Financial Services Update: Revision to Policy Document on Risk Management in Technology

Bank Negara Malaysia ("BNM") has revised the policy document on Risk Management in Technology ("RMiT PD") on 25 September 2026.
 
Following the revision to the RMiT PD:

• a new Appendix 12 on New cyber security Code of Practice for NCII entities has been inserted. Institutions designated by BNM as national critical information infrastructure entities under the Cyber Security Act 2024 ("NCII entities") face added requirements on governance, cyber policy, staff training, audits (every two years), vendor management, asset inventory, and annual risk assessments.
• Appendix 12 will prevail for NCII entities, in the event of any inconsistency between Appendix 12 and the main body of the RMiT PD.

Contact us for further information regarding Financial Services matters. 

COPYRIGHT © 2026  SHEARN DELAMORE & CO. ALL RIGHTS RESERVED
THIS UPDATE IS ISSUED FOR THE INFORMATION OF THE CLIENTS OF THE FIRM AND COVERS LEGAL ISSUES IN A GENERAL WAY. 
THE CONTENTS ARE NOT INTENDED TO CONSTITUTE ANY ADVICE ON ANY SPECIFIC MATTER AND SHOULD NOT BE RELIED UPON AS A SUBSTITUTE FOR DETAILED LEGAL ADVICE ON SPECIFIC MATTERS OR TRANSACTIONS.