The Malaysian Communications and Multimedia Commission (MCMC) has updated the upcoming mandatory standards for prepaid mobile registration. Set to be officially introduced sometime during the first quarter of 2026, the new framework will see tighter controls, but will differ from what were initially proposed last year.
Yesterday, the commission released the Public Inquiry Report on the Mandatory Standards for the Registration of End-users of Prepaid Public Cellular Services, and will issue the formal Determination and an accompanying FAQ towards the end of February 2026. The new framework will replace the existing 2017 guidelines with legally binding rules that apply to service providers and their dealers.
The public inquiry ran from 14 October to 28 November 2025 and received 15 submissions, including from major operators such as CelcomDigi, Maxis, U Mobile, YTL Communications, TM Technology Services, Tune Talk, XOX and others, as well as feedback from the public and the GSMA. MCMC said the responses showed support for stronger safeguards, reflecting shared concerns over the misuse of prepaid SIM cards for scams and other fraudulent activities.
Additionally, the commission reiterated that tighter prepaid SIM registration controls remain a necessary and proportionate response to telecommunications-related fraud. While acknowledging that scams may increasingly shift to over-the-top platforms, foreign SIM cards, network exploitation or device compromise, the MCMC said enforcement data continues to show that a significant portion of telecom-enabled fraud originates from improperly registered prepaid SIM cards.
Prepaid SIM Limits
One of the most visible outcomes from the report is the decision on how many prepaid SIM cards individuals can hold. While the consultation paper had proposed cutting the cap to two prepaid SIMs per service provider for Malaysians and limiting foreigners to two across the entire industry, the MCMC has decided against those stricter proposals.
Under the updated standards, Malaysians, permanent residents and temporary residents will continue to be allowed up to five prepaid SIM cards per service provider. For non-Malaysians, the rules will be tightened in a more targeted way, with a limit of two prepaid SIM cards per service provider, instead of an industry-wide cap.
The commission said the lower cap for foreigners is based on enforcement data showing that a significant share of prepaid numbers linked to scam cases involve non-Malaysian identity documents. It added that the approach is also more operationally realistic for service providers and tourists compared to the original proposal.
Regarding Existing Numbers
MCMC has also clarified that SIM limits will only apply to new registrations and will not be enforced retrospectively. Users who registered multiple prepaid SIM cards before the Mandatory Standards take effect will be allowed to keep their existing numbers. These users will also retain their right to port out their numbers under the existing Mobile Number Portability (MNP) framework.
However, the commission noted that users who have already exceeded the SIM limit may face restrictions when attempting to port in additional prepaid numbers in the future. While the MNP process will continue to operate independently for already registered numbers, eligibility to add new prepaid lines will be affected by the new caps.
Biometric And MyDigital ID
The new standards will also significantly tighten how prepaid users are registered and verified. The MCMC said existing flaws such as document-only uploads, pre-activated SIMs and inconsistent dealer checks have contributed to fraud, identity theft and untraceable lines.
Under the strengthened framework, all prepaid registrations must go through secure automated platforms with clear responsibilities for service providers and dealers. Assisted registrations for Malaysians will use biometric authentication with National Registration Department (NRD)-recognised readers when verifying MyKad and other NRD-issued cards, or chip-based data where fingerprint checks are not possible. For non-Malaysians, registration must be carried out using passport readers with biometric checks and physical sighting of the original passport.
For self-registration, MyDigital ID will be placed at the centre of the process. The MCMC described this integration as a key enhancement that provides higher assurance for online sign-ups, replacing older methods that relied on manual uploads of photos of identity documents.
Age Restrictions, SIM Replacement, And SIM Count Checks
The mandatory standards also introduce specific rules for minors. Children below 12 years old will not be allowed to register prepaid services. For those aged 12 to 17, a parent or guardian must complete the registration, with the minor recorded as the actual end user in the system.
Importantly, the SIM limits will apply to the minor’s own quota and will not reduce the parent or guardian’s personal limit. The MCMC said this is intended to improve child protection while maintaining accurate records of actual SIM users.
SIM replacement will be treated as a high-risk activity under the standards and will remain tightly controlled. While replacement SIMs are not classified as new or unauthorised registrations, service providers must follow defined verification steps and maintain proper documentation and monitoring.
To improve transparency, service providers will also be required to offer a free system that allows users to check how many prepaid SIMs are registered under their identity. Operators will have flexibility in how this is delivered, such as through apps, websites or short codes, but the feature must be easily accessible. Registration documents will also need to carry watermarks identifying the telco or dealer to prevent reuse.
Transition Period For Telcos And Dealers
The new standards will come with a six-month implementation period from the date they are issued. This is intended to give operators time to acquire biometric devices, integrate MyDigital ID, update dealer systems and train staff. The MCMC said the transition period is proportionate given the long-standing weaknesses identified in prepaid registration and the scale of system and operational changes required.
