Malaysia's Online Safety Act 2025 (Act 866) took effect on January 1, 2026, and its subsidiary Period Regulations now set some of the tightest content-moderation clocks in the democratic world. Under the framework, licensed platforms must acknowledge a user report within one hour and complete an initial assessment within twelve. For "priority harmful content" — child sexual abuse material and financial fraud — providers must make the content inaccessible immediately for 24 hours once they decide not to dismiss a report, then permanently remove it within one hour of confirming the violation. Other harmful content gets a slightly longer runway: four hours to temporary removal, twelve to permanent takedown (Mayer Brown).
The penalties back up the clock. Failing a core Part III duty carries a civil penalty of up to RM10 million (~$2.1 million). Missing a takedown deadline or ignoring an MCMC instruction brings fines up to RM1 million plus daily penalties of up to RM100,000 for continuing non-compliance, and giving MCMC false information is its own RM500,000 offense. Directors, compliance officers, partners, managers and company secretaries can be charged jointly with the company — and are presumed liable unless they can prove the offense happened without their knowledge and that they exercised reasonable diligence to stop it (Mayer Brown; MCMC, Act 866).
The Case for Speed
MCMC's justification deserves a fair hearing before it gets a rebuttal. CSAM and financial-fraud content cause compounding harm with every hour it stays live — a scam post circulates to new victims, an abuse image gets re-shared, and platform dashboards already prove near-real-time detection is technically feasible. MCMC's deputy managing director has framed the law as protective rather than restrictive, telling reporters in December 2025 that "the freedom of expression of internet users would not be restricted" because the nine categories of prohibited content were already illegal under existing law, and that "Onsa is not directed at the user, it is about imposing responsibility on the platform providers" (Free Malaysia Today). That is a coherent theory: shift the compliance burden onto the entities with the engineering resources to meet it, and leave ordinary users' speech untouched.
Where the Design Breaks Down
The problem is that the same one-hour clock applies whether the reported content is unambiguous CSAM or a contested claim about a public figure that requires actual judgment. A platform staring at RM10 million exposure and personal criminal liability for its compliance officer will not spend the hour deliberating close calls — it will take the content down and sort out the appeal later, if an appeal mechanism gets used at all. That dynamic is precisely what civil society groups warned about when Malaysia's underlying 2024 amendments to the Communications and Multimedia Act expanded MCMC's powers: campaigners noted "the absence of an independent oversight body" and warned that a "broad and vague list" of harmful-content categories risks sweeping in lawful speech, with MCMC itself described as "not independent in law or practice" from the government it regulates (CIVICUS Monitor). A regulator that both writes the takedown categories and sits inside the government being criticized is not a neutral referee for edge cases — and edge cases are exactly what a one-hour deadline forecloses from careful review.
The personal-liability provision compounds the incentive problem. Reasonable-diligence defenses are notoriously hard to prove in the moment a report lands, so the rational move for any named officer is to over-remove rather than risk being the test case for what "reasonable diligence" means in a Malaysian court. That is a rule optimized for compliance-department risk aversion, not for accurate moderation.
A Better Calibration Exists
None of this means MCMC should abandon fast lanes for genuinely urgent categories — CSAM and active financial fraud are exactly the content types where near-immediate action is defensible, and the law's own tiering (24-hour blocking for priority harms versus 4-12 hours for everything else) shows MCMC already accepts that not all harmful content deserves identical urgency (MCMC ONSA FAQ). The fix is to extend that same logic further: widen the window for contested-speech categories, route disputed calls to an appeal tribunal before removal rather than after, and pair the compliance deadlines with a genuinely independent oversight mechanism that can review MCMC's own takedown instructions — not just platforms' responses to them.
Malaysia is not wrong that platforms have been slow and inconsistent about scam and abuse content; the volume of complaints MCMC has fielded since January makes that case on its own. But a statute that treats a debunked scam ad and a disputed political post with the same one-hour stopwatch and the same threat of personal prosecution is not proportionate regulation — it is a system designed to make platforms choose speed over judgment every time, with predictable costs to speech that had nothing to do with fraud or child safety in the first place.