Megaspeed bought $4.8bn of Nvidia gear — and broke no US law

Megaspeed, a Singapore-based Nvidia cloud partner, bought at least US$4.8 billion of Nvidia-based equipment in under two years and rented the computing power to Chinese customers — including Alibaba — without, on the public record so far, breaking a single US law.

That is the uncomfortable core of the scandal that ended Jensen Huang's tenure at the company he co-founded in 1993 and built into a $215.9 billion-revenue juggernaut. Huang confessed to an affair with Alice Huang, a Megaspeed executive whom US officials allege is a Chinese intelligence asset, in a letter to staff. Beijing denies the allegation. The board opened an inquiry into whether he had been targeted by a foreign intelligence operation, and a second relationship with a subordinate Nvidia executive then surfaced. The Justice Department has opened its own inquiry, and three House committee chairs have asked him to brief lawmakers privately on November 18.

Strip out the personal drama, and what remains is a structural problem, not a legal one.

How did the money and the chips move?

The chain looks clean at every link:

• An American chip company sells to an American server maker — the US arm of Inspur, a Chinese firm Washington has blacklisted.
• The server maker ships to a data centre in Malaysia, which is not China.
• The Malaysian operator, Megaspeed's subsidiary Speedmatrix, rents out computing time over the Internet to Chinese customers.

Under current US rules, renting AI chips to Chinese companies for use outside China is allowed. It becomes unlawful only if the hardware moves into China, or the operator is shown to act on behalf of a Chinese entity. Megaspeed denies wrongdoing and says checks by US and Malaysian authorities, and by Nvidia, found no violations. Nvidia said its site visits confirmed the GPUs were where they were supposed to be.

The takeaway in plain words: every party can be compliant while the outcome still serves the purpose the rules were written to prevent.

Why can't export controls catch this?

Export controls were written for objects that cross borders. AI capability travels as a service. A model trained on racks in Johor, Malaysia, is as useful to an engineer in Hangzhou as one trained in the US.

Washington has grasped the gap but not closed it. The House passed the Remote Access Security Act in January, which would treat remote access to controlled chips as a regulated export; the Senate has not passed it into law. In August, the Commerce Department was reported to be drafting a remote-access rule, but none has been published.

In the meantime, policing falls by default to the vendor. Nvidia selected its cloud partners, ran the site inspections and vouched for the result — an honour system in which the seller certifies the buyer.

What would actual enforcement look like?

Three fixes stand out:

• Follow the money. The Financial Times reported that Alibaba, through a Singapore subsidiary, lent Speedmatrix money in June 2024 while Speedmatrix was renting compute to Alibaba. Operators renting top-end compute face no know-your-customer duties comparable to banking rules.
• Make lenders and landlords gatekeepers. Bridge Data Centres, Bain Capital's data centre arm, removed Megaspeed from its Malaysian campus in April while raising billions in loans. Shared liability would move faster than any legislature.
• Track usage, not just location. The Chip Security Act would require exported AI chips to verify their location, typically by signal timing. Advocates say Nvidia's GPUs already have the hardware to support location checks through firmware. Tamper-resistant usage logs should go to an auditor without a sales quota, not only to the vendor — training a large model leaves a distinctive footprint of thousands of GPUs running flat out for weeks.

What should Singapore and Malaysia do?

Singapore police are investigating Megaspeed for suspected breaches of domestic law, as they did an earlier case of Nvidia servers declared for Malaysia that may have ended up in China. Singapore stresses it enforces its own laws, not America's; both regimes watch the box leaving the building, not access leaving over fibre.

Malaysia began requiring permits in July 2025 for exports and transfers of high-performance American AI chips, and its trade ministry says it has tightened oversight and keeps a dialogue with Washington. But Malaysia's pitch as a neutral data centre hub — the foundation of Johor's boom — will not survive the next US rule if neutrality means not asking who the tenant is.

Both countries should amend their strategic trade laws so that supplying high-end compute to a restricted end user counts as a controlled transfer, impose know-your-customer duties above a compute threshold, and inspect jointly — an operator headquartered in one country and racked in the other currently falls between both.

Huang built the company that made the AI boom possible; his departure fixes none of what Megaspeed exposed. Until the rules catch up with how computing is actually sold, the next Megaspeed may already be registered somewhere in Singapore.