The Fine for Selling a Pirate Android TV Box in Malaysia Is Now Up to RM200,000. Buying One Is a Different Story.

In June 2022, officers raided a kiosk at Kompleks Emart in Kuala Lumpur and seized three Android boxes preloaded with unauthorised Astro channels. The kiosk owner and his salesperson became the first people in Malaysia charged under a law barely three months old. More than a year later, in August 2023, both men were fined RM20,000 each.

That case opened the floodgates. By November 2025, Astro, the police (PDRM), the Malaysian Communications and Multimedia Commission (MCMC) and the domestic trade ministry (KPDN) reported 52 joint raids since 2021, 508 devices seized, 33 people charged, and RM656,500 collected in court fines — plus another RM345,000 from civil lawsuits.

Not one was a customer who bought a box and just watched football at home.

The law on pirate Android TV boxes and IPTV in Malaysia is genuinely severe on paper, but every confirmed prosecution so far has landed on the person selling, installing or distributing the pirated setup — not the person watching it.

1. What actually changed in 2022

Before 2022, prosecuting box sellers meant stretching general copyright rules never built for a mass market of preloaded boxes sold openly at kiosks and night markets. The Copyright (Amendment) Act 2022 fixed that by inserting a new Part VIAA into the Copyright Act 1987, headed "Streaming Technology." Its core provision, Section 43AA, defines "streaming technology" broadly — any computer program, device or component that, used in whole or in part, results in copyright infringement — and criminalises manufacturing, importing, selling, hiring, distributing or offering that technology (or a related service) commercially, plus non-commercial distribution that prejudices the copyright owner, which is how sharing pirated links in a Telegram group can theoretically be caught too.

This is what turned "selling Android boxes" from a grey-market side hustle into a specific criminal offence with its own section number. The Act was gazetted in February 2022 and took effect 18 March 2022 — one of the earlier regional laws to name and criminalise illicit streaming devices. Malaysia's broadcast and creative industries put the annual cost of piracy at around RM3 billion, the scale of the problem it targets.

2. The real penalty — and why "RM100,000, 20 years" isn't quite right

Section 43AA carries a fine of between RM10,000 and RM200,000, and/or imprisonment of up to 20 years — a range, not a flat figure, and courts decide where within it case by case. That's confirmed consistently across law firm commentary and every reported court case we checked.

So where does "RM100,000" come from? The closest verified match is Section 41A, which lets prosecutors offer to "compound" (settle) a case out of court for up to 50% of the maximum fine — a cap that works out to RM100,000. That's not the statutory maximum, though. The real ceiling is RM200,000 plus up to 20 years in prison — harsher than "RM100,000, 20 years" suggests, with a floor of just RM10,000. As the next section shows, every actual sentence sits much closer to that floor than to either maximum.

3. What's actually happened in court so far

The maximum is one thing; what courts actually hand down is another. Every verified conviction looks like this:

• Yap Kim Fatt and Chu Kar Wai, the kiosk owner and salesperson from the opening case, fined RM20,000 each, August 2023.
• Leong Wei Xiang, caught selling boxes in Selangor, fined RM20,000 under Section 43AA(2), also August 2023.
• Lee Ah Moy (Johor Bahru) and Yee Kwai Weng (Puchong), retailers, fined RM16,000 and RM11,000 under Section 43AA(1)(c), each with an alternative three months' jail if unpaid.
• Tay Wee Hwa and his son Tay Eng Guan, a Kluang electronics outlet, fined RM14,000 combined under an older circumvention provision, since their December 2021 raid predates Section 43AA.

Nobody went to prison. Fines cluster between RM11,000 and RM40,000 total, and the "jail time" is only the default sentence if a fine goes unpaid — not a judge choosing to jail someone for piracy. That could change, but it hasn't yet, in any case we could verify.

One earlier case sits slightly apart. In February 2021, company director Ng Lee Lee was fined RM30,000 (six counts of RM5,000) after 55 TV boxes were seized from her premises, including six she'd installed with an unauthorised app for a paying customer. Coverage called her the first person "punished for using TV boxes to illegally obtain content" — which sounds like a straightforward end-user case. Look closer and she was running an installation service, not just watching TV at home.

4. The enforcement numbers behind the headlines

Individual cases are only part of the picture. In November 2025, Astro, PDRM, MCMC and KPDN jointly published their combined enforcement record since 2021 (2025 runs to that October only — a snapshot, not a final count):

Astro has also filed 15 civil lawsuits against sellers since a landmark May 2021 ruling, where the Intellectual Property High Court declared that selling or distributing illicit streaming devices is copyright infringement in its own right — a route that doesn't need police to lay criminal charges at all. Eight suits are resolved, for a combined RM345,000 in damages; seven are ongoing.

Notice the 2024 jump: 311 devices seized that year alone, against 28 the year before. Enforcement is scaling up, not down.

5. Seller risk vs user risk: the honest split

This is the part most coverage glosses over, so here it is straight.

Every offence actually used so far targets commercial dealing — making, importing, selling, hiring, distributing — not the act of watching something. None of the provisions above criminalise simply owning a box or viewing content at home.

That doesn't mean a user is in the clear forever — copyright law is drafted broadly, and "no case yet" isn't the same as "legal." But based on every verified case to date, the people getting raided, charged, fined and sued are the sellers, not the households watching a match on a box someone sold them.

6. What about IPTV subscriptions, not physical boxes?

Plenty of Android boxes today carry pirated content through an app or linked subscription rather than the box itself being hacked. Some sellers skip hardware entirely and just sell subscriptions — a login, an app, or a Telegram/WhatsApp package promising "all channels, RM30 a month."

Legally, this isn't a loophole. Section 43AA's definition of "streaming technology" covers software and services, not just devices, and was written partly to catch people sharing apps, websites and hyperlinks through messaging platforms — exactly the IPTV-reseller model. Someone running a paid subscription service without a licence faces the same offence and the same RM10,000–RM200,000/20-year range as someone selling hardware.

What we couldn't verify is a specific prosecution of a pure subscription reseller who never touched a physical device — every confirmed case involved a seized box. That may just mean enforcement has gone after the easier target so far, not that there's a genuine gap. Treat that as unverified, not as a safe assumption.

7. The malware and scam angle that actually affects users

If you're an ordinary household, the realistic threat isn't a criminal charge — it's what's running on the box itself.

A July 2025 study by the Alliance for Creativity and Entertainment (ACE), the Hollywood-backed anti-piracy coalition, measured cybersecurity risk across five Southeast Asian countries, including Malaysia. Piracy sites and services exposed users to roughly 22 times more cybersecurity risk than legitimate platforms overall, with illegal IPTV specifically carrying about 32 times the risk, and peer-to-peer downloading around 52 times. Malaysia ranked among the three highest-risk countries studied, alongside Indonesia and Singapore; legitimate licensed services showed close to zero measured risk.

This isn't abstract: researchers have separately documented real malware on cheap, uncertified boxes — a strain called Vo1d had, by late 2024, reportedly infected over a million devices worldwide, running on outdated hardware with backdoors that let attackers silently install more software.

Astro, PDRM, MCMC and KPDN made the same point in their November 2025 statement: "nearly all" illegal streaming device apps request permissions far beyond what a TV app needs — access usable to record conversations, harvest credentials, or monitor your home. The box giving you free football can also be quietly watching you back.

8. Why blocked sites and boxes keep dying — and coming back

MCMC doesn't usually storm a living room over a TV box. Its main tool is quieter: website blocking.

Under Section 263 of the Communications and Multimedia Act 1998, ISPs must assist MCMC "as far as reasonably necessary" to prevent an offence when asked in writing. Rights owners complain to KPDN, KPDN works with MCMC, and MCMC directs ISPs to block the servers or subdomains a streaming app relies on. Since KPDN's CyCORE programme began in 2021, authorities report blocking 298 websites and securing 1,418 content removals.

This is why your box's channels sometimes just stop working overnight, with no warning and no knock on the door. The fix never lasts, either — a blocked server gets swapped for a new address within days. It's been a running cat-and-mouse game since blocking ramped up around 2019, with no sign of ending.

What to actually do

If you sell, repair, or install apps on these boxes:

• Stop. This is a standalone criminal offence with a real conviction record, not a grey area, and rightsholders can also sue you civilly on top — "installing an app on a customer's box" is exactly what got Ng Lee Lee convicted, no shopfront required.
• If you're facing a raid or charge, get a lawyer immediately. Sentences so far have been fines, not jail, but don't assume that holds for repeat offenders or bigger operations.

If you already own or use one:

• Check what you actually have. A certified, brand-name device with an official app store is a different animal from a generic box marketed for "all channels free."
• Stop side-loading APKs from Telegram or Facebook links promising free channels — the highest-flagged malware route — and check what permissions your streaming apps have (a TV app doesn't need your microphone or contacts).
• If your channels stop working, that's almost certainly MCMC's blocking, not a raid warning — a good moment to switch to a licensed service instead of chasing the next workaround.
• Paying a Telegram or WhatsApp "reseller" for IPTV? They carry the legal risk, but your money, data and device security ride on a stranger's server staying online and clean.