A Threat Aimed at Compliance, Not Structure
Malaysia Competition Commission (MyCC) chief executive Iskandar Ismail has warned that companies refusing to hand over data for the commission's ongoing digital-economy market review could face criminal investigation (MLex, Sept 2, 2026). In the same breath, he confirmed Malaysia will stick with what MyCC itself calls a "soft approach" — dialogue and enforcement under existing competition law — rather than adopting European Union-style ex ante rules that impose pre-emptive conduct obligations on designated "gatekeeper" platforms (The Edge Malaysia special report).
That combination is more coherent than it first appears, and it is the right sequencing for a market regulator still building its evidentiary base.
What the Review Actually Found
MyCC's market review, launched under Section 11 of the Competition Act 2010, examined four sub-sectors: mobile operating and payment systems, e-commerce marketplaces, digital advertising, and online travel agencies (Skrine, March 2025). After roughly 18 months of work, the commission identified 34 issues it says threaten competitive dynamics — concentrated market structures driven by network effects, vertical integration, and data-driven advantages, with small merchants absorbing thin margins under platform fee structures (The Edge Malaysia). Iskandar also flagged that vertically integrated platforms may be sharing consumer data across payments, financing, and delivery arms in ways that sit uneasily with data protection law even where no statute is technically breached.
Those are legitimate findings, and the strongest case for tougher regulation follows directly from them. Ex ante rules exist precisely because after-the-fact enforcement is slow, and by the time a competition authority proves an abuse of dominance, the harm — a foreclosed rival, a captured merchant base — is often already locked in. The EU's Digital Markets Act (Regulation (EU) 2022/1925) was built on that logic: rather than litigate each instance of self-preferencing or data leverage case by case, it imposes upfront obligations on gatekeepers before harm materializes. Given MyCC's own findings on data cross-use, a regulator less committed to proportionality could reasonably argue Malaysia needs the same.
Why Soft Enforcement Is the Better Bet Here
MyCC is nonetheless right to hold off, for reasons the commission's own posture already reflects. First, capacity: Malaysia has never designated a gatekeeper, run a market-definition exercise at DMA scale, or built the adjudicative infrastructure needed to police obligations like interoperability or self-preferencing bans without years of appeals. Rushing into ex ante rules before the evidentiary base is solid risks the kind of blunt, overbroad designation criteria that critics of the DMA itself have flagged in Brussels.
Second, the diagnosis-remedy mismatch. As the Information Technology and Innovation Foundation argued in its submission to the review, concentration in fast-moving digital markets often reflects efficiency and innovation rather than anticompetitive foreclosure, and Malaysia already has overlapping tools — the Competition Act, the Communications and Multimedia Act, consumer protection regulation, and the Personal Data Protection Act — that can address specific harms without a new structural regime (ITIF, April 2025). An ex ante code written now, before the final report even settles which conduct is actually harmful, risks freezing untested obligations onto a market that is still relatively young by global standards — deterring the investment MyCC needs platforms to keep making in a market of Malaysia's size.
The Information Powers Are the More Consequential Change
The criminal-probe warning is not idle. Malaysia's Parliament passed the Competition (Amendment) Bill 2026 and the Competition Commission (Amendment) Bill 2026 through the Dewan Rakyat on July 6, 2026, and the Dewan Negara approved them on July 27, 2026 (Media Selangor). The amendments give MyCC expanded power to compel information — including from government entities — for market reviews, and legal commentary describes non-compliance or knowingly supplying false or incomplete information as a standalone criminal offence, alongside a new offence for destroying or concealing records (ZICO Legal analysis). Notably, the Bills dropped the merger-control regime that had been floated in 2022 consultations — MyCC chose to sharpen its investigative teeth before expanding its jurisdiction.
The Right Order of Operations
Compelling firms to answer information requests, backed by criminal sanction for non-cooperation, is a proportionate and narrowly targeted power: it forces disclosure without pre-judging the substantive question of what conduct is anticompetitive. Ex ante gatekeeper regulation does the opposite — it locks in remedies before the underlying market failure is confirmed. MyCC's approach gets the sequencing right: gather the facts under compulsion, publish a final report grounded in evidence expected by end-2025 slipping into 2026, and only then decide whether existing competition law tools are sufficient. Regulators elsewhere would do well to notice that data compulsion and regulatory restraint are not in tension — they are how you avoid regulating on a hunch.