Bank Negara Warns Even a Small Bank Could Put Malaysia’s Financial System at Cyber Risk
Bank Negara Malaysia (BNM), the country’s central bank, says every bank and payment institution, however small, must be ready to fend off and contain a cyber attack. Governor Datuk Seri Abdul Rasheed Ghaffour warned on 6 November that “even a small bank could pose a risk to the entire financial system”, as the government urges vigilance against rising cyber threats.
Key facts
- BNM requires financial institutions to keep adequate cybersecurity safeguards and to keep strengthening them, the governor told the national news agency Bernama.
- Under BNM’s Risk Management in Technology (RMiT) policy, institutions must run cyber drills every year to test their systems and find weak spots.
- Incident reporting platforms let BNM and institutions share threat intelligence, so new threats can be spotted early and kept from spreading across the sector.
- If an attack happens, BNM expects institutions to contain it first, by isolating affected systems and cutting connections where needed, and they may pause some online services while they investigate.
- The latest RMiT revision, effective 28 November 2025, added a code of practice endorsed by the National Cyber Security Agency (NACSA) for firms classed as national critical information infrastructure.
What BNM is asking banks to do
The governor’s message has three parts: prevent, detect and recover. Banks and other regulated firms are expected to take a “proactive and comprehensive” approach, stopping incidents where they can and catching threats quickly when they can’t.
The annual cyber drills required by RMiT are a key tool. They work like a fire drill for IT systems: a bank simulates an attack to see whether its defences hold and whether it can keep serving customers even if some systems are compromised.
BNM also stressed that it reviews its guidelines and standards regularly, so the rules keep pace with new kinds of attacks. Rasheed said cybersecurity has long been a priority because it underpins public confidence, and confidence in turn affects financial stability.
What it means for Malaysians
For consumers: the most visible effect of a cyber incident may be a bank’s app or website going offline for a while. BNM has said openly that a temporary suspension of some online services is an acceptable part of containing an attack, as long as the institution recovers with minimal disruption and protects customer information. If your bank’s online services go down, use official channels for updates and be wary of messages or links claiming to “fix” your account. Scammers often exploit outages.
For smaller banks and fintechs: the “weakest link” warning is aimed squarely at them. Size is no excuse. Digital banks, smaller lenders and payment firms connected to shared networks are expected to meet the same level of preparedness, because an attack on one connected player could ripple out to others.
For merchants and SMEs: businesses that rely on online banking, payment gateways or DuitNow transfers should have a back-up plan, such as a second bank account or an alternative way to accept payment, in case a provider pauses services during an incident.
Why now
The comments follow a run of cyber attacks reported around the world that have raised concern about critical digital infrastructure, including the financial sector. Prime Minister Datuk Seri Anwar Ibrahim recently said Malaysia must stay vigilant against escalating cyber threats.
BNM did not announce new penalties or deadlines. Instead, the governor pointed to the rules already in place and signalled that supervisors will keep checking that every institution, large or small, can withstand an attack.
What to watch
- Whether BNM issues further updates to the RMiT policy or new guidance on how quickly institutions must restore online services after an incident.
- How smaller banks, digital banks and e-money issuers strengthen their defences and cyber drills in response to the “weakest link” warning.
- Closer co-ordination between BNM and NACSA on protecting the financial sector as critical national infrastructure.
Related on FinDeskAsia: PayNet and the regulators · How Malaysia’s payment system works
Sources: Malay Mail / Bernama (November 2026) · Media Selangor via Newswav (November 2026) · Bank Negara Malaysia, RMiT policy document (November 2025)
