Act 588 · CMA 1998

Section 263
Obligations of Network & Services Providers

Section 263 of the Communications and Multimedia Act 1998 requires network facilities providers and network services providers to assist authorities in the prevention, detection and investigation of offences — making it central to Malaysia's lawful interception and cybercrime enforcement framework.

Statutory Provision

Text of Section 263

(1) A licensee shall, upon request by the Commission or any other authority, use its best endeavours to do or refrain from doing anything to prevent the commission of an offence under any written law in Malaysia.

(2) Without prejudice to the generality of subsection (1), a licensee shall, upon request by the Commission or other authority, use its best endeavours to —

(a) prevent the carriage of any communication which is, or is likely to be, in contravention of any written law;

(b) give assistance in connection with the prevention of, or the investigation into, the commission of an offence under any written law; and

(c) provide any information requested by the Commission or other authority in connection with the functions or powers of the Commission or such other authority.

(3) Any person who contravenes subsection (1) or (2) commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.

Communications and Multimedia Act 1998 (Act 588), Section 263 · Parliament of Malaysia
Scope

Who Is Bound by Section 263?

Section 263 applies to licensees under the CMA — that is, any entity holding a licence to provide network facilities, network services, applications services or content applications services in Malaysia. In practice this covers:

Licence Type Examples Key Obligation
Network Facilities Provider Telekoms, tower companies, fibre operators Assist in lawful interception; provide access to physical infrastructure for investigations
Network Services Provider Internet Service Providers (ISPs), mobile operators Block designated content; retain traffic data; assist in subscriber identification
Applications Service Provider VoIP platforms, messaging services, cloud providers Provide communication records; assist in preventing transmission of unlawful content
Content Applications Service Provider Online news portals, streaming platforms, social media operating locally Remove or restrict access to content upon request; provide user data to authorities
Three Core Obligations

What Section 263 Requires

1. Content Blocking

Licensees must use best endeavours to prevent the carriage of communications that contravene Malaysian law. This is the primary legal basis for MCMC's authority to issue content blocking orders to ISPs — requiring them to block access to websites hosting illegal, offensive or seditious content.

2. Investigation Assistance

Licensees must assist authorities — including the MCMC, Royal Malaysia Police, MACC and others — in investigating offences. This includes providing subscriber information, IP address logs, traffic data and communication records upon lawful request.

3. Information Provision

Licensees must provide any information requested by the Commission (MCMC) or other authorities in connection with the performance of their regulatory or enforcement functions — a broad obligation that supports regulatory oversight of the communications sector.

The "Best Endeavours" Standard

Section 263 does not impose an absolute obligation — it requires licensees to use best endeavours, a standard that courts interpret as requiring all reasonable steps short of actions that would be unreasonable or commercially ruinous. This means ISPs and telcos must actively attempt to comply with requests, but may have grounds to challenge technically impossible or disproportionate demands.

Penalties

Punishment on Conviction

Maximum Penalty — Section 263(3)

RM 300,000 fine

and/or imprisonment up to 3 years

The significantly higher penalty compared to Sections 211 and 233 (both capped at RM 50,000 / 1 year) reflects the severity of a licensed provider — with institutional resources and technical capability — refusing to cooperate with lawful enforcement.

Practical Context

How Section 263 Is Used