BNM AI Guidelines

BNM AI Guidelines refers to the regulatory guidance issued and proposed by Bank Negara Malaysia (BNM), the country's central bank, governing the use of artificial intelligence in Malaysia's financial sector. Rather than a single standalone regulation, BNM's approach to AI oversight is layered across its existing Technology Risk Management (TRM) framework, supplemented by a formal Discussion Paper on AI in the Financial Sector published in August 2025 and an industry-led AI Governance Framework developed by the Association of Banks in Malaysia (ABM) and the Asian Institute of Chartered Bankers (AICB).

Background

Malaysia's financial sector began adopting machine learning and AI tools at scale from approximately 2018, initially for fraud detection, credit scoring, and customer service automation. By the end of 2024, BNM's own AI Survey found that 71 percent of banking institutions and development financial institutions (DFIs) had implemented at least one AI application — up from approximately 56 percent the prior year. Among insurance and takaful operators, adoption rose from 58 percent to 77 percent of companies over the same period.

This rapid adoption prompted BNM to formalise its regulatory expectations. The central bank recognised that existing frameworks — principally the 2020 TRM framework and the Risk Management in Technology (RMiT) policy document — provided a foundation but required AI-specific elaboration to address risks unique to machine learning systems, including model drift, unexplainability, data bias, and the use of third-party AI models.

Discussion Paper (August 2025)

In August 2025, BNM published a Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector, launching a 10-week public consultation period closing on 17 October 2025. The paper articulated BNM's regulatory philosophy: AI oversight should be proportionate to the materiality and risk profile of each AI application, and should avoid stifling innovation while ensuring financial system stability and consumer protection.

The Discussion Paper identified five principal risk dimensions associated with AI in finance. The first is model risk — the potential for AI models to produce inaccurate or biased outputs, particularly when deployed outside the distribution of their training data. The second is operational risk arising from system failures, adversarial inputs, or inadequate human oversight of automated decisions. The third is third-party risk, reflecting the widespread use of external AI vendors and cloud-based model APIs. The fourth is consumer harm risk, including discriminatory outcomes in lending, insurance underwriting, or customer service. The fifth is systemic risk, where correlated AI behaviour across multiple institutions could amplify market volatility.

Key Regulatory Principles

BNM's emerging AI governance expectations, as outlined in the Discussion Paper and reinforced by AICB's framework, coalesce around several principles.

Accountability requires that financial institutions designate clear ownership of AI systems, with board and senior management accountable for material AI risks. This extends to third-party models — institutions cannot outsource accountability to AI vendors.

Explainability requires that decisions materially affecting customers — such as credit denials or insurance claim rejections — be explainable to the affected individual in plain language. This aligns with the rights established under the Personal Data Protection Act (PDPA) 2010 and anticipated amendments.

Fairness mandates that AI models be tested for discriminatory bias across protected characteristics, including ethnicity, gender, and religion, reflecting Malaysia's diverse demographic context.

Robustness requires that models be monitored continuously for performance degradation and distribution shift, with defined thresholds for human intervention or model retraining.

Human oversight dictates that AI systems operating in high-stakes domains — such as credit underwriting or anti-money laundering detection — retain meaningful human review at critical decision points.

Technology Risk Management Framework

BNM's TRM framework, first issued in 2020, remains the primary binding instrument under which AI systems are governed. The RMiT policy document requires institutions to conduct technology risk assessments, maintain up-to-date system inventories, and ensure that third-party technology arrangements — including AI APIs — meet defined security and resilience standards.

AI systems are classified within the TRM framework according to their criticality and potential impact. Systems classified as critical require enhanced governance, including independent validation and board-level reporting. The framework also mandates incident reporting to BNM for AI-related failures that cause material disruption or customer harm.

AICB AI Governance Framework

The AICB AI Governance Framework, developed with BNM's endorsement and adopted by ABM member banks, provides practical implementation guidance complementing BNM's regulatory requirements. The framework sets out high-level principles — transparency, accountability, fairness, privacy, and robustness — and provides illustrative use cases drawn from Malaysian banking practice, covering retail credit assessment, fraud detection, and customer engagement analytics.

References

1. Bank Negara Malaysia. (2025). Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector. BNM, Kuala Lumpur.
2. AICB. (2024). Driving Responsible AI Adoption: AI Governance Framework. aicb.org.my.
3. HHQ. (2025). Bank Negara Malaysia's Discussion Paper — Artificial Intelligence in The Malaysian Financial Sector. hhq.com.my.
4. Tech Wire Asia. (2025). Malaysia's Central Bank unveils AI financial regulation framework at MyFintech Week 2025. techwireasia.com.
5. OECD. (2025). Artificial Intelligence in Asia's Financial Sector: A Review of Country Policies. OECD Publishing.