Summary

  • Malaysia’s 2026 consultation proposes statutory authority for MCMC over electronic addressing, an NIR model and related fees; APNIC’s published account says an earlier bilateral discussion turned on whether MCMC would receive final assignment authority.
  • The RIR Governance Document’s September draft does not set NIR recognition criteria directly, yet says an RIR remains responsible for obligations attached to services and resources it delegates. The allocation boundary and the accountability boundary therefore need to be designed together.

A national internet registry is easy to describe as a local counter where operators apply for IP addresses and autonomous system numbers. That description hides the consequential question. When a request becomes a recognized assignment, which institution can say yes, update the authoritative record, apply the governing policy and answer if the decision is challenged?

Malaysia’s proposed National Internet Registry brings that question into public view. APNIC’s July 2026 summary of a Malaysian Communications and Multimedia Commission (MCMC) consultation says the paper proposed statutory authority for MCMC to manage electronic addressing resources, including IP addresses and AS numbers; support for a Malaysian NIR; and a legal basis for related fees. APNIC’s own submission describes its response as addressing the proposal to confer authority on MCMC in support of an NIR. The original consultation paper is linked from APNIC’s announcement, but the analysis here relies on APNIC’s published summary and submission rather than treating that summary as the full Malaysian record. (APNIC’s consultation announcement; APNIC submission to MCMC; MCMC consultation paper (not accessible in this research session))

The underlying APNIC correspondence makes this more than a dispute about local support or a new fee line. In a letter dated 29 May 2026, APNIC says it had offered MCMC a model in July 2025 under which APNIC would retain the back-end registry operation and final delegation responsibility, while the existing APNIC membership and governance structure remained unchanged. APNIC says MCMC declined that option in a 10 July 2025 letter, preferred the legacy NIR model, and asked for “full operational and technical autonomy over resource assignments.” The MCMC letters themselves were not in the reviewed public source set. This is APNIC’s account of the exchange, not a jointly agreed description. But it identifies the unresolved design choice: a local service layer with APNIC holding the last assignment decision, or a transfer of more decision authority to a Malaysian institution. (APNIC EC letter, 29 May 2026; APNIC EC correspondence index)

That distinction matters because the number pool and the assignment desk are different things. APNIC argues in its July submission that establishing an NIR would not, by itself, increase resource availability, alter the criteria used for IP addresses or ASNs, or confer preferential access on Malaysian operators if APNIC’s community-developed policies continued to apply. That is a claim about an NIR inside APNIC’s system. It does not answer whether a domestic regulator should have its own public-law authority over the process, nor does it establish that the consultation’s final model would preserve every APNIC policy or access route.

APNIC’s January letter said it could not process a new NIR application because the old APNIC-104 criteria had been deprecated and no formally adopted recognition process existed. The May letter supplied more history: APNIC says the old moratorium had been in place since 2012, became permanent under an Executive Council decision in February 2024, and could only be revisited through new community-developed criteria. APNIC says that position does not rule out a future NIR; it means the new basis has not yet been agreed. Its July submission repeats that it is not opposed to a Malaysian NIR in principle, while arguing that timing and design should follow the global RIR review and a subsequent APNIC NIR consultation. (January APNIC letter; July APNIC submission)

The global draft now exists, but it does not close the NIR question. Version 3 of the RIR Governance Document is labelled a “FINAL DRAFT” dated 1 September 2026 and is identified as an ASO Address Council recommended draft. The NRO FAQ says the drafting group delivered it to the NRO Executive Council on 28 July, which must now review it and progress the path to a final version. It has not been adopted. (RIR Governance Document v3; NRO FAQ; NRO’s 28 July handoff announcement)

Section 2.4 says the draft does not pertain directly to NIRs and other sub-regional registries that do not receive resources directly from IANA. The same paragraph says that when an RIR delegates services or resources to such a registry, that delegation does not excuse the RIR from its obligations for the delegated services and resources. The NRO’s FAQ states the same accountability rule plainly: RIRs remain responsible for compliance where they have delegated work to an NIR. So the draft draws a boundary around its direct subjects without making delegated operations disappear from the RIR’s responsibility. It does not itself supply a complete NIR recognition procedure or decide who must hold every operational decision. (RIR Governance Document v3, §2.4; NRO FAQ on NIRs)

That leaves two institutions with different sources of authority. Malaysian legislation can define what MCMC may do within Malaysia. APNIC’s system still determines whether an organization is accepted as an NIR under its regional arrangement, what policies it must apply, and what service responsibilities APNIC retains. Neither source can substitute for the other. A statute does not by itself create an APNIC delegation; APNIC’s recognition process does not answer how Malaysian public authority, fees or remedies should be bounded.

The allocation boundary also reaches technical services. APNIC’s consultation submission asks how any new NIR would preserve direct access to APNIC, operator choice, RPKI trust relationships, certificate management and the continuity of route-origin and ASPA records. Those are questions posed by APNIC, not settled features of an MCMC plan. They show why the assignment decision cannot be designed as a registry database alone: the record, the policy that authorizes it, the security attestations that depend on it, and the route for contesting it must remain coherent through a change of operator.

A separate parliamentary event should not be mistaken for an answer. Malaysia’s Parliament lists the Communications and Multimedia (Amendment) Bill 2026, D.R.18/2026, as passed in both chambers. The 3 August Dewan Negara Hansard describes its change to section 202 as creating a National Universal Service Provision initiative for national security. That recorded scope is different from the June consultation’s addressing-resource and NIR proposal. The bill’s passage is not evidence that the NIR proposal was enacted, rejected or resolved. (Parliament bill record; Dewan Negara Hansard, 3 August 2026)

The policy test is therefore not “national” versus “regional.” It is whether authority and accountability stay aligned. If APNIC keeps the final assignment decision, the arrangement should say what decisions MCMC can make, what APNIC can review, and where an operator can appeal. If MCMC receives final assignment authority, the framework must explain which APNIC policies remain binding, who audits their application, how a disputed entry is corrected, and how APNIC satisfies its continuing obligations for delegated services.

In either model, the public record should identify the decision-maker rather than hide the allocation of power behind the word “registry.”

A Malaysian NIR may improve local administration or serve objectives that APNIC says can also be pursued through regulation and cooperation. The evidence available does not settle that policy choice. It does show that the proposal is not merely a new national front desk. It asks who may make an assignment decision that other operators, registries and routing-security systems must recognize—and whether the institution exercising that power can be held to account for it.