Legal Protection for Investors in Securities Crowdfunding: A Comparative Study with Initial Public Offerings in Malaysia (Jurnal Daulat Hukum)

Summary

• As of June 30, 2021, equity crowdfunding activities in Malaysia had raised RM294.21 million through 214 successful campaigns involving 203 issuers.p.3
• Among Malaysian equity crowdfunding participants, 46 percent were under the age of 35 and 63 percent of fund allocations were directed toward the retail sector.p.3
• Indonesia's Law Number 27 of 2022 mandates that personal data controllers report data breach incidents within a maximum of 72 hours.p.7
• The Personal Data Protection (Amendment) Act 2024 in Malaysia increased the maximum penalty for data breach violations from RM300,000 to RM1 million.p.11
• Sponsors on Malaysia's ACE Market carry reputational risk and must remain bound to support the issuer for a minimum of 3 years post-listing.p.9

Key insights

1. Financial Services Authority Regulation Number 17 of 2025 strengthens platform operator obligations in Indonesia but fails to establish structured investor exit mechanisms for issuer defaults.p.1
2. Securities crowdfunding investors face structural vulnerabilities because issuers lack profitability track-record requirements, secondary markets lack liquidity, and exchanges do not list these securities.p.2
3. Malaysia distributes risk across gatekeepers including principal advisors, underwriters, and ACE Market sponsors that maintain post-offering responsibilities.p.1
4. Financially distressed listed companies in Malaysia are categorized under Practice Note 17 and Guidance Note 3, enforcing structured deadlines for regularization plans or compulsory delisting.p.9
5. Sharia crowdfunding in Indonesia faces legal uncertainty because regulatory authority rules remain Sharia-neutral while National Sharia Board fatwas lack automatic statutory enforcement mechanisms.p.3
6. Both Indonesia and Malaysia enforce a 72-hour data breach notification window, though Indonesia faces enforcement delays due to the non-establishment of its dedicated data supervisory authority.p.12