MCMC SMS Rules 2026: What Can You Still Send?

If you searched for the MCMC SMS rules 2026 because your business SMS blast suddenly stopped delivering, here is the short version: Malaysia's regulator has stripped business SMS down to plain, link-free, one-way text. No URLs. No callback numbers. No requests for personal details. Marketing messages only between 8am and 8pm, sent with an RM0 prefix and your brand name attached.

Most of the advice ranking for this topic comes from SMS gateway vendors, and it all answers the same narrow question: how to keep your SMS blast compliant. This post answers the question that actually matters for your revenue: after these rules, what is SMS still for, and which parts of your marketing now belong on a different channel entirely?

What Do the MCMC SMS Rules 2026 Actually Ban?

Business SMS in Malaysia can no longer contain hyperlinks, callback phone numbers, or requests for personal information. The URL ban started as an anti-scam directive in September 2024 (MCMC, via Lowyat.NET) and is now fully enforced across every telco, with filtering applied at the network level (CelcomDigi support).

On top of the content bans, application-to-person (A2P) messages must identify the sender by brand name and carry the RM0 prefix showing the recipient pays nothing, and marketing sends are restricted to the 8am to 8pm window (15below).

The enforcement side has teeth too. Using SIM boxes or bulk SIMs to blast messages outside the licensed A2P system is an offence carrying fines up to RM100,000, up to two years in prison, or both (MCMC, via Business Today).

That last point matters more than most SME owners realise. A lot of cheap "SMS blast" services sold on Facebook run exactly this way: racks of prepaid SIMs pushing retail promos. The customer paying a few sen per message rarely asks how that price is possible. Now the method itself is the offence.

Why Did MCMC Ban Links in Business SMS?

Because scammers made the link the weapon. Smishing (SMS phishing) reached the point where a text from "your bank" with a login link was indistinguishable from the real thing, so the regulator removed the mechanism for everyone rather than trying to referee case by case. When MCMC raided a fake base station operation in Genting Highlands in January 2026, the syndicate was doing precisely this: pushing scam SMS that impersonated legitimate senders (Malay Mail).

The collateral damage is every legitimate business that used SMS as a cheap campaign channel. Your promo was never a scam, but the network filter cannot tell your shortlink from a phishing link, so both get blocked. This is the part the SMS vendor guides gloss over: compliance is not a checkbox that gets your old campaign back. The old campaign format is gone.

Here is the contrarian point worth sitting with. SMS gateways still advertise 98% open rates in their own marketing, and the number is real. But an open with no link to tap, no number to call back, and no way to reply is a read receipt, not a marketing outcome. Post-2026, celebrating SMS open rates is measuring the step that no longer leads anywhere. The metric that pays is what happens after the open, and MCMC has made "after the open" structurally impossible inside SMS.

What Can Business SMS Still Do in Malaysia?

SMS still does one job well: short, one-way, factual notification to any phone number, with no app and no opt-in friction. Used inside the rules, it remains excellent for:

• Transaction receipts and order confirmations (no link, just the fact)
• TAC and verification codes (its biggest legitimate use)
• Appointment and payment reminders, where the recipient already knows who you are and what to do
• Service alerts: outage notices, collection-ready notices, delivery-day notices

What it can no longer do is anything requiring action. Compare the two channels honestly:

Notice the pattern: everything on the left that got banned reappears on the right, but gated behind consent and quality rules instead of banned outright. That is the real story of the MCMC crackdown. Malaysia did not lose a marketing channel. The campaign layer relocated from an unregulated channel to a regulated one.

Which Campaigns Have to Move to WhatsApp?

Any message whose success depends on a click, a reply, or a booking. In practice that means promo blasts with catalogue links, flash sale announcements, win-back offers, new launch previews with images, and anything where the next step is a conversation. The moment your draft contains "tap here", "call us at", or "reply YES", it is no longer an SMS use case in Malaysia.

But moving channels is not copy-paste, and this is where we see businesses get hurt a second time. WhatsApp is not the new SMS blast. It is an opt-in channel where Meta scores your number's quality rating on how recipients react, and where blasting cold lists gets numbers restricted or banned. If SMS blasting was legally risky, cold WhatsApp blasting is operationally risky: the channel itself cuts you off.

From the accounts we have seen inside MSME sales operations, the restrictions that do happen are rarely about raw volume. The moves that show up right before trouble are a brand-new template, a sudden volume jump, or switching to a fresh number, usually on an account that was already flagged. An SME migrating off SMS is tempted to do all three at once: new number, new template, full list on day one. That exact combination is the worst possible opening move.

Frequently Asked Questions

What This Looks Like in Practice

The wider numbers back the relocation. WhatsApp already sits on roughly 90%+ smartphone penetration among Malaysian users, which is why the campaign layer lands there rather than email or a new app; our WhatsApp business statistics roundup collects the current figures. And because the surviving workflow spans two channels, the businesses handling this well run it from one system: a platform like Raion HUB keeps the opt-in list, the approved templates, the send throttling and the two-way replies in one place, so the compliance layer is built into the workflow instead of being a checklist someone forgets.

For the complete playbook on running compliant WhatsApp campaigns, from opt-in collection to template strategy, see our WhatsApp blasting guide for Malaysia.

The Bottom Line