Fifty-five of the 117 data centre projects Malaysia has approved are running. The rest are planned, under construction, or stalled somewhere between a permit and a power connection. That gap is the reason the government now wants the information in statute rather than in a planning condition.
Investment, Trade and Industry Minister Johari Abdul Ghani said on Nov. 12 that operators will be required by law to disclose electricity consumption, the number of graphics processing units imported, the identity of the operator and of the hyperscale tenants, and the location of each facility. He was speaking at the launch of a ministry mobile application in Kuala Lumpur, and the data-centre rules were the part of the remarks that travelled.
Approval has so far been the main control point, and Johari said monitoring has to continue after a project is granted. Writing the requirement into law gives regulators a basis to demand the numbers on a schedule, and a penalty when they are missing or wrong. Neither the draft nor the penalty has been published.
The minister’s illustration of the electricity problem was the most concrete part of the announcement. A data centre that books 100 megawatts of capacity but uses 50 still pays for the other 50, because the utility has to reserve it. The government wants operators to state the capacity they actually need, so that the grid is not holding space for projects that may not run for another one to three years.
The scale is what makes that matter. Malaysia has approved 117 data-centre projects worth 385.7 billion ringgit with a combined maximum power demand of about 23,500 megawatts, according to figures the government released in late October. That is a large share of Peninsular Malaysia’s generating capacity, and most of it is concentrated in Johor, next to Singapore.
Then there is the chip question. Malaysia imposed export controls last year on the movement of US-origin high-performance AI chips, after pressure from Washington over their possible diversion to China. Tracking how many GPUs enter the country and who is using them is the enforcement half of that policy, and it cannot be done with customs declarations alone.
Johari said the government has no plans to investigate Speedmatrix, the Malaysian unit of Singapore-based cloud company Megaspeed, over allegations that it may have been used to channel Nvidia chips to Chinese users. His reasoning was narrow: if the company bought the GPUs for use in its own data centres, he said, he could not see which law would apply.
Megaspeed said in a statement that it takes its compliance obligations under US export control law seriously and welcomes government scrutiny. Its chairman and chief executive, James Tan Yong Pong, said the company is committed to demonstrating that it operates transparently and in line with applicable US rules.
The minister did describe the behaviour the new rules are meant to catch. He said some parties have rented space in Malaysian data centres, imported GPUs, and then re-exported them. A disclosure regime that records the operator, the tenant and the GPU count creates a paper trail for exactly that pattern, and lets the government answer questions from US authorities about where a given chip ended up.
The Digital Ministry is separately reviewing existing laws to see whether any of them can be used against re-export of sanctioned chips, Johari said. That review implies the government does not yet believe it has the power to act, which is an unusual thing for a minister to say while announcing a new disclosure law.
Disclosure is also not verification. A registry that records how many GPUs an operator says it imported tells the government what the operator believes, not what is in the racks. Matching those figures against customs data and against electricity consumption would give a fuller picture, and the minister’s emphasis on power use suggests the government understands that a hall full of accelerators draws a recognisable load.
For the industry, the immediate concern is not the reporting itself but what it precedes. Malaysia built its data-centre business on speed of approval, cheap land and available power, and it has been the main beneficiary of Singapore’s land constraints. A law that requires disclosure before construction can become a law that requires approval before construction, and operators have seen that sequence in other markets.
The economics of the buildout are already tightening. Johari said in October that states without sufficient water supply would not be allowed to host data centres, and the government has been separating data-centre power demand from that of other industries. Cheap electricity was part of the original pitch, and reserving it for speculative projects is no longer affordable.
What remains open is whether the law arrives as a reporting requirement or as a gate. A reporting requirement changes little for the hyperscalers, which already publish sustainability data and answer to their own auditors. A gate would change the timing of every project in Johor, and with it the assumptions behind the 23,500 megawatts of approved demand.
The government has not published the draft, and the penalties are unknown. Until they are, the operators have a strong incentive to keep building while the old rules apply, which is one more reason the coming quarters will show whether disclosure was the point or the opening move.
