Johor Data Centre Regulatory Risk: What Is Building and What Lands Next

In July 2024, the Johor state government announced it was drawing up the Johor State Data Centre Development Planning Guidelines — a framework to coordinate and monitor data centre development across state agencies and local councils. [MIDA] That process moved quickly: the guidelines were presented and approved by 2025, and the procedural requirement that all applications be submitted through either the OSC 3.0 Plus System or the Johor Fast Lane took effect at the same time. [Johor State Town and Country Planning Department]

From that point, the approval structure became markedly more complex. The Johor Data Centre Development Coordinating Committee took responsibility for approving projects, and new applications were required to pass five levels of vetting under PlanMalaysia before a development order could even be sought from the local planning authority. [Lowyat.net] Before 2024, operators had needed only a development order from the local authority to begin construction — that single-step route no longer exists. [The Straits Times]

The most consequential legislative step came in late 2025: the Johor state government announced it would no longer approve Tier 1 and Tier 2 data centres, redirecting all new approvals toward Tier 3 and Tier 4 projects on water-scarcity grounds. [KAAP Law] For operators with existing Tier 1 or Tier 2 applications in the pipeline, this represented an immediate market-entry closure rather than a pending risk — the policy was announced, not proposed. The legislative trajectory now points toward further tightening rather than relaxation, with sustainability thresholds already converted into enforceable metrics rather than aspirational targets.

On 21 August 2025, the Iskandar Puteri City Council issued Johor's first-ever stop-work order against a data centre construction project, citing breaches of construction conditions under the Streets, Drainage and Building Act 1974. [Malay Mail] The council's instruction to step up monitoring and take enforcement action for non-compliance was not directed at one project — it was a signal to the sector that local authorities now have both the mandate and the intent to enforce. This was not a fine or a warning letter; it was a halt to active construction.

The state's sustainability enforcement regime has also been codified into hard numbers. Johor now mandates a Power Usage Effectiveness of 1.8 or lower and a Water Usage Effectiveness of 1.4 or lower — the WUE threshold is notably stricter than Malaysia's own national guideline of 2.2. [The Business Times] Operators must declare annual power demands, and those that fail to use at least 85 percent of their declared electricity in the first four years face a shortfall penalty of RM8.50 per kilowatt per month imposed through their electricity bill. A separate source confirmed the same 85-percent utilisation requirement with a penalty of S$2.74 per kilowatt of shortfall, reflecting the same policy reported in different currencies. [Kontinentalist]

At the tier level, Johor's state government moved from selective rejection to outright prohibition. Late in 2025 it announced a blanket ban on two categories of extremely water-intensive data centres — those requiring as much as 50 million litres of water daily, equivalent to the capacity of 20 Olympic swimming pools. [Reuters] The state characterised Tier 1 and Tier 2 centres as consuming up to 200 times more water than Tier 3 and Tier 4 facilities, which typically use around 200,000 litres a day. [W.Media] That framing — treating water consumption as categorically disqualifying rather than a factor to be improved — marks a structural shift in enforcement philosophy.

The six-area review framework used by Johor's committee covers water and electricity usage, environmental impact, PUE and WUE performance, fibre-optic infrastructure availability, cooling technologies that reduce water dependency, alternative water sources, and green criteria including the Green Building Index. [W.Media] Applications that cleared all technical criteria prior to 2024 under the old single-step development-order system would not automatically clear this review. [The Straits Times] The rejection rate of nearly 30 percent recorded in late 2024 — before the WUE and PUE thresholds were codified as enforceable metrics — suggests the effective rejection rate under the current framework is likely to be no lower and may be higher.

The procedural submission routes — OSC 3.0 Plus System or Johor Fast Lane — remain the only valid channels for development applications. [Johor State Town and Country Planning Department] The 50-metre buffer requirement between a data centre's building line (including chillers, generators, and support structures) and the nearest residential lot boundary adds a siting constraint that reduces the pool of compliant land parcels. Together, the enforcement signals point in one direction: the cost of non-compliance is rising, the definition of compliance is expanding, and the state is prepared to use its full range of enforcement tools.

The Johor State Town and Country Planning Department's guidelines set the physical parameters within which a data centre may operate. Data centre development is encouraged within a 100-metre radius of transmission lines or Main Intake Substations, making proximity to power infrastructure a planning preference rather than merely a practical consideration. [Johor State Town and Country Planning Department] The minimum site area for a commercial or business planning zone is 2 acres (8,094 square metres), while an industrial zone requires a minimum of 1 acre (4,047 square metres). The 50-metre buffer from residential boundaries — covering the full building line including chillers and generators — further constrains viable sites. The minimum internet speed requirement of 100 Mbps is also specified in the guidelines as a connectivity threshold.

All applications must be submitted through either the OSC 3.0 Plus System or the Johor Fast Lane — there is no alternative channel. [Johor State Town and Country Planning Department] This procedural discipline reflects the planning department's priority of maintaining visibility and control over the pipeline of development, not merely issuing approvals on demand.

Bank Negara Malaysia operates an entirely separate regulatory layer that becomes directly relevant when a data centre hosts financial-sector tenants. BNM's Risk Management in Technology policy requires that any financial institution using shared data centre facilities ensure the service provider does not host more than 30 percent of all financial institutions within a single facility — a concentration risk ceiling that has direct consequences for colocation operators marketing to banks, insurers, and payment firms. [Bank Negara Malaysia] A colocation facility that approaches that 30-percent threshold faces a hard cap on financial-sector tenancy growth, regardless of available physical capacity.

BNM's Outsourcing Policy Document adds a further layer. Financial institutions must obtain BNM's written approval before significantly modifying any existing approved material outsourcing arrangement, meaning that tenant relocations, facility upgrades, or operator changes at the hosting layer can trigger a regulatory process at the financial institution level. [Bank Negara Malaysia] Where the outsourcing arrangement crosses a border — for example, where operations are performed outside Malaysia — BNM requires additional controls and safeguards to manage country risk, with regard to social and political conditions, government policies, and legal and regulatory developments. The policy document's stated objectives include board-level governance of outsourcing risk, due diligence of service providers, protection of data confidentiality, and business continuity planning. For a colocation operator, these requirements translate into tenant-side compliance obligations that can affect tenancy agreements, service-level structures, and the scope of permissible sub-contracting.

The upfront physical compliance requirements alone narrow the viable development universe. A data centre in a commercial zone requires a minimum 2-acre site; an industrial zone requires at least 1 acre. [Johor Town and Country Planning Department] The building line — including chillers, generators, and all support structures — must sit at least 50 metres from the nearest residential lot boundary. Development is encouraged within 100 metres of transmission lines or Main Intake Substations, making proximity to power infrastructure a practical necessity as well as a stated planning preference. Internet connectivity must meet a minimum of 100 Mbps. These siting requirements impose land-selection costs and reduce the pool of compliant parcels, particularly in areas where residential development has encroached on industrial zones.

The most direct financial compliance cost is the under-utilisation penalty. Malaysia's Ministry of Investment, Trade and Industry requires data centre operators to use at least 85 percent of their declared electricity demand during the first four years of operation. Failure to meet this threshold triggers a monthly penalty of RM8.50 per kilowatt of shortfall, imposed through the electricity bill. [Azmi & Associates] For an operator that declares 50 megawatts of demand and achieves only 70 percent utilisation, the shortfall of 15 MW would generate a monthly penalty exposure of RM7.65 million — a material recurring cost that penalises ramp-up risk in the early operating years. The penalty is specifically designed to deter speculative applications and address stranded-asset risk at the state level, not to generate revenue, but its financial impact on an operator with slower-than-projected take-up is the same.

Environmental compliance adds a separate multi-instrument cost layer. Water-cooled data centres in Johor produce high-volume cooling-tower blowdown that is governed by the Environmental Quality (Industrial Effluent) Regulations 2009, with free chlorine concentration in discharge capped at 1.0 mg/L under Standard A and 2.0 mg/L under Standard B. [JohorIndustry.com] Periodic testing and maintenance of large emergency diesel generators produces hazardous waste oils and spent batteries regulated under the Environmental Quality (Scheduled Wastes) Regulations 2005: on-site storage is limited to 180 days or less, accumulation must not exceed 20 metric tonnes without prior written Department of Environment approval, and all transfers must be declared through the DOE's e-Consignment system to licensed facilities. These environmental obligations require dedicated storage infrastructure, third-party licensed waste contractors, and ongoing monitoring — costs that are not one-time and scale with the size and cooling intensity of the facility.

Overlaying all of this is the MCMC Technical Code for Green Data Centres, which sets minimum energy-efficiency requirements for green data centres in Malaysia. [MIDA] Taken together, the compliance cost trajectory for a Johor data centre is not a single capital outlay but a multi-layer, multi-agency obligation set that accumulates over the operational life of the facility. The under-utilisation penalty is the most visible acute financial risk in the first four years; the environmental and efficiency obligations are the structural ongoing cost base.

BMI, a unit of Fitch Solutions, assessed that Malaysia's sustainability-linked regulatory framework for data centres may carry some degree of risk for builders and operators already engaged in campus or facility construction. [The Edge Malaysia] This assessment predates the codification of PUE and WUE thresholds into enforceable metrics — which means the risk BMI flagged in August 2024 has since materialised in a harder form than the sustainability-linked proposals that existed at the time of the assessment. The trajectory of policy since August 2024 is consistent with BMI's concern and suggests it was underestimated rather than overstated.

BMI separately anticipated that data centre investment in Malaysia may slow due to new operational requirements that some investors are unable to meet. [Developing Telecoms] The 85-percent utilisation threshold and the RM8.50/kW/month shortfall penalty are precisely the type of operational requirements BMI signalled as potentially deterrent — operators with uncertain demand ramp-up curves face a real financial exposure from the first year of operation, not at the point of final commissioning.

The most structurally significant risk signal is the national-level non-AI approval freeze. BMI confirmed that Malaysia formalised a policy — announced by the Prime Minister in February 2026 — under which proposals for non-AI-related data centres have been halted since 2024. [The Star] BMI characterised this as Malaysia prioritising high-value and capital-intensive projects. For a standard colocation operator without a clear AI workload positioning, this policy closes the approval path regardless of how well the project performs on water and energy metrics.

Water availability is the constraint that sits beneath all others. Johor has set a WUE threshold of 1.8 — matching Singapore's standard — but the state has explicitly stated that even a project achieving a WUE below 1.8 may still be refused if sufficient water is not available. [Malay Mail] This conditional approval structure transforms water scarcity from a background environmental factor into a direct deal risk that cannot be mitigated through engineering alone. An operator that invests in best-in-class cooling technology and clears every published efficiency standard is still exposed to a discretionary water-availability determination by the approving committee.

The base case — tightening continues at the current pace — rests on the strongest evidence. Johor's approval committee has already rejected nearly 30 percent of applications and banned two tiers outright. [The Straits Times] The state has codified PUE and WUE as enforceable metrics and introduced financial penalties for under-utilisation. [The Business Times] The national non-AI approval freeze, confirmed by BMI as formalised in February 2026, forecloses the market for standard colocation without a clear AI workload positioning. [The Star] Nothing in the retrieved corpus signals a relaxation of these positions within the 18–24 month window.

The bull case requires either a material improvement in Johor's water supply — through infrastructure investment, alternative sourcing, or a revision of the WUE approval threshold — or a reversal of the non-AI freeze that reopens the market to standard colocation. Neither is currently signalled in the corpus. The bear case assumes that the cumulative compliance burden — the five-level vetting process, the tier ban, the utilisation penalty, and the discretionary water-availability determination — deters enough capital that Johor's state government intervenes to prevent project pipeline collapse, potentially through a recalibration of thresholds or a formal review of the approvals process. Reuters' July 2026 reporting on Malaysia's resource anxieties testing Asia's fastest data centre build-out is directionally consistent with the conditions that could trigger such a review. [Reuters]