What BNM RMiT Expects from Bank Staff in Malaysia

Enforcement or supervisory actions can be taken against the financial institutions including its directors, officers and employees for any noncompliance with any provision marked as “S” in Part B of this policy document.

Paragraph 1.3, BNM Risk Management in Technology (RMiT), issued 25 September 2026

Most of RMiT is written for the financial institutions. But this one sentence shows that the accountability doesn’t stop at the institution. It reaches the directors, officers and employees too. That includes you.

So, what does RMiT expect from the people who work in a bank? This blog walks you through the answer, by role.

Key RMiT Expectations for Bank Staff in Malaysia

The expectations below follow the order of RMiT’s Part B (Policy Requirements).

1. Directors and senior management

Section 8: Governance

What the bank must do:

• The board decides how much technology risk the bank is willing to take (technology risk appetite), and oversees the plans for managing technology and cyber risk.
• The board designates a committee to watch over technology matters, with at least one member with technology experience.
• Board members get regular training on technology, set aside real time to discuss cyber risk, and join cybersecurity awareness training themselves.
• Senior management runs technology and cyber risk day to day, and sets up a team from different departments to guide technology plans.
• Any exception to a technology policy is approved only after a careful risk check, and any major exceptions are reported to the board.

What this means for you (if you’re a director, senior manager or team lead):

• Make time for training and briefings. Leadership participation is expected.
• Never ask staff to skip a control because of a deadline. If a deviation is truly needed, it goes through a formal risk assessment, not a verbal “just do it.”
• Make it safe for people to report problems. Staff only escalate if they trust they won’t be blamed.
• Treat cyber risk as a business issue, not only an IT issue.

2. Specialists: competence and certification

Section 9: Technology Risk Management

What the bank must do:

• Designate a Chief Information Security Officer (CISO) who is independent of day-to-day technology operations, has the right skills and holds the right certification.
• The CISO writes the security policies and enforces compliance with them.
• Keep training staff in technology operations, cybersecurity and risk management, so they are competent and suitably certified.

What this means for you (if you work in these roles):

• Keep your skills and certifications up to date, and take the training the bank offers.
• If you work in security or risk, stay independent. Don’t water down your findings because someone asks you to.
• Know who is responsible for the risks of the systems you work on, and raise concerns early (if any).

3. Technology and project staff

Section 10: Technology Operations Management

What the bank must do:

• Keep production separate from development and test environments.
• Review the code behind critical systems before changes go live.
• Have system changes independently reviewed and approved with contingency plans
• Authorise and protect any sensitive data used as test data.
• Fix security weaknesses quickly. Don’t run systems that have known flaws or are no longer supported, unless there is an approved, risk-checked exception with a deadline.
• Identify and reduce “shadow IT” (tools used without the IT team’s approval).

What this means for you (developers, testers, DevOps, infrastructure):

• Don’t make changes outside the review and approval process, even for a quick fix.
• Don’t copy real customer data into test environments without authorisation and protection.
• Raise unpatched or end-of-life systems rather than working around them.
• Use only approved tools. Pasting customer data or internal code into an unapproved AI tool counts as shadow IT. “Everyone on the team does it” doesn’t make it approved. If a tool would help, ask for it to be assessed.

4. Third-party and vendor staff

Section 10: Technology Operations Management

What the bank must do:

• Write into vendor contracts that the vendor must tell the bank quickly about any disruption or cyber incident.
• Require vendors to keep their key staff’s skills and certifications current, and join the bank’s awareness programme where appropriate.
• Protect physical data media (such as removable drives). Media must never be held by just one person, and must always stay within sight of its designated custodians.

What this means for you:

• If you manage vendors: finish due diligence and contract terms before giving access. A verbal “yes” is not approval. Keep access limited, and remove it when the work ends.
• If you work for a vendor: you are part of the bank’s defences. Complete the training you’re given and report incidents promptly.
• If you handle physical media: follow the custody rules. Never handle it alone, and never let it out of sight.

5. Access control

Section 10: Technology Operations Management

What the bank must do:

• Deny access by default. Give it only when someone has explicitly approved it.
• Give each person only the access their job needs (least privilege), sometimes only for a set period.
• Tie credentials to one individual so accountability is clear.
• Use strong multi-factor authentication on critical systems, strong enough to resist social engineering.
• Split duties and require two approvals for certain tasks, so no single person can change, bypass or switch off security controls alone.
• Record user activity on critical systems, keep the records for at least three years, and flag anything unusual for investigation.
• Approve and monitor any vendor or programmer access to live systems.

What this means for you:

• Never share logins or sessions. If a colleague carries on in your open session, everything they do is recorded under your name. End the session and let them start their own.
• Only access what your work requires. Activity is logged and unusual activity is investigated, so looking up a friend’s or relative’s account will show up. Point them to the normal channel.
• Don’t get around approval steps. Two-person approvals and split duties exist so that no one, even with good intentions, can override controls alone.
• Request access through the proper process, even when you’re in a hurry. If you need more access for a task, ask for it formally.

6. Incident reporting and service disruption

Section 11: Cybersecurity Management

What the bank must do:

• Detect and escalate incidents quickly.
• Maintain an incident response plan whose Cyber Emergency Response Team (CERT) members know the plan and remain contactable at all times.
• Hold a cyber drill every year to test the plan against current threats, with social engineering as one example.
• By 30 September 2027, be able to detect failed transactions and service slowdowns early. Escalate to senior management straight away if a disruption hits 5% or more of expected daily customers or transactions.
• Keep critical systems down for no more than 4 hours in total over any 12 months, and no more than 120 minutes in a single incident.
• From 15 October 2027, publish its service availability record every quarter.
• Give staff clear responsibilities and a clear way to escalate.

What this means for you:

• Report early, even when it’s your own mistake. A misdirected email, a clicked phishing link or a lost device should go to the incident process straight away, not wait a day and see.
• Report colleague misconduct through the designated channel. A quiet word doesn’t create the record the bank needs.
• Know your escalation path before something goes wrong. When a disruption is measured in minutes, hesitation counts.
• Take part in drills when asked. They are how the bank finds gaps before attackers do.
• Don’t hide or minimise problems, including unpatched vulnerabilities you know about, even if someone asks you not to make a fuss.

7. Fraud, verification and customer-facing work

Section 12: Digital Services

What the bank must do:

• Staff the contact centre well enough to help customers quickly when fraud is suspected. This includes suspending and reactivating accounts, and restoring access once the customer is verified.
• Give customers practical ways to verify that a call is genuinely from the bank or its outsourced provider.
• Remove clickable links from SMS messages sent to customers.
• After a data leak or fraud incident, watch affected accounts more closely, tell affected customers and replace their credentials where needed.
• Keep customer fraud-awareness programmes continuously refreshed.

What this means for you:

• Know and follow the verification processes. If a customer asks to change their registered contact number after losing a device, a correct name, date of birth and security question aren’t enough. Apply the extra verification your procedure requires.
• Stay firm under pressure. Scammers rush people, and they use the same tricks on staff, like a “senior manager” who needs account details right away. Route the request through the standard process however urgent it sounds, and call back using official contact details, not the number the caller gives you.
• Don’t send customer data outside approved channels. If a customer asks for a statement by personal email, explain that sensitive information goes only through the secure channel, and help them use it.
• Verify third-party representatives. If an accountant says they act for a customer, confirm the authorisation with the customer or your records first.
• Spot patterns. If several customers mention odd “password reset” emails you can’t trace, escalate it. Your report may help the bank catch a scam campaign early.
• Keep up with new scams, so you recognise new patterns when customers describe them.

8. Technology audits

Section 13: Technology Audits

What the bank must do:

• Match the scope, frequency and depth of technology audits to how complex and critical its systems are.
• Review the technology audit plan every year. The plan should cover critical services, third-party providers and major system changes.
• Have dedicated technology auditors who are specialised and professionally certified.

What this means for you:

• If you’re an auditor: keep your certifications current and protect your independence. If you advise on new projects, think about whether that could affect how fairly you review them later.
• If you’re anyone else: give auditors accurate records and don’t hide gaps. Fix audit findings quickly, because the board audit committee must make sure they are closed on time.

9. External party assurance

Section 14: External Party Assurance

What the bank must do:

• Hire a qualified expert or an external provider to check how resilient your main data centre and its network are.
• Do these checks at least every three years, or sooner after a major change.
• Have the board-level committee discuss the results.

What this means for you:

• If you work in data centre, network or infrastructure teams: give the assessors accurate information and help fix the gaps they find. Don’t tidy things up just for the visit.
• If you’re anyone else: your role is indirect. Following the access, change and reporting rules day to day is what these assessments end up testing.

10. Training and awareness

Section 15: Security Awareness and Education

What the bank must do:

• Give all staff adequate, regular technology and cybersecurity awareness training that suits their roles, at least once a year, reflecting current threats.
• Measure whether the training works, not just who attended or completed it.
• Include relevant third-party providers where appropriate.
• Staff in technology operations, cybersecurity and risk management get continuous training.
• Give board members regular training and updates on technology developments.

What this means for you:

• Complete your training and treat it as part of your job. The bank is expected to measure behaviour, and phishing simulations are one way it does that.
• Apply what you learn. Passing the quiz isn’t the goal, spotting the real phishing email is.
• Keep up with new scam patterns, because customer fraud-awareness programmes are expected to be refreshed continuously.

The Pattern to Remember

1. Follow the process when someone pushes you to skip it. Urgency and seniority are not approval.
2. Use your own access, and only what you need. Never share logins or sessions.
3. Use approved channels and tools for bank and customer data. Personal email, unapproved apps and unapproved AI tools are out.
4. Verify before you act. A correct name and date of birth don’t prove who is on the line. Check, then proceed.
5. Report early, including your own mistakes. The bank can only fix what it knows about.
6. Report what you see. If a colleague is breaking the rules or something looks off, use the official channel. A quiet word leaves no record.
7. Keep learning. Complete your training, join the drills and keep up with new scams, because threats change faster than policies.
8. Ask when you’re unsure. A quick question to your compliance, risk or security team costs far less than a breach.
9. Support the checks. Audits and assessments only work if people give accurate information and fix what they find.
10. Lead by example. If you manage people, never ask them to skip a control, and make it safe for them to speak up.

The bank builds the controls. You make them work.

This blog is not a legal or compliance advice. Always refer to the official RMiT policy document and your institution's compliance team for obligations that apply to you.