Cyber Crime Bill 2026 Grants Malaysia Extra-Territorial Powers To Prosecute Overseas Cybercriminals

KUALA LUMPUR, Nov 5 – Malaysia can initiate legal action and extradition proceedings against foreign-based cybercriminals operating overseas if their offenses target Malaysian computer systems or involve Malaysian citizens, Deputy Prime Minister Datuk Seri Dr. Ahmad Zahid Hamidi confirmed.

In a written parliamentary reply published on the Parliament website on Thursday, November 5, 2026, Ahmad Zahid stated that Clause 2 of the Cyber Crime Bill 2026 establishes extraterritorial jurisdiction, allowing law enforcement to treat cross-border offenses as though they were committed physically within Malaysia.

“The government is leveraging existing international cooperation mechanisms to ensure that foreign-based criminals can be investigated, prosecuted and, where the requirements are met, extradited to Malaysia,” Ahmad Zahid explained.

The Deputy Prime Minister, who also serves as Minister of Rural and Regional Development, was responding to interpellations from Datuk Shamshulkahar Mohd Deli (BN-Jempol) regarding the adequacy of existing laws in tackling artificial intelligence (AI)-powered online scams, identity impersonation, deepfake manipulations, and multi-jurisdictional syndicates.

Ahmad Zahid noted that the Cyber Crime Bill 2026, which was passed by Parliament in July 2026, repeals the outdated Computer Crimes Act 1997 (Act 563) to close legislative loopholes concerning modern digital fraud and AI exploitation.

Specifically, Clause 23 of the Bill expands the legal definition and scope of impersonation offenses committed through computer systems to counter sophisticated deepfake threats.

“Existing laws are no longer sufficient to deal with deepfakes, which can produce fake videos, images and voices that are difficult to distinguish from genuine ones and can be used to defraud and deceive the public,” he noted.

To expedite investigations into digital syndicates, Clauses 38 to 41 grant law enforcement agencies enhanced investigative powers—subject to statutory safeguards—covering traffic data collection, data preservation, and communications interception to prevent swift digital evidence deletion or transfer.

For victim protection, Clause 54 empowers courts to issue pre-charge judicial orders upon application by prosecutors or authorized officers. These include asset restraint orders to freeze scam proceeds, cessation orders, restitution orders, and compliance directives.

Statutory Provisions, Enforcement Powers, and Legal Reforms

Key legal provisions, investigative mechanisms, and victim protection measures under the Cyber Crime Bill 2026 include:

• Extraterritorial Jurisdiction (Clause 2): Enables prosecution and extradition of foreign-based offenders targeting Malaysian citizens or systems.
• Deepfake & Impersonation Scope (Clause 23): Expands impersonation offenses to criminalize synthetic media, fake video, image, and voice manipulation.
• Investigative Powers (Clauses 38–41): Authorizes data preservation, traffic data collection, and communications interception.
• Victim Protection & Asset Restraint (Clause 54): Empowers courts to issue asset freezing, restitution, and cessation orders prior to formal indictment.
• Legislative Predecessor: Repeals and replaces the Computer Crimes Act 1997 (Act 563) following parliamentary passage in July 2026.

–NMT