Ad Claim Substantiation Rules (Malaysia)

The short version

Malaysian advertising rules do not ask you to clear a claim in advance. They ask you to be able to prove it on demand, and they give you almost no time to find the proof once someone asks.

The operative sentence sits in Part 3, paragraph 4.8 of the Malaysian Communications and Multimedia Content Code 2022, under the heading "Truthful Presentation": "All descriptions, claims and comparisons which relate to matters of objectively ascertainable fact should be capable of substantiation, and Advertisers are required to hold such substantiation ready for scrutiny without delay if and when requested." Two duties, not one. Capable of substantiation is about whether proof exists. Hold ready for scrutiny without delay is about whether you can put your hand on it this week.

The Code is a registered voluntary industry code, not a statute. Voluntary does far less work in that sentence than most marketers assume, and the complaints machinery has a hard edge. Part 8 paragraph 6.1 provides that for any complaint on matters relating to comparative, superlative or misleading claims, upon the request of the Content Forum's Complaints Bureau, the party complained against shall submit documentary evidence to prove the claims within five working days. Paragraph 6.3 lets the Bureau rule that there has been a breach if you miss it, so a request you cannot answer in time can be lost on procedure before the merits are reached.

Running underneath all of that is a statute that is not voluntary at all. Section 18(1) of the Trade Descriptions Act 2011 provides that "No person shall make any false or misleading statement in any advertisement in relation to any goods or services", and section 18(2) puts the onus of proving that the statement is true or not misleading on the person charged. That is a reversed burden in a criminal matter. Your evidence file is not paperwork. It is your defence.

Where the substantiation duty actually sits

The advertising rules that apply to Malaysian social ads live in Part 3 of the Content Code 2022. MCMC's Register Of Current Voluntary Industry Codes lists it as the Content Code (Third Edition), registered on 30 May 2022, and it was still the code in force as at 28 July 2026. The edition label is the register's, not the document's: the phrase "Third Edition" appears nowhere in the body of the code the Content Forum publishes, so cite the register when you cite the edition.

Part 3 reaches online advertising on its own terms. Paragraph 1.1 says the Part "applies to Advertisements communicated over a networked medium and displayed on devices that can process Content electronically and includes television, radio, and Digital Media", and the Code defines Digital Media as content transmitted over the internet or computer networks, including text, audio, video and graphics. Paragraph 1.1 does not name Meta or paid social, so the step to your ad account is a reading rather than a quotation: a Facebook or Instagram ad is content communicated over a networked medium and displayed on a device that processes content electronically, which is what puts it inside Part 3 on the paragraph's own terms. The same paragraph draws a boundary in the other direction: "The Code shall not apply for Advertisements content that do not utilise the networked medium."

Responsibility is placed on the brand, not parked with the platform. Paragraph 1.3 states that responsibility for observing Part 3 primarily falls on the Advertisers and Online Marketplace Operators, with influencers, agencies, online publishers, broadcasters and other advertising service suppliers, including production houses, music composers and designers, also obliged to abide by it. The definition of "Advertiser" in Part 1 paragraph 5.1 is correspondingly wide: any person who utilises the Network and Digital Media to display advertisements or marketing communications, including advertising agencies, brand owners, manufacturers, content providers, sales promoters, broadcasters and direct marketers, where those communications are transmitted or disseminated for the purposes of promoting their brand or products, or influencing consumer behaviour.

One point of hygiene, because it is the single most repeated error in Malaysian ad-compliance writing. Substantiation, superlatives and comparisons all sit inside paragraph 4.8. Paragraph 4.9 is headed "Testimonials and Endorsements" and governs something else. Anyone citing "4.9" for a superlatives rule is citing the wrong provision, which matters the day you are quoting a paragraph number back at a complainant. This page covers the general substantiation duty; the superlative and comparison limbs of the same paragraph have their own treatment in the superlative claims guide, and the price and discount rules sit one paragraph further on, in 4.10, covered in the discount claims guide.

What "capable of substantiation" means in practice

The duty attaches to claims "which relate to matters of objectively ascertainable fact". That phrase does most of the work, so it is worth being precise about which side of the line a given line of copy falls on.

A claim is objectively ascertainable when someone outside your company could, in principle, check it. Numbers, durations, quantities, comparisons of measurable properties, certifications, ingredient content, geographic origin, professional qualifications, awards, customer counts. If a person could sensibly ask "how do you know that?" and expect a document rather than a shrug, the duty is live.

Genuine subjective preference sits outside it. "Our favourite blend" is a taste. "The nation's favourite blend" is a factual assertion about other people's preferences, and now you need the survey.

Here is the same distinction applied to copy of the kind that actually ships.

The last row hides the trap that catches most small advertisers. A number that was accurate when the creative was designed goes stale while the ad keeps running. The duty to hold substantiation ready runs for as long as the claim is being published, so a figure you can no longer prove is a figure you should no longer run.

The evidence file, built before launch

The Code's phrase is "ready for scrutiny without delay". Reverse-engineer your process from that phrase rather than from the moment a complaint arrives, and the work becomes routine.

For every campaign, assemble one file before the first impression is served. It should contain the exact creative as published (image, video and the full text, not a summary), the dates the claim ran, the source document supporting each factual assertion, the date of that source, who produced it, and the name of the person inside your company who signed off. Keep the third-party permissions in the same place: signed testimonial releases, licence terms for any research you are quoting, and written confirmation from a supplier where the underlying proof belongs to them rather than to you.

The supplier case deserves its own habit. If your claim rests on a manufacturer's test report, get a copy of the report now, in a form you can forward, rather than a promise that it can be provided if needed. Five working days is not enough time to open a conversation with a factory in another timezone, and the Bureau's discretion to extend a deadline is a discretion, not an entitlement.

Version the file the way you version creative. When you change a claim, you have made a new claim, and the old evidence may not cover it. "Up to 30% off" and "30% off" are different assertions. "Clinically tested" and "clinically proven" are different assertions. A file that tracks copy revisions is worth more under pressure than a file that tracks campaigns.

Finally, keep your own archive of what you actually published. Creatives get paused, edited and deleted, and a complaint can be brought up to two months after the occurrence, by which time the ad may not exist anywhere you control. The Meta Ad Library is a free way to see what a page is running, and the guide to using it covers how to search it, but do not treat it as your record. Your own copy is the one that matters, because it carries the dates, the versions you have since replaced and the sign-off trail.

The five working days, and the clock around them

The complaints procedure has a shape, and knowing it changes how you respond on day one.

Read the middle rows for what they are. Paragraphs 6.1 to 6.3 sit under a heading that names its own scope, "Procedure for Complaints on Matters relating to Comparative, Superlative and Misleading Claims", so the five-day evidence demand is the track a claim dispute runs on rather than a rule for every complaint the Bureau receives. In practice that covers most substantiation arguments, because a claim you cannot prove is usually put to you as a misleading one.

Three practical readings follow.

The clock starts on the request, not the complaint. You may hear nothing for weeks and then have a week. That asymmetry is exactly why the file has to be built in advance.

Paragraph 3.3 also filters what gets through. The Bureau deals with complaints "provided the complaint is made within two (2) months after its occurring, and if deemed valid, with reasonable basis and not frivolous". Note where the two months run from: the occurrence, not the takedown. Pulling the ad down does not put it outside the window.

And the ruling window is short too. Paragraph 6.2 requires the Bureau to make a ruling within ten working days of receiving the documentary evidence, so what you send is what the ruling is made on. Send the primary document rather than a description of it, and label each exhibit against the specific line of copy it supports, so that nothing in the submission depends on a follow-up conversation you may not get.

Voluntary code, real teeth

Malaysian marketers hear "voluntary industry code" and file it under optional. That reading is wrong in four directions, and the fourth one changed in 2025.

Start with the accurate framing. Part 1 paragraph 6.2 of the Code states that "Compliance with this Code is voluntary, subject to Section 99 of the Act and the provision of this Code", and section 98(1) of the Communications and Multimedia Act 1998 provides that "Subject to section 99, compliance with a registered voluntary industry code shall not be mandatory." So the Code is not a statute and registration does not make it one.

Then read what compliance buys you. Section 98(2) provides that "Compliance with a registered voluntary industry code shall be a defence against any prosecution, action or proceeding of any nature, whether in a court or otherwise, taken against a person (who is subject to the voluntary industry code) regarding a matter dealt with in that code." That is an affirmative payoff, and it is the strongest commercial argument for running your claims through paragraph 4.8 even though nobody is forcing you to.

Third, voluntary can be converted. Section 99(1) provides that "The Commission may direct a person or a class of persons, in accordance with section 51, to comply with a registered voluntary industry code." The cross-reference to section 51 matters: a direction has to follow that procedure, so this is a formal instrument rather than an informal word.

Fourth, the sanction for ignoring such a direction was raised in 2025. Section 33 of the Communications and Multimedia (Amendment) Act 2025 inserted a new section 99(2): "Notwithstanding section 53, the Commission may impose a financial penalty not exceeding five hundred thousand ringgit on any person who fails to comply with a direction of the Commission under subsection (1)." Be precise about what changed. This raised and relocated an existing sanction rather than inventing one, because section 34 of the same Act deleted section 100 of the CMA, which had provided a civil penalty not exceeding two hundred thousand ringgit for the same failure. The amending Act came into operation on 11 February 2025, except sections 92 and 112, under a gazette notification, P.U. (B) 61/2025.

One trap for anyone who reads the Code cover to cover and stops there. The Code's Appendix I reprints extracts from the CMA, and it is not a reliable copy of the statute. It reproduces section 99 in its pre-2025 single-paragraph form, omits section 100 entirely, and misprints section 95(1)(b). Read the Act itself for statutory text and treat the appendix as context.

Separately, the Content Forum's own Complaints Bureau has its own remedies under Part 8 paragraph 9.1, available singly or together: a written reprimand, a fine not exceeding RM50,000, and removal of the content or cessation of the offending act. Under paragraph 9.2 it may also refer the offending party to MCMC for further appropriate action. That RM50,000 is the Bureau's stated maximum. No published decision setting a going rate was located, so plan against the ceiling rather than against a rumour.

The statute that is not voluntary

Everything above sits inside a self-regulatory system. The Trade Descriptions Act 2011 does not.

Section 18(1) is short and broad: "No person shall make any false or misleading statement in any advertisement in relation to any goods or services." Note that it reaches services as well as goods, which is not true of every provision in the Act.

Section 18(2) reverses the burden: "Where any person is charged with an offence under this section, the onus of proving that the statement made by him is true or not misleading shall be upon the person charged." This is the provision that turns your evidence file from good practice into the thing standing between you and a conviction. You do not get to make the prosecution disprove your claim.

Section 19 decides who is in the frame. It deems the following persons, unless the contrary is proved, to have given a false or misleading statement in an advertisement: the person who directly or indirectly offers to supply the goods or services, and the person on whose behalf the advertisement is made. The brand cannot point at the agency and step back.

The penalties in section 21, for contravening Part III of the Act (which contains section 18), are the reason this matters more than the Code's fine. A body corporate faces a fine of up to RM500,000, rising to RM1,000,000 for a second or subsequent offence. A person who is not a body corporate faces a fine of up to RM250,000 or imprisonment of up to three years or both, rising to RM500,000 or five years for a second or subsequent offence. That second band is the one an unincorporated Malaysian business sits in, and it is the only one of the two that carries a prison term.

Neither regime is the whole picture for every advertiser. Health and medicinal claims sit under their own Malaysian approval regime, which the KKLIU approval guide covers separately. And Meta's ad review is a different thing again: it is platform policy, not Malaysian law. Approval is not a finding that your claim is substantiated, and a rejection is not a legal finding either. The ad policy guide covers what those decisions do and do not settle.

Claims that rest on research

If your copy says the claim is backed by research, the Code has a specific requirement about how you say it.

Paragraph 4.8, under the "Claims" heading, sub-paragraph (e), provides: "Where Advertisement claims are expressly stated to be based on, or supported by, independent research or assessment, the source and the date of this should be indicated. Where this is not possible, for whatever reason, such claims to independent support should not be made. Where a claim relating to research or testing is based on the Advertiser's own work or work done at his request, it should be clear from the text of the Advertisement that such is the basis of the claim."

Three obligations are packed into that.

The source and the date go on the ad. Not in a landing page footnote you might add later, and not in a folder on your drive. If a creative asserts independent support, the creative should say who provided it and when.

If you cannot name the source, do not make the claim. The provision says so directly. "Studies show" with no study is exactly the formulation this sub-paragraph is written against.

Own research must be disclosed as own research. In-house testing is perfectly usable, and plenty of strong ads run on it. What you may not do is let a reader believe an independent party stood behind a result that your own lab produced.

A drafting note that matters if you are advising a client. The Code's wording here is "should", not "shall", and that softness has been noticed: the Content Forum's own November 2025 consultation report records respondents complaining that "should" in the Code reads as optional. Do not overstate it as a hard requirement. Do, however, notice that a research claim which fails this test is usually also the sort of claim a complainant calls misleading, and the misleading route runs straight into paragraph 4.8's opening substantiation duty and into section 18 of the Trade Descriptions Act. The soft word does not make the risk soft.

Ages and dates deserve a specific mention. A study from several years ago can still support a claim, but sub-paragraph (e) asks for the date as well as the source, and a reader can only weigh how current the research is if the year is on the creative. Quietly dropping the year from a citation is the kind of edit that turns an accurate claim into a misleading presentation.

Testimonials are claims too

Paragraph 4.9 of the Content Code is headed "Testimonials and Endorsements" and runs from (a) to (i). It covers genuine testimonials, obsolete endorsements, professional qualifications, efficacy and before-and-after claims, fictitious characters, non-resident testimonials and record-keeping. It is not the superlatives provision, whatever a dozen blog posts say.

For substantiation purposes, the useful way to think about a testimonial is that it is a claim wearing a customer's face. If the speaker asserts a fact about your product, your ad is asserting that fact. Paragraph 4.8's duty does not switch off because the words came from someone else's mouth.

So the file for a testimonial ad holds more than the signed release. It holds the release, the unedited original recording or written statement, the date it was given, evidence that the person is a real customer, and separate evidence for any factual claim inside the testimonial. If a customer says a product resolved a condition, that resolution claim needs support of its own, exactly as it would if your copywriter had written the line. Where the testimonial is carried by a before-and-after visual, the before-and-after ad rules guide covers what that creative form has to satisfy in Malaysia.

Two habits keep testimonial creative clean over time. Retire endorsements when the underlying circumstance changes, because an endorsement that was true two product formulations ago is no longer describing what you sell. And record your permissions with an expiry, so a two-year-old release does not silently authorise a campaign the customer never agreed to.

The 2025 review proposes to add a verification duty here. The Content Code 2025 Draft attached to the September 2025 consultation paper inserts a new paragraph 4.9(b): "Where a testimonial or endorsement includes references to professional expertise or qualifications, reasonable steps shall be taken to verify that such claims are accurate and supported by appropriate recognition from the relevant professional or regulatory bodies." Note the "shall". If that language is adopted as drafted, an ad featuring someone described as a doctor, a nutritionist, an engineer or a licensed trainer would carry an express duty to check the credential against the body that grants it. Whether or not it lands, checking is already the sensible reading of the existing duty, and it costs one email.

One structural warning about that draft: inserting a new (b) pushes the existing sub-paragraphs down. Today's 4.9(b) on obsolete endorsements would become 4.9(c) if the draft is adopted as written. If you cite sub-paragraph numbers in internal policy documents, cite the edition too.

The awkward cases practitioners actually hit

The clean cases are easy. These are the ones that generate arguments.

The claim is in the image, not the caption. Paragraph 4.8 attaches its duty to descriptions, claims and comparisons, not to the field of the ad they were typed into. The safe working assumption is that on-screen text, a graphic badge and a spoken line in a video are all claims you must substantiate. Design review should read the artwork, not just the copy doc.

The claim is true for one SKU and the ad is generic. A statistic that holds for your premium variant does not automatically hold for the range shown in a carousel. Either narrow the creative to the product the evidence covers or narrow the claim to what is true across everything pictured.

An influencer improvised. You briefed a safe script and the creator added "the best in Malaysia" or "clinically proven" on their own. Paragraph 1.3 obliges influencers to abide by Part 3, but responsibility primarily falls on the advertiser, and section 19 of the Trade Descriptions Act deems the person on whose behalf the advertisement is made to have given the statement unless the contrary is proved. Approval rights and a written claim list in the creator contract are cheaper than the argument afterwards.

The evidence belongs to somebody else. Distributors carrying an imported brand routinely rely on the principal's testing. Get the documents into your own hands, in English or with a translation, before the campaign runs.

The ad has already been taken down. A complaint can be brought within two months of the occurrence, so removal does not close the matter. Keep the archived creative and the evidence for at least that long, and in practice longer: the two-month window is a rule about when the Complaints Bureau will take a complaint, and it has nothing to do with a prosecution under the Trade Descriptions Act.

A claim about a service, not a product. Section 18 of the Trade Descriptions Act reaches statements about goods or services, so service businesses are inside the false-advertising provision. Do not assume a rule you read about product labelling exhausts your exposure.

What the 2025 review would change

The Content Forum published a Public Consultation Paper on the Content Code Review 2025 on 17 September 2025, closed it on 7 November 2025, and received 1,891 submissions in total, comprising 7 written submissions and 1,884 responses through the official online survey. The Public Consultation Report followed in November 2025.

For substantiation specifically, the news is continuity. In the Content Code 2025 Draft attached to that consultation paper, paragraph 4.8 is still "Truthful Presentation", 4.9 is still "Testimonials and Endorsements" and 4.10 is still "Prices", and the opening substantiation requirement in 4.8 is carried over with a single added comma. Evidence practice you build against the 2022 text does not become obsolete.

Two proposals are worth watching. The first is the new 4.9(b) verification duty for professional credentials described above. The second is territorial: the consultation paper states that "the revised text makes clear that this scope covers advertisements that originate from, or are intended for, Malaysian audiences, regardless of whether the advertiser is located within or outside Malaysia." The consultation report, drawn from those 1,891 submissions, records at Question 9 that "Many respondents (97.5%) supported applying advertising rules to television, radio, and digital media when the content targets the Malaysian market, including advertisements originating from abroad." Read that figure as attaching to the question as the survey framed it rather than to the territorial extension in isolation. How the extension would be enforced against a foreign advertiser buying Meta placements is not addressed in either document, so treat the direction of travel as clear and the mechanism as unstated.

Status matters more than proposals. The November 2025 report states that after working group agreement and a final legal and technical review, "the finalised Content Code will be submitted to the Malaysian Communications and Multimedia Commission (MCMC) for registration". As at 28 July 2026, no revised code had been registered: MCMC's Register Of Current Voluntary Industry Codes still showed the Content Code (Third Edition) of 30 May 2022 as the latest content code, while carrying other sub-codes registered as recently as May 2026, and the Content Forum's own download page still offered only the 2022 English and Malay editions. Check the register yourself before relying on a paragraph number in anything formal, because a registration event would move several things at once.

A pre-launch substantiation checklist

Run this before the campaign goes live, not after the request arrives.

1. List every factual assertion in the creative, including on-screen text, voiceover, badges and anything a testimonial says. Ignore genuine expressions of taste.
2. For each assertion, name the document that proves it, who produced it, and when. If no document exists, the claim changes or the claim goes.
3. Check that research claims name their source and date on the creative, and that in-house work is described as your own.
4. Verify any professional credential appearing in the ad against the body that grants it, and keep the confirmation.
5. Collect signed releases for every testimonial, with the unedited original and the date.
6. Archive the published creative and its dates in a place that survives the ad being paused or deleted.
7. Name an owner who can produce the whole file within five working days without asking anyone else for permission.
8. Diarise a review for any claim containing a number that changes over time, so a stale figure never outlives its proof.

None of this stops you writing confident copy. It stops you writing copy you cannot stand behind, which is a much smaller category than most advertisers assume, and the difference between the two is a folder you either built in advance or did not.