Applies now
DORA: EU operational resilience rules apply
ICT risk, the third-party register, incident reporting and testing, passed on to providers by contract.
Financial Services
AI and platforms ready for the regulator’s questions.
What we would build for banks, insurers, takaful operators, payment firms and capital market intermediaries: AI whose outcomes can be explained to a supervisor, integration that leaves the core stable, and operations designed from the first architecture decision for the Risk Management in Technology (RMiT) policy document of Bank Negara Malaysia (BNM) and the technology risk guidelines of the Securities Commission Malaysia (SC).
For financial institutions and capital market intermediaries supervised by BNM or the SC, and for Malaysian providers that serve EU financial entities.
17 January 2025
DORA applies in the EU
EU financial entities pass ICT risk, incident and exit requirements on to their ICT providers by contract, providers in Malaysia included.
28 November 2025
Revised RMiT in effect
The revised BNM policy document on technology risk for financial institutions takes effect.
2 December 2027
EU AI Act: credit and insurance uses
Credit scoring of individuals and pricing of life and health insurance become high-risk uses in the EU, under the 2026 amendment.
What is changing for Malaysian financial institutions
Technology risk is supervised in detail
BNM’s revised RMiT, in effect since 28 November 2025, and the SC Guidelines on Technology Risk Management, in effect since 19 August 2024, set the technology risk expectations for financial institutions and capital market intermediaries. Systems that suppliers build and run sit inside that risk picture.
SourceBNM policy document RMiT
Automated decisions need evidence
In the EU, credit scoring and insurance pricing are high-risk uses under the AI Act. In Malaysia, the personal data behind such models falls under the Personal Data Protection Act 2010 (PDPA). Model risk management therefore has to reach machine learning and generative models, with documentation, monitoring and human oversight scaled to the impact.
Customers expect app-level speed
Instant transfers, mobile banking and digital onboarding have raised what customers expect in speed and clarity, and fraud controls have to keep pace with them.
The core still runs the books
Core banking and policy administration platforms hold years of business rules. Change is made around them, through APIs and events, so that stability and regulatory reporting are not put at risk.
Problems and how we would respond
- The problem
Onboarding and periodic customer reviews rely on analysts reading documents.
How we would respondIdentity, ownership and source-of-funds documents are extracted and checked automatically. Analysts work the flagged cases, and each check is logged for internal audit and the regulator.
- The problem
Agents, advisers and service staff check five systems to answer one question.
How we would respondAn assistant over products, policies and procedures that respects access rights, cites its sources and records what it showed, keeping the advice record complete.
- The problem
Each change to the core is slow, costly and risky.
How we would respondCore functions are opened up through APIs and event streams and moved out one at a time, with reconciliation running until the old path is closed.
- The problem
Technology risk evidence and incident workflows live in spreadsheets.
How we would respondProvider register, incident classification and reporting flows are built into your service management and cloud tools and linked to the critical services they support, so evidence for RMiT, the SC guidelines or an EU client’s DORA clauses comes from one place.
- The problem
Models that cannot be explained fail validation.
How we would respondAn evaluation framework agreed with risk and model validation teams: test sets, explanations where the decision calls for them, drift monitoring and a documented human override.
- The problem
Regulatory returns are reconciled by hand every quarter.
How we would respondPipelines with recorded lineage and automated quality checks in line with BCBS 239, so every reported figure can be followed back to its source.
A reference landscape that puts controls first
Where AI sits between channels and core systems, with an approval step before any consequential action and the technology risk controls of RMiT, the SC guidelines and DORA running beside every layer.
Illustrative example
AI services reach core systems only through the integration layer, and technology risk controls cover every component.
Read the diagram as text
Customers, agents, advisers and service staff use the mobile app, web, branch and contact centre channels.
Behind the channels are three AI services: document intake for onboarding and know-your-customer checks, an assistant for advisers and service staff, and an analyst approval step that every consequential decision must pass.
Core systems are reached only through an integration layer of APIs and event streams. Behind it sit the core banking or policy platform, the CRM and service platform, and a data platform with recorded lineage.
Technology risk controls run beside every layer, as RMiT, the SC guidelines and, for EU clients, DORA expect: technology risk management, the register of third-party providers, incident classification and reporting, and resilience testing. Each model is registered, validated and monitored under model risk management.
A person approves outcomes
AI drafts, extracts and suggests. Decisions on credit, claims or account restrictions remain with a named officer.
Explanation decided at design
The depth of explanation is set per decision type during design, rather than added just before validation.
Exit and concentration risk
Cloud and model providers are selected with documented exit plans and substitution paths, ready for the provider register.
Logs that rebuild a case
Inputs, outputs, model versions and approvals are kept so that auditors and supervisors can reconstruct any case.
Dates that matter for financial institutions
Dates that change what a technology provider must be able to show, in Malaysia and in the EU. BNM, the SC and the European supervisory authorities add their own guidance and standards.
Applies now
AI Act: EU bans on prohibited AI practices and AI literacy duty
Applies now
PDPA: DPO and breach notification duties apply
Under the Personal Data Protection (Amendment) Act 2024: a data protection officer where thresholds are met, and notification of personal data breaches to the Commissioner (within 72 hours under the Commissioner’s guidance).
Applies now
RMiT: Revised RMiT in effect
BNM’s revised policy document on risk management in technology for financial institutions.
Applies now
AI Act: EU transparency duties for AI begin
People must be told when they are interacting with an AI system.
Status on 2 October 2026
Coming
AML Regulation: Single EU AML rulebook applies
Harmonised customer due diligence, beneficial ownership and record-keeping for EU entities.
Coming
AI Act: EU high-risk AI duties apply
Covering creditworthiness assessment and life and health insurance pricing, under the 2026 amendment.
Coming
AMLA: AMLA starts direct supervision of selected EU institutions
Rules and standards in brief
The EU instruments that most often shape AI and platform work for Malaysian financial institutions with EU counterparties, and for Malaysian providers that serve EU firms, with what each means for delivery.
Prepared for planning discussions, not as legal or regulatory advice. EU dates checked on 2 October 2026; Malaysian dates on 6 November 2026.
- DORAScopeEU law
Since 17 January 2025, Regulation (EU) 2022/2554 has bound EU banks, insurers, investment firms, payment institutions and other financial entities. It covers ICT risk management, incident reporting, resilience testing and third-party risk, including mandatory contract terms (Article 30), which reach Malaysian providers through their EU clients. A provider outside the EU designated as critical has twelve months to establish an EU subsidiary (Article 31(12)).
What it means in practiceAs an ICT provider we support your obligations, or those of your EU client: contract terms, incident notification, exit plans, participation in testing and the details your register needs.
SourceRegulation (EU) 2022/2554, EUR-Lex (opens external site)
- EU AI ActScopeEU law
Credit scoring of individuals and risk-based pricing in life and health insurance are high-risk uses. Providers and deployers need risk management, data governance, logging, human oversight and documentation, from 2 December 2027 under the 2026 amendment. A Malaysian provider is covered where its system’s output is used in the EU (Article 2(1)(c)).
What it means in practiceEach use case is classified early, human oversight is designed into the process, and the documentation fits your model risk framework.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- EU AML package (AMLR and AMLA)ScopeEU law
From 10 July 2027, the Anti-Money Laundering Regulation brings customer due diligence in the EU under one rulebook. The new authority, AMLA, coordinates national supervisors and will supervise selected high-risk institutions directly.
What it means in practiceThis matters where your group has entities in the EU. Onboarding and review need consistent evidence handling and audit trails, and we design document intake and case flows to that standard.
SourceRegulation (EU) 2024/1624, EUR-Lex (opens external site)
- GDPR and automated decisionsScopeEU law
Article 22 protects people from decisions with significant effects taken by automated processing alone, unless an exception applies with safeguards such as human review and a right to contest. The GDPR reaches a Malaysian firm that offers services to people in the EU (Article 3(2)).
What it means in practiceProcesses let a person review, explain and change an automated outcome, and record that this happened. At home, the same design supports PDPA notice, consent and breach notification duties.
SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)
- MiFID II and IDD advice recordsScopeEU law
EU rules on investment and insurance distribution require suitability or demands-and-needs assessments and a record of the advice given. An AI tool that supports advisers becomes part of that record.
What it means in practiceAssistants log what they displayed and which sources they drew on, so the advice file stays complete and open to review.
- PSD2 and the next payment services rulesScopeEU law
In the EU, PSD2 sets the rules for payment services and open banking access. PSD3 and a new Payment Services Regulation, agreed provisionally in 2025, will raise fraud prevention and API performance requirements once a transition period ends.
What it means in practicePayment APIs built for EU markets today should plan for stricter performance, monitoring and fraud-data sharing.
SourceDirective (EU) 2015/2366, EUR-Lex (opens external site)
Illustrative scenarios
Illustrative exampleIdentity checks at onboarding
At a bank or payment firm, identity and ownership documents would be extracted and cross-checked; an analyst decides every flagged case.
Answers for agents and advisers
Agents of a life insurer or takaful operator would get product, policy and procedure answers with sources, within their own access rights.
Complaint intake and routing
Customer complaints would be sorted by topic and urgency and routed with a draft summary, while response deadlines are tracked.
General insurance claim intake
Claim forms, repair invoices and reports would be read and matched to the policy; a claims handler approves every payment.
Core transactions as APIs
Core transactions of a banking or stockbroking platform would be exposed as documented APIs and events, so new channels no longer rely on batch files.
Platforms for financial institutions
Salesforce
Summit PartnerWorkspaces for advisers and agents, onboarding journeys and service operations, connected to core systems, document intake and PDPA consent records.
SAP
Gold PartnerFinance and group reporting, with SAP data supplied to risk and regulatory reporting along a documented lineage.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
Supervised in Malaysia, contracted from the EU
Banks, insurers, takaful operators, e-money issuers and operators of designated payment systems work under BNM’s RMiT, revised with effect from 28 November 2025, and capital market intermediaries under the SC Guidelines on Technology Risk Management, revised with effect from 19 August 2024. Since 1 June 2025, the PDPA as amended by Act A1727 has required a data protection officer where the thresholds are met and notification of personal data breaches to the Commissioner, within 72 hours under the Commissioner’s guidance.
For Malaysian firms serving EU banks or insurers, DORA arrives through the client’s contract. Our delivery produces the evidence once and keeps it usable for any reviewer: architecture and model documentation, logs, test results and exit plans, refreshed with each change to the system.
- BNM Risk Management in Technology (RMiT)Risk Management in Technology (RMiT), policy document of Bank Negara Malaysia for financial institutions (opens external site)
- Personal Data Protection Act 2010 (PDPA)Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727): data protection officer, breach notification, data portability (opens external site)
- DORADigital Operational Resilience Act, Regulation (EU) 2022/2554 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Frequently asked questions
How do you support RMiT, the SC guidelines and DORA as a provider?
We document our controls and the services we run for you, agree incident notification and exit arrangements in the contract, take part in resilience testing and supply the information your provider register and outsourcing records need. Where an EU client applies DORA, we agree the contract terms it requires. What the arrangement means under RMiT or the SC guidelines is for your risk and compliance teams to decide.
Can AI support credit or underwriting decisions?
Yes, if the safeguards match the decision. In the EU this is a high-risk use under the AI Act, which brings risk management, data governance, logs, human oversight and documentation. A person takes the decision and can explain it, and personal data is handled under the PDPA or, for customers in the EU, the GDPR.
Where would models and data run?
Where your risk appetite and your regulator’s expectations allow: your own cloud tenancy, a public cloud region agreed with you, or on premises for sensitive workloads. The hosting location is recorded in the contract, and model and hosting choices are documented with exit options.
Must we replace our core platform?
No. Integration is our default and modernisation happens in stages: APIs and events around the core first, functions moved out only where it pays, and reconciliation until the old path closes.
How is generative AI evaluated in regulated processes?
Before release, against test sets and quality criteria your risk and validation teams have agreed; after release, through monitoring and review steps for doubtful output. The process is built on the expectation that some output will be wrong and routes it to people.
Plan your next step in financial services
Introducing AI in onboarding, advice or claims, or preparing evidence for RMiT reviews or an EU client’s DORA clauses? Speak with engineers who design for supervisors as well as for users.