Following-up on their exposure draft issued in June 2021, Bank Negara Malaysia (“BNM”) has recently issued a Policy Document on the requirements and guidance applicable to approved issuers of electronic money (“EMI”).[1] Serving a twofold purpose, the Policy Document aims to:

 

(a) Ensure the safety and reliability of E-money issued by EMI; and

 

(b) Preserve customers’ and merchants’ confidence in using or accepting E-money for the payment of goods and services.

 

The usage of E-money has grown exponentially in recent times. Based on BNM’s data, the average number of digital payment transactions per capita has more than quadrupled over the last 10 years, increasing from 49 transactions per capita in 2011, to over 221 transactions per capita in 2021. In 2020, the nation saw 3 million new mobile banking service subscriptions, largely due to the COVID-19 pandemic. In light of our increasing reliance on E- money, it is of utmost importance that the integrity of E-money payment systems is duly safeguarded.

 

The Policy Document is divided into 5 parts –

 

a) Part A – Overview;

 

b) Part B – Governance;

 

c) Part C – Operational and Risk Management Requirements;

 

d) Part D – Information Technology (IT) Requirements; and

 

e) Part E – Regulatory

 

This Update will focus on Part D of the Policy Document, which sets out the IT requirements imposed by BNM. With over 20 pages dedicated to IT Requirements, the Policy Document imposes extensive risk assessment and management obligations, including:

 

Establishing a Technology Risk Management Framework (“TRMF”) to safeguard the EMI’s information infrastructure, systems and data as an integral part of the EMI’s risk management framework;

 

• Establishing an independent enterprise-wide technology risk management framework for implementing the TRMF as well as a Cyber Resilience Framework (“CRF”);

 

• Appointing a Chief Information Security Officer (“CISO”) to be responsible for the technology risk management function of the EMI;

 

• Establishing an Enterprise Architecture Framework that provides a holistic view of technology systems and functions of the EMI;

 

• Establishing clear risk management policies and practices for key phases of the system development cycle (“SDLC”);

 

• Establishing proper management of data infrastructures, authorisation procedures to ensure confidentiality, integrity and availability of data;

 

• Conducting a comprehensive risk assessment prior to cloud adoption which considers the inherent architecture of cloud services;

 

• Implementing an appropriate and robust access control policy for logical and physical technology access controls;

 

• Implementing additional controls for high-risk transactions or transactions above RM10,000.00; and

 

• Ensuring that technology systems and applications are properly audited.