Malaysia and MyDigital ID: When optional starts to look unavoidable

It’s been a big year for MyDigital ID, Malaysia’s national digital identity system. Once promoted by Malaysia’s cybersecurity chief as a credential whose adoption should remain voluntary, it is increasingly becoming the authentication layer for important digital services, from transport to telecoms to government platforms, while banks and other private-sector providers test integrations of their own.

While digital transformation is supposed to reduce bureaucracy and improve the delivery of public services, making life more efficient and streamlined for citizens, an overzealous approach could have far-reaching consequences.

Inclusion and trust are words often bandied around when discussing digital public infrastructure, but technical issues affecting MyJPJ in recent months have raised concerns about public confidence. Created by the Malaysian Road Transport Department (JPJ), the MyJPJ app allows drivers and vehicle owners to manage their licenses, road tax and traffic summonses digitally.

Since May 1, MyDigital ID has been the single sign-on (SSO) method for MyJPJ. Within days of the switch, seven million MyJPJ users had registered and logged in through MyDigital ID, while total MyDigital ID enrollment reached 12 million (in a country of 35 million).

However, ongoing technical glitches have drawn sharp criticism. The Star newspaper reported that former MP Datuk Raime Unggi warned that unresolved problems will undermine faith in government digitalization initiatives.

“Digitalization is meant to simplify public services, not create more bureaucracy and inconvenience,” Raime said in a statement. “Why push a digital service if the public is still forced to travel to physical counters?”

The former MP is said to have experienced the problems first-hand, and the sense of frustration is palpable. What’s worse is that the app’s failures reportedly impacted rural residents disproportionately, who have to travel to faraway JPJ branches to get help.

Issues with app crashes, slow response times and failed online transactions have been reported. Such failures can lead to the kind of frustration that results in mistrust, a mistrust that can be hard to dislodge. Ill-formed reputations can take years of work to shift. Malaysia already has experience with this, as it struggled to scale MyDigital ID registrations initially, before a successful PR campaign helped to change public perception.

Government agencies and vendors in other countries have used trials to limit these kinds of issues, whilst allowing feedback to tweak and refine their systems. Singapore’s Immigration and Checkpoints Authority (ICA) used a phased approach to bring in biometric border crossings. Trials were used to refine deployment and reduce operational risks.

The trust curve: security versus optionality

Every government must balance the security demands of its situation. Scams and fraud have plagued Malaysia and Southeast Asia more generally. A lot of this criminal activity is happening through smartphones and the internet, with online scams and identity fraud.

The Malaysian Communications and Multimedia Commission (MCMC) has fully enacted its Mandatory Standards framework. MCMC’s new mandatory prepaid SIM registration standard tightens identity checks through secure automated registration, biometric verification and MyDigital ID. The rules also include enhanced passport checks for non‑Malaysian users.

The measures mean citizens, permanent residents and temporary residents may register up to five prepaid SIMs per provider, while non‑Malaysians are limited to two. Children under 12 cannot register, and minors aged 12 to 17 must have their SIMs registered by a parent or guardian.

Registrations must be confirmed within 12 hours, and tourist SIMs will expire after three months. Service providers and dealers are required to comply fully, with regulatory action possible in cases of non‑compliance. The framework also introduces consumer‑focused safeguards intended to create a more secure communications environment.

Meanwhile, under 16s have been barred from opening social media accounts in Malaysia. Licensed platforms must verify that users are at least 16 using recognized official documents such as MyKad, passport, birth certificates or other accepted credentials. MyDigital ID has also been promoted by officials as a privacy-preserving verification option.

“MyDigital ID does not require users to submit or store physical ID copies, nor does it store biometric data such as fingerprints or facial images,” said NACSA CEO Megat Zuhairy Megat Tajuddin. “Instead, it verifies users against official records held by the National Registration Department (NRD) to ensure that sensitive data remains within a secure and trusted government system.”

Malaysia follows Indonesia in age-gating social media, although its approach allows several routes to proving age.

Loophole-chasing teenagers will also find it tougher as Malaysia’s Cybercrimes Bill 2026, which has passed both houses of Parliament, also includes offences involving misuse of national digital identity credentials, including supplying or transmitting another person’s credentials for criminal purposes.

Immigration, cross–border IDV, ASEAN DEFA

MyDigital ID is also transforming into a core security pillar for international travel through its integration with the National Integrated Immigration System (MyNIISe). As the sole login credential for the MyNIISe application, the platform functions as a secure single sign-on gatekeeper that streamlines paperless, biometric transit across high-traffic border points like the Johor-Singapore land corridor and major international airports.

While MyDigital ID is mandatory for Malaysians who want to use MyNIISe, MyNIISe itself is not currently mandatory for border clearance; travelers can still use passports, conventional autogates or manual counters.

The next two years are pivotal to Malaysia’s border modernization. Biometrics use and e-gates will expand with plans to deploy automated immigration gates and biometric verification across the country by 2028.

Immigration Department Director-General Datuk Zakaria Shaaban said the measure will enable human resources to be directed toward “more challenging enforcement and investigation tasks.”

“The installation of 635 automatic gates at 125 country entrances by 2028 will reduce dependence on manual inspections by immigration officers because routine inspection matters will be handled through technological systems,” Zakaria told Bernama.

Malaysia is also pursuing cross-border identity verification (IDV) pilots that lay the groundwork for regional economic integration designed to align with the upcoming ASEAN Digital Economy Framework Agreement (DEFA).

The promise of digital identity remains. There’s the convenience of unified access — residents can use a common authentication credential across a growing number of services rather than maintain separate login methods for each.

The limits of optionality

Malaysia has not formally made possession of MyDigital ID universally mandatory. But the distinction between formal compulsion and practical necessity is becoming increasingly important as more essential digital services make it their authentication layer.

The chief executive of Malaysia’s National Cyber Security Agency (NACSA) and a think tank previously urged the Malaysian government to rethink a move to consider making MyDigital ID mandatory. While that legislative intention doesn’t appear to be hastening, it’s a wistful reminder of the words written by NACSA’s chief Dr. Megat Zuhairy Megat Tajuddin.

“In an age of rising digital scams and identity theft, Malaysia’s push for a national digital identity system — MyDigital ID — could not be more timely,” he wrote in the New Straits Times, in July 2025. “But for it to succeed, it must be built on trust, transparency, and voluntary adoption.” That advocacy for optionality seems to have fallen by the wayside.

Malaysia is targeting 17 million MyDigital IDs by year’s end. But in the rush for registrations, it should be important to always underline what a national digital ID is supposed to be for: making the lives of residents easier, safer and more convenient. And to remember that a resilient governmental system, technological or otherwise, is always, ultimately, about trust.

Article Topics

digital ID  |  digital identity  |  digital public infrastructure  |  Malaysia  |  MyDigital ID