Can Malaysia Govern a Digital Market It Has Never Licensed?

Malaysia's draft law on a digital market it never licensed tests a development question: who supervises it, who taxes it, and what the state still controls.

Governments across emerging economies are finding that some of the fastest-growing corners of their digital economies are ones they never licensed. The services reach citizens through phones and domestic payment apps, while the operators, their regulators and their tax obligations sit somewhere else. Malaysia is about to test what a national law can do about that. In February, Deputy Prime Minister Fadillah Yusof said the government was drafting a law to address illegal gambling, including online gambling, and hoped to table it at the next sitting of Parliament. Whether it would be a standalone act or amendments to existing statutes and cybercrime legislation was still being studied.

The choice of instrument matters well beyond one sector. Malaysia has never licensed an online operator in this market, so the state has no supervisory relationship with the platforms its residents use, collects no tax from them and has no consumer-protection rules it can enforce against them. What it has instead is an enforcement system built around removal. Service providers took down 457,562 pieces of online gambling content between 1 January 2025 and 31 May 2026, and internet providers blocked 1,778 websites at the request of the Malaysian Communications and Multimedia Commission, according to a written parliamentary reply published in July.

Removal has not reduced demand

The UN Office on Drugs and Crime's regional threat assessment, published on 21 July, helps explain why those numbers keep rising without changing the market. An Interconnected Criminal Ecosystem, its Transnational Organized Crime Threat Assessment for Southeast Asia 2026, finds that across East and South-East Asia prohibition "displaces gambling demand offshore rather than suppressing it". It also finds that acting against individual brands achieves little when hundreds of them share the same underlying platform and cloud hosting lets servers move between jurisdictions within hours. A white-label provider, the report notes, can launch a fully functioning online casino within days, for setup fees as low as zero to USD 5,000, so a blocked brand is cheap to replace.

The ministry's own figures show the same pattern at home. On 10 September, Communications Minister Fahmi Fadzil said that of more than one million takedown requests sent to online platforms between 1 January 2025 and 31 August 2026, covering scam and illegal gambling content, 935,416 items had been removed and 65,280 had not. Removal, in other words, is running at high volume and high compliance, and the content keeps coming.

The UNODC traces part of the reason to how the market recruits. In Malaysia, it finds, the affiliate model "mirrors multi-level marketing": so-called master affiliates working in the entertainment, tourism and restaurant trades recruit waiters and bartenders into tiered networks, with affiliates receiving 30 to 40 per cent of player losses. A distribution network of that kind sits largely offline and is untouched by website blocking.

Malaysia's own licensed perimeter is narrow and physical. It consists of a single casino licence at Resorts World Genting, horse-race betting through the turf clubs, and number forecast operators licensed through the Ministry of Finance, with licensing handled by the Finance Ministry's Betting Control Unit rather than a gaming commission. Muslims are prohibited from gambling altogether, and Syariah courts have jurisdiction over them. In October 2023 the Court of Appeal confirmed that online gambling is an offence under the Common Gaming Houses Act, holding that it was enough for the prosecution to show that gambling took place using computers, with no need for gaming machines on the premises.

Supervision has moved abroad while payments have stayed at home

With no domestic online licence, the platforms Malaysians actually use answer to foreign regulators, or to none. The record of who licenses online casinos used in Malaysia names the authorities behind the sites it lists: the Malta Gaming Authority, the UK Gambling Commission and Curaçao's gaming regulator. The same record documents the payment side of that market. The listed sites accept DuitNow, Touch 'n Go, GrabPay and Boost alongside bank transfer, cards and cryptocurrency, with withdrawals taking anywhere from 24 hours to several days depending on the method.

Taken together, those two facts describe the policy problem more precisely than the takedown statistics do. Licensing and supervision sit outside Malaysia, while the money moves through domestic payment systems overseen by Bank Negara Malaysia. Official figures count the sites that were blocked. They do not record which regulator supervises the platforms that remain reachable, or which Malaysian payment channels those platforms rely on, and that is the information anyone assessing the draft bill needs in order to see which levers actually sit within Malaysian jurisdiction.

The UNODC assessment points to the same layer. It describes illegal online gambling payment infrastructure as "deeply embedded within the formal financial systems of multiple South-East Asian economies", with players depositing through local payment channels into accounts controlled by operators' payment agents. On supervision, its observation is about jurisdictions in general: licensing from low-oversight jurisdictions "serves primarily as reputational camouflage rather than a genuine regulatory constraint", which makes the strength of the supervising regime, rather than the existence of a licence, the variable that matters.

The drafters are choosing between instruments

The bill's drafters therefore face a choice of tools rather than a choice about whether to act. A tougher criminal statute strengthens the hand of the police, but on the UNODC's evidence it mostly relocates supply. Payment-side measures act on the one layer that is domestic, although they raise the question of how far banks and e-wallet operators can be asked to screen merchants based abroad. A domestic licensing regime would bring supervision and a tax base onshore, but it sits uneasily with Malaysia's religious and political settlement.

The Philippines is the cautionary case for that last option. Its offshore operators were banned in a measure announced in July 2024 and implemented in October 2025, and the UNODC finds the ban displaced them to Cambodia, Myanmar's border zones, Lao PDR and parts of Indonesia rather than eliminating them.

A national law will only go as far as regional rules allow

The UNODC's central prescription is coordination on financial infrastructure, digital marketing channels and enforcement capacity, and it warns that legal reform without coordinated regional frameworks "accelerates geographic diffusion rather than reducing overall criminal capacity". Devdiscourse's coverage of the assessment set out the wider finding behind that warning: the region's illicit economy now runs on shared services that cross borders more easily than enforcement does.

For Malaysia, the value of the new law will depend less on how it defines offences than on whether it reaches the two places the market operates from: foreign licensing regimes and domestic payment rails. A bill that addresses neither would leave the market supervised abroad and paid for at home.