Cloud services regulations to be implemented in April 2022 (updated)

In October 2021, the Malaysian Communications and Multimedia Commission (“MCMC”) announced that it would implement light regulations on cloud services1 (“Cloud Regulations”) effective January 1, 2022 (see our update LHAG, Cloud Services Regulations to come into effect January 2022, published 22 October 2021).

As things stand, the MCMC will not introduce new stand-alone regulations for cloud services, but will instead rely on the existing regulatory framework (for more details, see below).

Following the October 2021 Cloud Regulatory Information Notice (FAQ), the MCMC has subsequently issued the following updates as of December 17, 2021:

(a) Cloud Service Provider Licensing Frequently Asked Questions (FAQs) (“Updated FAQs”); and

(b) Cloud Services Regulation Disclosure (“Disclosure”).

The updated FAQs and backgrounder provide further clarification on the regulatory framework for cloud services under Lightened Regulation and include additional guidance on the application not previously covered in the notice October 2021 advisory.

Cloud service providers will need to be licensed under the Application Service Provider Class License (“ASP(C) License”), which generally regulates end-consumer activities involving voice services, data services, Internet access and e-commerce.

Some of the major updates provided by MCMC in the updated FAQ and backgrounder include the following:

(a) The Cloud Regulations come into force on January 1, 2022. Notwithstanding, a grace period from January 1, 2022 to March 31, 2022 will be granted and registration during this period will be accepted by the MCMC. The Cloud Regulations (i.e. the requirement for certain cloud service providers to register for an ASP(C) license) will be fully enforced from April 1, 2022.

(b) There will be no changes or introduction of a new regulatory provision to the existing legal framework to regulate the licensing of cloud services. Instead, the MCMC will rely on Regulation 30(1)(j) of the current Communications and Multimedia (Licensing) Regulations 2000 (issued under the Communications and Multimedia Act 1998 (“CMA”)) to implement the licensing regime for cloud services. .

(c) Licensing requirement depends on whether a cloud service provider is locally present. In this regard, local presence will be determined as follows:

(i) A locally incorporated/established person in accordance with applicable laws. However, a local branch of a foreign person will not be considered locally incorporated/established, as branches of a foreign person will still be considered part of that foreign person.

(ii) A person who is incorporated/established locally in accordance with applicable laws and who provides cloud services from a foreign cloud service provider, through its local data center. In this situation, the provision of foreign cloud services would be undertaken by the local data center that controls the cloud services offered to end users.

Here are updated illustrations of what constitutes a “local presence”:

  • Scenario 1: Company A is a locally incorporated company that provides cloud services to end users. Company A must be registered under the ASP(C) license to provide such services.
  • Scenario 2: Company B is not a locally incorporated company but provides cloud services through a local data center, Company C, to end users. Company C must be registered under the ASP (C) license to provide the services of the foreign cloud service provider through its local data center.
  • Scenario 3: Company D is not a locally incorporated company and does not provide cloud services through local data centers to end users. Company D is not required to be registered under the ASP(C) license.
  • Scenario 4: Company E is not a locally incorporated company, but has a local branch. Since the branch office is not considered to have a local presence, it does not need to be registered under the ASP(C) license.

d) The following persons or activities will not be subject to the licensing requirement:

(i) Pure software vendors, e.g. people who only provide software and solutions relying on other cloud computing platforms and infrastructure.

(ii) Cloud computing resellers, for example local businesses reselling cloud services or products provided by large cloud service providers and having no control over the cloud services or products.

(e) With regard to cloud services offered to “end users”, these are natural persons (individuals) or legal persons (companies).

(f) There will be no restrictions on foreign ownership and licensees will be permitted to be 100% foreign owned.

(g) Web hosting and client server activities will remain exempt application services under the Communications and Multimedia (Licensing) (Exemption) Order 2000.

(h) As noted above, a Universal Service Provision (“USP”) fund contribution waiver will apply and revenues generated from the cloud service business will not be subject to USP fund contribution.

(i) For existing ASP(C) licensees who provide cloud services, those individuals may continue to provide cloud services under the existing ASP(C) license, but would be required to include service activities cloud among the activities undertaken (if applicable), when re-registering the same permit for the following year.

(j) Provision of unlicensed cloud services will now constitute an offense under the CMA (subject to the prescribed grace period). Service providers are advised to obtain the required licenses before commencing their operations.

With the above updates in place, cloud service providers are reminded to register for the ASP(C) license within the allotted grace period to avoid any service disruption and enforcement action. potential taken by the MCMC. For better compliance and risk management, end-user organizations and cloud service providers can refer to the MCMC’s Technical Code for Information and Network Security ― Selection of Cloud Service Providers (First Revision). (registered August 2021), which specifies relevant security requirements that must be considered by organizations when selecting a cloud service provider.

Previous discusses the benefits of cybersecurity consulting services
Next Espress Labs among top finalists for Vaughan 2022 Business Achievement Awards