What Malaysian Online Sellers Must Disclose

The checklist you were sent is describing a revoked instrument

A great deal of the Malaysian e-commerce compliance advice still in circulation is built on the Consumer Protection (Electronic Trade Transactions) Regulations 2012, gazetted as P.U.(A) 458/2012. Agency posts, chamber briefings, seller-group PDFs, the onboarding pack a platform emailed you. They recite a familiar list and they cite the same 2012 instrument.

Regulation 10 of the Consumer Protection (Electronic Trade Transaction) Regulations 2024 reads, in full:

The Consumer Protection (Electronic Trade Transactions) Regulations 2012 P.U. (A) 458/2012 is revoked.

That is the whole regulation. One sentence, and everything built on the 2012 text stopped being a description of Malaysian law on 25 December 2024.

The replacement is P.U.(A) 449, the Consumer Protection (Electronic Trade Transaction) Regulations 2024, in Malay the Peraturan-Peraturan Perlindungan Pengguna (Urus Niaga Perdagangan Elektronik) 2024. It was made on 20 December 2024, carries a gazette header dated 24 December 2024, and came into operation on 25 December 2024 by regulation 1(2). The gazette copy carries the file reference KPDNKK-600-1/1/7; PN(PU2)607/V and the signature of Datuk Armizan bin Mohd Ali, Minister of Domestic Trade and Cost of Living.

One small identification trick is worth knowing, because it will save you from reading the wrong document. The 2012 title uses the plural, Electronic Trade Transactions. The 2024 title uses the singular, Electronic Trade Transaction. If the PDF in front of you says Transactions and P.U.(A) 458, close it.

Nothing here is legal advice. It is a reading of what two published instruments say, written for the person who has to run the shop.

The ten items, as the Schedule prints them

The Schedule to P.U.(A) 449/2024 is headed Disclosure of information and carries the marginal reference Regulation 3. It lists ten items. The left column below is the gazetted wording; the right column is what the item usually means for a working seller.

Item 6 is the one that catches the most sellers, because the wording is not full price of the product. It is the full price including transportation costs, taxes and any other cost. A listing that shows RM89 and reveals RM12 of shipping and a handling fee three screens later is presenting a number that does not match the item's description of itself. How a discount or a struck-through price can be presented is a separate topic with its own rules, and it is worked through in the guide to discount and price claims.

Items 2 and 10 both end in the phrase if any, and item 4 is grammatically broken as gazetted. Neither observation is a loophole. They are simply features of the text you should know are there before someone quotes the Schedule at you with the awkward parts smoothed out.

Two corrections to the summary that circulates

The summaries floating around Malaysian seller communities get two things wrong often enough that they are worth calling out separately, because both change what you actually have to do.

The registration number is not a seller disclosure item. The phrase people remember, name and registration number of trade or company, if any, does appear in P.U.(A) 449/2024. It appears at regulation 8(1)(c). Regulation 8 is a record-keeping duty imposed on the online marketplace operator, requiring it to keep and maintain records about the suppliers trading on its platform, and to keep them for three years. It is not in the Schedule, and regulation 3(1) does not require you to publish it.

This distinction gets flattened constantly, usually because a platform's own onboarding form asks for your SSM number and the seller reasonably assumes the request is the regulation speaking. It is not. Whatever is behind the form, whether the operator's record-keeping duty under regulation 8, its own onboarding policy, or both, it is a duty on the operator and not the disclosure duty regulation 3(1) puts on you. Whether you separately want your registration details visible is a different calculation, and it interacts with platform-level identity checks rather than with this Schedule. The SSM verification requirements for Facebook advertising run on that other track.

The duty does not attach to your own website. This is the more consequential correction. Regulation 3(1) of P.U.(A) 449/2024 says the supplier shall disclose the information specified in the Schedule on the online marketplace. Not on the supplier's website, not on the product page of the seller's own store, not in the advertisement. On the online marketplace. A website appears in the 2024 text only as Schedule item 2, website address of the online marketplace, if any, which is a piece of information to be disclosed rather than a place where disclosure must occur.

That single prepositional phrase is the whole reason the scope question below is hard. If the duty attached to your own site, the answer for a Meta advertiser would be simple and boring. It attaches to something called an online marketplace, and whether your shop is one is exactly what nobody has settled.

The definitions, and the question they do not answer

Regulation 2 of the Consumer Protection (Electronic Trade Transaction) Regulations 2024, the P.U.(A) 449 gazetted on 24 December 2024, defines three terms. Here they are as printed.

"online marketplace" means any electronic trade platform that is conducted through electronic means by any supplier;

"online marketplace supplier" means any person who conducts a trade or advertisement through an online marketplace;

"online marketplace operator" means any person who makes available or operates an online marketplace for the purpose of trading or advertising.

Read those slowly if you run paid social, because two of the three expressly reach advertising. The supplier definition covers a person who conducts a trade or advertisement through an online marketplace. The operator definition covers making a platform available for the purpose of trading or advertising. Whatever else the drafter was doing, they were not confining this instrument to transactions. Anyone telling you the Regulations only bite once money changes hands is not reading regulation 2.

And yet the definitions circle back to a term that is never defined. An online marketplace is an electronic trade platform conducted through electronic means. The Regulations do not say what an electronic trade platform is. There is no interpretation provision expanding it, no illustrative list, no exclusion clause, and no scoping regulation anywhere in the instrument that tells you which businesses fall inside and which fall outside.

So the question a Malaysian Meta advertiser actually asks, does this bind the shop I run on a Facebook Page or an Instagram account, has to be answered from a phrase the drafter left open. The wording is wide enough to be argued in either direction and the primary text does not close it.

KPDN calls the boundary uncertain itself

This is not a gap invented by cautious writing. The ministry says so.

The 2025 e-commerce legislative review published by KPDN, the Ministry of Domestic Trade and Cost of Living, is written in Malay and addresses the convergence of social media and commercial function directly. Its own words are that this fusion mewujudkan ketidakpastian peraturan untuk perniagaan eDagang yang berada dalam domain AKM 1998, iaitu media sosial dan rangkaian sosial. Rendered into English, and the rendering is ours because the document is published in Malay: it creates regulatory uncertainty for e-commerce businesses sitting in the domain of the Communications and Multimedia Act 1998, namely social media and social networks.

Ketidakpastian peraturan. Regulatory uncertainty. That is the regulator's own characterisation of exactly the boundary you are standing on.

The same review then proposes widening definitions to cover aktiviti eDagang yang dijalankan melalui platform media sosial, akaun khusus eDagang dalam aplikasi pemesejan, which is e-commerce activity carried out through social media platforms, and dedicated e-commerce accounts inside messaging applications.

Resist the obvious inference. A proposal to widen a definition is frequently read as proof that the current definition does not reach, and that reading is available here. But the opposite reading is equally available: a ministry that considers the current wording arguably wide enough may still want the point put beyond argument, which is a very ordinary reason to legislate. The review does not say which it is. Treating the reform proposal as a judicial ruling on the current text would be inventing an answer from a document that declines to give one.

For balance and not for reliance, a contrary view exists in secondary commentary. At least one law-firm alert on the 2024 Regulations reads their scope as covering multi-vendor platforms and as not typically extending to single-vendor e-commerce sites or non-transactional platforms. That is a professional opinion, not an instrument, not a court decision and not KPDN guidance, and it is offered here only so you know the argument is live on both sides. No KPDN enforcement guidance or FAQ on social-commerce scope was located.

What an honest position looks like when the law is unsettled

Unsettled does not mean you get to do nothing until someone rules. It means you decide how much of the Schedule to satisfy voluntarily, knowing the cost of each side of being wrong.

Consider what compliance actually costs a small Malaysian seller. Publishing a business name, an email address, a phone number, a trading address, an all-in price, your payment methods, your terms, and a delivery estimate is roughly one pinned post, one Instagram highlight or one link-in-bio page. Most of it you want visible anyway, because a buyer who cannot find a phone number or a delivery estimate frequently does not buy. The genuine friction is item 6 and regulation 4, that is, quoting the delivered price rather than the product price, and producing the disclosure in Malay.

Now consider the exposure on the other side. Regulation 9 makes non-compliance an offence, and the general penalty discussed below is not trivial for a small business. Set the cost of one pinned post against that and the calculation makes itself for most sellers, without anybody needing to resolve the definitional question.

What you should not do is convert that practical conclusion into a legal one. Choosing to publish the ten items because it is cheap and useful is a business decision. It is not evidence that the Regulations bind you, and it is not a concession you have to make in any argument later. Keep those separate in your own head, and be careful with any adviser who collapses them.

The national language requirement

Regulation 4 of P.U.(A) 449/2024 has two limbs and they are short.

Regulation 4(1) provides that the information disclosed shall be in the national language. Regulation 4(2) provides that other languages may be used in addition.

The structure is plain: Malay is the required version, and everything else is additive. English does not substitute. For a large share of Malaysian online sellers this is the most likely point of non-compliance, because plenty of them operate entirely in English, sell to English-speaking customers, and have never produced a Malay version of anything.

What the Regulations do not do is prescribe how. There is no rule on placement, ordering, prominence, translation quality or whether a language toggle satisfies the duty. If you are producing a Malay version, the low-friction approach is to write the ten Schedule items once in Malay, keep the English alongside, and stop trying to derive rules the instrument does not contain.

The rest of the operative regulations

Disclosure is the headline but it is not the whole of P.U.(A) 449/2024. Four other regulations in the same instrument impose duties worth knowing.

Regulation 5 deals with the cost of re-delivery where goods are materially different from what was described, or defective. This is a live issue for anyone selling apparel or electronics into a market where returns are already a friction point, and it is the kind of provision that surfaces in a dispute rather than in an audit.

Regulation 6 deals with error rectification and acknowledgement of an order. Two mundane-sounding duties that carry real design consequences: a buyer needs a route to correct a mistake before committing, and an order needs to be acknowledged. If your entire order flow is a WhatsApp conversation, ask yourself where the acknowledgement lives and whether a customer could point to it.

Regulation 7 sets out operator duties, and regulation 7(1)(c) is the one to note if you sell on a platform run by someone else: the operator must ensure that advertising by a supplier does not contravene the Regulations. That is a policing duty placed on the platform rather than only on you, which means the platform has a stake in what your listings say quite apart from its own house rules. If you sell through the big marketplaces and advertise those listings on Meta, the interaction between platform rules and your own catalogue is covered in the guide for Shopee and Lazada sellers running Meta catalogue ads.

Regulation 8 requires the operator to keep and maintain records about its suppliers for three years, including the registration detail discussed above.

The penalty, and why a single number misleads

Regulation 9 of P.U.(A) 449/2024 reads that any person who fails to comply with any provision of these Regulations commits an offence. It provides no penalty at all. The regulation creates the offence and stops.

The general penalty in section 145 of the Consumer Protection Act 1999 (Act 599) applies where the regulations provide none. Section 145 provides that a person convicted of an offence under the Act for which no penalty is expressly provided is liable to a fine not exceeding fifty thousand ringgit or imprisonment for a term not exceeding three years or both, and on a second or subsequent offence to a fine not exceeding one hundred thousand ringgit or imprisonment for a term not exceeding five years or both. For a body corporate the figures are one hundred thousand ringgit, rising to two hundred thousand ringgit on a second or subsequent offence. Section 145(3) adds, for a continuing offence, a fine not exceeding one thousand ringgit for each day or part of a day during which the offence continues after conviction.

Now the part that most write-ups skip. Section 145 speaks of an offence under this Act. Regulation 9 creates an offence under the Regulations. Section 150(3) of Act 599 shows that Parliament expressly contemplated subsidiary legislation carrying its own penalties, up to one hundred thousand ringgit or three years, and up to two hundred and fifty thousand ringgit or six years on a repeat offence, and P.U.(A) 449/2024 declined to include any. So the path from regulation 9 to section 145 is a step of construction rather than a printed cross-reference in either document.

Which is why the correct sentence is that the general penalty in section 145 of Act 599 applies where the regulations provide none, and the incorrect sentence is that the penalty for failing to disclose is RM50,000. The second version reads cleaner and states more than the instruments print. If you see it in a compliance deck, you now know what has been smoothed over.

Four situations, worked through

Abstract rules get clearer against real shapes of business. Regulation numbers below are all from P.U.(A) 449/2024. None of the readings resolves the scope question, because the scope question is not resolvable from the text.

The Facebook Page shop. No website, no cart, no checkout. Customers comment or message, you quote a delivered price, they transfer, you post. The definitions in regulation 2 reach advertising expressly, so the argument that a Page used commercially is inside is not frivolous. The argument that a Page is not an electronic trade platform is also not frivolous, since no transaction infrastructure exists. Nothing decides it. The practical move is to pin a post carrying the ten items, in Malay with English alongside, and stop worrying about the classification.

The Instagram shop closing in DMs. Same analysis, with one wrinkle worth naming. Order acknowledgement and error rectification under regulation 6 are harder to evidence in a DM thread than in a checkout flow, and a message thread that both parties can delete is a poor record. That is a reason to keep order confirmations somewhere durable, independent of how the definitional question lands.

The seller on a large marketplace. Here the operator side of the instrument is clearly engaged. The platform is subject to regulation 7 and regulation 8, and you are the supplier under regulation 3(1). A listing form that already asks for a product description, a price, a payment method and a delivery window is collecting most of the Schedule for you. The two it is unlikely to force are the all-in price of item 6 and the Malay of regulation 4(1). Open one of your own listings and check those two.

The Shopify or WooCommerce store advertising on Meta. This is the hardest fit and the reason the attachment point matters. Regulation 3(1) attaches to the online marketplace, and a single-vendor store selling only its own goods is the case the secondary commentary above reads as outside the instrument, though that is opinion rather than authority. The information in the Schedule is standard good practice for a store of that kind regardless, and building it into the product page and footer costs little.

Across all four, notice what did not change: the price, the delivery estimate and the terms are things a buyer wants to see whichever way the classification falls. Whether you can stand behind the performance or benefit claims your ads make on top of that is a different question with a different answer, taken up in the guide to substantiating ad claims.

What this guide cannot tell you

A short and deliberate list, because a compliance page that hides its own gaps is worth less than one that names them.

We are not telling you how the 2024 list compares item by item with the 2012 one. The 2012 text could not be retrieved from a source worth trusting, so any account of what narrowed or broadened would be reconstruction rather than reading. If you want that comparison, it has to come from the two gazette copies side by side.

We are not telling you that nothing has moved since. No amendment to P.U.(A) 449/2024 was located when this page was written, but subsidiary legislation changes quietly and the gazette is the only place that settles it.

We are not telling you whether a Facebook Page, an Instagram account or a WhatsApp catalogue is an electronic trade platform. That is the question you came for, and the answer is that the instrument does not say, no KPDN guidance on the point was located, and the ministry's own 2025 review calls the boundary uncertain while proposing to widen the definitions.

Take the unsettled parts to a Malaysian adviser with the actual text in hand, rather than with a summary of it.

A short pass to run this month

Open your shop and read it as a stranger would. Can they find your trading entity's name, an email address, a phone number, and the address the business trades from, without asking? That is items 1, 3 and 4 of the Schedule to P.U.(A) 449/2024.

Then look at how your prices display. Is the number a customer sees first the delivered, all-in figure including transport, tax and any handling charge, or is it the product price with the rest arriving later? Item 6 describes the first one.

Then check for a stated delivery estimate and a set of sale terms that exist somewhere findable, which is items 8 and 9. Then check whether any of it exists in Malay, which is regulation 4(1) and the requirement most English-language Malaysian sellers have never met.

Then, if you sell through a platform run by someone else, keep the two sides of the instrument apart in your head. Regulation 8 puts a record-keeping duty on that operator and regulation 7(1)(c) puts a policing duty on it. Neither is your disclosure duty under regulation 3(1), and neither discharges it.

Finally, delete the 2012 checklist from your shared drive. Whoever reads it next will act on a revoked instrument, and that is a preventable problem.