Data Centre Requirements for Malaysian Financial Institutions Under BNM RMiT

BNM RMiT, Bank Negara Malaysia’s policy document on Risk Management in Technology, sets the minimum standards a Malaysian financial institution must meet for the data centre that runs its critical systems, whether that facility is owned in-house or provided by a third party. The current version took effect on 28 November 2025, and Bank Negara Malaysia (BNM) issued an updated text on 25 September 2026.

For a bank, insurer or payment provider choosing a data centre, RMiT turns a broad question into a specific one: can this facility, and this provider, help you evidence each requirement to your board and to BNM. Each requirement in the RMiT policy document translates into evidence you can ask a provider to produce.

Which Financial Institutions BNM RMiT Applies To

BNM RMiT applies to licensed banks, licensed investment banks, licensed Islamic banks, licensed insurers and takaful operators (including professional reinsurers and retakaful operators), prescribed development financial institutions, approved issuers of electronic money, operators of designated payment systems, registered merchant acquirers and intermediary remittance institutions. For e-money issuers, non-bank merchant acquirers and intermediary remittance institutions, RMiT applies to those that meet the size or market-share criteria set out in the policy document.

Payment services regulatees also have a separate policy document. BNM issued the Technology Requirements for Payment Services Regulatees policy document on 12 March 2026, which consolidates technology requirements for e-money issuers, merchant acquirers and money services businesses and takes effect on 12 March 2027.

What BNM RMiT Requires of a Production Data Centre

BNM RMiT sets out five data centre resilience requirements in paragraphs 10.24 to 10.28, and together they describe what a compliant production data centre looks like.

1. Defined objectives: The financial institution must specify the resilience and availability objectives of its data centres so that they support its business recovery objectives.
2. Redundancy: Data centres must have redundant capacity components and multiple distribution paths serving the computer equipment, so that no single failure stops the identified recovery objectives from being met.
3. Dedicated, secure space: Critical systems must be hosted in a dedicated space intended for production data centre use, physically secured from unauthorised access and not located in a disaster-prone area. The design and connectivity of critical components, including hardware, electrical utility, thermal management and data centre infrastructure, must have no single point of failure, and those components must be maintained and continuously monitored with timely alerts.
4. Operational controls: Data centre operations need adequate control procedures, including automated tools for batch processing and procedures for production changes, error handling and exceptional conditions.
5. Segregation of duties: Incompatible activities in data centre operations must be segregated, and any vendor or programmer access to the production environment must be authorised and monitored.

These requirements apply to the financial institution, not to the data centre provider directly. In practice, a colocation provider’s design, operating procedures and audit evidence determine how easily the financial institution can show it meets them.

Availability Targets for Critical Systems Under BNM RMiT

BNM RMiT sets a specific availability target for critical systems where customers or counterparties expect immediate service. Under paragraph 10.32, these systems must be designed for high availability, with cumulative unplanned downtime affecting customers or counterparties of no more than 4 hours on a rolling 12-month basis, and a maximum tolerable downtime of 120 minutes per incident.

The 4-hour and 120-minute limits apply to the service the customer sees, so the data centre is only one part of meeting them. Application design, network resilience and recovery procedures matter as much as the facility. When comparing providers, ask how their facility design, maintenance practices and incident escalation support recovery within your own targets, rather than relying on a single availability figure.

The Data Centre Resilience and Risk Assessment Under BNM RMiT

BNM RMiT requires an independent check of the production data centre. Under paragraph 14.1, a financial institution must appoint a technically competent external service provider to carry out a data centre resilience and risk assessment (DCRA) at least once every three years, or whenever there is a material change in the data centre infrastructure, whichever comes first. The assessment must determine the current level of resilience and consider whether the requirements in paragraphs 10.24 to 10.28 are met, and the outcome must be deliberated by the board-level committee responsible for technology.

For data centres managed by a third party, the financial institution may rely on independent third-party assurance reports, provided the reliance is consistent with its risk appetite and the assurance covers similar risks and meets the same requirements. A provider that already holds a recent, independent DCRA covering those paragraphs can shorten this step.

What the Service Agreement With a Data Centre Provider Must Cover

A financial institution remains accountable for all risks arising from a third-party service provider, and BNM RMiT sets out what the service level agreement must contain. Under paragraph 10.48, the agreement must include, at a minimum:

1. Regulator access: Access rights for BNM and any party appointed by the financial institution to examine its activities, records, files and data.
2. Sub-contracting notice: Sufficient prior notice of any substantial sub-contracting.
3. Secrecy undertaking: A written undertaking to comply with secrecy provisions under relevant legislation, binding even after the engagement ends.
4. Disaster recovery and backup: Arrangements for disaster recovery and backup capability, where applicable.
5. Availability objectives: Service level objectives for uptime or availability.
6. Exit arrangements: Business continuity arrangements if the provider exits or is terminated, including timely recovery of the financial institution’s data.
7. Incident notification: Prompt disclosure of service disruptions or cyber incidents affecting the financial institution or its customer data.
8. Standards and certification: Compliance with relevant internationally recognised standards, with key staff keeping their certifications current.
9. Security awareness: Participation in the financial institution’s security awareness and education programme, where appropriate.

Where an engagement also meets BNM’s definition of an outsourcing arrangement, RMiT requires the financial institution to follow BNM’s policy document on Outsourcing as well.

Network Resilience for Data Centre Connectivity

A data centre is only as resilient as the network paths into it, and BNM RMiT treats network resilience as a separate requirement. Under paragraph 10.37, network services for critical systems must be reliable and have no single point of failure, and the guidance in paragraph 10.38 expects component redundancy, service diversity and alternate network paths. Financial institutions must also monitor bandwidth in real time, keep a network design blueprint showing all internal and external connections, and retain relevant network device logs for at least three years.

Paragraph 14.2 requires a network resilience and risk assessment (NRA) by a technically competent external provider at least once every three years, or whenever the network design changes materially. For data centre selection, that makes carrier choice, diverse building entry points and the provider’s connectivity documentation part of the evaluation rather than an afterthought.

Colocation or Public Cloud for Critical Systems

BNM RMiT treats public cloud differently from a dedicated data centre. Under paragraph 17.1, a financial institution must consult BNM before adopting a public cloud for critical systems for the first time, after completing a comprehensive risk assessment, a readiness confirmation and a third-party pre-implementation review. Paragraph 10.50 lists the risks that assessment must cover, including the location of cloud infrastructure, multi-tenancy or data co-mingling, vendor lock-in, and the ability to secure the institution’s data on termination.

The consultation in paragraph 17.1 applies to public cloud adoption, so colocation in a dedicated space is assessed under the data centre resilience and third-party service provider requirements instead. Whichever model you choose, the service agreement terms in paragraph 10.48 still apply.

Backup Sites and Recovery Environments Under BNM RMiT

BNM RMiT extends to where backups are kept and how they travel. Under paragraph 10.44, backup media must be stored in an environmentally secure, access-controlled backup site, and backup and restoration procedures must be tested periodically. Sensitive data on removable media must meet minimum controls during storage and transport, including encryption, dual custody so that media is never in one person’s sole custody, secure transport and location tracking of each media container.

Paragraph 10.45 adds a newer requirement: a tamper-proof backup arrangement and an isolated recovery environment, so that critical banking and payment services can resume within tolerable limits after a destructive cyber attack such as ransomware. For data centre selection, that makes the recovery site, the offsite storage arrangement and the media transportation process part of the same decision as the production facility.

BNM RMiT Data Centre Checklist for Financial Institutions

Where We Fit

At Strateq, we have operated data centres in Malaysia since 1989 and are one of Malaysia’s pioneer data centre providers, with around 30 years of experience serving the banking sector. Our facilities are audited by BNM and the Chief Government Security Office (CGSO), and our Petaling Jaya data centre is a CGSO-declared Protected Area and Protected Place, manned by Auxiliary Police.

The accreditations for our Malaysian facilities include ISO/IEC 27001:2022, ISO 9001:2015 and PCI-DSS, and the facilities have undergone threat and vulnerability risk assessments (TVRA) and data centre resilience and risk assessments (DCRA). Alongside colocation and data centre management, we provide disaster recovery hosting, offsite storage and media transportation, so production, recovery and backup handling can be planned together.

Contact us to review our audit and assessment evidence against your RMiT checklist.