General

technology risk

Risks arising from use of information technology and systems.

How the laws define this

Regulators agree that technology risk fundamentally centers on financial loss and operational disruption resulting from the use, failure, or inadequacy of information technology, including systems, hardware, software, data, and infrastructure, as well as associated threats like cyberattacks, data breaches, and system outages. These definitions diverge primarily on the specific consequences and operational scope included in their frameworks. The updated Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) incorporates regulatory non-compliance, integration, reliance on platforms, and reputational damage into its scope, using the concept to set required controls and governance across financial institutions. Conversely, the Policy Document on Risk Management in Technology (RMiT) emphasizes failures or inadequacies in processes, specifically highlighting data corruption and broader impacts on a financial institution's financial stability.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Malaysia	Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated)	In Force	Adds explicit risks of operational disruption, financial loss, data breaches, or regulatory non-compliance, and widens scope to integration or reliance on IT, applications, platforms or infrastructure.
Malaysia	Policy Document on Risk Management in Technology (RMiT)	Repealed	Limits to potential losses from failure or inadequacy of IT systems, infrastructure, or processes, exemplified by cybersecurity incidents, system outages, and data corruption.

What it triggers

The 2023 Policy Document on Risk Management in Technology (RMiT) recommended financial institutions manage technology risk until it was repealed.source

Definitions (3)

Risks that originate from the use, operation, integration or reliance on information technology, systems, applications, platforms or infrastructure which may cause operational disruption, financial loss, data breaches or regulatory non-compliance. The PD uses this term to frame the scope of required controls and governance across FIs.

Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated)Definition 1 of 3

Technology Risk encompasses potential losses arising from the failure or inadequacy of information technology systems, infrastructure, or processes. This broad definition includes risks associated with cybersecurity incidents, system outages, data corruption, and other technology-related disruptions that can impact a financial institution's operations and financial stability.

Policy Document on Risk Management in Technology (RMiT)Definition 2 of 3

Technology Risk refers to the risk of financial loss, disruption, or reputational damage arising from the use of technology, including hardware, software, and data. This encompasses risks related to system failures, data breaches, cyberattacks, and inadequate technology infrastructure.

Bank Negara Malaysia — Policy Document on Risk Management in Technology (RMiT) (updated)Definition 3 of 3

Not to be confused with

TRMF (Technology Risk Management Framework)

TRMF is the board-approved framework for managing technology risk, while technology risk is the risk itself that the framework addresses.

Technology incident

Technology incident is a specific event causing disruption or compromise, whereas technology risk is the broader potential for such events and losses.

critical systems

Critical systems are specific systems whose failure impairs essential services, while technology risk arises more generally from any IT use or failure.

Questions and answers

What does technology risk cover under the current RMiT?

It covers risks from the use, operation, integration or reliance on information technology, systems, applications, platforms or infrastructure. This may cause operational disruption, financial loss, data breaches or regulatory non-compliance. The policy uses this to frame controls and governance.

How did the repealed RMiT define technology risk?

It defined technology risk as potential losses from failure or inadequacy of IT systems, infrastructure, or processes. This included cybersecurity incidents, system outages, data corruption, and other disruptions impacting operations and stability.

What is distinctive between the two RMiT technology risk definitions?

The updated definition broadens to integration, reliance, and specific harms like data breaches, while the repealed one focuses on losses from IT failure or inadequacy with examples like outages.