Bank Negara Malaysia revises Risk Management in Technology Policy Document

2 October 2026

On 25 September 2026, Bank Negara Malaysia (“BNM”) issued the revised Risk Management in Technology (“RMiT”) Policy Document, which supersedes the previous version issued on 1 June 2023 and certain other technology and cyber risk-related regulatory documents. The revised policy document aims to strengthen the management of technology and cyber risks by financial institutions.

The key amendments and introductions include:

• introducing a new Code of Practice (“CoP”) for National Critical Information Infrastructure (“NCII”) entities designated by BNM in the banking and finance sector, setting out additional cybersecurity requirements to support compliance with the Cyber Security Act 2024 and applicable cybersecurity standards and directives;
• making the CoP legally binding on designated NCII entities upon endorsement by the Chief Executive of the National Cyber Security Agency (“NACSA”), with the CoP taking precedence over the general RMiT requirements where they conflict or overlap;
• permitting NCII entities to adopt alternative cybersecurity measures, standards or processes where they can demonstrate to NACSA that these provide an equivalent or higher level of protection against cyber threats, while requiring them to maintain and provide relevant compliance documentation upon request;
• strengthening requirements for cyber risk management, including the maintenance of a cyber risk management function, continuous monitoring, timely detection of and response to cybersecurity incidents, and controls to address evolving cyber threats; and
• enhancing requirements for digital services, technology audits and third-party assurance, including the management of technology and cyber risks arising from third-party service providers.