BNM tightens cybersecurity safeguards for financial institutions amid rising global threats

BNM’s Risk Management in Technology (RMiT) policy document requires financial institutions to conduct annual “cyber drills”. — File picture by Yusof Mat Isa

First Published: Friday, 06 Nov 2026 5:04 PM MYT

KUALA LUMPUR, Nov 6 — Bank Negara Malaysia (BNM) has put in place regulatory requirements for financial institutions to maintain adequate cybersecurity safeguards, continuously strengthening their defences, said Governor Datuk Seri Abdul Rasheed Ghaffour.

This comes as Prime Minister Datuk Seri Anwar Ibrahim recently warned that Malaysia must remain vigilant against escalating cyber threats amid a series of cyberattacks reported globally that have heightened concerns over the vulnerability of critical digital infrastructure, including the financial sector.

The governor stressed that cybersecurity has always been a priority because it is the foundation of confidence and it could have implications for financial stability.

“We expect financial institutions to adopt a proactive and comprehensive approach to cybersecurity, with strong measures to prevent cyber incidents (as well as) detect and contain threats promptly,” he told Bernama.

Abdul Rasheed said BNM continuously reviews and updates the guidelines, regulations, requirements and standards to ensure that financial institutions remain equipped to address emerging cyber threats.

Incident reporting arrangements and platforms are also in place to enable the central bank and financial institutions to exchange threat intelligence. This helps identify emerging threats early and reduces the risk of contagion across the financial sector.

He noted that BNM’s Risk Management in Technology (RMiT) policy document requires financial institutions to conduct annual “cyber drills”.

These exercises are intended to test banks’ systems, identify weaknesses and ensure they can maintain operational resilience even if their systems are compromised.

He said cybersecurity preparedness must extend across all financial institutions, regardless of their size, as weaknesses in one institution could potentially expose the wider financial system.

“In cybersecurity, the weakest link would affect everyone as entities within the system are all interconnected. Even a small bank could pose a risk to the entire financial system,” he said.

In the event of an attack, the immediate priority would be to contain the threat by isolating affected systems, disconnecting connections where necessary and conducting checks to minimise contagion risk to other systems or institutions.

He said affected institutions might have to temporarily suspend certain online operations while investigations and security assessments are carried out before services could safely resume.

He added that BNM expects financial institutions to recover operations with minimal disruption while safeguarding customer information. — Bernama