Cyber Risk Remains Leading Concern for Malaysia’s Financial Institutions, Says BNM
Cyber risk continues to be the most significant operational concern for Malaysia’s financial institutions as digital adoption accelerates and threat actors deploy increasingly sophisticated techniques. According to Bank Negara Malaysia’s Financial Stability Review for the second half of 2025, financial institutions remain operationally resilient despite a rise in cyber threats, fraud attempts and technology-related disruptions. The central bank noted that institutions are strengthening cyber defences and operational controls as digital financial services expand and interdependencies with third‑party providers grow.
Cyber threats and operational risks remain prominent
Bank Negara Malaysia (BNM) identified cyber risk as the foremost concern facing financial institutions in 2026, given the operational, financial and reputational consequences associated with successful cyber incidents. The central bank also highlighted strategic and organisational risks linked to evolving business models, intensifying competition for specialised talent and the rapid pace of technological change.
Other operational risks include information technology disruptions, potential execution failures caused by human error and vulnerabilities arising from the growing reliance on external service providers. These risks are emerging as financial institutions expand digital services and integrate more complex technology infrastructure.
Operational resilience maintained despite rising losses
BNM reported that financial institutions remained operationally resilient throughout the second half of 2025. Financial losses from operational incidents increased slightly but remained limited, amounting to 0.11 per cent of total banking system capital compared with 0.04 per cent in the first half of 2025 and 0.03 per cent in the second half of 2024.
Most losses were linked to a small number of external fraud cases and isolated system disruptions. Authorities noted that institutions addressed these incidents through prompt corrective and recovery actions while continuing to strengthen internal risk management systems and operational controls.
The emphasis on cyber resilience aligns with broader national efforts to reinforce digital security and infrastructure, including initiatives highlighted in Malaysia’s push to strengthen cybersecurity and connectivity for a resilient digital economy.
Managing risks from third‑party service providers
Incidents involving third‑party service providers rose slightly amid global data leaks and supply‑chain compromises. However, BNM reported no major incidents or direct breaches affecting local financial institutions.
The central bank assessed systemic risks from third‑party failures as low, citing strengthened oversight, stricter risk management controls and improved contingency planning by financial institutions. Ongoing investments in cyber resilience complement broader national initiatives such as the development of new cybersecurity capabilities, including those discussed in Malaysia’s efforts to bolster digital resilience through dedicated cyber centres.
Fraud threats rising alongside digital banking
BNM noted a significant increase in the number of fraudulent transactions successfully blocked in 2025 as financial institutions strengthened monitoring and detection systems. Despite this progress, reported fraud cases continued to rise, largely due to increasingly sophisticated malware capable of compromising customer devices and enabling unauthorised fund transfers.
To mitigate these risks, the central bank and industry participants enhanced mobile shielding technologies to better protect mobile banking platforms and customer devices from malware and unauthorised access.
Payment systems strengthened through RENTAS+
BNM also reported that key payment and settlement infrastructure, including the Real-time Electronic Transfer of Funds and Securities System (RENTAS) and major retail payment systems, maintained high availability during the second half of 2025. Isolated incidents were resolved quickly without systemic impact.
To address credit and settlement risks associated with the growing volume of electronic payments, BNM introduced near real-time settlement for Real-time Retail Payments Platform transactions through the launch of RENTAS+ in late September 2025. Under this model, transactions are settled on a near real-time gross basis, significantly reducing interbank credit and settlement risks while strengthening overall confidence in Malaysia’s payment infrastructure.
