Key Takeaways
- The MCMC SMS regulations in 2026 prohibit hyperlinks, requests for personal data, and callback numbers in all A2P and P2P messages in Malaysia.
- Businesses must include an RM0.00 prefix and their brand name.
- Marketing messages are restricted to 8 AM to 8 PM.
- Compliance is monitored under the Communications and Multimedia Act 1998, with heavy fines for non-compliance.
If you are a business owner in Malaysia, you’ve likely noticed that the “Wild West” days of SMS marketing are officially over. As of early 2026, the Malaysian Communications and Multimedia Commission (MCMC) has fully enforced a series of stringent directives aimed at one goal: eradicating the epidemic of “smishing” (SMS phishing).
For legitimate enterprises, these rules are a double-edged sword. While they protect your customers, failing to follow them means your critical business alerts, OTPs, and promotions will be blocked by telcos like Maxis, CelcomDigi, and U Mobile without warning.
Here are the updates you need to know to stay compliant and ensure 100% deliverability in 2026.
1. The Absolute Ban on URLs and Personal Info
The most significant change is the total enforcement of the URL ban. While this began in phases back in 2023, the 2026 landscape is zero-tolerance.
- What is blocked: Any SMS containing a hyperlink (clickable or non-clickable), requests for personal details (IC numbers, bank account info), or phone numbers for a “callback.”
- Why this matters: Scammers often use links and personal data requests to commit fraud. By removing URLs and data requests from SMS, MCMC is cutting off the main tools that cybercriminals rely on.
- The Impact: You can no longer send an SMS saying “Click here to track your parcel: [Link]”.
- The Workaround: Shift your call-to-action (CTA) to your official app or website. Use phrases like: “Please check your status on the [BrandName] app” or “Visit our official website to update your profile.”
2. The Mandatory “RM0.00” Prefix
Under MCMC’s Mandatory Standards, every Application-to-Person (A2P) message must start with the RM0.00 prefix to indicate that recipients will not be charged for receiving it.
If your SMS gateway doesn’t automatically prepend this, your messages will be filtered at the carrier level.
Example: RM0.00 Your [Brand] OTP is 123456. Valid for 5 mins.
3. Sender ID and “Deeming Provisions”
In a major update for 2026, MCMC has introduced “deeming provisions” for messaging platforms. Furthermore, telcos have refined how Sender IDs appear. For instance, official messages from major brands may now be appended with numeric shortcodes (such as, 80663 SMS Gateway) to distinguish them from spoofed alphanumeric IDs.
4. Restricted “Quiet Hours” for Marketing
- Marketing SMS: 8:00 AM – 8:00 PM
- Transactional SMS (OTPs/Alerts): 24/7
- Why this matters: Prevents consumer annoyance and maintains respect for privacy, while allowing critical alerts like OTPs to be delivered anytime.
Tip: Sending a promo at 8:05 PM isn’t just bad practice; it can lead to formal complaints via the MCMC Aduan portal, risking your ASP license.
Conclusion
Staying compliant with MCMC SMS regulations is crucial, not just to avoid fines, but to build trust, deliver messages reliably, and maximize the impact of SMS advertising for Malaysian SMEs. Partnering with a reliable SMS gateway or service provider simplifies compliance, automates RM0.00 prefixes, manages Sender IDs, and ensures messages reach your audience on time.
For Malaysian businesses looking to stay ahead in 2026, choosing a professional SMS service provider is essential. Reliable providers will handle regulatory compliance for you, letting you focus on what matters most: connecting with your customers safely and effectively.
Frequently Asked Questions About MCMC SMS Compliance
Why can’t I send URLs in SMS in Malaysia anymore?
MCMC directed all telcos to block URLs in SMS to prevent online scams. Scammers frequently used links to lead users to "phishing" sites that stole banking credentials. By removing the link, the primary tool for SMS fraud is eliminated.
Will I be charged for SMS that are blocked by MCMC?
Generally, most Malaysian telcos and reputable aggregators will not charge for messages blocked due to regulatory filtering, though you should check your specific provider's Terms of Service.
How do I register an official Sender ID in Malaysia?
To register a branded Sender ID, you must provide your Company Registration (SSM), a sample of your SMS template, and a formal letter of authorization to your SMS service provider. This process typically takes 1–2 weeks.
Can I still include promotional content in transactional messages like OTPs or alerts?
No. Transactional messages must only contain essential information, like OTPs, account alerts, or delivery updates. Mixing promotions risks blocking by telcos and complaints under MCMC regulations.
What happens if my SMS gateway doesn’t automatically apply the RM0.00 prefix?
Messages without the RM0.00 prefix may be filtered or rejected at the carrier level. Always ensure your gateway supports automatic prefix insertion to guarantee deliverability.
Are P2P messages (between individuals) subject to the same rules as A2P messages?
Yes. While the restrictions are stricter for A2P messages, MCMC also monitors P2P traffic for links, personal data requests, and spam-like behavior. Non-compliance can result in fines or account suspension.
