Selling online in Malaysia? Check these rules before your next order

Start here: look at your shop as a buyer

Running a small shop already means juggling stock, messages and courier pickups. It is easy to complete a platform’s onboarding form and assume the legal paperwork is done. But information you submitted privately to the platform may never appear on your customer’s screen.

I would start by opening your shop on a phone, as an ordinary customer. Can you find the seller’s identity and contact details? Can you tell what the total will be, when the item should arrive and whom to contact about a mistake? That quick check often exposes the gaps worth fixing first.

The 2024 Regulations took effect on 25 December 2024 and revoked the 2012 Regulations, while preserving pending action under the old rules. They distinguish the supplier, who trades or advertises through an online marketplace, from the operator, who provides or runs it.

The definition of an online marketplace is broad: an electronic trade platform conducted through electronic means by a supplier. The text does not expressly require multiple sellers or give a blanket exemption to a shop selling only its own products. So avoid assuming that your own website, or taking orders through social media, automatically puts you outside the rules. If your arrangement is unusual, describe the actual advertising, ordering and payment process to KPDN and ask how the Regulations apply.

This guide focuses on selling in trade to consumers. A genuinely private, occasional disposal of your own belongings can raise a different question from buying stock to resell. The Consumer Protection Act’s scope and exclusions still matter; calling a trading operation a “personal account” does not settle that question.

What buyers need to be told

Regulation 3 and its Schedule set out ten items. The practical notes below explain how to check them; the Regulations do not prescribe one universal page layout.

Keep seller details easy to find on the marketplace and product-specific information with the relevant offer. Do not assume that details supplied only to the platform’s verification team fulfil public disclosure duties. Regulation 3 also prohibits information you know, or have reason to believe, is false or misleading.

What about the registration number? It is not one of these ten Schedule items. That does not mean you can leave it out: separate registration and company laws impose their own name-and-number display duties, explained below. Equally, the operator’s obligation to keep identity and business-account records is not a direction to publish your IC, passport or bank-account details in a listing.

Hypothetical example: a small marketplace seller

Aina sells scarves from Selangor. Her listing says “RM35, PM for postage”, her profile has only a messaging button, and the platform holds her registration details privately. I would fix the visible seller name, email, telephone and trading address, then make the scarf’s material, size, full delivered price, payment method and delivery estimate clear. Private onboarding details do not fill those gaps for a buyer.

Bahasa Malaysia is part of the requirement

Regulation 4 requires the disclosures in the national language. You may add English, Chinese, Tamil or another language alongside it. Give the BM version the same useful detail, and check translations of prices, measurements and conditions carefully.

There is a difference between the law’s commencement and an enforcement concession. Malay Mail reported on 23 June 2025 that enforcement of the BM requirement had been postponed. That is a dated report of a postponement, not proof of a continuing exemption or of today’s enforcement arrangements. We did not locate a later primary notice conclusively settling the current concession position during this update. Prepare the BM disclosures and ask KPDN or your platform for current operational guidance if you need it; do not build your shop around an assumed pause.

A sample listing you can adapt

Illustrative template—not an official form or a certification of compliance. This fictional notebook offer shows how the information can fit together. Replace every bracket with your real details, check any applicable product rules and adapt the terms to your operation.

Penjual: [Nama pembekal / syarikat]
Nama dan nombor pendaftaran perniagaan / syarikat: [Butiran yang berkenaan]
Laman kedai: [Alamat laman sesawang pasar dalam talian, jika ada]
E-mel: [Alamat e-mel] · Telefon: [Nombor telefon]
Alamat operasi perdagangan / pengiklanan: [Alamat penuh]
Produk: Buku nota A5, 100 helai, kertas 80 gsm, kulit biru, keadaan baharu, 1 unit.
Harga penuh bagi pesanan ini: RM18 + penghantaran RM5 = RM23. Tiada caj lain bagi pesanan ini. [Pastikan kedudukan cukai dan kawasan penghantaran adalah betul.]
Pembayaran: [Kaedah yang diterima]
Anggaran tiba: [Julat tarikh / hari bekerja yang realistik selepas pengesahan pesanan]
Terma jual beli: [Terma lengkap atau lokasi terma yang mudah dicapai sebelum membeli, termasuk pembatalan dan pengendalian barang bermasalah; hak pengguna di bawah undang-undang terpakai.]
Pembetulan pesanan / aduan: Hubungi [saluran] dengan nombor pesanan. Kami menyediakan cara untuk membetulkan kesilapan sebelum atau selepas pengesahan pesanan.
Perakuan keselamatan / kesihatan: [Butiran perakuan yang terpakai, jika ada—semak dengan agensi berwibawa.]

Do not copy the price or “no other charges” line unless it is true for that order. Nor should a seller invent a certificate or assume every product needs the same approval.

Hypothetical example: selling through social media. Ravi advertises notebooks on Instagram and takes orders by message. A sensible setup is a clearly accessible seller-information post or shop page, full product information with the offer, and a message confirming the chosen item, total price and delivery estimate. That is a practical arrangement to check against the Regulations; it is not a promise that a particular link or message format alone satisfies every duty.

After the order: corrections, delivery and records

The obligation does not end when someone pays. Regulation 6 requires a suitable way for the buyer to correct errors before or after order confirmation, and an acknowledgement of the order without undue delay. The receipt rule turns on when the parties can access the order or acknowledgement.

Make the correction route visible and usable. For example, provide an order-review screen and a monitored contact route for a wrong quantity or address. The provision is not an unlimited right to cancel any purchase or demand an impossible change after delivery. If a requested correction cannot be made, explain promptly what has happened and what options remain.

Who pays when the wrong or faulty item arrives?

Regulation 5(a) says that a supplier who has agreed to accept payment must bear the cost of re-delivery to the purchaser where the received goods are materially different or defective. The direction matters: this concerns getting the goods to the buyer again. It should not be paraphrased as a universal rule reimbursing every buyer-to-seller return shipment.

Hypothetical example: the replacement parcel. A customer orders a blue notebook but receives a damaged one. You arrange to send a proper replacement. The re-delivery cost to that customer is yours under regulation 5(a). Whether the damaged notebook needs to come back, and how that return is arranged, is a separate question.

The wider Consumer Protection Act supplies the rules on faulty-goods remedies. Where supplier redress is available, a fixable failure generally allows the supplier a reasonable opportunity to remedy it; rejection and a refund or replacement depend on the statutory conditions. After a valid rejection, section 45 generally requires return, but the supplier must collect at its expense where the fault, size, height or attachment makes return, removal or transport significantly costly to the consumer. A blanket “no refunds” term cannot override the Act.

Our guide to repair, replacement and refund rights for faulty goods explains those conditions. Keep any platform’s extra return benefits separate from the statutory minimum, and agree the logistics in writing.

For services, regulation 5(b) requires services that are reasonably fit or as offered or supplied. Describe the actual scope and timing clearly; do not promise a service you cannot deliver.

Keep a record you can use later

Regulation 8 extends the requirement concerning electronic transaction or advertising records to suppliers. Take reasonable steps to keep those records for three years. Save the listing and its date, order confirmation, payment record, messages, delivery tracking, complaints and any remedy agreed.

Three years is not a universal permission to delete everything. HASiL’s digital-business guidance separately calls for business documents, records and accounts to be kept for seven years. Follow the applicable tax record rules and preserve evidence needed for an ongoing dispute. Restrict access to customer information instead of leaving it in a publicly shared folder.

The platform has duties too

Under regulation 7, operators must check supplier compliance with regulation 3 before allowing a transaction, provide a buyer complaint channel and ensure advertisements do not contravene the Regulations. Regulation 8 adds three-year record duties covering supplier identity and contact information, the marketplace address, trade or company registration details if any, and transaction or advertising records.

These operator duties do not replace your duties as a seller. If you operate the trading platform yourself, check whether both roles apply to your setup. And if you receive a platform compliance notice, read its actual requirements and deadline rather than guessing that its onboarding checks are the whole law.

Which fine applies to whom?

Regulation 9 creates the offence but does not set out its own punishment. Section 145 of the Consumer Protection Act supplies the general penalties:

For a continuing offence after conviction, section 145(3) also permits a further fine up to RM1,000 for each day or part of a day it continues. These ceilings do not predict a particular sentence.

Why do some accounts give a different number? Section 150 authorises the making of regulations, including prescribed penalties. That enabling power should not be mistaken for a penalty actually prescribed by these Regulations. Nor should the company’s first-offence ceiling be presented as the individual’s.

A KPDN investigation, a formal compliance order, a compound offer and a court conviction are different things. A compound is a separate statutory process; the table is not a schedule of automatic administrative charges. A customer’s claim for a remedy is also separate from a prosecution.

Register the business—not just the marketplace account

Peninsular Malaysia and Labuan

For a sole proprietorship or partnership falling under the Registration of Businesses Act 1956, section 5(1) requires an application within 30 days from commencement of the business. The Act extends to Labuan through a separate 1996 Order. Its definition of business concerns activity carried on for gain; it does not require you to have earned a net profit first.

So if you have started buying stock and trading, do not wait for your first profitable month to think about registration. The precise commencement date depends on what you have actually begun doing. SSM’s EzBiz route is for eligible business owners, including Malaysian citizens or permanent residents aged at least 18. Company incorporation is a different process; opening a marketplace account does neither job for you.

For a registered business, rule 13(2), as amended in 2020, requires the business name and registration number on business websites, social-media platforms and online marketplaces, as well as specified business documents. Those are separate display duties from the 2024 consumer-disclosure Schedule.

Failure to register a business that must be registered is separately punishable under section 12(1) by a fine up to RM50,000, prison up to two years, or both. Registering with SSM also does not replace a licence or approval your activity or premises needs.

Sabah and Sarawak

Do not transplant the Peninsular EzBiz instruction into these states. Sabah has its own trading-licence framework, and Sarawak has business-name registration and trading-licence arrangements. Check with the relevant district office or local authority for your location and activity before starting; the documents, premises conditions and responsible office can differ.

For example, Sarawak’s official e-R&DO portal says business-name, trade-licence and operating-licence applications in Sibu and Kanowit have been handled by the respective local councils since 1 August 2025. That is a useful reminder to confirm the current local route. The regional sources below are starting points, not a finding that a particular home business qualifies for a licence or an exemption.

Already trading through a company?

Under section 30 of the Companies Act 2016, a company must disclose its registered name and registration number on its websites and specified business communications and documents. This company duty is distinct from sole-proprietor registration.

Hypothetical example: an established company. A company adds a consumer-facing web shop to its wholesale operation. Its incorporation does not complete the shop’s disclosures: it still needs clear seller contacts, product details, full prices, terms and delivery estimates. Ask the person responsible for the website and the company secretary to check the applicable display duties together. A purely business-to-business sale raises a different consumer-law scope question.

Tax and e-Invoice: a short, separate check

Online business income belongs in your tax reporting. Check your Tax Identification Number and report the business income through the appropriate return. The tax payable depends on the applicable income, deductions, reliefs and other rules; gross sales are not automatically your final taxable income. Keep sales and expense records from the start, even if this is a side business.

e-Invoice is a separate system, not a tax-free allowance. HASiL announced on 30 August 2026 that the exemption threshold would rise to annual income or sales below RM3 million, effective 1 September 2026. Its current timetable reflects that figure. Check the current guidelines and eligibility conditions for your entity on the HASiL e-Invoice microsite, particularly if you are part of a group or your circumstances have changed. This short guide does not decide your exemption or transaction-by-transaction obligations.

Our guide to common Malaysian tax mistakes explains the wider filing and record issues. Do not assume that an e-Invoice exemption removes income-tax reporting or the seller disclosures above.

What I would fix this week

1. Check every sales channel on a phone. Update the ten disclosure items, the BM version and any separate registration-number display. Confirm that buyers can see them.
2. Run through a test order. Check the full price, delivery estimate, acknowledgement and correction route, including after confirmation.
3. Give complaints an owner. Decide who reads the messages, investigates a fault and arranges a remedy or re-delivery. Keep the response and costs in writing.
4. Confirm registration and licences. Use the route for your entity and location. If a deadline has already passed, contact the responsible registry promptly with the true commencement date; do not invent a later one.
5. Save the evidence and check tax separately. Keep dated listing copies, order and payment records, supplier documents, delivery evidence and complaints. Check current HASiL guidance rather than an old phase chart.

For consumer-law questions or suspected breaches, KPDN is the relevant agency; its official complaints guidance directs consumer issues to e-Aduan. Registration questions go to SSM or the relevant regional authority. Eligible consumer disputes may go to the Tribunal for Consumer Claims Malaysia (TTPM), subject to its jurisdiction and procedure. If you receive a formal notice or claim, read it promptly and get advice on the response required; do not assume replying to a platform message answers a legal notice.

FAQ

Is RM50,000 still a possible fine for an individual?

Yes. Under section 145, an individual’s first offence under these Regulations carries up to RM50,000, up to three years’ imprisonment, or both. Companies and subsequent offences have different ceilings. A maximum is not an automatic sentence.

Can I choose email, phone or address?

No. The Schedule requires email and telephone details, plus the address where the relevant trading or advertising operation is carried on. Provide all three; do not substitute a chat button for the listed information.

Can I leave out BM because enforcement was postponed?

The legal requirement remains in regulation 4. A June 2025 report of a postponement is not reliable proof of a current exemption. Prepare the BM disclosures and check current operational guidance if needed.

Must I wait until the shop makes a profit to register?

No. For a business subject to the Registration of Businesses Act, the application deadline is 30 days from commencement. Sabah and Sarawak have different registration and licensing arrangements; check your local route.

Does every faulty item mean I must pay all return postage?

Regulation 5(a) expressly covers re-delivery to the buyer. Buyer-to-seller returns need separate analysis under consumer-remedy rules and any applicable platform terms. After valid rejection, section 45 can require collection at the supplier’s expense where returning, removing or transporting the goods would significantly cost the consumer for the specified reasons.

Is a small seller exempt from everything if e-Invoice does not apply?

No. e-Invoice eligibility does not decide income-tax reporting, business registration, licences or consumer disclosures. Check each obligation separately.

Sources and what each supports

Sources checked 13 September 2026. Legislative sources establish the rules; agency pages explain administration. The dated news report supports only the historical enforcement announcement attributed to it.

1. KPDN repository: Consumer Protection (Electronic Trade Transaction) Regulations 2024, P.U. (A) 449/2024. Complete BM and English text; regulations 1–11 and Schedule: commencement, scope, disclosures, language, delivery, orders, records and offences.
2. Attorney General’s Chambers: Consumer Protection Act 1999, Act 599. Reprint as at 1 November 2021; sections 2–3, 6, 40–46, 85, 141 and 145–150: consumer scope, remedies, enforcement and penalty structure.
3. AGC amendment-Act index and subsidiary-legislation search for electronic trade. Bounded currentness checks; no later amendment displacing the cited provisions was identified.
4. SSM: Registration of Businesses Act 1956, Act 197. Sections 2, 4, 5 and 12: business definition, scope, commencement-based application and separate registration offence.
5. SSM: Federal Territory of Labuan extension Order 1996. Territorial extension from 15 March 1996.
6. SSM: Registration of Businesses (Amendment) (No. 2) Rules 2020, P.U. (A) 140. Effective 7 May 2020; amendments to rules 13 and 13A, including online name-and-number display.
7. SSM: EzBiz Online and new-business registration guidelines. Eligibility and registration procedure; read with the current legislation index.
8. SSM: Companies Act 2016, section 30; Companies (Amendment) Act 2024 checked alongside SSM’s current legislation index. Company name-and-number duties; the 2024 amendments do not replace section 30.
9. Sabah State Attorney-General’s Chambers: Trades Licensing Ordinance and Sabah Government business portal. Regional framework and local licence routes; no individual exemption or licence eligibility determined here.
10. Sarawak: Business Names Ordinance, Chapter 64 and official e-R&DO portal. Regional registration framework and notice concerning Sibu and Kanowit councils from 1 August 2025.
11. HASiL: Digital business. Income reporting, business expenses and seven-year record guidance.
12. HASiL: e-Invoice threshold announcement, 30 August 2026, current implementation timetable and e-Invoice microsite. Attributed threshold change effective 1 September 2026 and current eligibility guidance.
13. KPDN official complaints guidance. Directs consumer issues to the e-Aduan portal. TTPM official portal provides the consumer-claim route and current procedure.
14. Malay Mail, 23 June 2025, “E-commerce Malay language rule paused, ministry to gather feedback from sellers”. Supports the attributed historical postponement, not the current duration of a concession. Plain source URL: https://www.malaymail.com/amp/news/malaysia/2025/06/23/e-commerce-malay-language-rule-paused-ministry-to-gather-feedback-from-sellers/181337

A quick note

This is general Malaysian legal information, not advice on a particular seller, product or dispute. Sector-specific approvals, unusual trading arrangements and formal enforcement notices may need advice from the relevant authority or a Malaysian lawyer. The examples are hypothetical. Check current official guidance before acting on a requirement that depends on your own circumstances.

Spot something outdated or wrong? Tell us — we’ll verify and correct it.