Navigate BNM's RMiT requirements, the Cyber Security Act 2024, and PDPA amendments simultaneously — build AI capabilities your compliance team will champion.
Malaysia's financial sector operates under one of ASEAN's most rigorous regulatory frameworks. BNM's Risk Management in Technology (RMiT) policy requires financial institutions to strengthen cybersecurity and cloud risk governance, while the Cyber Security Act 2024 mandates 6-hour incident notification for NCII entities including banks. The PDPA amendments impose RM1 million maximum fines and mandatory DPO appointments from June 2025. BNM's Financial Technology Regulatory Sandbox — with its new 'Green Lane' accelerated track — creates opportunities for AI innovation within a controlled environment. This programme is structured to qualify for HRD Corp SBL-Khas claims, with training costs covered directly from employer levy contributions — no upfront payment required. The PDPA amendments, with maximum fines increased to RM1 million and mandatory 72-hour breach notification, make compliance-aware AI deployment a business imperative.
LOCAL CONTEXT
Malaysia is rapidly positioning itself as a regional AI hub through the Malaysia Digital initiative. Strong government incentives, including HRDF and MDEC grants, combined with a growing pool of digital talent, create fertile ground for AI transformation across industries.
$2.1 billion AI market by 2030
growing
THE CHALLENGE
“PDPA Amendment Compliance Gap”
“HRD Corp Funding Underutilisation”
“AI Talent Shortage Blocking Implementation”
“Cyber Security Act 2024 Compliance Burden”
Our team has trained executives at globally-recognized brands
OUTCOMES
FUNDING & SUBSIDIES
Up to RM1,000 per participant
Covers training costs for employees of registered employers (mandatory for 10+ staff). Direct provider payment — no upfront cost to employer.
Official SourceUp to MYR 5,000 per company
50% matching grant for digital service subscriptions adopted as part of this programme's implementation phase.
Official SourceVaries by partner institution
Part of RM1.5 billion public-private initiative supporting MSME business digitalisation through financial institutions and digital service providers.
Official SourceREGULATORY LANDSCAPE
The PDPA 2010 amendments (effective January–June 2025) are directly relevant: maximum fines increased to RM1 million, mandatory DPO appointments, 72-hour breach notification, expanded sensitive data definitions including biometrics, and new data portability rights. BNM's Risk Management in Technology (RMiT) policy imposes additional technology governance requirements on financial institutions, while the Financial Technology Regulatory Sandbox provides a controlled environment for AI innovation. The Cyber Security Act 2024 requires NCII entities to conduct annual cybersecurity risk assessments, biennial audits, and notify authorities of incidents within 6 hours of discovery. MOSTI's National Guidelines on AI Governance and Ethics (AIGE) outline seven core principles for responsible AI deployment, and the National AI Office (NAIO) is developing the AI Technology Action Plan 2026–2030 as a risk-based regulatory framework.
CHALLENGES IN MALAYSIA
The 2024 PDPA amendments require mandatory DPO appointments, 72-hour breach notification, and expanded sensitive data definitions including biometrics — effective June 2025. Many Malaysian organisations lack the AI governance frameworks needed to ensure automated systems meet these heightened requirements, risking fines up to RM1 million.
Malaysian employers with 10+ staff pay a mandatory 1% levy to HRD Corp, yet many fail to fully claim these funds for AI training. The SBL-Khas scheme covers up to RM1,000 per participant with direct provider payment, but the 'apply before training' requirement and 5-10 day processing time catch unprepared organisations off-guard.
Malaysia has only 3,000 AI professionals against a projected demand of 30,000 by 2030. With 81% of employers struggling to hire AI talent and a 34% salary premium required for AI-skilled candidates, building internal capability through training is significantly more cost-effective than competing in the talent market.
The Cyber Security Act 2024 requires NCII entities to conduct annual cybersecurity risk assessments, biennial audits, and report incidents within 6 hours. AI systems that process sensitive data must be designed with these requirements embedded from the start — retrofitting compliance is far more expensive.
OUR PROCESS
We audit your current compliance workflows, regulatory obligations across ASEAN markets, and existing RegTech systems to identify AI automation opportunities and regulatory reporting pain points.
We tailor the training program to your specific regulatory requirements (banking, insurance, payments, crypto), tech stack (AML systems, sanctions screening tools), and cross-border jurisdictional challenges.
Your compliance and risk teams gain practical experience with AI tools for regulatory monitoring, KYC automation, transaction surveillance, and regulatory reporting across 4-5 days of intensive workshops.
Teams design 3-5 AI compliance use cases (e.g., automated sanctions screening, regulatory change alerts, AML transaction monitoring) tailored to your institution's risk profile and regulatory obligations.
We provide 90-day post-training support including AI model validation frameworks, audit trail documentation, and regulatory engagement guidance to demonstrate compliance with MAS/OJK/BNM/BSP AI risk management principles.
IS THIS RIGHT FOR YOU?
Financial institutions with compliance teams managing cross-border ASEAN regulatory requirements
Banks, insurers, and payment processors facing KYC/AML operational bottlenecks
RegTech leaders seeking to automate transaction monitoring and reduce false positives
Compliance functions preparing for regulatory reviews of AI systems
Institutions navigating MAS FEAT, OJK AI governance, BNM RMiT, or BSP AI guidelines
Institutions without existing compliance teams or regulatory obligations
Organizations seeking off-the-shelf AI compliance solutions (we train your team, not deploy software)
Teams expecting AI to eliminate all compliance costs (AI augments, not replaces, compliance functions)
See yourself above? Let's talk about AI Compliance & RegTech for Financial Services in Malaysia.
Let's TalkCOMMON QUESTIONS
MORE TRAINING
WHY PERTAMA PARTNERS
Pertama's advisors understand the specific intersection of BNM's RMiT requirements, the Cyber Security Act 2024, and PDPA amendments that Malaysian financial institutions must navigate simultaneously. Most local training providers address these regulations in isolation; we train teams to build AI systems that satisfy all three frameworks from the start.
Training is delivered in English as the primary working language, with Bahasa Malaysia terminology integrated where relevant. Facilitators are comfortable with the code-switching between English, Bahasa Malaysia, and Mandarin that is common in Malaysian professional settings. All materials reference Malaysian regulations, funding mechanisms, and market examples. On-premise delivery is available for organisations with strict information security requirements. Programme structure is designed to meet HRD Corp's 'apply before training' process requirements, with adequate lead time built into scheduling.
Let's discuss how ai compliance & regtech for financial services can help your organization in Malaysia.
Start a Conversation