Malaysia's eKYC mandate arrives one sector at a time

Malaysia's Online Safety Act 2025 came into force on 1 January 2026, and with it a duty that used to belong to banks. Social media and messaging services with at least eight million Malaysian users now need an Applications Service Provider (Class) licence, and platforms likely to be reached by minors have to run an electronic know-your-customer (eKYC) check against government-issued records rather than accept a self-declared birthday. The Malaysian Communications and Multimedia Commission began enforcing against platforms in January.

That duty landed while the state was still assembling the credential meant to satisfy it. MyDigital ID held about 6.36 million registrations in early December 2025. By the middle of February 2026 it was approaching 10 million, adding roughly 50,000 sign-ups a day against a target of 17 million by the end of the year. It became the only sign-on method for the immigration app MyNIISe on 15 January 2026, and takes the same role for the road transport app MyJPJ from 1 May.

Three eKYC tracks, three different owners

Identity verification in Malaysia now runs on three separate tracks under three different authorities. Bank Negara Malaysia set the oldest one. Its eKYC policy document, updated in 2024, lets institutions onboard customers remotely provided they use at least one of four accepted verification methods, with MyKad chip reading and liveness detection among the techniques on that list. Customers onboarded digitally without in-person verification sit under transaction and balance limits until they clear a supplementary step.

Where the three tracks currently sit

• Bank Negara Malaysia, eKYC policy document, binds licensed financial institutions, updated 2024
• MyDigital ID, the state credential, binds government services first and is planned for finance, healthcare and telecommunications from 2026
• MCMC under Act 866, ASP(C) licence plus age verification, binds social media and messaging services at eight million Malaysian users or more, in force 1 January 2026

The pattern is that the same verification logic keeps being ported into sectors that were never supervised as financial institutions. Healthcare has been adapting know-your-customer checks into a know-your-patient control for much the same reason, to catch fraud at onboarding rather than reconstruct it afterwards. Act 866 applies that thinking to consumer platforms with no supervisory relationship to a central bank at all.

The sector with the highest stakes sits outside all three

Online gambling is the obvious outlier. Malaysia licenses exactly one casino, at Genting Highlands, and has issued no online licences, so the platforms Malaysian users actually reach are licensed somewhere else entirely. There is no domestic supervisor with standing to impose an eKYC standard on them, and Act 866 was not drafted with them in mind.

Verification still happens. It just happens to different standards depending on which regulator an operator answers to. An operator licensed by the Malta Gaming Authority or the UK Gambling Commission carries that regulator's identity and source-of-funds obligations into a market its own regulator never contemplated, while an operator holding a Curacao licence answers to a considerably lighter rulebook. A record of how offshore casinos handle Malaysian player verification is one of the few places the applicable standard can be read off brand by brand, because it lists which regulator covers each operator instead of treating offshore as a single category. For anyone benchmarking verification practice in this market, that distinction is the entire question.

Verification here tracks the licence, not the user. A Malaysian opening an account at a locally licensed bank and a Malaysian opening one at an offshore gambling platform pass through checks written by two different jurisdictions, and only one of those jurisdictions answers to anybody in Kuala Lumpur.

What a verification duty actually costs

None of this is cheap to build. Free Malaysia Today's explainer on what the Act changes sets out the obligations platforms picked up in January, and the engineering underneath them is substantial: document capture, liveness checks that hold up against replay and synthetic-media attempts, chip reading where a MyKad is present, a fallback path for users whose documents fail, and a retention policy that satisfies data protection rules while still leaving an audit trail.

There is a commercial cost on top of the engineering one. Every verification step is a point where a user abandons signup, which is why platforms resisted anything stronger than an age checkbox for as long as they could. Sectors inside a licensing regime absorb that cost and that friction, while cross-border platforms outside one pick their own standard, and generally a lighter one.

Where the layer goes next

The credential is arriving faster than the rules that will draw on it. At close to 10 million registrations and climbing daily, MyDigital ID will shortly cover enough of the adult population to work as a default for private-sector onboarding, which is precisely what the planned integration into finance, healthcare and telecommunications assumes.

The remaining gap is legislative rather than technical. A dedicated bill covering online gambling was drafted in February 2026 and has still not been tabled. If it ever is, the verification layer it would need already exists and is already compulsory somewhere else in the economy. The open question is whether the sector with the most to verify gets brought inside that layer, or left to go on choosing its own regulator.