Bank Negara (Malaysia)

Bank Negara Malaysia, the central bank of Malaysia, is responsible for promoting monetary and financial stability and providing a conducive environment for the sustainable growth of the Malaysian economy. Bank Negara aims to achieve this by developing a sound, resilient, progressive and diversified financial sector which serves to support the economy.

Some of the key BNM regulations for financial institutions (FIs) to consider when outsourcing their information technology activities are:

• Risk Management in Technology (RMiT)

This policy sets technology risk standards, treating cloud usage as outsourcing. FIs must conduct comprehensive risk assessments before adopting cloud services for critical systems, addressing inherent risks like location and multi-tenancy. FIs must retain ownership, control, and management of customer data and cryptographic keys.

• Frequently Asked Questions on Risk Management in Technology (RMiT)

This FAQ supplements the RMiT policy and provides useful explanations for the implementation of the policy.

• Policy Document on Outsourcing

This policy governs activities performed by third parties, including cloud services. FIs must ensure board accountability, conduct due diligence on the provider’s capability and location. Contracts must grant the regulator access, protect data confidentiality, and establish robust business continuity and exit strategies.

• Frequently Asked Questions on Outsourcing

This FAQ supplements the Outsourcing Policy and provides useful explanations for the implementation of the policy.

• Interoperable Credit Transfer Framework

This framework ensures customer protection in credit transfer services. FIs must securely protect customer data by deploying preventive and detective controls. Non-banking FIs must obtain the Bank’s prior written approval before entering a third-party arrangement for the retention or storage of customer data related to credit transfer services.

• Clarification and Frequently Asked Questions on the Interoperable Credit Transfer Framework

This clarification requires non-banking FIs to obtain prior written approval from the Bank to engage third parties for storing sensitive customer data for credit transfer transactions. The FI must ensure the provider's security controls and governance are robust and manage country risk arising from offshore arrangements.

• Management of Customer Information and Permitted Disclosures Policy

This sets out BNM’s requirements and expectations of financial institutions' measures and controls in handling customer information.