SEA E-Commerce Risk
Landscape 2026
Southeast Asia's e-commerce market reached $185 billion in GMV in 2025 and is on a trajectory to surpass $300 billion before 2030, according to the e-Conomy SEA 2025 report by Google, Temasek, and Bain.
That headline growth masks a deepening risk profile: platform concentration among Shopee, TikTok Shop, and Lazada is tightening, regulatory frameworks are being rewritten country by country, and cross-border trade tensions are already forcing governments to act against specific operators — Indonesia moved to block Temu in 2025 to protect local SMEs.
The structural tension in this market is the collision between rapid growth and fragmented governance. No two countries in the region apply the same rules to digital platforms, cross-border goods, or consumer data. That fragmentation is a compliance cost for large platforms, a barrier to scale for mid-tier players, and a genuine solvency risk for smaller merchants dependent on a single platform's algorithm or fee structure. Three risks are already materialising — regulatory action against China-origin low-cost platforms, social commerce scrutiny driven by TikTok Shop's rise to 25% of GMV, and cybersecurity exposure as e-skimmer attacks on e-commerce domains nearly tripled between 2023 and 2024. The remaining risks — BNPL credit defaults, currency stress, and logistics concentration — remain largely theoretical for now but carry escalation potential through 2027.
Six markets, six rulesets — and all of them are changing at once.
Malaysia is tabling new e-commerce legislation in 2026 while Vietnam drafts rules with revenue-based fines. No binding regional floor exists.
The most immediate regulatory risk for SEA e-commerce investors is not any single law — it is the simultaneous rewriting of rules across six separate jurisdictions with no coordinating mechanism. Malaysia's Deputy Minister announced a new e-commerce framework to be tabled in Parliament's first 2026 sitting, covering commission rate regulation, consumer protection, and cross-border transaction monitoring.[ICLG Malaysia] Vietnam's Draft E-Commerce Law imposes platform obligations around counterfeit goods and data protection, with non-compliance fines of up to 10% of annual revenue — a potentially existential penalty for smaller operators.[Cambridge CIIP]
To regulate platform commission rates, cross-border transactions, and consumer protection. Policy paper approved by Cabinet; legislation to be tabled in first 2026 parliamentary sitting.
Online marketplaces must disclose seller information, provide complaint channels, ensure compliant advertising, and maintain transaction records.
10% sales tax on imported goods valued at RM500 or below. Foreign sellers exceeding RM500,000 in 12-month sales must register as 'registered sellers'.
Mandates counterfeit goods controls and data protections for platforms. Non-compliance fines up to 10% of annual revenue — one of the highest penalty thresholds in the region.
Regional framework aiming to streamline cross-border digital trade and e-commerce access across ASEAN members. No binding enforcement mechanism or ratification timeline confirmed.
At the regional level, the ASEAN Digital Economy Framework Agreement (DEFA) has advanced negotiations aimed at streamlining cross-border digital trade rules, but it carries no enforcement mechanism and no firm ratification timeline.[ASEAN WEF] This means platforms face a compliance environment where each market demands separate legal structures, localised data handling, and distinct consumer protection regimes — raising operational costs in ways that favour large incumbents like Shopee and disadvantage smaller cross-border merchants.
The signal to watch is Malaysia's parliamentary session in mid-2026. If the new e-commerce framework passes with commission rate caps, it would directly compress Shopee's and Lazada's take rates in their third-largest SEA market and set a precedent other governments could follow. A second signal is Vietnam's finalisation of its Draft E-Commerce Law — early drafts suggest enforcement will be real, not symbolic.
Platform concentration is a risk multiplier — merchants with no alternative absorb every policy shift.
TikTok Shop commands roughly 25% of GMV. When a single channel controls that much merchant revenue, any regulatory or algorithmic change becomes a solvency event for dependent sellers.
Quantified market share data by platform and country is not publicly available for 2025 — no Tier 1 source provides named figures for Shopee, TikTok Shop, Lazada, or Temu at the country level. What the evidence does show is directional: video commerce, driven almost entirely by TikTok Shop, reached 25% of total e-commerce GMV across SEA in 2025.[e-Conomy SEA] That single channel's dominance in the short-video commerce segment means platform concentration risk is real even without precise share data.
The mechanism is straightforward. When one platform controls a significant share of discovery and transaction volume for a product category, merchants face a binary choice — invest fully in that platform's ecosystem or accept lower sales. That dependency means any change to fee structures, algorithm logic, or regulatory status of the platform flows directly to merchant economics with no buffer. Indonesia's 2023 temporary ban on TikTok Shop commerce features — later reversed — was the clearest demonstration: it forced an immediate operational halt for merchants who had consolidated their sales on the channel.
Indonesia's 2025 move to block Temu signals that governments in the region are willing to use blunt instruments to protect domestic SMEs from low-cost imported goods.[e-Conomy SEA] The implication for investors is not that Temu specifically will fail — it is that the playbook exists and has been used. Any platform perceived as channelling Chinese-origin goods at prices that undercut local manufacturing becomes a political target. Shopee's cross-border product lines and AliExpress inventory visible on regional marketplaces carry the same structural vulnerability.
China-origin goods are already under political fire — protectionism is accelerating, not slowing.
Indonesia's Temu block and Malaysia's low-value goods tax point to the same direction: regional governments are drawing lines around domestic retail.
The clearest materialised risk in SEA e-commerce in 2025 is government action against Chinese-origin low-cost goods flowing through digital platforms. Indonesia formally requested tech giants block Temu, explicitly citing the need to protect local SMEs from price competition that domestic manufacturers cannot match.[e-Conomy SEA] Malaysia has had a 10% sales tax on imported goods valued at RM500 or below in place since the Sales Tax (Amendment) Act 2022, directly targeting the sub-threshold pricing model used by Temu, AliExpress, and some Shopee cross-border listings.[ICLG Malaysia]
The mechanism is political as much as economic. As Chinese platforms redirect export capacity toward SEA in response to US tariffs, the volume of competitively priced Chinese goods available on regional e-commerce platforms increases. Local SME associations in Indonesia, Malaysia, and Vietnam have already lobbied governments to act. That lobbying has produced results in Indonesia and is directly linked to Malaysia's pending e-commerce legislation. The trajectory is toward more restrictions, not fewer.
For investors, the specific exposure is to platforms that depend on cross-border Chinese inventory for GMV growth — particularly in fashion, electronics accessories, and household goods categories where Chinese manufacturers hold a structural cost advantage. A platform that cannot credibly separate its domestic seller GMV from cross-border Chinese inventory in regulatory filings faces the highest policy risk.
E-skimmer attacks nearly tripled in a year — and most small merchants are not equipped to respond.
~11,000 e-commerce domains were infected with e-skimmer malware in 2024. Only 68.5% of ASEAN small firms have adopted basic cybersecurity software.
The cybersecurity risk in SEA e-commerce is materialising through two distinct channels. The first is direct platform compromise: e-skimmer attacks — malware embedded in checkout pages to steal payment data — hit roughly 11,000 unique e-commerce domains in 2024, nearly three times the 2023 level.[Cambridge CIIP] These attacks do not require a breach of the main platform — they exploit third-party plugins, underpowered merchant storefronts, and outdated payment gateway integrations. The second channel is deepfake and AI-driven social engineering. In Singapore, Vietnam, and other regional markets, 59% of surveyed respondents cited deepfakes as their top AI-related fear, reflecting a consumer trust problem that platforms have not yet solved.[Cambridge CIIP]
The structural vulnerability is the merchant layer. Large platforms like Shopee and Lazada invest heavily in core security infrastructure, but the millions of small merchants operating on their marketplaces often lack the technical capacity or budget to secure their own integrations. Only 68.5% of ASEAN small firms had adopted basic cybersecurity software as of 2025 data — meaning roughly one in three small e-commerce operators is running materially below-standard defences.[Cambridge CIIP] UNODC has noted the evolution of cybercrime in SEA toward organised, AI-automated operations, which increases the sophistication of attacks even as small merchant defences remain static.
For investors, the financial risk from cybersecurity is indirect but real. A major data breach involving payment credentials from a regional platform would trigger regulatory investigation, consumer trust loss, and potential liability under consumer protection frameworks in multiple jurisdictions simultaneously. Malaysia's Online Safety Bill 2024, passed but not yet in force, and Vietnam's draft law both include platform liability provisions that would attach legal exposure to security failures.[SKRINE Alert]
The macro backdrop for SEA e-commerce in 2025–2026 is broadly supportive. The e-Conomy SEA 2025 report by Google, Temasek, and Bain records 15% year-on-year GMV growth to $185 billion[e-Conomy SEA], and the OECD's Economic Outlook 2025 for SEA points to easier financial conditions and supportive public investment as growth drivers across the region.[OECD] Private investment in the SEA digital economy has stabilised following the 2022–2023 funding correction, with over $2.3 billion flowing to AI startups in H1 2025 alone — about 30% of total digital funding.[e-Conomy SEA]
The important caveat is what the research does not show. No public Tier 1 source provides named volatility metrics for the Indonesian rupiah, Philippine peso, or Vietnamese dong against the US dollar for 2025–2026. Cross-border payment failure rates for SEA e-commerce are not documented in available sources. And while digital financial services — including embedded lending and BNPL products from Grab, Shopee Pay, and GoPay — are growing rapidly, no default rate data has been published. QR-based payment interoperability across eight ASEAN nations and digital payments growing at a compound annual rate of 17.33% toward $115 billion in Indonesia by 2025 point to a maturing payments layer[Cambridge CIIP], but maturation does not mean stress-tested.
The risk for investors is not that macro conditions are currently adverse — they are not. It is that the absence of granular financial data on currency exposure, credit performance, and cross-border payment reliability means that stress in these areas would not be visible until it had already become material. A currency depreciation event in Indonesia or the Philippines — both of which have demonstrated historical volatility — would raise import costs for Chinese-origin goods sold on platforms and compress the margin economics of cross-border fulfilment without an obvious early warning signal.
Logistics vulnerabilities are real but under-documented — the absence of data is itself a risk signal.
No Tier 1 source has published a systematic assessment of SEA e-commerce logistics risk. That gap means investors are pricing this risk on incomplete information.
The operational and logistics risk picture for SEA e-commerce is hampered by a fundamental research gap: no Tier 1 source has published named data on last-mile delivery provider concentration, warehouse risk, or port bottleneck incidents specifically for e-commerce in the region as of 2025. The e-Conomy SEA 2025 report covers GMV growth in detail but does not note logistics disruptions.[e-Conomy SEA] This absence of data does not mean the risks are absent — it means they are unquantified, and investors are pricing them without evidence.
What the available research does establish is the physical context. Vietnam experienced a 10% increase in lead times for some manufacturing outputs in late 2024 as Apple and other companies accelerated sourcing shifts from China — a supply chain restructuring that raised logistics costs by 5% due to longer shipping routes.[Supply Chain Brain] Walmart reduced Chinese imports by 10% in 2024 and increased sourcing from Vietnam and Thailand. These manufacturing shifts increase the volume of goods moving through Vietnam's logistics infrastructure without a proportional expansion of that infrastructure, creating latent bottleneck risk at port and customs clearance points.
The geography of SEA creates structural operational risk independent of any single operator's decisions. Indonesia's archipelago of 17,000 islands means last-mile delivery costs are fundamentally higher than in contiguous markets — a cost structure that compresses seller margins and makes the economics of low-value cross-border goods more fragile. The Philippines faces similar island geography challenges. Both markets depend on a small number of logistics providers — J&T Express and Ninja Van are the most prominent — for the bulk of e-commerce last-mile fulfilment, but no concentration failure or outage is on record for 2025.
Three risks are already live — three remain theoretical but escalating.
Likelihood × impact scoring applied across six named risk categories. Scoring reflects available evidence — not generic frameworks.
| Impact 1 | Impact 2 | Impact 3 | Impact 4 | Impact 5 | |
|---|---|---|---|---|---|
| Regulatory / Platform Ban | LIVE | ||||
| Social Commerce Disruption | LIVE | ||||
| Cybersecurity Incidents | LIVE | ||||
| Cross-Border Tariff Escalation | RISING | ||||
| Currency / Credit Stress | WATCH | ||||
| Logistics Concentration | WATCH |
Three risks carry the highest combined likelihood and impact scores based on available evidence. Regulatory action against platforms — particularly those handling Chinese-origin cross-border goods — is already materialising, evidenced by Indonesia's Temu block and Malaysia's pending e-commerce legislation. Social commerce disruption is high-likelihood given TikTok Shop's 25% GMV share and the existing precedent of Indonesia's 2023 channel suspension.[e-Conomy SEA] Cybersecurity incidents are already occurring at scale — ~11,000 infected domains in 2024 — and the merchant security gap means the attack surface continues to expand.[Cambridge CIIP]
Three risks remain theoretical but are moving. Currency and credit stress is not currently documented but is unquantified — meaning investors cannot confirm its absence, only that it has not yet been reported publicly. Logistics concentration risk is structural in Indonesia and the Philippines but lacks a documented failure event. BNPL credit defaults are not evidenced in available sources — digital lending platforms report growth without disclosing default rates, which means risk is accumulating in a dark corner of the balance sheet.
The overall risk environment has shifted from 2023–2024 in one important direction: governments have demonstrated willingness to use platform bans as policy tools, not just as threats. That changes the probability distribution for regulatory risk from a tail event to a recurring feature of the operating environment.
Key things to remember
About About this report
This report assesses the specific, evidenced risks facing the Southeast Asian e-commerce market across Malaysia, Singapore, Indonesia, Thailand, the Philippines, and Vietnam as of Q2 2026.
It is intended for investors managing exposure to SEA digital assets, operators preparing board-level risk updates, and advisers briefing clients on platform and regulatory risk in the region.
Ren synthesised primary research from the e-Conomy SEA 2025 report (Google, Temasek, Bain), OECD Economic Outlook 2025, McKinsey's Southeast Asia Quarterly Economic Review, and supporting Tier 2 and Tier 3 sources covering regulatory, cyber, and trade developments.
Core market data is sourced from late 2025 reports; regulatory detail for markets other than Malaysia reflects limited available evidence and carries MEDIUM to LOW confidence.
Sources Sources & Methodology
Research conducted 10 Apr 2026. All statistics carry inline citation markers.
SEA e-commerce market size 2025 — e-Conomy SEA 2025 (Google, Temasek, Bain): $185B GMV, $41B revenue vs eMarketer 2026 Asia-Pacific forecast: separate methodology with different scope. e-Conomy SEA 2025 used as primary source — Tier 1 publisher, specific to SEA geography, most recent available.
No Tier 1 source provides named market share figures by platform (Shopee, TikTok Shop, Lazada, Temu) and country for 2025. All platform concentration analysis is directional only. Confidence for market share claims capped at MEDIUM.
No public data is available on BNPL or embedded lending default rates for any named SEA digital finance platform. BNPL credit risk section reflects structural analysis only — no financial metrics available.
Currency volatility data for the Indonesian rupiah, Philippine peso, and Vietnamese dong specific to e-commerce exposure is not available in any source consulted. Macro currency risk section relies on general economic outlook data.
No systematic logistics risk assessment exists in available Tier 1 or Tier 2 sources for SEA e-commerce last-mile or warehouse concentration. Logistics section confidence rated LOW.
Regulatory detail for Thailand, the Philippines, and Singapore e-commerce-specific rules is not covered in available sources. Malaysia and Vietnam carry higher confidence; other markets are largely undocumented in this research set.
No early-warning signal analysis or documented historical precedent chain for previous risk escalations (e.g., TikTok Shop 2023 Indonesia ban) was available from the research provided. Intelligence brief items for these risks are drawn from structural analysis, not documented causal chains.
This report is produced for informational purposes only. It does not constitute financial, legal, or investment advice. All data is sourced from publicly available information as at the date of research. Renatus Ventures makes no representations as to the completeness or accuracy of third-party data.
Video commerce grew to 25% of GMV — then governments started watching.
TikTok Shop's Indonesia experience showed the channel can be switched off overnight. The scale it has since reached makes a repeat more damaging, not less.
Video commerce — live shopping, short-video discovery, and in-app checkout — grew to roughly 25% of SEA e-commerce GMV in 2025, driven almost entirely by TikTok Shop.[e-Conomy SEA] That growth rate makes it the fastest-expanding channel in the region. It also makes it the most likely target for the next wave of regulatory scrutiny. Indonesia's 2023 ban on TikTok Shop's commerce features — since reversed after TikTok merged its Indonesian operations with Tokopedia — proved that national governments will act when they believe a foreign platform is concentrating too much commercial power.
The current regulatory posture across the region is one of monitoring edging toward intervention. Malaysia's incoming e-commerce framework specifically references platform commission rate regulation — a mechanism that would directly affect TikTok Shop's take rate. Vietnam's Draft E-Commerce Law imposes obligations on platforms hosting third-party sellers that are operationally demanding for short-video formats where product verification happens faster than compliance processes can run.[Cambridge CIIP] Bain flags ASEAN regulatory fragmentation as a structural barrier to social commerce scale.[e-Conomy SEA]
The signal to watch is whether any government moves to require localised data storage or operational entity registration for social commerce platforms specifically — rather than applying existing consumer protection laws. That would mark an escalation from general platform regulation to channel-specific control and would materially raise TikTok Shop's cost of operating in that market.