Is CM2 Legit?
Our 2026 Review

Desk research, checked 7 August 2026: built from CM2’s own published pages in both languages — the Bahasa Melayu site at cm2.im and the English version at cm2.im/en/ — plus its Terms & Conditions, Responsible Gaming and Casino pages, and public regulator registers. We have not registered an account, deposited, played or requested a withdrawal at CM2, and nothing below is a first-hand payment test. How we work: our methodology.

Short answer: CM2 tells you on its own homepage that it “operates in Malaysia under an official licence.” Malaysia does not issue online casino licences to anybody. That single sentence is the most important thing we verified about this operator — and it cannot be true. Everything else follows from it: no regulator named, no licence number, no company name, no bonus terms published, and a liability clause capping what CM2 owes you at your last 30 days of deposits.

CM2 is not on our recommended list. Here is what we could verify, and what we could not.

What Is CM2?

CM2 (styled cm2, at cm2.im) is an online gambling brand marketed to Malaysian players in Bahasa Melayu and English. Its published sections are Live Casino, Table Games, Slots, Sports Betting (Liga Malaysia, EPL, badminton, esports) and 4D/6D Lottery. Payments are advertised in Ringgit only, via DuitNow, GrabPay and local bank transfer. An Android APK is offered as a direct download from the operator’s own domain.

The site is heavily localised — Langkawi, Sabah, Johor, Penang and Kota Kinabalu all appear in image filenames and headings. That tells you who the marketing targets, not who runs the cashier.

CM2 at a Glance

CM2 Licence & Ownership Check

This is where the review effectively ends for most readers.

CM2’s Bahasa Melayu homepage says: “Kami beroperasi di Malaysia dengan lesen rasmi yang memastikan setiap transaksi dan data peribadi anda dipelihara dengan ketat.” The English version of the same page puts it as: “We operate in Malaysia under an official licence, ensuring every transaction and your personal data are strictly protected.” Further down that page: “Cm2 is a licensed online gaming platform that operates with full integrity and regulatory compliance in Malaysia.”

There is no such licence to hold. Under the Common Gaming Houses Act 1953 and the Betting Act 1953, Malaysia does not license remote or online casino gambling. The only licensed land casino in the country operates under a separate, specific concession. No online operator — trusted or otherwise — is licensed in Malaysia. Every legitimate offshore casino serving this market therefore points to a foreign regulator, and shows a number you can look up.

CM2 shows nothing to look up. Across the homepage (both languages), Terms & Conditions, Responsible Gaming and Casino pages we found no regulator name, no licence number, no certification seal and no register link. We could not run a register check because there is nothing to check — and no company name to search on any register either.

For reference, this is what a verifiable claim looks like. Genuine licensees appear by name on their regulator’s public register:

• Curaçao Gaming Authority — licensees carry a live seal that resolves on cert.cga.cw under the LOK regime
• PAGCOR (Philippines) — pagcor.ph regulatory pages
• MGA (Malta) — licensee register
• UKGC — public register, searchable by business name or domain

One note on the domain, because it causes confusion: .im is the Isle of Man’s country code, but .im domains are sold commercially to anyone worldwide. Registering a .im address confers no Isle of Man licence and no Isle of Man oversight, and CM2 makes no Isle of Man claim itself — the inference is one readers draw, not one the operator states.

The “governed by Malaysian law” problem

CM2’s Terms & Conditions (§6) state that they are “governed by and construed in accordance with the laws of Malaysia” and that, if negotiation fails, “the parties agree to refer the dispute to the appropriate courts of jurisdiction in Malaysia.”

Read that as a player, not a lawyer. Your only stated route of redress is a Malaysian court — for a gambling contract Malaysian law does not recognise or enforce. That clause gives you nothing. A properly licensed offshore operator points you at its regulator’s complaints process, which is the mechanism that actually recovers money.

CM2 Payments: Methods and Minimums

CM2’s published cashier is straightforward and genuinely local:

Those are CM2’s own figures, verified as published on its Casino page — not measurements of ours. We have not deposited or withdrawn here and do not present operator-claimed speeds as tested ones. For timings we stand behind, see our e-wallet casino guide.

Two things in the payments section matter more than the speeds.

First, the T&C do not commit to any withdrawal timeframe. The binding text says requests “will be processed within the timeframe set by the platform, subject to internal verification,” and reserves the right to “delay or hold withdrawal requests.” The “few minutes” figure lives only in marketing copy, where it is not enforceable.

Second, the liability cap. T&C §5 limits CM2’s total liability to “the total amount deposited by that user in the thirty days preceding the claim.” If you deposited RM200 last month and won RM20,000, CM2’s own terms say its exposure is RM200. Paired with the same section’s balance-forfeiture clause — users whose accounts are closed for an alleged breach are “not entitled to reclaim any balance associated with the violating activity” — the terms are written so that a large, disputed win is the hardest thing to collect.

Whatever site you use, check the payee name and phone number the cashier gives you against PDRM’s free Semak Mule portal before you transfer a single ringgit. A payee that resolves to a personal name rather than a company is a stop signal.

Bonus Terms: The Red Flags

CM2 advertises a “Sign-Up Bonus & Exclusive Promotions” on its homepage and Casino page. We could not find a single published bonus term. No promotions page, no bonus T&C section, no amount, no wagering multiple, no game-weighting table, no maximum cashout.

That absence is the red flag. A bonus you cannot read the terms of before depositing is a bonus whose terms can be told to you afterwards. The rollover requirement, the max-bet-while-bonus-active rule and the withdrawal cap are exactly the clauses that decide whether a bonus is worth anything — see wagering and rollover explained and our casino bonus types guide for what should be on that page and is not.

We also noted several trust-signal elements that appear to be page furniture rather than live data: a “Major Jackpot” counter reading RM 1,250,000, a “Weekly Leaderboard” of masked winners (R***123), and a “Your Rewards Progress” points widget — all rendered to logged-out visitors who have no account. None of these is fraud on its own. Collectively they are decoration presented as evidence, on a site that publishes no licence.

Player Complaints We Found

We searched casino complaint databases, review aggregators and player forums for CM2 and cm2.im. We found no substantiated withdrawal complaints — and no independent accountability record of any kind. CM2 does not appear in the major complaint-mediation databases that cover this market.

Read that carefully: absence of complaints is not a clean record. It means there is no third party you can escalate to, no published dispute history, and no pattern to check. For an operator with no regulator, that leaves the player with no recourse at all.

Verdict: Should You Play at CM2?

No. CM2 scores 2/10 on our 10-point scale — level with WinMy, i2 Malaysia, i5 Malaysia, Waja33 and Alibaba66, the other Malaysian brands we rate Not Recommended.

The rating rationale is short, because one finding dominates. Licensing (fail): the operator advertises a Malaysian licence that cannot exist, names no regulator, and publishes no number — under our methodology an unverifiable licence claim is disqualifying on its own. Ownership transparency (fail): no company, registration number or address published anywhere. Bonus transparency (fail): bonuses advertised, terms never published. Payout commitment (weak): no binding withdrawal timeframe, liability capped at 30 days of deposits, balance forfeiture on alleged breach. Provider transparency (weak): no named game supplier on any page, for a site advertising live dealers and hundreds of slots. Product presentation (adequate): the site is clean, fast, genuinely bilingual, and the payment rails are the right ones for this market — presentation is the one column where CM2 scores.

To be fair to the operator: we found no evidence that CM2 has refused a withdrawal, and we are not alleging that it has. What we are reporting is that CM2 publishes a licence claim that cannot be true, hides its corporate identity, and writes terms that cap what it owes you. Any one of those would keep it off our list.

If you already hold a CM2 balance, withdraw it, keep screenshots of the balance and every chat transcript, and stop depositing while the licence question is open.