On September 10, 2026, Digital Minister Gobind Singh Deo said his ministry had submitted Budget 2027 proposals to the Finance Ministry. According to Malay Mail's report of the engagement session, they include incentives to lower the cost of equipment and digital applications for small traders, so that government-built infrastructure is actually used. He declined to give details, saying it was better for the Finance Ministry to decide and the prime minister to announce. Budget 2027 is due to be tabled on October 9. Nothing concrete is on the table yet, so what follows is an assessment of the direction, not of a measure.
The case for state-built digital infrastructure
The strongest argument for the government's approach is a fraud argument. MyDigital ID verifies a person against National Registration Department records in real time, and it arrives as e-financial fraud climbs. The Sun reported 5,159 e-financial fraud cases in 2025 against 1,812 in 2024, with losses of RM458 million. A single, state-verified credential that banks can plug into is a reasonable answer to that problem. Without a shared utility, each bank and platform builds its own weaker verification, and small businesses bear the cost of the resulting fraud.
The uptake figures suggest the policy is working at the consumer end. The Sun reported that MyDigital ID Sdn Bhd was aiming for 17 million registered accounts by the end of 2026, up from 7.3 million at the close of 2025. Malay Mail reported on July 8, 2026 that Deputy Prime Minister Zahid said 12 million Malaysians had signed up as of June 30, with 114 government services integrated. Fifteen banks and fintech firms have signed agreements to use its e-verification. That is real scale.
Where the gap actually is
The minister's own framing identifies the problem: infrastructure exists, and small businesses are not using it. Citizens signing up for a credential is not the same thing as a corner shop accepting digital payments, issuing e-invoices, or authenticating customers through the platform. Those steps require point-of-sale hardware, software subscriptions, connectivity and training. For a micro-enterprise these are fixed costs that do not scale down.
A targeted subsidy on those costs is a defensible use of public money. It treats the barrier as economic rather than behavioural. It also fits the stated national ambition: the MyDIGITAL blueprint site lists a 30% digital-economy share of GDP and a top-25 IMD digital competitiveness ranking as 2030 targets. Neither is reachable if the long tail of small firms stays offline.
Design principles Budget 2027 should follow
The risk in adoption incentives is that they drift from helping firms toward herding them. Three principles would keep the programme on the right side of that line.
- Subsidise the tool, not the platform. Incentives should be technology-neutral: a rebate on any certified payment terminal or accounting package that interoperates with open standards, not only products tied to one government system. Tying money to a specific platform converts a subsidy into a quiet mandate and invites vendor capture.
- Keep participation voluntary and portable. The EFF's September 2026 essay on digital sovereignty argues that data should be easily portable between platforms and services, and that people deserve clarity on who can lawfully access it. It also warns that some governments pursue sovereignty to enable surveillance and censorship. A national ID that becomes a precondition for ordinary commerce raises the stakes of every breach and every access request. Malaysia should say plainly that businesses and customers can transact without it.
- Publish the metrics. Registered accounts measure sign-ups, not value. The ministry should report active use, authentication success rates, merchant onboarding and cost savings per firm, so Parliament can see whether the incentive changed behaviour or merely subsidised purchases that would have happened anyway.
The privacy guardrails already exist, and need enforcement
Malaysia has recently strengthened the legal backbone for this. The Personal Data Protection (Amendment) Act 2024 was implemented in phases during 2025, according to law-firm summaries, with the final phase on June 1, 2025 covering data protection officers, mandatory breach notification and data portability. The Personal Data Protection Department's site now carries a data breach notification reporting channel and references the amended Act 709. A digital-ID ecosystem concentrating identity data across government and banks depends on that regime being enforced, not just enacted. Budget 2027 should fund the regulator's capacity alongside the adoption incentives.
What to watch on October 9
The constructive outcome is a modest, time-limited, technology-neutral incentive aimed at micro and small firms. It would sit alongside funding for the data protection regulator and a commitment to publish adoption results. The weaker outcome is a headline allocation to the platforms themselves, with no use-based targets. The first treats small businesses as customers with a real cost problem. The second treats them as a user-count statistic.
Governments across Asia are building digital public infrastructure, and Malaysia's early numbers are strong. The next test is whether that infrastructure gets used because it is cheaper and better than the alternatives. A budget that lowers real costs and leaves the choice to firms would be a sound way to find out.