Bank Negara sets 4-hour downtime cap for critical banking systems in revised RMiT

Bank Negara Malaysia has reissued its Risk Management in Technology policy document, consolidating and superseding the 2023 RMiT and five other instruments. It sets hard availability metrics for critical systems, phased resilience deadlines through 2027, and governance obligations covering the board, a designated technology committee and a CISO. The scope reaches well beyond banks into insurers, takaful operators, e-money issuers, payment system operators and remittance institutions.

• Critical systems must keep cumulative unplanned customer-facing downtime to no more than 4 hours on a rolling 12-month basis and no more than 120 minutes per incident.
• Firms must implement early-warning mechanisms and establish stand-in processing arrangements by 30 September 2027, and escalate to senior management when disruptions affect 5% or more of expected daily customers or transaction volumes.
• Service-availability track records must be disclosed quarterly within 15 calendar days of quarter-end, beginning 15 October 2027.
• The board must designate a technology committee with at least one member holding technology experience, and the firm must designate a CISO independent of day-to-day technology operations.
• The document supersedes the 1 June 2023 RMiT and five other instruments, and network device logs must be retained for at least three years.

Executive summary

Bank Negara Malaysia issued a reissued Risk Management in Technology (RMiT) policy document on 25 September 2026 under reference BNM/RH/PD 028-98. The document states it comes into effect on 28 November 2025 except where otherwise stated, and it supersedes the…

Machine-verified against the primary source, then read, edited and published by the Regulus editorial desk on 19 Oct 2026.