Cloud Services Licensing Update
Subsequent to our previous update on the same subject matter in October 2021 available here (“Previous Update”), the Malaysian Communications and Multimedia Commission (“MCMC”) had on 17 December 2021 published the following further guidance on the regulation of cloud services in Malaysia:
(a) Information Paper on Regulating Cloud Services; and
(b) Frequently Asked Questions on Licensing Cloud Service
Providers.
No Amendment to the Existing Legislation
As noted in the Previous Update, cloud service providers are required to obtain applications service provider class licence (“ASP Class Licence”) under the Communications and
Multimedia Act 1998 (“CMA“) for the provision of cloud services.
In this regard, MCMC confirmed that the legal basis for licensing stems from Regulation 30(1)(j) of the Communications and Multimedia (Licensing) Regulations 2000 (“Licensing Regulations”), as extracted below:
“Regulation 30(1). A person who provides any or all of the following applications service may be registered as an applications service provider class licensee:
(j) such other applications service which are not exempt under the [CMA] or not listed in this
subregulation.”
As such, there will not be any addition or amendments to the existing provisions of the CMA or Licensing Regulations to specifically address the licensing of cloud service providers.
Software Providers Excluded
Cloud services can generally be categorised into three types based on current market trends and offerings:
(a) Software as a Service (SaaS);
(b) Platform as a Service (PaaS); and
(c) Infrastructure as a Service (IaaS).
MCMC’s Advisory Notice dated 15 October 2021 defined cloud service as “any service made available to end users on demand via the Internet from a cloud computing provider’s server”.
The broad definition of “cloud services” is to ensure that it will be sufficiently wide to cover various forms of cloud services provided to end users. Notwithstanding this definition, MCMC
acknowledges the possibility of service providers providing software and solutions through cloud services platform and infrastructure of other service providers.
On the basis that the provision of software and solutions is not a licensable activity under the CMA, MCMC has clarified that “pure software providers” will not be subject to the licensing
requirements applicable to cloud service providers.
Resellers Excluded
Further, resellers of cloud services are not required to be licensed if such resellers merely resell the cloud services offered by other service providers and has no control over the
cloud service products. It will be the service provider actually offering the cloud services that will be required to be licensed.
Local Presence
Based on MCMC’s latest guidance, the following entities would be required to be licensed as cloud service providers:
(a) locally incorporated companies providing cloud services to end users; and
(b) locally incorporated companies operating local data centres through which services of foreign cloud service providers are provided.
Grace Period
Although the licensing requirements have come into force from 1 January 2022, MCMC has granted a grace period until 31 March 2022 for stakeholders to manage their affairs, only
after which the new licensing requirements will be enforced from 1 April 2022.
Further, existing ASP Class Licence holders that are providing other forms of applications service other than cloud services will be allowed to provide cloud services under their existing
ASP Class Licence but will be required to include the provision of cloud services within the scope of their ASP Class Licence upon re-registration of their licence upon expiry in the
following year.
As it is an offence under the CMA to provide licensable services without a licence, cloud service providers should review their services to determine if an ASP Class Licence is necessary.
Contact Us For Further Information Regarding Technology, Media & Telco Matters.
