AI in Malaysian Banking: Use Cases and Governance

Banks evaluating AI solutions for enterprise in Malaysia face two questions: which processes to apply AI to first, and how to govern it so that every output can be explained to an auditor, a regulator and a customer.

This guide covers four banking use cases (credit assessment, document intake, compliance screening and audit support), the controls a bank needs around each, what Bank Negara Malaysia has and has not set out on AI, and when sensitive credit data needs on-premises AI. If you are earlier in the process and still deciding where AI fits across the organisation, start with our guide to enterprise AI in Malaysia for business leaders.

Where AI Is Used in Malaysian Banking: 4 Use Cases

In banking, AI works best where a skilled person spends time reading, extracting and checking, and where the final decision stays with a person. Four use cases fit that description:

1. Credit assessment: Assembling the borrower’s financials and supporting documents, scoring risk, and drafting the credit memo for an analyst to review and an approver to decide.
2. Document intake: Extracting data from applications, financial statements and supporting documents, checking that they are complete, and flagging documents that look altered or forged.
3. Compliance screening: Running anti-money laundering (AML), litigation and adverse market checks on a case, and Shariah compliance checks for Islamic financing, so that every case is screened the same way.
4. Audit support: Checking case files against the bank’s written policy, and assembling the evidence an internal auditor or regulator asks for.

In all four, the AI prepares, and a person decides. The governance controls below exist to protect that division of responsibility.

Governance Controls for AI in Banking

A bank can defend an AI-assisted decision only if it can show how the output was produced, who reviewed it and what they decided. Five controls provide that:

1. Explainability: Every assessment shows its reasoning and the source documents behind it, so an analyst can challenge it. A score with no reasons cannot be defended to an auditor or a customer.
2. Human checkpoints: Define where a person reviews the output, what they see and their authority to override it. A named, accountable role gives final sign-off before any decision takes effect, and uncertain outputs are routed to a reviewer instead of acted on.
3. Audit log: Record the inputs, outputs, reviewer actions and overrides for every case, in a log that cannot be edited afterwards, so that any decision can be reconstructed later.
4. Policy grounding: Check outputs against the bank’s own written policies, and version those policies so you know which one applied to a given decision.
5. Monitoring and change control: Have people score a sample of outputs on a schedule, watch for drift as conditions change, and require approval before the model or its settings change.

Where Human Checkpoints Belong in a Credit Workflow

Place a person at each point where an error would otherwise carry forward into the decision:

1. Document intake: A reviewer confirms the extracted data is correct and resolves any document the system has flagged.
2. Risk assessment: An analyst checks that the reasoning holds up and that the score is consistent with their own judgement of the borrower.
3. Compliance alerts: A named person clears or escalates every alert, and the decision is recorded against their name.
4. Exceptions and overrides: Any case outside policy, or any recommendation that a person overrides, is reviewed by someone more senior than the person who made the call.

A final sign-off by the accountable role then confirms the decision before it takes effect. The question at every checkpoint is the same: could a reviewer have caught the error here, and can the bank show that they had the information and the authority to do so?

What Bank Negara Malaysia Has Set Out on AI

In August 2025, Bank Negara Malaysia (BNM) issued a discussion paper, Artificial Intelligence in the Malaysian Financial Sector, and its consultation closed on 17 October 2025. The paper is non-binding. It sets out principles that BNM expects institutions to build into their processes across the AI lifecycle: accountability, fairness, ethics, transparency, explainability, reliability and security.

BNM’s Governor has said that banks must be able to explain AI outcomes, challenge decisions and remain accountable for how AI is used. The industry has also published an AI Governance Framework, developed through the Chief Risk Officers Forum of the Asian Institute of Chartered Bankers with BNM’s support, which is built on the same principles.

Existing BNM requirements also bear on AI. BNM’s Risk Management in Technology (RMiT) policy document, issued on 28 November 2025 and updated on 25 September 2026, requires a financial institution to consult BNM before it first adopts emerging technology or public cloud for critical systems. Ask your compliance team whether an AI use case falls within that requirement. BNM’s policy document on Management of Customer Information and Permitted Disclosures also sets requirements for handling customer information, including where an outsourced service provider is involved.

These are expectations and direction, not a complete rulebook. Confirm what applies to your institution with your compliance team.

When Sensitive Credit Data Needs On-Premises AI

A credit file holds customer information, financial statements and commercial terms. Section 133 of the Financial Services Act 2013 restricts the disclosure of customer information, and customer information passed to an external AI service reaches another party. Before any customer data is sent, the bank has to establish the legal basis under banking secrecy and its outsourcing and customer information requirements. The Personal Data Protection Act 2010 (PDPA) adds its own duties: since 1 April 2025, data processors, such as an AI service handling personal data for you, have been directly subject to its security principle.

Running the model on-premises removes that question for the model itself. A Local LLM is a large language model deployed on-premises or on your own infrastructure, so prompts, documents and outputs stay in your environment. It carries operating work of its own, which our guide to Local LLMs and data sovereignty sets out. The decision is made per use case: classify the data first, then decide which processes can use an external service and which cannot.

AI Solutions for Enterprise in Malaysia: Matching Controls to Each Use Case

Use this matrix to check that each use case has a person who decides, evidence that is logged, and a decision about where the data is processed:

AI in Banking Governance Checklist

• Each use case defined, with the decision a person keeps
• Output shows its reasoning and source documents
• Uncertain outputs routed to a reviewer
• Reviewers placed at intake, assessment, compliance alerts and exceptions, with the final sign-off role named
• Audit log records inputs, outputs, reviewer actions and overrides, and cannot be edited afterwards
• Outputs checked against current, versioned bank policy
• Sample scoring, drift monitoring and change approval scheduled
• Data classified by sensitivity, with the legal basis checked before any customer data leaves the bank
• Local LLM or another on-premises option assessed for the most sensitive processes
• RMiT consultation requirement checked for first-time adoption in critical systems
• Customer information and PDPA obligations mapped to each use case

Where We Fit

At Strateq, we have been a system integrator in Malaysia since 1983. Our Enterprise Business Solutions unit, established in 2012, includes our Data & AI team.

Our AI-driven credit memo platform, the Credit Memo AI Agent, covers the credit memo lifecycle for bank clerks, associates, managers, team heads and governance teams. Automated document intake applies forgery detection and OCR to every document. Risk scoring is self-hosted, with AML, Shariah, litigation and market checks, so sensitive credit data never leaves the bank’s environment. Policy and completeness checks use retrieval-augmented generation (RAG) against the bank’s policy, and AI reasoning is shown for every assessment.

Five human-in-the-loop checkpoints and a mandatory final sign-off keep every decision reviewed, and every decision is recorded in an immutable audit log. The benefits we list for it are case turnaround of under 24 hours, from 5 to 7 days, and 100% traceability from upload to sign-off.

Use the matrix and checklist to review any AI solution your bank is considering, and contact us if you would like to talk through a credit or compliance use case.