Skip to content
OmniChannels.ai
Menu

Bulk SMS in Malaysia: MCMC, Sender ID and PDPA Guide

Bulk SMS Malaysia guide: MCMC context, sender ID set-up with CelcomDigi, Maxis and U Mobile, PDPA 2010 consent, OTP vs promo and Malay, English and Chinese text.

Updated 10 min read

By OmniChannels.ai Editorial Team · Reviewed by BroadNet Messaging Solutions Team

SMS & OTP

Short answer

To send bulk SMS in Malaysia, use a provider with routes to CelcomDigi, Maxis and U Mobile, agree your alphanumeric sender ID (up to 11 characters) with the operators, and send marketing only to people who consented, as the Personal Data Protection Act 2010 expects. Keep OTPs on a separate transactional route, add opt-out wording to promotions, and remember that Chinese text switches a message to Unicode at 70 characters.

On this page
  1. What rules apply to bulk SMS in Malaysia?
  2. What does the PDPA require before you send?
  3. How does sender ID work in Malaysia?
  4. Which operators carry SMS in Malaysia?
  5. How should you format Malaysian numbers?
  6. How should you separate OTP and promotional traffic?
  7. How do Malay, English and Chinese text affect SMS length?
  8. When should you send?
  9. A worked example: a Kuala Lumpur cafe chain
  10. What are the common mistakes?
  11. How OmniChannels.ai helps

Key takeaways

  • The telecom regulator is the Malaysian Communications and Multimedia Commission (MCMC); our regulation data records that sender ID requirements are set by the operators, with a typical lead time of 5 to 7 business days and alphanumeric IDs up to 11 characters.
  • Our coverage data lists CelcomDigi (ex-Celcom 502-13 and ex-Digi 502-16), Maxis (502-12) and U Mobile (502-18), all on direct routes.
  • Personal data for marketing falls under the Personal Data Protection Act 2010 (Act 709). Our regulation data calls for verifiable opt-in, categorised by use case at registration, with a STOP keyword and suppression of opted-out numbers.
  • Malay and English use Latin letters that fit the default GSM 7-bit alphabet at 160 characters (153 per part); Chinese characters force Unicode at 70 (67 per part), so a Chinese message holds far fewer characters.
  • We have not found a regulator-published time-of-day window for promotional SMS in Malaysia. Schedule promotions for local daytime and keep OTPs and alerts on a transactional route.

This guide is for marketing, e-commerce, fintech and operations teams that want to send business SMS to mobile numbers in Malaysia: OTPs, delivery alerts, reminders and promotions. It explains who regulates what, how sender IDs work, what the Personal Data Protection Act 2010 means for consent, and how Malay, English and Chinese text change message length. It is a practical overview, not legal advice; confirm requirements with Malaysian counsel and the operators before launch.

What rules apply to bulk SMS in Malaysia?

Three layers apply: telecom regulation, operator policy and the Personal Data Protection Act 2010. None of them is a single "bulk SMS law", so you assemble the picture from each.

Layer What it covers Where to check
MCMC and the operators Telecom regulation, sender ID set-up, routes, content filtering mcmc.gov.my
Personal Data Protection Act 2010 (Act 709) How personal data is processed, consent, the right to stop direct marketing pdp.gov.my
Operator policy Sender ID approval, content rules on links and phone numbers, traffic categories Your provider and each operator

Our regulation data lists MCMC as the regulator, records that sender ID requirements are set by the operators and notes that traffic is categorised by use case when you register. Our Malaysia market page describes the same position in summary. Because operators apply their own content rules, including on links and phone numbers in messages, test a final message on every network before a full send.

What does the PDPA require before you send?

You need a lawful basis to use each number, and for marketing that basis is in practice the person's consent. The Personal Data Protection Act 2010 (Act 709) governs how businesses process personal data in commercial transactions in Malaysia, and the Department of Personal Data Protection oversees it.

On direct marketing, law-firm commentary on the Act describes section 43 as letting an individual tell a business in writing to stop, or not start, using their personal data for direct marketing. We could not read the statute's section text from a primary source for this guide, so check the exact wording with the Department or counsel.

Our regulation data adds the operating rules that matter for SMS: opt-in must be verifiable, traffic is categorised by use case at registration, and opt-out is handled with a STOP keyword and suppression applied automatically. A safe routine:

  1. Capture consent with a record: the exact wording shown, the date and time, the channel and the number.
  2. Say who is sending and why at sign-up, for example "Offers from Kopi Bangsar by SMS".
  3. Honour opt-outs immediately and keep the suppression list across campaigns and channels.
  4. Keep records so you can answer a complaint.
  5. Do not buy lists. Purchased numbers have no consent trail.

For wording, our opt-in consent generator drafts a consent text, and the guide to opt-in consent across channels shows how to record it. See opt-in and opt-out in the glossary.

How does sender ID work in Malaysia?

Business SMS to Malaysia uses an alphanumeric sender ID of up to 11 characters, which shows your brand instead of a number. Our regulation data notes that local script is supported. Requirements are set by the operators and confirmed at onboarding, and our published lead time is 5 to 7 business days. Treat it as typical, not guaranteed.

Step What to do
1. Classify Decide which traffic is transactional (OTP, alerts) and which is promotional, and plan a sender ID for each
2. Choose names Use your registered business or brand name, up to 11 characters; avoid names that imitate banks, government bodies or operators
3. Prepare documents Business registration papers and an authorisation letter naming the sender IDs and your provider
4. Submit Your provider files with the operators; track each approval separately
5. Test Send an OTP and a promotion to CelcomDigi, Maxis and U Mobile handsets

Our sender ID letter generator drafts the authorisation letter, and you can check the current position with the sender ID checker or the Malaysia sender ID page. If you want us to prepare and file the registration with you, see registrations; approval decisions stay with the operators and regulators. Some provider guides describe a zero-ringgit prefix convention at the start of promotional messages. We have not found it in an MCMC text, so we do not present it as a rule here; ask your provider what the operators currently expect. For background on formats, read our guide to sender ID types.

Which operators carry SMS in Malaysia?

Our coverage data lists these mobile networks, each with a direct route:

Operator MCC-MNC
CelcomDigi (ex-Celcom) 502-13
CelcomDigi (ex-Digi) 502-16
Maxis 502-12
U Mobile 502-18

Celcom and Digi merged and now trade as CelcomDigi, but our data still shows two network codes, so report on each. Read delivery reports per operator, not as a blended rate. Our guide to improving SMS delivery rates shows how to diagnose a weak network, and the MCC-MNC entry explains the codes. Because customers can port numbers between networks, do not infer the operator from the prefix alone; see mobile number portability.

How should you format Malaysian numbers?

Store numbers in E.164 format: a plus sign, the country code and the subscriber number, with no spaces and no leading zero. Malaysia's country code is +60. A mobile number written locally with a leading zero, such as 012-XXX XXXX, becomes +60 12 XXX XXXX once the zero is dropped. Format at the point of entry and reject numbers that do not fit. Our phone number formatter shows the conversion, and the E.164 entry gives the definition.

How should you separate OTP and promotional traffic?

Keep OTPs, order alerts and other service messages on a transactional sender ID and route, and promotions on their own. A promotion inside an OTP puts your login codes at risk if the route is filtered, and our regulation data notes that transactional traffic runs around the clock while promotions do not.

Traffic Example Practice
Transactional OTP, payment confirmation, delivery alert No promotion inside; own sender ID; any hour
Promotional Sale, new product, loyalty offer Consented numbers only; opt-out in the message; daytime schedule
Mixed "Your parcel shipped. Get 10% off your next order" Avoid; the offer makes it promotional

For OTP content and security, read our OTP authentication messages guide, and if codes go missing, our OTP not received troubleshooting guide.

How do Malay, English and Chinese text affect SMS length?

Malay and English fit the default GSM 7-bit alphabet, so one message holds 160 characters (153 per part when split). Any Chinese character, and also emoji and curly quotation marks, switches the whole message to Unicode with 70 characters (67 per part). See GSM-7, Unicode SMS and concatenated SMS.

Encoding Single message Per part when concatenated
GSM 7-bit 160 characters 153
Unicode (UCS-2) 70 characters 67

These examples were counted against the limits (Kopi Bangsar is a synthetic business):

Message Encoding Characters Parts
Kod anda ialah 482913. Sah selama 10 minit. Jangan kongsi dengan sesiapa. Kopi Bangsar GSM-7 86 1
Kopi Bangsar: Pesanan 1042 anda dalam perjalanan dan tiba sebelum 5 petang hari ini. GSM-7 84 1
Kopi Bangsar: Beli 2 kopi, percuma 1 kuih Sabtu ini! Info: kopibangsar.example/s Balas STOP untuk berhenti GSM-7 106 1
Kopi Bangsar：周六买两杯咖啡，送一块糕点！详情：kopibangsar.example/s 本周末所有门店适用，数量有限，先到先得，每人限两份。回复 STOP 退订 Unicode 88 2

The last row shows how much shorter Chinese messages are: a message of this length needs two parts. Write Chinese copy tightly, and check the final text in the SMS character counter. For other scripts see SMS character limits and Unicode.

When should you send?

We have not found a regulator-published time-of-day window for promotional SMS in Malaysia, and our regulation data records none. Agree sending hours with your provider and the operators, send promotions in local daytime (Malaysia Time, UTC+8) and avoid late evenings and early mornings. OTPs and alerts can go at any hour. The send time planner helps schedule campaigns, and our SMS marketing rules by country article compares hours across markets.

A worked example: a Kuala Lumpur cafe chain

"Kopi Bangsar" (synthetic) has 18 outlets and wants OTPs for its loyalty app, order alerts and a weekly promotion in Malay and Chinese.

  • It sets up two sender IDs, one transactional and one promotional, and tests both on CelcomDigi, Maxis and U Mobile.
  • It collects consent in the app and at the counter, storing the wording, timestamp and number, with the language the customer chose.
  • OTPs and order alerts use plain Malay at 160 characters or fewer.
  • The Chinese-language promotion is written for the 70-character limit and sent only to customers who chose Chinese.
  • Opt-outs from replies and the link feed one suppression list that also covers WhatsApp and email.

What are the common mistakes?

  • No consent evidence. Without a timestamp and source you cannot answer a complaint.
  • Look-alike sender names. Names that imitate banks, government bodies or operators risk blocking.
  • Treating the merged operator as one network. Report on each network code.
  • Forgetting that Chinese means Unicode. A message of 100 Chinese characters is two parts, not one.
  • Mixing OTP and promotion on one sender ID.
  • Treating lead times as promises. Plan buffer beyond 5 to 7 business days.

How OmniChannels.ai helps

OmniChannels.ai is powered by BroadNet, which has direct routes to CelcomDigi, Maxis and U Mobile in our coverage data. We prepare and file sender ID registration with you, support Malay, English and Chinese content with Unicode, and give you per-operator delivery reports, with SMPP 3.4 for high volume. For indicative list prices, see the Malaysia SMS pricing page, then book a demo. Small team? Our SMS marketing guide for small businesses covers the basics.

Frequently asked questions

Is bulk SMS legal in Malaysia?

Yes. Businesses send OTPs, alerts and marketing SMS in Malaysia over licensed operator routes. Marketing needs a lawful basis for using the number, in practice documented consent under the Personal Data Protection Act 2010, and an easy opt-out. There is no single statute called a bulk SMS law, so rules come from MCMC, the operators and the PDPA.

Do I need to register a sender ID to send SMS in Malaysia?

Plan on agreeing it with the operators. Our regulation data says sender ID requirements are set by the operators and that BroadNet confirms current requirements during onboarding, with a typical lead time of 5 to 7 business days. Requirements and timing are not guaranteed, so test delivery on every network before launch.

Which networks carry SMS in Malaysia?

Our coverage data lists CelcomDigi (the former Celcom and Digi networks, MCC-MNC 502-13 and 502-16), Maxis (502-12) and U Mobile (502-18), each with a direct route. Read delivery reports per network, not as one blended rate.

Do I need consent to send promotional SMS in Malaysia?

Treat consent as required. The PDPA sets out how personal data may be processed, and gives individuals the right to tell a business in writing to stop using their data for direct marketing. Our regulation data calls for verifiable opt-in. Keep a record of when and how each number agreed, and ask a Malaysian lawyer about edge cases.

Can I send SMS in Malay, English and Chinese?

Yes. Malay and English use Latin letters that fit GSM-7, so one message holds 160 characters. Chinese characters require Unicode, which holds 70 characters per message (67 per part when concatenated). Mixed-language messages that include any Chinese character are Unicode as a whole. Check the segment count before sending.

How long does sender ID set-up take in Malaysia?

Our published lead time for Malaysia is 5 to 7 business days. That is a typical range, not a promise. Operators decide, and missing company documents can add time. Build the lead time into your launch plan; our team can prepare and file the registration with you.

Sources

  1. Malaysian Communications and Multimedia Commission (MCMC)
  2. Department of Personal Data Protection Malaysia (PDP)
  3. ITU-T Recommendation E.164: The international public telecommunication numbering plan
  4. 3GPP TS 23.038: Alphabets and language-specific information

Keep reading

More guides