital planning now.
The Madani Budget 2026 plans to extend the MyDigital ID program to telecommunications after reaching 15 million users by end-2025.[Malaysian Budget 2026] This could affect customer onboarding and Know Your Customer (KYC) processes for MNOs, but the specific rules, costs, and implementation timelines have not been published. The MSAP — which caps wholesale access pricing for mobile origination, termination, and interconnect — expires at end-2026. Its renewal or replacement is a near-term regulatory event with direct commercial implications, but no consultation document or proposed successor has been published as of April 2026.
Malaysia's telecom regulation is federal and uniform — Sabah and Sarawak do not have separate MNO rules.
Federal MCMC authority covers all three territories with identical licensing and QoS obligations.
Unlike land law, labour law, and certain taxation matters where Sabah and Sarawara have devolved powers, telecommunications is a federal subject in Malaysia. The CMA applies uniformly across all three territories — MNOs hold the same licence categories, face the same QoS benchmarks, and are subject to the same MCMC enforcement powers whether they are operating in Kuala Lumpur, Kota Kinabalu, or Kuching. No source identified any spectrum fee differential, rollout obligation variation, or QoS enforcement distinction between the territories.[ICLG]
The practical asymmetry is not regulatory but commercial and physical: Sabah and Sarawara are geographically large with lower population density, making rural coverage targets harder and more expensive to meet. MCMC's QoS enforcement captured lapses in both urban and rural areas, which means that operators with significant East Malaysian exposure face the same enforcement risk on the same metrics with structurally higher build costs. The MADANI Subsea Cable Link (SALAM) — a 3,190 km cable project budgeted at RM2 billion — will improve backhaul connectivity across all three territories when complete, but it does not change the regulatory framework.[Malaysian Budget 2026]
Three regulatory risks dominate the next two years: 5G densification obligations, foreign ownership exposure, and escalating QoS fines.
The risk is not that the rules will change dramatically — it is that the enforcement of existing rules will intensify.
The most immediate risk is an escalation of MCMC's QoS enforcement from directives to fines. The regulator issued 547 directives in the first seven months of 2025 after a zero-enforcement year in 2024 — a pattern that signals institutional momentum, not routine oversight. The RM500,000-per-instance maximum fine under the CMA has not yet been applied, but MCMC explicitly warned operators in July 2025 that fines would follow if shortfalls persisted.[The Malaysian Reserve] For YTL Communications, which received 154 of the 279 mid-2025 directives, the financial exposure is material. For all operators, indoor coverage — where 80% of mobile data is consumed — remains the structural weak point that QoS field tests are most likely to expose.
The dual-network transition creates a second category of risk that is harder to price. U Mobile must build out to 80% COPA by H2 2026 while simultaneously divesting its DNB stake — creating funding pressure and potential governance changes that could trigger MCMC's foreign ownership review processes under the CMA's shareholding notification requirements.[The Edge Malaysia] Existing operators renting from DNB face a different version of the same problem: spectrum remains locked to DNB's assignments, blocking independent RAN optimisation. The framework governing how these asymmetric structures will be regulated over the next 24 months has not been published.
The MSAP expiry at end-2026 is the least visible but potentially the most commercially consequential near-term event. If MCMC uses the renewal process to restructure wholesale access pricing — either raising or lowering caps for mobile termination and origination — the downstream effect on operator revenue and competitive positioning will be direct. No consultation document has been published as of April 2026, which means operators are currently pricing this risk blind.
The base case is continued enforcement intensification — not a dramatic regulatory reset.
The regulatory direction is clear. The question is how fast MCMC moves from directives to financial penalties.
The base case reflects the evidence directly: MCMC is in an active enforcement phase, the QoS framework is the primary instrument, and the dual-network transition is proceeding without a published densification rulebook. The most likely outcome over 18 months is that at least one operator receives a financial penalty under the CMA and that the MSAP is renewed with modest adjustments rather than a structural redesign. Neither the regulator's stated agenda nor the legislative calendar points to a dramatic overhaul of the CMA itself.
- Operators demonstrate measurable QoS improvement in H2 2026 field tests
- MCMC internal approval processes remain slower than enforcement activity
- MSAP consultation produces consensus renewal without structural change
- YTL Communications or another repeat-directive operator fails to remediate within stipulated timeframe
- MCMC publishes MSAP consultation in H2 2026 ahead of December expiry
- Formal dual-network coverage framework published by MCMC
- QoS metrics do not improve despite 2025 directives — political pressure forces financial penalties
- MSAP renewal contested, resulting in delayed or restructured access pricing regime
- U Mobile DNB stake divestiture triggers ministerial shareholding review with conditions
The bull case — lighter regulatory pressure — would require MCMC to pull back from the enforcement trajectory visible in H1 2025 data. That is possible if the regulator judges that the directive regime alone is driving compliance improvement, but the data does not currently support that reading. The bear case — an aggressive multi-front regulatory tightening — would require both an MSAP renewal that restructures wholesale pricing materially and an escalation of QoS fines to the maximum RM500,000 level across multiple operators simultaneously. Either alone is plausible; both together in the same 18-month window is less likely.
Key things to remember
About About this report
This report maps the regulatory framework governing mobile network operators in Malaysia — covering active licences, enforcement actions, pending policy changes, and the top forward-looking risks through mid-2028.
Regulatory affairs leads, compliance teams, investors, and consultants who need a factual picture of how Malaysian telecommunications regulation works in practice, not just on paper.
Ren searched MCMC regulatory instruments, government publications, named enforcement records, and Tier 2 industry sources across six targeted research queries covering licensing, enforcement, spectrum, pending legislation, regional variation, and forward risk.
Primary research reflects publicly available data as of April 2026; enforcement figures cover activity to July 2025 and some forward-looking initiatives extend to 2028. Licensing fee schedules and formal MCMC determinations were not publicly accessible — this is flagged explicitly throughout.
Sources Sources & Methodology
Research conducted . All statistics carry inline citation markers.
MCMC individual and class licence fee schedules and processing timelines are not publicly documented. No official MCMC Licensing Guidelines or Communications and Multimedia (Licensing) Regulations fee schedule was accessible from public sources. The licensing burden section reflects this gap and is capped at MEDIUM confidence.
No Tier 1 MCMC determinations, primary enforcement notices, or official case files were available for the 2025 QoS directive actions. The enforcement record relies on Tier 2 news reporting (The Malaysian Reserve, The Star, The Vibes). Enforcement figures are credible but not independently verified against primary MCMC documents. Confidence on enforcement detail: MEDIUM-HIGH rather than HIGH.
Post-July 2025 enforcement updates — whether fines were ultimately issued, whether operators remediated within stipulated timeframes, and whether MCMC issued further directives in H2 2025 or early 2026 — are not available in any source found. The enforcement record has a five-month gap to April 2026.
No formal MCMC consultation or published framework for the dual-network densification obligations under the post-DNB structure was identified. The regulatory expectations placed on U Mobile versus DNB-renting operators are based on news reporting rather than primary regulatory instruments.
Fewer than two Tier 1 sources cover the core regulatory framework and enforcement record directly. The CMA framework analysis relies primarily on ICLG (Tier 2) rather than primary MCMC publications. This is noted across all affected sections with confidence ratings capped at MEDIUM or MEDIUM-HIGH.
This report is produced for informational purposes only. It does not constitute financial, legal, or investment advice. All data is sourced from publicly available information as at the date of research. Renatus Ventures makes no representations as to the completeness or accuracy of third-party data.
