Malaysia

Risk Management in Technology (RMiT) guidelines issued by Bank Negara Malaysia (BNM) provide binding requirements concerning technology risks and operational resilience in the Malaysian financial sector. Fully effective since September 2026 after its update in November 2025, this guideline requires active protection against cyber threats, continuous monitoring via the Security Operations Centre, and reporting to BNM within an hour of any notable incident. More information on regulatory changes can be found on the Bank Negara Malaysia website.

The Financial Services Act 2013 (FSA) is the main statutory law regulating the conventional financial services of Malaysia, including banking, insurance, and payment systems, having been fully implemented on June 30, 2013, to repeal old acts such as the BAFIA. As of September 2026, the Act has remained valid and is being actively implemented by Bank Negara Malaysia (BNM) with help from the new Amendment Act A1761 that came into force on March 1, 2026, to update electronic transactions. The FSA is the enabling law that allows BNM to implement regulations, including the RMiT framework, among others.

IFSA stands out as the leading legislation guiding Islamic banking, takaful, and Shariah-compliant payment systems in Malaysia, coming into force on June 30, 2013. By September 2026, the legislation continues to be in full force and effect, backed by the Islamic Financial Services (Amendment) Act 2026, which defines the modern concept of digital Islamic assets and electronic transactions. This piece of legislation makes Shariah compliance an essential statutory requirement, punishable by heavy fines of up to RM 25 million for any violation, and grants Bank Negara Malaysia the power to regulate the industry through operational rules such as the RMiT Framework.

Personal Data Protection Act 2010 (PDPA) is one of the major pieces of legislation covering personal data processing within commercial operations in Malaysia since the law was enacted on November 15, 2013. By September 2026, the Act functions on a highly modernized platform due to the successful implementation of the Personal Data Protection (Amendment) Act 2024 in mid-2025. The modified framework is strictly enforced by the Personal Data Protection Commissioner (PDPC), with strict compliance pillars being mandatory, such as the compulsory appointment of the Data Protection Officer (DPO), a 72-hour data breach notification period, and increased financial sanctions amounting to up to RM 1 million. PDPA interfaces with financial systems such as BNM RMiT to ensure the personal data processed in the digital environment complies with general privacy laws and banking security measures.

The main legislative statute governing securities, derivatives, and capital markets in Malaysia is the Capital Markets and Services Act 2007 (CMSA), which was established on September 28, 2007, in order to unify the previous statutes. The statute is still in effect until September 2026 due to its effective implementation by the Securities Commission Malaysia (SC). It is also supplemented by the Capital Markets and Services Order 2025, which was promulgated on January 1, 2026, and aims to modernize the regulation of trust companies, expand the scope of exempted transactions, and enable foreign currency debentures. It is the supreme statute for granting CMSL licenses and punishing market misconduct, including insider trading.

Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 (AMLA) is Malaysia’s key piece of legislation that aims to deal with illegal financial flows, coming officially into force on 15 January 2002. As of September 2026, AMLA is rigorously enforced by Bank Negara Malaysia (BNM), as it has received a considerably updated mandate due to the substantial changes made in order to address the financing of restricted activities and weapons of mass destruction on 1 March 2026. AMLA requires reporting entities to perform stringent Customer Due Diligence (CDD), identify UBOs, generate CTRs automatically if a transaction is over RM 25,000, and report STRs right away. AMLA intersects directly with BNM’s RMiT program, requiring financial institutions to implement robust tamper-proof algorithmic transaction monitoring mechanisms in order to avoid substantial statutory penalties and criminal responsibility.