MalaysiaBNM Risk Management in Technology Policy Document, Cyber Incident Notification and Threat Intelligence Sharing
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds a financial institution that this policy document covers: a licensed bank, investment bank or Islamic bank, a licensed insurer or takaful operator, a prescribed development financial institution, an approved issuer of electronic money, an operator of a designated payment system, a registered merchant acquirer, or an intermediary remittance institution (reached by declaring that you provide financial services). Some paragraphs are disapplied for the smaller classes in paragraph 2.2.
- Notify the Bank of cyber incidents in adherence to the Bank's policy documents on Operational Risk Reporting (Part C), Business Continuity Management (Part C) and Merchant Acquiring Services (paragraphs 19.25 to 19.26), and any other relevant policy document the Bank specifies; the clock sits in those documents, and the RMiT policy document states none (S 11.18).
- Subject to the applicable data protection laws, share cyber threat intelligence information with the industry on a timely basis through the sharing platforms developed by the Bank, the industry or law enforcement agencies, and allocate resources to take part in industry-wide initiatives that improve collective threat intelligence capabilities (S 11.19).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Bank Negara Malaysia, which may take enforcement action for non-compliance with a standard (S) of the policy document.
Settledness
- As of
- Open questions
- Within what time must a cyber incident be notified to the Bank, given that S 11.18 leaves the clock to the Operational Risk Reporting and Business Continuity Management policy documents?
What this law does
Paragraph S 11.18 requires a financial institution to notify the Bank of cyber incidents in adherence to the Bank's policy documents on Operational Risk Reporting, Business Continuity Management and Merchant Acquiring Services, and any other relevant policy documents the Bank specifies.
Paragraph S 11.19 requires a financial institution to share cyber threat intelligence information with the industry on a timely basis, subject to the applicable data protection laws, and to allocate resources to take part in industry-wide initiatives.
The policy document applies to licensed banks, licensed investment banks, licensed Islamic banks, licensed insurers, licensed takaful operators, prescribed development financial institutions, approved issuers of electronic money, operators of a designated payment system, registered merchant acquirers and intermediary remittance institutions.
The requirements in the policy document are specified pursuant to sections 47(1), 47(2)(d) and 143(2) of the Financial Services Act 2013, and to the corresponding sections of the Islamic Financial Services Act 2013, the Development Financial Institutions Act 2002 and the Money Services Business Act 2011. Paragraph 5.2 provides that non-compliance with a standard may result in enforcement action. Paragraph 4.1 states that the policy document comes into effect on .
When LexLint raises it
When your app profile says your app provides financial services.