Grab became Malaysia’s economy. Regulators still have no rules for it.

Grab contributed an estimated RM9.9 billion to Malaysia’s economy in 2023 — equivalent to 0.5% of national output, according to a study it commissioned. The company operates ride‑hailing, food delivery, payments and now a fully licensed digital bank, yet its dominance has drawn worker protests and antitrust scrutiny that has so far produced no formal action.

The 2018 acquisition of Uber’s Southeast Asian business drew fines in Singapore but was never challenged in Malaysia. As Grab pivots to profitability, drivers are bearing the cost while regulators study competition in the e‑hailing and food‑delivery sectors.

Malaysia’s antitrust regulator has never blocked a platform acquisition in the e‑hailing market. The result is a single company — Grab — that now processes the daily movement, meals and increasingly the banking of a nation. Protests by food delivery riders in 2022 and again in 2024 signalled that the shift from heavily subsidised growth to corporate profitability was landing unevenly, but the complaints have been met with official studies, not enforcement.

What started as a local startup called MyTaxi in 2012, outmanoeuvring Uber with cash payments and better map data, has become a super app bound into 300,000 drivers’ livelihoods and the spending habits of millions. The company, listed on the NASDAQ, is now focused on turning a profit — and the levers it is pulling are the same ones that worry a handful of economists and watchdogs who say the regulatory framework has not caught up.

Grab’s success is the story that gets told. The friction is in the fine print: a commission near 20 percent, pricing algorithms no outside auditor can inspect, and a digital banking licence that renders the app even harder to leave. The numbers make the case that the platform has become infrastructure. The question is who governs infrastructure no single agency designed rules for.

The numbers that shifted the ground

In 2023 Grab Holdings reported US$2.35 billion in revenue, a 32 per cent jump, and turned its first full‑year adjusted EBITDA profit of US$35 million, according to its annual filing. That pivot, from loss‑making subsidiser to profit‑generating platform, was achieved partly by cutting driver incentives — the very mechanism that once built its network.

For a driver, the numbers are simpler. Grab’s commission remains near 20 per cent. The bonuses that once stretched a 10‑hour day into a liveable income have been thinned. Iskandar Ismail, CEO of the Malaysia Competition Commission (MyCC), has said the agency is studying the ride‑hailing and food‑delivery sectors, warning that any abuse of dominant position — excessive pricing, exclusionary practices — could trigger enforcement. So far, no case has been filed.

Economist Mohd Afzanizam Abdul Rashid of Bank Muamalat argues that dominant platforms can create consumer dependency and pricing power, and that regulators must monitor competition and gig worker protections. Meanwhile, Juita Mohamad of the Institute for Democracy and Economic Affairs has called for minimum standards and portable benefits for platform workers — proposals that remain on the drawing board.

GXBank, Grab’s digital bank, received its full licence from Bank Negara Malaysia in January 2024 after a foundational licence in 2022. The bank is positioned as a tool for financial inclusion, but its integration into the super app means user transaction data flows between mobility, food and finance — a loop regulators have not yet mapped.

The structure that produced these gaps is not complicated, but it is consequential. Next, what the competition for Southeast Asia’s platform economy means for regulation and for anyone trying to challenge Grab on its home turf.

The regulatory shell that hasn’t grown

Malaysia’s regulatory tools were built for a world of distinct industries — transport, banking, data protection — not for a single app that bundles all three. The Land Public Transport Agency (APAD) licenses operators and drivers, but has no mandate over pricing algorithms. The PDPA gives users consent rights but no right to algorithmic transparency. Bank Negara’s digital‑banking licence sets capital and operational rules, not limits on how deposit data can be used to price ride fares.

This patchwork leaves Grab operating a vertically integrated ecosystem whose internal data flows no single agency oversees. By comparison, the EU’s Digital Markets Act imposes gatekeeper obligations and interoperability requirements. Australia’s gig‑economy reforms include portable benefits and minimum standards. None of these exist in Malaysia.

Grab’s super app model — ride‑hailing, food delivery, payments and banking in one interface — is closer to China’s Meituan than to Western apps. Uber and DoorDash separate mobility, delivery and finance, while Grab cross‑subsidises, shares data and locks in users across more touchpoints. For a Western investor or competitor, that means facing a firm that can monetise a user five ways before a single‑vertical rival turns a profit.

The next MyCC update, expected over 2025–2026, is the first moment the pattern could break — or confirm itself for another cycle. Until then, the platform that drivers and consumers rely on remains governed largely by its own algorithms and the quarterly demands of a publicly listed company.

Beyond the headline

The Bigger Picture

Grab’s rise illustrates how digital platforms can become quasi‑infrastructure in emerging markets, filling gaps in transport, payments and banking faster than the state. Once embedded, they shape everything from small‑business logistics to consumer credit access. The policy debate is no longer about a single app but about who governs everyday economic flows in Southeast Asia’s cities.

The Response Gap

Regulators and labour institutions in Malaysia have not kept pace with Grab’s consolidation. Licence rules and the PDPA offer baseline oversight, but no integrated framework addresses competition, algorithmic pricing and gig‑worker protections together. The gap leaves drivers and consumers relying on informal protest rather than predictable institutional remedies.

The Power Behind It

Control over user demand and transaction data, not vehicles or restaurants, gives Grab its leverage. The incentive and ranking algorithms, tuned in Singapore and regional headquarters rather than Kuala Lumpur, decide which drivers and eateries thrive. That makes the algorithms, not Malaysian policymakers, the real centres of power in urban economies.

Three decisions for the people watching Kuala Lumpur

With GXBank fully licensed and Grab’s core business pivoting to profitability, three groups face immediate decisions.

• Tech investors in ASEAN platforms

  Review Grab’s latest annual and quarterly filings on its investor relations site to understand how much growth and profitability is driven by Malaysian operations and super‑app monetisation. Compare with Bank Negara’s digital bank licensing framework to gauge regulatory risk before taking a position.

• Malaysian regulators and policymakers

  Track MyCC’s ongoing study on ride‑hailing and food‑delivery competition, and assess whether pre‑merger notification rules and algorithmic transparency requirements can be introduced before the GXBank data loop widens. The EU’s Digital Markets Act and Australia’s gig‑worker reforms offer workable templates.

• Western firms entering Malaysia’s digital services market

  Map the data‑sharing boundaries between Grab’s mobility, payments and banking lines. If partnering, demand contractual separations; if competing, know that you are not facing a single‑vertical rival but a firm that cross‑subsidises across four layers of the consumer wallet.

Explainer

Super app

A mobile application that combines multiple services — ride‑hailing, food delivery, payments and banking — within a single interface; the model originated in China with WeChat and Meituan. In Southeast Asia, Grab and Gojek use super apps to cross‑subsidise services and lock users into an ecosystem, making it harder for single‑vertical competitors to gain share. Malaysia’s regulatory framework was not designed for a platform that simultaneously acts as a transport operator, payment provider and bank.

E‑hailing

Ride‑booking services arranged entirely through a mobile app, as distinct from street‑hail taxis; Grab’s e‑hailing business accounts for about 23 per cent of its group revenue, with the bulk now coming from deliveries. In Malaysia, e‑hailing operators must hold an E‑Hailing Operator licence from APAD, and drivers must obtain a vocational PSV licence. The regulatory regime covers safety and driver vetting but does not extend to pricing algorithms or commission caps.

GXBank

GXBank Berhad is the digital bank launched by Grab in Malaysia, receiving its full licence from Bank Negara Malaysia in January 2024 after a foundational licence in 2022. It is part of Bank Negara’s digital banking framework, designed to promote financial inclusion, and offers savings products to the public through a mobile‑first model. Because it sits inside the Grab super app, user transaction data can flow between ride‑hailing, food orders and banking, creating a concentration of personal data that no single regulator fully oversees.

APAD

The Land Public Transport Agency (Agensi Pengangkutan Awam Darat) is the Malaysian body under the Ministry of Transport responsible for licensing and regulating land public transport, including e‑hailing operators. It issues E‑Hailing Operator licences and enforces driver PSV requirements under the Road Transport Act 1987. APAD’s mandate covers safety and entry conditions but does not empower it to intervene in dynamic pricing or the platform’s incentive structures for drivers.

PDPA

The Personal Data Protection Act 2010 is Malaysia’s primary data‑protection law, enforced by the Personal Data Protection Commissioner under the Communications and Multimedia Ministry. It mandates consent for data collection, specifies purpose limitation and requires data security, but lacks provisions for algorithmic transparency, data portability, or cross‑service data‑sharing restrictions. Western users accustomed to GDPR should note that the PDPA does not confer the same rights to access or object to automated decision‑making.