On 19 October 2026, Malaysia’s Communications Minister, Fahmi Fadzil, said the government will study whether to extend eKYC (electronic know-your-customer, an identity check done online) and age verification to online gaming platforms. He named Roblox. He said Roblox had shown it was ready to cooperate, and that the remaining issue may be “user verification and user age verification”.
The reason he gave is the part to read twice. It isn’t loot boxes, gambling or adult content. It’s underage users, and the risk that gaming platforms are used by extremist and terrorist groups.
Nothing is decided. The proposal is at the feasibility stage, with no deadline and no scope. So this is not a compliance deadline post. It’s a design post. If a regulator asks for “verification” because of who can reach whom, which check do you build?
What was actually said
Here is what we could confirm from the reports of the last week.
- The minister said the government is considering eKYC and age verification for online games. The Star reported it on 19 October. Biometric Update covered it on 20 October.
- The reasons given were underage users and abuse of platforms by extremist, radical and terrorist groups.
- In March, the same minister said police arrested six people over alleged links to Daesh. They were aged 16 to 21, and three were minors. He said some suspects had used Roblox to show interest in extremist movements. He asked the regulator (MCMC) to get details from the police.
- Malaysia’s social media age checks have been mandatory since June 2026. We covered those in our Child Protection Code post.
What we could not find: any obligation, deadline, fine or list of covered games. Anyone who tells you what Malaysia “requires” from game studios today is guessing.
Three questions that get called one thing
“Verify the user” is used for three different jobs. They need different checks and they leave you holding different data.
| Question | What answers it | What you learn | What you should keep |
|---|---|---|---|
| How old is this person? | Age estimation, a registry lookup, or a document check | An age band, or yes/no at a line such as 16 or 18 | The result, the method and the date. Not a copy of the ID. |
| Is this a real person, and which one? | eKYC: document plus face match, or a national digital ID | A verified identity | A reference to the check. Raw identity data only if the law makes you. |
| Who is this account talking to? | Your own product rules | Which pairs of accounts may contact each other | The rule and a log of its decisions |
A regulator worried about recruiting might want the second row. The harm they describe is about contact, though. An adult with a verified identity can still message a 14-year-old. Knowing who the adult is helps the police afterwards. It doesn’t stop the message.
That’s why the third row matters most, and why the first row is cheaper than it looks. For most contact rules you don’t need to know who someone is. You need to know which side of the 18 line (and the 16 line) their account sits on, and how sure you are.
Why an age check at sign-up doesn’t cover contact
Say you check age once, at sign-up, and store “adult”. Three things go wrong later.
The account changes hands. A verified account can be sold or lent. We wrote about a market of 13.2 million resold verified accounts in one quarter. The label “adult, verified” stays on the account. The person behind it doesn’t have to.
The label has no feature attached. An “adult” flag that nothing reads protects nobody. The flag has to decide something: who can send a friend request, who can join a voice room, who can DM.
Signals disagree. A birthday field says 17. A face estimate says 22. A device says 15. Without a stated order of trust, the account gets whichever label was written last. Our post on conflicting age signals covers the precedence rule. Here it matters for one reason: a declared age should not unlock contact.
Our earlier post on communication features as the trigger for age assurance explains why chat pulls a product into scope. This post is about the next step: what the rule says once you’re in scope.
A contact rule you can build this week
The rule below is small on purpose. It takes the age band and how that band was established, and it returns allow or deny with a reason.
type Band = "under13" | "13-15" | "16-17" | "adult" | "unknown";
type Assurance = "verified" | "estimated" | "declared" | "none";
type Link = "none" | "guardian_approved";
interface Account { band: Band; assurance: Assurance }
interface Decision { allow: boolean; reason: string }
// A band only counts if a check backs it. A birthday field is not a check.
function effectiveBand(a: Account): Band {
return a.assurance === "verified" || a.assurance === "estimated" ? a.band : "unknown";
}
const MINOR: Band[] = ["under13", "13-15", "16-17"];
const isMinor = (b: Band) => MINOR.includes(b);
export function canContact(from: Account, to: Account, link: Link = "none"): Decision {
const a = effectiveBand(from);
const b = effectiveBand(to);
if (link === "guardian_approved") return { allow: true, reason: "guardian approved" };
// Adults and unknowns never reach minors on their own.
if (isMinor(b) && (a === "adult" || a === "unknown")) {
return { allow: false, reason: "recipient is a minor and sender is not a checked minor" };
}
if (isMinor(a) && (b === "adult" || b === "unknown")) {
return { allow: false, reason: "sender is a minor and recipient is not a checked minor" };
}
// Minors only talk to the same band or the next one up or down.
if (isMinor(a) && isMinor(b)) {
const order = ["under13", "13-15", "16-17"];
const gap = Math.abs(order.indexOf(a) - order.indexOf(b));
return gap <= 1
? { allow: true, reason: "minors in neighbouring bands" }
: { allow: false, reason: "bands too far apart" };
}
return { allow: true, reason: "no minor involved" };
}We ran it with eight tests using Node’s built-in test runner. All eight passed. They cover the cases that matter: a verified adult can’t message a teen, a teen can’t message a verified adult, a declared birthday doesn’t make an adult, guardian approval opens one link, and neighbouring minor bands can talk while under-13 and 16-17 can’t.
Three design choices are worth arguing about with your team.
Declared age counts as unknown. This is the strict choice. It means an unchecked account can’t reach a minor, even if it says it’s 30. It costs you some friction for new adult users. It’s also the only version that holds up when someone types a false birthday.
Estimated counts. A face-age estimate is a real check, but it has an error range near the lines. Use a challenge age (a higher pass line that sends borderline users to a stronger method) for anyone whose estimate is near 18. See layered verification.
The rule denies by default. Adults reach minors only through a guardian link. That will annoy some creators and some older siblings. Make that an explicit exception path, not a quiet hole.
This is a sketch, not a full safety system. It doesn’t cover public lobbies, group invites, or usernames. It doesn’t detect grooming or radicalising content. An age rule can’t do those jobs. It only closes the cheapest route: a stranger the platform knows nothing about writing directly to a child.
What a registry-backed check gives you
Malaysia already runs age checks for social media through MyDigital ID. Biometric Update reported 14.2 million MyDigital ID registrations as of 7 October 2026. The country’s cyber agency (NACSA) described the service as a middleman: it checks users against National Registration Department records, and platforms receive only the information needed to confirm eligibility.
That is a good shape for a game studio, with one gap. The reports we found don’t say which fields reach the platform. Before you build on it, ask for the exact response: is it yes/no at an age line, an age band, a date of birth, or a name? Your contact rule needs the first two. If you receive more, you now hold data you’d have to protect and delete.
Two related posts are worth reading. Türkiye’s e-Devlet age token is another state-issued age signal that platforms must accept. And in the Sweden parcel locker post, a login check proved the login and not the person.
Put the strong check at the risky feature
Studios often ask where to spend the money. The answer is not “at sign-up, for everyone”.
Most players never need to reach a stranger. They play, they join public lobbies, they text friends they already know. A cheap browser age check (what we call a Check) is enough for them, and an unverified account can still play.
The strong check belongs at the moment someone asks for a risky feature: open DMs, voice with strangers, or messaging users outside their own age band. That is where an adult account should earn the right with a document and face match (what we call a Verification).
On Xident’s paid plans a Check costs from €0.01 to €0.03, and a document Verification costs from €0.10 to €0.30. If one player in twenty ever asks for open contact, you pay the higher price for five percent of players, not all of them. Your own ratio will differ. Measure it before you promise a number to finance.
Our Roblox analysis argues that much of the user loss after its age check came from design choices, not from the mandate itself. Gating the feature instead of the whole game is one of those choices.
What we could not confirm
- Whether Malaysia will require anything of game studios, and when. As of 23 October the stated position is a study.
- Which fields MyDigital ID returns to a relying party (the service that asks for the check).
- Whether the proposal covers all online games or only platforms with chat and user-generated content. The minister named Roblox. Nothing else is named.
- Any link between the March arrests and a specific platform. The minister said some suspects used Roblox to show interest. Police have not said more in what we read.
If you run a game with chat, don’t wait for a rule. The contact rule above is useful whether Malaysia acts or not. Several laws already key their duties on contact, as our chat-trigger post lists.
Checklist for the next seven days
- List every way one player can start contact with another: DM, friend request, voice, group invite, trade offer, comment.
- For each, write down which age band and which assurance level is needed today. If the answer is “nothing”, mark it.
- Add the
declaredlevel to your data, and make sure it never unlocks contact. - Pick the rule for adult-to-minor contact. Deny by default is our suggestion.
- Choose the step-up: which check does an adult pass to use open contact?
- Log each contact decision with the reason string, so you can answer a regulator later.
- Ask your age check provider, in writing, exactly which fields a registry or digital ID check returns.
The short version
Malaysia is studying eKYC for games because of who can reach whom, not because of what’s on screen. An age check tells you which side of a line someone is on. A contact rule decides what that means. Build the rule first, and spend the strong check where the risk is.
Xident provides age verification and age estimation with a decision record on every check, a lower-cost Check for everyday access, and a document Verification for high-risk steps. Talk to us about gating contact features in your game, or see pricing.
