Malaysia's E-Commerce Bill 2027: What Platforms Must Prep

Malaysia's E-Commerce Bill 2027: what platforms must prep

On 18 October, Deputy Minister of Domestic Trade and Cost of Living Datuk Dr Fuziah Salleh confirmed what the industry had been guessing since Budget 2027: the E-Commerce Bill will be tabled in Parliament at the first meeting of 2027, expected in March. The initial draft is finished, she said, and is being refined with the Attorney-General's Chambers before it is finalised.

That gives the industry roughly one sitting of Parliament's worth of runway. Prime Minister Datuk Seri Anwar Ibrahim announced the bill in his Budget 2027 speech on 9 October, and Minister Datuk Armizan Mohd Ali fleshed out the licensing angle on 14 October. If you run a marketplace or build commerce features into a product, this bill is closer to a spec change than a news item.

The law you are actually shipping under today

Malaysia has never lacked e-commerce rules — it has lacked an e-commerce law. The Electronic Commerce Act 2006 is, in Armizan's own framing, an enabler act: it recognises the validity of electronic transactions, nothing more. Everything operational — seller conduct, consumer redress, platform duties — has been borrowed from the Consumer Protection Act 1999 through regulations.

The most important of those regulations today is the Consumer Protection (Electronic Trade Transactions) Regulations 2024 (CPETTR 2024), which came into force on 25 December 2024 and revoked the 2012 version. CPETTR is the closest thing to a working spec that platform builders have right now:

• Every marketplace supplier must disclose ten items: name or company, website, email and phone, business address, description of the goods, full price including shipping and taxes, payment methods, sale terms, delivery estimates, and safety or health certification where a competent authority sets one (the Schedule to reg 3).
• Every marketplace operator must ensure that disclosure happens before any transaction, provide a complaints channel, and ensure ads on the platform do not breach the regulations (reg 7).
• Operators must keep supplier records — name, address, phone, IC or passport number, business account, email, trade or company registration, transaction records — for three years (reg 8).

There is a catch: enforcement never fully landed. Shopee's seller education hub told sellers in June 2025 that KPDN had postponed CPETTR enforcement "until further notice"; the Bahasa Malaysia disclosure requirement remains suspended though the rule was never revoked. Fuziah was blunt in August 2025: the regulations are "only an interim solution" and "not comprehensive enough".

The interim solution has not been quiet. KPDN logged 14,411 e-commerce complaints in 2023 — the highest category that year — 10,486 in 2024, and 4,809 in the first seven months of 2025, per figures the deputy minister cited in Kuching. Recurring themes: goods never arriving, listings that lie, counterfeits, fake seller identities, and chasing a refund from an overseas seller.

What the bill actually proposes

The headline decision sits at Cabinet level: repeal the Electronic Commerce Act 2006 entirely and replace it with a single, comprehensive act. Armizan confirmed in September the policy memorandum had been to Cabinet, with two committees working through jurisdiction questions alongside the Attorney-General's Chambers, the Communications Ministry and the Digital Ministry.

The drafting rests on four stated pillars, per Armizan's 14 October statement: consumer protection; the responsibilities of marketplace operators, online vendors and consumers; efficient dispute resolution; and alignment with international model laws. Behind them sits KPDN's regulatory review, completed 15 October 2025, which laid out three thrusts and twelve focus areas: intermediary responsibility, truthful product information, product safety (children named explicitly), online dispute resolution, fair online contracts, responsible AI use, and cross-border enforcement, among others. The final report benchmarked the EU's Digital Services Act, the UK's Digital Markets, Competition and Consumers Act, and the Philippines' Internet Transactions Act 2023 — a decent map of the finished text's possible shape.

Three proposals deserve special attention from anyone building in this space:

A licensing regime for platform operators — including overseas ones. The 14 October steering-committee statement confirmed a licence may be required of platform operators, explicitly including platforms operated from abroad that serve Malaysian consumers. Today, KPDN has no clear enforcement handle on platforms without a physical presence here; the bill is designed to change that. The political context is not subtle: Anwar's Budget 2027 remarks, as reported by The Edge, pointed directly at cross-border platforms such as China's Pinduoduo, whose ultra-low pricing local retailers say they cannot match under different tax and compliance burdens.

Powers over fees, algorithms and cross-border flows. In October 2025 parliamentary replies, Fuziah said the bill would let KPDN require platforms to notify it before raising commission rates and to monitor cross-border transactions, working with MCMC on algorithm issues. She also floated reclassifying marketing affiliates as a category of their own rather than folding them into "sellers", after both sides complained about the current arrangement.

A dispute-resolution architecture, not just a complaints inbox. The review's recommendations include strengthening the Consumer Claims Tribunal for e-commerce cases and building a national online dispute resolution framework with a "no wrong door" policy across KPDN, MCMC and other agencies. When that lands as statute, "we logged the complaint" stops being an adequate answer.

Why this is a developer problem

It is tempting to file this under legal and move on. Resist that. Almost every reform above translates into data models, onboarding flows and operational APIs your team will have to build:

• Seller onboarding becomes identity infrastructure. The review pushes digital identity verification so regulators can trace online sellers. Reg 8's record set is the floor; expect the bill to raise it, especially for cross-border sellers, where "false seller identity" is already a top complaint.
• Disclosure becomes a required schema. CPETTR's Schedule already reads like a validation contract on every listing — postponed enforcement is a deadline-shaped silence, not a cancellation.
• Complaint handling becomes product surface. An ODR framework implies structured case state, evidence retention and probably machine-readable endpoints — the opposite of a mailto: link in the footer.
• Serving Malaysian consumers from abroad may require a licence. If your platform is foreign-operated but transacts here, the scope question stops being theoretical — the current framework's inability to reach those operators is precisely the gap the bill names.
• Your seller records are personal data under the PDPA as well. IC numbers and passports retained for three years is a data-minimisation conversation to have before a regulator asks.

Local platforms have already lived one round: Mudah.my and Carousell rolled out mandatory advertiser-identification fields ahead of CPETTR's timeline. The bill raises that pattern to statutory level, with licensing attached.

Start with the data model you already need

You don't need the bill's text to start closing the gap — the obligations below are already in CPETTR 2024. Here is a deliberately boring validator for your onboarding pipeline:

// seller-compliance.mjs — mirror the duties that already exist under the
// Consumer Protection (Electronic Trade Transactions) Regulations 2024
// while the E-Commerce Bill is still being drafted.

// Reg 8: marketplace operators keep these supplier records for 3 years.
const SUPPLIER_RECORD_FIELDS = [
  "fullName",        // name or company name
  "address",         // place of business
  "phone",
  "idNumber",        // IC or passport number
  "email",
  "businessAccount", // platform account identifier
  "ssmNumber",       // trade / company registration, if any
];

// Schedule (reg 3): what every listing must disclose to the buyer.
const LISTING_DISCLOSURE_FIELDS = [
  "sellerName",
  "contactEmail",
  "contactPhone",
  "businessAddress",
  "itemDescription",   // main characteristics of the goods
  "fullPrice",         // including shipping, tax and other costs
  "paymentMethods",
  "saleTerms",         // terms and conditions of sale
  "deliveryEstimate",
  "safetyCertificate", // null ONLY when no competent-authority standard applies
];

function missing(fields, obj) {
  return fields.filter((f) => {
    const v = obj[f];
    return v === undefined || v === null || String(v).trim() === "";
  });
}

export function auditSeller(supplier, listing) {
  const problems = [];
  const missSupplier = missing(SUPPLIER_RECORD_FIELDS, supplier);
  const missListing = missing(LISTING_DISCLOSURE_FIELDS, listing);
  if (missSupplier.length)
    problems.push(`supplier record incomplete: ${missSupplier.join(", ")}`);
  if (missListing.length)
    problems.push(`listing disclosure incomplete: ${missListing.join(", ")}`);
  if (listing.safetyCertificate === undefined)
    problems.push("safetyCertificate must be explicit (null only if no standard applies)");
  return { ok: problems.length === 0, problems };
}

const result = auditSeller(supplierRecord, listingDraft);
if (!result.ok) {
  console.error(result.problems);
  process.exit(1); // block the listing — reg 7(1)(a) gates the transaction
}

The safetyCertificate === undefined check is the subtle one. CPETTR only requires certification "if" a competent authority has set a standard — but the field must exist and be answered, because "we never asked" and "no standard applies" are different claims, and only one is auditable.

What March 2027 actually buys you

Tabled is not passed. The first reading in March 2027 starts a process — committee stage, debate, royal assent, then a commencement date. A realistic planning assumption: obligations bite from 2028, while CPETTR 2024 remains the live enforcement hook meanwhile (the regulations were never revoked, and the Consumer Protection Act's machinery still applies). The regulatory impact assessment with the Malaysia Productivity Corporation is still feeding the final text, so details — including any size-based thresholds for smaller platforms, a concept the review's risk-based tiering keeps alive — can still move.

Which makes now exactly the right moment for the unglamorous work:

1. Classify yourself honestly. Under CPETTR today, are you an operator, a supplier, or both? The bill will ask the same question with a licence form attached.
2. Backfill your seller records. If reg 8's fields are not already complete and retained for every active seller, fix the pipeline before the text lands.
3. Ship the disclosure schema. Ten fields per listing, explicit nulls where a standard genuinely does not apply, enforcement at publish time rather than at complaint time.
4. Stand up a real complaints channel. Structured, logged, with response tracking — treat it as the prototype of the ODR integration everyone may eventually need.
5. Watch the bill, not the coverage. The text will be published with the bill papers; the pillars and focus areas are a map, but the obligations live in the clauses. Set a reminder for March.

Malaysia's e-commerce sector has spent two decades growing on regulatory light-touch. The ministry's own figures, cited in the Dewan Rakyat, put the sector at RM1.184 trillion in 2023. A market that size was always going to get a regulator. Builders who treat March 2027 as a compliance deadline will be stressed; those who treat it as a data-model deadline will be early.