Malaysia’s central bank fines Bank of China for unapproved system relocation

The bank reportedly failed to obtain approval before relocating the systems.

Bank Negara Malaysia (BNM) has imposed a penalty of approximately $20,196 (MYR88,000) on Bank of China (Malaysia) (BOCM) for failing to obtain approval before relocating its core banking systems to new data centres.

BOCM reportedly failed to obtain the central bank’s approval in relocating two of its systems to new data centres in December 2022 and February 2023.

The actions breach paragraph 48 (1)(a) of the Financial Services Act 2013 (FSA) read together with paragraph 12.1(b) of the Policy Document on Outsourcing (Outsourcing PD).

A financial institution is required to obtain the central bank’s written approval before “significantly” modifying any existing approved material outsourcing arrangement. 

The two systems relocated are core banking systems, and their relocation is deemed as a significant modification to the existing approved outsourcing arrangement as it may materially change the level and/or type of risk which BOCM is exposed to, the BNM said in a statement posted on its website.

BNM said that the non-compliance was due to gaps in BOCM’s oversight over its outsourcing activities and outsourcing-related internal policies and procedures. 

BOCM has reportedly taken appropriate measures to strengthen its oversight over outsourcing practices, BNM said. 

These include institutionalizing periodic reviews of its outsourcing arrangements; and improving coordination within its to ensure compliance with applicable local laws and regulations at all times.

BOCM has paid the fine on 2 August 2024.

(US$1 = MYR4.36)