Malaysia's Communications Regulator Is About To Get A 10x Budget Increase

Malaysia's communications regulator is about to become significantly more powerful, and honestly, most of that expansion makes sense given how much digital infrastructure has grown since the underlying law was written. But there's a specific number buried in these amendments that deserves a lot more scrutiny than it's getting.

Why expanding MCMC's powers actually makes sense.

The Malaysian Communications and Multimedia Commission is getting broader authority under amendments to the MCMC Act 1998, a law that's nearly three decades old at this point, written for a completely different technological era.

That timing gap matters. Communications infrastructure today underpins everything from cloud computing and AI to data centers, digital banking, and e-commerce, none of which existed in any meaningful form when the original Act was passed. As Malaysia keeps pushing its digital economy ambitions forward, regulators are inevitably going to play a bigger role in safeguarding networks, protecting consumers, and keeping the country's communications infrastructure secure and resilient. Updating a 1998-era legal framework to actually match 2026-era technology is a genuinely necessary step, not an overreach.

Several specific changes hold up well under scrutiny. Giving MCMC authority to develop security and interoperability standards should help build a more resilient digital ecosystem as cyber threats keep getting more sophisticated. Broader audit powers could genuinely improve compliance across an ecosystem that's expanded well beyond traditional telecommunications into all the adjacent digital services Malaysians now depend on daily.

But "any other person" is doing a lot of work in this bill

Here's where things get less clear-cut. One amendment would let MCMC audit not just licensed operators, but also "any other person" providing services related to communications systems.

That's an extremely broad phrase, and it raises real practical questions. While stronger oversight is understandable given how communications infrastructure has expanded, businesses are going to want much greater clarity on exactly who actually falls within that scope, and how commercially sensitive information uncovered during an audit will actually be protected once MCMC has access to it. "Any other person" could theoretically sweep in a huge range of companies that never considered themselves subject to communications regulation before.

The transparency provisions cut both ways.

The Bill also lets MCMC publish information on enforcement actions, compounds, and regulatory decisions. Generally, that kind of transparency is welcome it promotes compliance, and it gives investors and consumers real visibility into how the regulator is actually exercising its authority, rather than operating behind closed doors.

But there's a genuine risk on the other side of that same coin: these disclosures need to be handled carefully, so companies aren't effectively penalized in the court of public opinion before investigations or legal proceedings have actually concluded. Publishing enforcement information is good practice. Publishing it prematurely, before due process has played out, can cause real reputational and commercial damage to a company that may ultimately be cleared.

The number that should actually raise eyebrows

Here's the part of this bill that deserves the closest scrutiny: MCMC's procurement limit is jumping from RM5 million to RM50 million without requiring ministerial approval. That's a full 10-fold increase in spending authority granted to a single regulatory body.

Deputy Communications Minister Teo Nie Ching defended the new RM50 million threshold as reflecting updated procurement rules, rising costs, and technological advancements replacing a RM5 million limit that had gone completely unchanged since 1998. And to be fair, that reasoning isn't unreasonable on its face. RM5 million bought a lot more in 1998 than it does now, and faster procurement genuinely may be justified given how quickly technology moves and how urgent cybersecurity challenges have become.

But a tenfold jump in spending authority, granted without requiring ministerial sign-off, is still a genuinely significant expansion of unchecked authority for any single body regulatory or otherwise. That's not a criticism of MCMC specifically; it's just a basic governance principle. The bigger the check someone can write without needing a second signature, the more robust the internal controls and oversight need to be to make sure that authority doesn't get misused, whether through bad intent or just weak processes.

One genuinely good governance move is buried in here

To its credit, one part of these amendments actually strengthens MCMC's independence directly: the bill prevents Members of Parliament and state assembly members from serving as the commission's chairman. That's a sensible structural safeguard keeping the regulator's top leadership at arm's length from active politicians reduces the risk of the commission's decisions being shaped by immediate political interests rather than its actual regulatory mandate.

The real question isn't whether MCMC needs more power

Here's the thing worth sitting with: the issue isn't really whether MCMC should have stronger powers in the first place. Given how much Malaysia's digital economy has grown, and how outdated a 1998 regulatory framework has become, it arguably does need them.

The bigger, more important question is whether those expanded powers are actually matched by adequate safeguards. A regulator that's genuinely trusted isn't defined simply by how much authority it holds it's defined by how transparently and responsibly it actually exercises that authority once it has it.

That's the balance that actually matters here, and it's the part of this bill that's gotten the least attention so far. Broader audit powers over "any other person," a tenfold jump in unchecked procurement authority, and expanded ability to publish enforcement actions are all individually defensible changes. But collectively, they represent a real concentration of power that deserves a genuine, public conversation about accountability structures not just a nod toward modernization and moving on.

Getting that balance right is what's actually going to determine whether businesses, investors, and the public maintain confidence in MCMC as it takes on this significantly larger role in Malaysia's digital economy.