ESG & Reputational Risk:
Malaysian Mobile Network Operators

Between November 2023 and February 2025, MCMC and the Securities Commission of Malaysia issued five formal enforcement actions against CelcomDigi, Maxis, and U Mobile. Total financial penalties reached RM11.5 million — concentrated in three areas: 5G spectrum obligation failures, service quality failures causing consumer harm, and a data privacy breach under the Personal Data Protection Act. No enforcement actions have been recorded in Q1 2026, but the trajectory is clear: MCMC is using its enforcement tools more actively as 5G rollout conditions tighten. McKinsey's 2025 Malaysia Digital Economy Report links this enforcement posture directly to National Energy Transition Roadmap compliance pressures. [McKinsey]

The most consequential single action is CelcomDigi's February 2025 PDPA fine of RM3.5 million for leaking 1.2 million user records. [MCMC] This is the first major operator-level privacy enforcement in Malaysia and it sets a regulatory precedent. Maxis and U Mobile now face MCMC scrutiny of their own data handling practices in an environment where the regulator has demonstrated willingness to act. The combined CelcomDigi entity serves approximately 20 million subscribers, making data hygiene across merged legacy systems a structural vulnerability rather than a one-off event.

The Securities Commission's two warning letters — one to Maxis in October 2023 for inadequate RPT disclosures and one to CelcomDigi in March 2024 for post-merger RPT non-compliance — have not resulted in fines. But they signal an SC watching governance closely at a time when both operators carry large related-party transaction volumes. The absence of fines does not mean the risk has passed; it means the clock is running.

The CelcomDigi merger has produced the sector's most complex governance structure. MCMC's 2022 merger review identified three directors holding cross-directorships in Telenor Asia and Axiata Group. [MCMC] By Q1 2025, Sustainalytics rated CelcomDigi's board independence as high risk, with 40% non-independent directors. [Sustainalytics] Deloitte's 2024 APAC Telecom Governance Study found that CelcomDigi's post-merger board committees were not fully operational until Q3 2023 — a delay of nearly a year after the merger closed. [Deloitte] KPMG's 2025 audit flagged inadequate ESG oversight in CelcomDigi's board charters. [KPMG]

Maxis carries a different but equally persistent governance risk: concentrated ownership. Four of nine directors were nominee directors of major shareholder Usaha Tegas Sdn Bhd as of 2023. [MSCI] Sustainalytics flagged two non-independent directors with tenures exceeding nine years as a medium governance risk. [Sustainalytics] FTSE4Good Bursa Malaysia excluded Maxis from its 2024 review, citing female board representation of 22% against a 30% target. PwC's 2024 Malaysia Corporate Governance Report recorded zero whistleblower cases investigated at Maxis in 2023 despite a functioning hotline — a cultural warning sign rather than an infrastructure gap. [PwC]

RPT volumes quantify the governance risk for institutional investors. EY's 2024 Malaysia RPT Review rated Maxis as elevated risk: 25% of capital expenditure is tied to related parties, and RPTs with Usaha Tegas affiliates reached RM520 million in 2025. [EY] CelcomDigi's RPTs with Axiata peaked at RM1.2 billion in 2023 and fell to RM900 million in 2024 — declining in volume but still under SC monitoring. Roland Berger's 2025 Telecom M&A Report describes this as merger-induced RPT vulnerability — a structural feature of post-merger integration that is slow to unwind and highly visible to institutional ESG screeners. [Roland Berger]

CelcomDigi is the only Malaysian MNO with a publicly available, named ESG score. Its MSCI ESG rating of AA and FTSE Russell four-star score place it in the upper tier of rated telecoms globally. [CelcomDigi SR] It is a member of the FTSE4Good Bursa Malaysia Index and participates annually in Sustainalytics, MSCI, and S&P Global assessments, with limited third-party assurance on sustainability data. In FY24, CelcomDigi reduced GHG emissions by 10% to 468,200 tCO2e and cut energy consumption by 6% to 861.7 GWh — concrete operational progress that underpins the rating. [CelcomDigi SR]

No equivalent public ESG rating data is available for Maxis or U Mobile for 2025 or 2026. Maxis was excluded from the FTSE4Good Bursa Malaysia Index in 2024 for falling short of the 30% female board representation target, and no MSCI or Sustainalytics score for Maxis has been published in available sources. U Mobile, as a private company, has no disclosure obligation and publishes no public ESG metrics. This disclosure asymmetry will widen as Bursa Malaysia's enhanced sustainability reporting requirements intensify through 2026. [Bursa Malaysia]

The absence of comparable data across the sector should not be read as an absence of risk. For investors applying ESG screens, unverifiable performance is equivalent to uninvestable. Maxis faces a compliance deadline — not just a reputational one — as structured reporting requirements for large listed companies tighten.

CelcomDigi's February 2025 PDPA fine is the sector's defining data privacy event. MCMC imposed RM3.5 million for the leaking of 1.2 million user records — a breach that combined volume (scale of exposure), regulatory follow-through (a named fine rather than a warning), and reputational damage to a company that had just merged two of Malaysia's largest subscriber bases. [MCMC] The combined CelcomDigi entity serves approximately 20 million subscribers, making data hygiene across merged legacy systems a structural vulnerability rather than a one-off incident.

The PDPA enforcement precedent changes the risk calculus for Maxis and U Mobile. Before February 2025, operator-level PDPA enforcement was theoretical. After it, Maxis — with its own large consumer database and a governance structure PwC identified as having zero investigated whistleblower cases in 2023 [PwC] — faces a live regulatory risk that its board has not publicly addressed. U Mobile's private status offers no protection: MCMC enforces PDPA regardless of listing status.

No documented activist campaigns targeting Malaysian MNOs on data privacy have been identified in available sources for 2025 or 2026. This absence reflects the early stage of civil society mobilisation in this area in Malaysia — not the absence of risk. MCMC has demonstrated enforcement capability and willingness, and Malaysia's broader digital economy ambitions will only raise the regulator's expectations further through 2027.

No Scope 1, 2, or 3 emissions figures for Maxis or U Mobile are available in public sources. CelcomDigi is the exception: FY24 GHG emissions of 468,200 tCO2e (down 10% year on year) and energy consumption of 861.7 GWh (down 6%) represent the only operator-level climate data in the Malaysian MNO sector. [CelcomDigi SR] The absence of equivalent data from Maxis and U Mobile means physical climate risks facing their tower estates and data centres have not been quantified, stress-tested, or disclosed to investors.

Malaysia's geography creates concrete infrastructure exposure. Peninsular Malaysia and Sabah experience annual monsoon flooding that has historically disrupted road access to rural tower sites and caused short-term outages. The OECD identifies energy dependency — specifically the high and growing power draw of mobile base stations — as a key physical and transition risk for telecoms in high-growth markets. [OECD] As 5G base station density increases under Malaysia's national rollout, energy consumption will rise before efficiency gains from network consolidation materialise. No Malaysian MNO has published a TCFD-aligned climate scenario analysis for its tower estate.

Deutsche Telekom, the most directly comparable peer on climate disclosure, achieved 100% renewable electricity by 2021 and publishes detailed physical risk adaptation plans. [Deutsche Telekom] Malaysian MNOs are not at that stage. CelcomDigi's emissions reductions are operational efficiency gains — reduced energy use per site — rather than a transition to renewable energy sourcing. The gap between current practice and what a TCFD-aligned investor expects is wide and will widen further as Bursa Malaysia's enhanced sustainability reporting requirements take effect through 2026.

Malaysia's National Energy Transition Roadmap (NETR), combined with NDC 3.0 commitments targeting emissions peaking by 2030, is creating a tightening regulatory environment for energy-intensive sectors including telecommunications. [PwC Malaysia] McKinsey's 2025 Malaysia Digital Economy Report directly links MCMC's recent enforcement posture to NETR compliance pressures — meaning the RM11.5 million in operator fines between 2023 and 2025 is partly a function of national climate policy, not purely sector-specific regulatory aggression. [McKinsey]

Bursa Malaysia's enhanced sustainability reporting framework requires large listed companies — which includes both CelcomDigi and Maxis — to report against structured ESG metrics. CelcomDigi is meeting this requirement through its FY24 sustainability report with limited third-party assurance. Maxis has not published equivalent data. The gap between what the framework requires and what Maxis is currently disclosing will become a compliance issue, not merely a reputational one, as enforcement of Bursa's requirements intensifies through 2026 and 2027. [Bursa Malaysia]

The ASEAN Economic Community Strategic Plan 2026–2030 includes digital infrastructure and sustainability integration as explicit regional priorities, reinforcing Malaysia's domestic trajectory. [ASEAN] For Malaysian MNOs, the practical implication is that transition risk is not a 2030 problem — it is a 2026 and 2027 procurement, compliance, and capital cost problem. Operators that build renewable energy sourcing and TCFD-aligned disclosure now will face lower compliance costs than those waiting for regulatory compulsion.

No specific activist campaigns, NGO engagements, or investor coalition actions targeting Malaysian MNOs on ESG themes — including e-waste, electromagnetic radiation, data sovereignty, or carbon emissions — have been documented in available sources for 2025 or 2026. The ESG Malaysia Summit 2025 involved Climate Governance Malaysia on supply chain transparency and climate risk but named no telecom-specific campaigns. EDOTCO Group, the tower infrastructure provider linked to Malaysian telcos, received a 3-star ESG recognition in the UN Global Compact Network Malaysia 2025 Select List with no activist engagements recorded. [UN GC Malaysia]

The absence of documented pressure does not mean the sector is under no social scrutiny. U Mobile's 2023 MCMC fine for rural coverage obligation breach, combined with persistent connectivity gaps in East Malaysia, signals an area where government and civil society expectations are ahead of operator performance. The CelcomDigi merger consolidated two large workforces — Celcom and Digi — but no public documentation of retrenchment disputes or labour actions linked to the merger has been identified in available sources. This is a data gap: Malaysian corporate labour dispute reporting is inconsistently public.

Malaysia's National Action Plan on Business and Human Rights (NAPBHR), which PwC identifies as requiring companies to assess human rights impacts across operations and supply chains, applies directly to MNOs' tower construction supply chains and customer-facing labour practices. [PwC Malaysia] None of the three operators has published a NAPBHR-aligned human rights assessment in available sources. This is a forward-looking disclosure gap that will become visible to ESG investors as Malaysian standards align with international human rights due diligence frameworks.

The base case reflects the enforcement pattern already established: MCMC continues issuing fines for 5G obligation breaches and data privacy failures, the Securities Commission monitors but does not escalate RPT warnings to formal penalties, and CelcomDigi makes incremental governance improvements while Maxis closes its disclosure gap under Bursa reporting pressure. This scenario assumes no major new data breach and no escalation of RPT concerns to enforcement action. It is the most likely outcome because it reflects the institutional inertia of both regulator and operators — enforcement is active but bounded.

The bear case requires a second large-scale data breach, an SC escalation from warning to fine on RPT grounds, or a governance failure — a board-level event or a whistleblower incident at Maxis — that shifts the reputational environment. None is implausible: CelcomDigi's merged legacy systems remain a data risk, Maxis's RPT volumes are still rising, and PwC's finding of zero investigated whistleblower cases at Maxis is a documented cultural warning sign. [PwC] The bear case probability of 30% reflects that the structural conditions for it are already in place.

The bull case requires CelcomDigi to publish TCFD-aligned climate disclosure, Maxis to achieve F4GBM re-inclusion by meeting the 30% female board target, and MCMC to complete its enforcement cycle without new material fines. CelcomDigi's emissions trajectory makes the environmental component achievable — but governance improvements at both operators require board-level decisions that have not been publicly committed to on any named timeline.