Do You Need a Licence to Sell Online in Malaysia?

There is no such thing as an e-commerce licence in Malaysia. No statute creates one, no agency issues one, and no fee is payable for one.

There is, however, a much more expensive problem: almost every guide to selling online in Malaysia is citing revoked law. The Consumer Protection (Electronic Trade Transactions) Regulations 2012 were revoked on 25 December 2024. If your compliance checklist has eight disclosure items on it, it is roughly eighteen months out of date.

Why there is no licence — and how we know

KPDN administers ten Acts, none of which creates an e-commerce licence. Its own E-Commerce Regulatory Review treats the licensing of e-commerce intermediaries as a policy option that was considered and not adopted, and records MCMC’s position that e-commerce platforms are outside its jurisdiction and that s.126 of the Communications and Multimedia Act 1998 is not used to license them.

That is a negative finding assembled from a statute list and a policy study rather than a single official sentence — but it is the strongest evidence available, and it points one way.

The MCMC licensing that does exist is not about you. Since 1 January 2025, social media services and internet messaging services are class-licensable under P.U.(A) 205/2024. The much-reported “8 million user” figure comes from P.U.(A) 206/2024 and is an exemption threshold — providers with fewer than eight million Malaysian users are exempt. It is routinely reported backwards, and it applies to platforms, not to sellers on them.

Register the business

In Peninsular Malaysia, ROBA 1956 s.2 defines business as “every form of trade, commerce, craftsmanship, calling, profession, or other activity carried on for the purposes of gain”. Nothing in that turns on premises or stock. A person selling from a phone is carrying on a business.

• s.5(1) — apply within 30 days of commencement
• s.11A — display the certificate at the principal place of business; s.12(2) fine RM2,000 or six months
• s.12(1)(a) — carrying on an unregistered business: fine up to RM50,000, imprisonment up to two years, or both

The sanction almost nobody writes about is s.8. While the prescribed particulars of an associate of the business are not on the register, no right of that person arising out of a contract made in relation to the business is enforceable by suit, in any name. Relief comes only on application to the High Court. An unregistered online seller who gets stiffed by a supplier starts the dispute unable to sue on the contract.

ROBA 1956 applies to Peninsular Malaysia only (s.1(2), extended to Labuan in 1996); Sabah and Sarawak never adopted it. Sellers there register under state instruments instead: in Sarawak, the Business Names Ordinance (Cap. 64) and the Business, Professions and Trade Licensing Ordinance (Cap. 33); in Sabah, business and trade registration runs through the Trades Licensing Ordinance (Sabah Cap. 144), administered by the local authorities.

What must appear on the listing — the ten items

The current instrument is the Consumer Protection (Electronic Trade Transaction) Regulations 2024, P.U.(A) 449/2024, made under s.150(2)(a) of the Consumer Protection Act 1999, made 20 December 2024 and in force 25 December 2024. Regulation 10 revokes the 2012 regulations outright.

Regulation 2 defines an online marketplace as “any electronic trade platform that is conducted through electronic means by any supplier”, and an online marketplace supplier as “any person who conducts a trade or advertisement through an online marketplace”. On its face that wording is broad enough to reach a seller’s own website, not only third-party platforms like Shopee or Lazada — but KPDN has published no interpretive guideline settling the point, so whether a proprietary e-shop is caught remains genuinely open.

The Schedule to regulation 3 requires the online marketplace supplier to disclose:

1. Name of the supplier or company
2. Website address of the online marketplace, if any
3. Email address and telephone number
4. Address of the trade or advertisement
5. Description of the main characteristics of the goods or services
6. Full price including transportation costs, taxes and any other cost
7. Method of payment
8. Terms and conditions of the sale and purchase
9. Estimated time of delivery
10. Certificate that the goods or services meet safety and health standards determined by the competent authority, if any

Three changes catch people out.

Regulation 4 requires the disclosures to be in the national language, with other languages permitted in addition. There was no equivalent in 2012, and an English-only product page does not comply.

The business or company registration number is no longer a disclosure item. It moved to regulation 8(1)(c), as a record the operator must keep. Displaying it remains sensible; it is no longer what the Schedule requires.

Regulation 6(1)(a) now requires a means to rectify errors “prior to or after the confirmation of the order”. The 2012 version stopped at prior to. Regulation 6(1)(b) still requires acknowledgement of receipt without undue delay.

Regulation 5 is new: the supplier bears the cost of re-delivery where goods are materially different or defective, or must provide services reasonably fit for purpose.

Records, and who keeps them

Three years, not two. Regulation 8(1) puts on the operator a duty to keep the supplier’s name, address, telephone number, IC or passport number, business account number and email; the website address; the trade or company name and registration number; and the records of electronic trade transactions or advertisements. Regulation 8(2) extends the transaction and advertisement record duty to the supplier.

Regulation 7 is the operator’s gatekeeping duty — ensure the supplier complies with regulation 3 before any transaction is permitted, provide a complaints channel, and ensure advertisements comply. This is why marketplaces chase you for documents: they are discharging their own obligation, not certifying yours.

Penalty — and here the law is genuinely unsettled. Regulation 9 provides that “any person who fails to comply with any provision of these Regulations commits an offence”, but prescribes no penalty of its own. Two routes could fill the gap, and no case law resolves which governs. On one reading the general penalty in s.145 of the Consumer Protection Act 1999 applies — an individual up to RM50,000 or three years, rising to RM100,000 or five years; a body corporate up to RM100,000, rising to RM200,000; plus up to RM1,000 for each day a continuing offence persists. But s.150(3) sets a dedicated regime for offences created by subsidiary legislation under the Act — a fine up to RM100,000 or three years, rising to RM250,000 or six years for a second or subsequent offence. Because P.U.(A) 449 set no penalty of its own under s.150(3), whether the fallback is s.145 (as “an offence under this Act for which no penalty is expressly provided”) or the unused s.150(3) route is open.

That also explains the figures other guides cite. RM250,000 is the s.150(3) subsequent-offence cap for subsidiary-legislation offences; RM500,000 is the separate s.16(4) PDPA penalty for processing personal data within a prescribed class without a valid data-controller registration certificate — not fabrications, but different provisions.

The data protection layer that arrived in 2025

The Personal Data Protection (Amendment) Act 2024 (Act A1727, not A1717 — that is the Free Zones amendment) commenced in three tranches under P.U.(B) 522/2024:

Date	What changed
1 Jan 2025	Registrar becomes Commissioner; electronic service provisions
1 Apr 2025	Data user becomes data controller; the Security Principle extends to data processors; the cross-border whitelist in s.129(1) is deleted
1 Jun 2025	s.12A data protection officer, s.12B breach notification, and s.43A data portability

The DPO threshold catches ordinary online retailers. JPDP’s February 2025 guideline, read with Circular 1/2025, sets three limbs: more than 20,000 data subjects; more than 10,000 data subjects’ sensitive personal data; or regular and systematic monitoring. The guideline’s own worked example of that third limb is a retail website using algorithms to monitor searches and purchases and offer recommendations. If you run a recommendation engine, volume does not save you. A DPO must be registered with the Commissioner within 21 days of appointment.

Breach notification runs from occurrence, not awareness. Notify the Commissioner as soon as practicable and no later than 72 hours from the occurrence of the breach, where it causes or is likely to cause significant harm, or affects more than 1,000 data subjects. Affected individuals must be told without unnecessary delay and no later than seven days after the Commissioner is notified — and that limb is triggered by significant harm only, not by the 1,000-subject scale test. Section 12B(3) carries a fine up to RM250,000 or two years.

Registration as a data controller is a separate question again. The Personal Data Protection (Class of Data Users) Order 2013 (P.U.(A) 336/2013) lists the classes that must register; class 9(b) covers a company or partnership “who conducts retail dealing and wholesale dealing as defined under the Control of Supplies Act 1961”. Because those terms are tied to that Act — which governs controlled, scheduled supplies — whether an ordinary online retailer not dealing in controlled goods falls within class 9(b) is genuinely open, and JPDP has published no interpretation. JPDP’s Circular 1/2026 (in force 1 June 2026, and revoking the 2024 circular) restates the registration and renewal duty: processing personal data within a prescribed class without a valid registration certificate is an offence under s.16(4) with a fine up to RM500,000 or three years, and continuing to process after a certificate lapses is an offence under reg 5(2) of P.U.(A) 337/2013 with a fine up to RM250,000 or two years. This registration duty is distinct from the s.12A DPO threshold above.

The product still decides the licence

Selling online changes the channel, not the regulator. Food, cosmetics, supplements, medical devices, alcohol, tobacco and financial products answer to the same authority whether they leave a shop or a listing. Importing your own stock puts you inside the Customs (Prohibition of Imports) Order 2023, where some goods need an import licence and others a prescribed certificate.

Common mistakes

• Working from the 2012 regulations. They were revoked on 25 December 2024. Eight disclosure items is the old law.
• English-only product pages. Regulation 4 requires the national language.
• Two-year record retention. It is three, and the field list is longer.
• Assuming a hobby is not a business. ROBA turns on activity carried on for gain.
• Assuming the PDPA is only for big companies. The monitoring limb has no volume floor.
• Treating the marketplace’s document request as the legal test. That is regulation 7, their duty, not yours.

What’s next

Do three things this week. Re-read your product page against the ten Schedule items and put the disclosures into Bahasa Malaysia. Extend record retention to three years and add the fields regulation 8 now names. Then work out honestly whether anything you do amounts to regular and systematic monitoring — because if it does, the DPO duty has been live since 1 June 2025.