Technical

critical systems

Systems whose failure would materially impair essential services.

How the laws define this

Both instruments agree that critical systems consist of technology whose failure or disruption materially or significantly impairs a financial institution's capability to deliver essential financial services. The primary divergence between the two frameworks lies in how they define the operational scope, regulatory duties, and potential impacts of such disruptions. The updated Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) explicitly includes applications and infrastructure within its scope, extends the concept of impairment to an institution's ability to meet regulatory obligations, and imposes mandate-level requirements such as heightened controls, resilience oversight, and stricter cloud-use criteria. Conversely, the un-updated Policy Document on Risk Management in Technology (RMiT) frames the concept around impacts on customers or the market, detailing the broad financial and sector-wide risks of failure, specifically highlighting substantial financial losses, severe reputational damage, or systemic instability within the financial sector rather than focusing on specific compliance obligations.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

Under the Policy Document on Risk Management in Technology (RMiT) (updated), the PD describes heightened controls, resilience and oversight for critical systems, including stricter cloud-use criteria.source

Definitions (2)

Systems, applications or infrastructure whose failure or disruption would materially impair a financial institution’s ability to deliver essential financial services or meet regulatory obligations. The PD requires heightened controls, resilience and oversight for critical systems, including stricter cloud-use criteria.

Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated)Definition 1 of 2

Critical Systems refer to technology systems whose failure would significantly impair a financial institution's ability to provide essential services to its customers or the market. Their disruption could lead to substantial financial losses, severe reputational damage, or systemic instability within the financial sector.

Policy Document on Risk Management in Technology (RMiT)Definition 2 of 2

Not to be confused with

critical information infrastructure

Critical information infrastructure focuses on information systems whose compromise endangers national security, unlike critical systems' focus on impairing financial services or regulatory obligations.

Critical technology

Critical technology emphasizes technology whose failure impairs key functions generally, while critical systems specifically target financial institutions' essential services.

Questions and answers

What controls apply to critical systems under current RMiT?

The updated RMiT describes heightened controls, resilience and oversight for critical systems. It includes stricter cloud-use criteria.

How does the repealed RMiT define critical systems' impact?

The repealed version defined critical systems as those whose failure would significantly impair essential services, leading to substantial financial losses, severe reputational damage, or systemic instability.