BNM RMiT Guide for Cybersecurity Vendors and Partners (2026)
Bank Negara Malaysia's Risk Management in Technology (RMiT) policy document is the main technology and cyber rulebook for Malaysian banks, insurers, e-money issuers and payment players. It is unusually specific, with fixed testing cycles, a 24x7 SOC, DLP coverage and customer authentication rules. That makes it one of the clearest regulation-to-product maps in ASEAN.
Key facts
- Current version: revised RMiT published 28 November 2025 and effective from that date unless a paragraph states otherwise; BNM's page marks the document as updated on 25 September 2026. It replaced the June 2023 version.
- Who: licensed banks, investment banks and Islamic banks, insurers and takaful operators, prescribed development financial institutions, e-money issuers, designated payment system operators, registered merchant acquirers and intermediary remittance institutions. Some parts do not apply to the smaller payment players.
- Availability: unplanned downtime of critical systems' customer-facing interfaces of no more than 4 hours over a rolling 12 months, and no more than 120 minutes per incident.
- Testing cycle: quarterly vulnerability assessments, annual intelligence-led penetration tests, an annual cyber drill, and red teaming plus an independent compromise assessment at least every three years.
- Operations: a 24x7 SOC, DLP across data in use, in motion and at rest, DDoS mitigation with clean-pipe services, tamper-proof backups with an isolated recovery environment, and at least three years of log retention for critical systems and network devices.
- Cloud: institutions must consult BNM before first-time adoption of public cloud or emerging technology for critical systems, and notify BNM for later adoptions.
- NCII: Appendix 12 is the Code of Practice under the Cyber Security Act 2024 for designated National Critical Information Infrastructure entities in banking and finance. It prevails over the main text where the two conflict.
1. Requirements with hard numbers
These are the RMiT requirements most often turned into a project, with the product categories they usually pull in.
| Area | What RMiT requires | Typical product categories |
|---|---|---|
| Service availability | No more than 4 hours of cumulative unplanned downtime in a rolling 12 months, and no more than 120 minutes per incident, for critical systems' customer and counterparty interfaces | High availability and DR, DDoS protection, observability |
| Early warning and stand-in processing | Early-warning mechanisms (escalate immediately when 5% or more of expected daily customers or volumes are affected) and stand-in processing arrangements, by 30 September 2027 | Observability and AIOps, resilience architecture |
| Public availability disclosure | Quarterly disclosure of service availability, starting 15 October 2027 | Service monitoring and reporting |
| Vulnerability assessment | Quarterly assessments of external and internal network components supporting critical systems | Vulnerability management, attack surface management |
| Penetration testing | Annual intelligence-led tests of infrastructure, critical systems and digital services by accredited testers, and before launching new systems or services | Penetration testing services, threat intelligence |
| Red teaming and compromise assessment | Red team simulation and an independent compromise assessment of critical systems at least once every three years | Red team services, threat hunting, compromise assessment |
| Cyber drills | Annual cyber drill | Tabletop and cyber range exercises, IR retainers |
| Resilience assessments | Data centre and network resilience assessments at least once every three years or on material change | Infrastructure assessment services |
| Security operations | SOC operating 24x7, monthly threat assessment report, threat intelligence subscription | SOC/MDR, SIEM, threat intelligence feeds |
| Data loss prevention | DLP covering data in use, in motion and at rest | DLP (endpoint, network, cloud), data classification |
| DDoS | DDoS mitigation services, including automatic clean-pipe services, and geolocation controls | DDoS protection, upstream scrubbing |
| Backup and recovery | Tamper-proof backups and an isolated recovery environment | Immutable backup, cyber recovery vaults |
| Logging | At least three years' retention of network device logs and critical system activity logs | SIEM, log management, archive storage |
| Patching and end-of-life | No known vulnerabilities or end-of-life technology in production; severity-based patch turnaround times; approved exceptions reviewed annually | Patch management, vulnerability prioritisation, virtual patching |
| Access control | MFA for critical systems; stronger authentication for critical activities and remote access; dual authorisation criteria for privileged activities | PAM, MFA, privileged remote access |
2. Digital services and fraud (Appendices 3 and 11)
RMiT goes further than most ASEAN rules on customer-facing security, which matters for anyone selling authentication, mobile app protection or fraud tools to Malaysian banks and e-wallets.
| Area | What RMiT requires | Typical product categories |
|---|---|---|
| Customer authentication | MFA for financial and high-risk non-financial transactions (including adding a favourite beneficiary), stronger than unencrypted SMS; OTPs generated on the customer's device; key-based authentication offered as an alternative to passwords | Passkeys and FIDO, in-app soft tokens, mobile app security |
| Limits for new customers | Conservatively low default transfer limits for new customers | Risk-based authentication, transaction limits engines |
| Fraud detection | Detect and block suspicious transactions in real time, terminate hijacked sessions, notify customers immediately and contact them within 30 minutes, validate the fraud playbook yearly | Real-time fraud detection, device intelligence, session monitoring |
| Digital service logs | Retain digital service logs for at least three years | Log management, fraud analytics |
3. How the policy is organised
| Part B section | Focus | Typical product categories |
|---|---|---|
| 8. Governance | Board and senior management oversight | GRC, board reporting |
| 9. Technology Risk Management | Risk framework and assessment | GRC, IT risk management |
| 10. Technology Operations Management | Availability, patching, backup, access control, logging | HA/DR, patching, PAM, SIEM |
| 11. Cybersecurity Management | SOC, testing, cyber drills, incident handling | SOC/MDR, VA/PT, red teaming |
| 12. Digital Services | Online and mobile channels | Customer authentication, app security, fraud |
| 13. Technology Audits | Independent audit of technology risk | Audit evidence, compliance reporting |
| 14. External Party Assurance | Third parties, data centre and network resilience | Third-party risk management, assessments |
| 15. Security Awareness and Education | Staff and customer awareness | Security awareness training, phishing simulation |
Part C covers the regulatory process: notifications for technology-related applications, consultation and notification for cloud services and emerging technology, and assessment and gap analysis.
4. NCII Code of Practice and the Cyber Security Act 2024
Appendix 12 is the Code of Practice for designated National Critical Information Infrastructure entities in banking and finance, made under section 25(1) of the Cyber Security Act 2024. Where it conflicts with the main RMiT text, the Appendix prevails for those entities. An NCII entity may use alternative measures only if it shows NACSA's Chief Executive that they give equal or higher protection. For sellers, this means the largest banks and insurers answer to both BNM and NACSA on cybersecurity, and evidence of compliance matters even more.
5. Using RMiT in a sales conversation
- Use the fixed cycles. Quarterly VA, annual pen tests and drills, and three-yearly red teams and compromise assessments are predictable buying windows. Ask when the last one was done.
- Watch the 2027 deadlines. Early-warning and stand-in processing are due by 30 September 2027, and quarterly availability disclosure starts 15 October 2027. Observability and resilience projects need budget in 2026–2027.
- Plan for the cloud consultation. If a SaaS or cloud deal touches a critical system and is the institution's first public cloud adoption for one, BNM consultation adds time. Have a risk assessment pack ready.
- Customer authentication is a live topic. The move away from SMS OTP toward device-bound and key-based authentication drives passkey, soft-token and anti-fraud projects at banks and e-wallets.
- Bring evidence for NCII entities. Designated entities must document compliance with the Code of Practice and produce it on request.
Looking for who sells these categories in the region? See the Channel Map.
Sources
- Bank Negara Malaysia: Revised Policy Document on Risk Management in Technology (RMiT)
- BNM: Risk Management in Technology (RMiT) policy document (PDF)
- Allen & Gledhill: Bank Negara Malaysia revises Risk Management in Technology Policy Document
- Rahmat Lim & Partners: BNM revises RMiT to include Cyber Security Code of Practice
This guide summarises BNM's public RMiT policy document for people who sell cybersecurity. It is not legal or compliance advice; check the current policy document, including which paragraphs apply to the specific institution type. Spotted something out of date? Tell us. Get regulation changes in the weekly newsletter.