Withholding Tax on Cloud, SaaS, Ad Spend and Marketplace Fees

A Malaysian SME pays a foreign hosting bill, a design-tool subscription, an ad platform and a marketplace commission every month, and withholds nothing on any of them. Then a tax audit lands and the question is not whether tax was due — it is which of two entirely separate taxes was due, because the answer is often both.

Two taxes, two Acts, two regulators

Almost every page ranking for this question answers one and silently drops the other. Keep them apart.

	Withholding tax	Imported-service SST
Statute	Income Tax Act 1967	Service Tax Act 2018
Regulator	LHDN	RMCD
Whose tax	The non-resident’s income tax, which you deduct	Yours, self-accounted
Charging provision	ss.109, 109B	s.7(b), s.26A
Rate	10% royalty, 10% s.4A, 15% interest	8% standard, 6% for listed services
Threshold	None	None — the first ringgit counts
Trigger	Paying or crediting	Payment or invoice, whichever is earlier
Deadline	One month after paying or crediting	Last day of the following month
Form	CP37 or CP37D	SST-02A if not registered, SST-02 if registered

They do not offset and they do not substitute. A cloud invoice can be royalty under s.109 and an imported taxable service under s.7(b) at the same time.

When is a digital payment a royalty?

The pivot is in the s.2 definition of royalty in the Income Tax Act 1967, which covers sums paid for “the use of, or the right to use in respect of, any copyrights, software, artistic or scientific works, patents, designs or models, plans, secret processes or formulae, trademarks or other like property or rights”.

LHDN’s e-commerce guidelines para 7.2 confirm that “software” was added with effect from YA2017, and the examples are unambiguous:

• Example 4 — a manufacturer buys an accounting software solution for RM70,000 from a foreign vendor plus a RM3,000 annual licence fee. Both amounts are royalty and both carry s.109 withholding tax.
• Example 5 — an online seller pays a foreign marketplace a monthly subscription and a per-transaction fee. The agreement ties the subscription to the right to use the platform’s application, so the subscription is royalty. The transaction fee is for services and falls under s.4A — and, because those services were performed outside Malaysia, it is not taxed.

That single example is the shape of most SME software stacks: a licence component that is royalty and a service component that usually is not taxable.

Advertising: the Practice Note 1/2018 test

Practice Note 1/2018 is two pages long and decides more cases than anything else in this area. Its structure:

1. Does the non-resident have a permanent establishment where a treaty applies, or a business presence where none does? If yes, the payment is business income derived from Malaysia, taxed under s.4(a), and no withholding tax applies.
2. If no, route on the nature of the payment:
   • s.109 if the payment is for the purchase or use of an application that allows the payer to create their own advertisement campaign;
   • s.109B if there is no application, merely the provision of a service, and the payer “solely relies on the service provider to deal with all aspects of digital advertising”.

The e-commerce guidelines Example 3 applies limb one directly: a company that uses a social media platform to build its own campaign makes a royalty payment subject to s.109.

Note what this means in practice. Self-serve ad platforms — where you log in, set a budget and build the creative — sit on the royalty side. A foreign agency that runs the whole campaign for you sits on the s.4A side, where the offshore-performance exemption is available. Most SMEs use the former.

Why the offshore exemption does not save royalty

For s.4A(i) and (ii) income, P.U.(A) 323/2017 exempts the portion performed outside Malaysia from 6 September 2017 — which is why the marketplace transaction fee in Example 5 escapes.

There is no equivalent for royalty. Section 15 deems interest and royalty derived from Malaysia on a payer test: responsibility for payment lies with a resident, or the royalty is charged as an outgoing or expense against income accruing in or derived from Malaysia. Where the software sits, where the servers are, and where the vendor is have no bearing on it. Booking the subscription as an expense in a Malaysian business is enough.

This is the single largest exposure in the typical SME software stack, and the one that “but it’s all overseas” does not answer.

The SST side of the same invoice

Service tax on imported taxable services is charged by s.7(b) of the Service Tax Act 2018 on any taxable service acquired from a person outside Malaysia. Section 26A puts the obligation on any person other than a taxable person who acquires such a service in carrying on business — so being unregistered, and having no prospect of ever registering, is not a defence. There is no threshold.

The one relief that matters here is the digital-services interaction. Where a foreign provider is registered under the digital services regime and has charged you digital service tax, item 3 of P.U.(A) 380/2018 exempts you from self-accounting under s.26/s.26A — but the condition is that you hold the provider’s invoice. The invoice is the entitlement. If the provider is not registered, or is registered but did not charge, the s.26A obligation revives and lands on you.

Practical consequence: file the invoices that show Malaysian service tax, and self-account on the ones that do not. See imported-taxable-services for the declaration mechanics.

Making monthly subscriptions administrable

A RM600 monthly SaaS bill produces RM60 of withholding tax. Remitting it monthly against a one-month deadline is how compliance quietly stops happening.

The small-value deferment exists for exactly this. Where the withholding tax on a single payment transaction does not exceed RM500, and such transactions occur more than once in the relevant six-month period, remittance can be deferred to:

• 30 June, for payment transactions from 1 December of the previous year to 31 May; or
• 31 December, for payment transactions from 1 June to 30 November.

Use CP37S for royalty and interest, CP37DS for s.4A income. Both conditions must be met — one isolated small payment in a half-year does not qualify.

Common mistakes

• Assuming a foreign invoice with no Malaysian tax on it means no Malaysian tax. The withholding obligation sits on you as payer whether or not the vendor has heard of it, and s.26A sits on you as acquirer.
• Treating the two regimes as alternatives. Paying imported-service SST does nothing for your withholding position, and withholding does nothing for your SST position.
• Applying the offshore exemption to royalty. It covers s.4A(i) and (ii) only.
• Deciding the routing from the vendor’s product name. Practice Note 1/2018 turns on whether you use an application to do the work yourself. Read the terms of service, not the marketing page.
• Ignoring the permanent-establishment limb. If the provider has a Malaysian presence, withholding is the wrong answer entirely.
• Failing to check for a foreign registered person invoice before self-accounting SST. You may be paying twice.

What’s next

Work through your last three months of card statements and recurring invoices, and sort each foreign line into royalty, s.4A service or Malaysian-presence. Then run the same list a second time for imported-service SST, because the sorting is different. If the review turns up past periods, withholding-tax-non-compliance sets out what the exposure actually is.