Risk Management in Technology (RMiT)

With the prevalent use of technology in the provision of financial services, financial institutions must-
(a) invest in the required expertise and risk controls to prevent operational disruptions given the complexity of Information Technology (IT) systems;
(b) achieve the highest level of security to combat fast-changing digital crimes for public confidence;
(c) maintain robust oversight to prevent transmission of risks with increased third party interlinkages;
(d) build operational resilience against sophisticated and malicious cyber threats amidst heightened cyber risks globally; and
(e) practice ethical and responsible use of technology for inclusive growth.

This policy document sets out the Bank’s policy objectives and minimum requirements to improve financial institutions’ management of technology risk, including cyber risk. In applying this policy document, a financial institution shall have regard to the size and complexity of its operations, the level of technology use and its external stress exposure. Accordingly, larger and more complex financial institutions, or those with a high degree of digitalisation and linkages with third parties, are required to adopt more robust risk controls that commensurate with the increased technology risk exposure of the institution.

Enforcement or supervisory actions can be taken against the financial institutions including its directors, officers and employees for any noncompliance with any provision marked as “S” in Part B of this policy document.

Where the Bank considers that a financial institution’s technology risk management has material weaknesses which, if not promptly and effectively addressed, might contribute to, or result in, non-compliance with this policy document, the Bank may, among others-
(a) require an independent external review of the overall or specific areas of the financial institution’s technology risk management;
(b) require the financial institution to develop and implement specific remediation plan;
(c) require the financial institution to hold additional capital; or
(d) require the financial institution to take any other corrective action necessary to rectify the weaknesses in a sustainable manner.

This document belongs to Bank Negara Malaysia (BNM). Full access to the original source is available here: https://www.bnm.gov.my/banking-islamic-banking