Bank Negara Malaysia (BNM) had, on 22 July 2024, imposed an Administrative Monetary Penalty (AMP)^[1] of RM88,000 on Bank of China (Malaysia) Berhad (BOCM) for failure to comply with the prudential requirements applicable to the material outsourcing arrangements. BOCM failed to obtain BNM’s prior approval in relocating two of its systems to new data centres in December 2022 and February 2023, in breach of paragraph 48(1)(a) of the Financial Services Act 2013 (FSA) read together with paragraph 12.1(b) of the Policy Document on Outsourcing (Outsourcing PD).

The two systems are core banking systems, and their relocation is deemed as a significant modification to the existing approved outsourcing arrangement as it may materially change the level and/or type of risk which BOCM is exposed to. Under the Outsourcing PD, a financial institution is required to obtain BNM’s written approval before significantly modifying any existing approved material outsourcing arrangement. This is to ensure BNM’s continued ability to effectively supervise financial institutions.

The non-compliance was a result of gaps in BOCM’s oversight over its outsourcing activities and outsourcing-related internal policies and procedures. BOCM has taken appropriate measures to strengthen its oversight over outsourcing practices, including institutionalising periodic reviews of its outsourcing arrangements and improving coordination with its group functions that perform material activities on behalf of BOCM to ensure compliance with applicable local laws and regulations at all times.

In deciding the imposition of the AMP, BNM considered the relevant aggravating and mitigating factors, including the facts of the case above as well as BOCM's past non-compliance record.

BOCM paid RM88,000 for the AMP imposed by BNM on 2 August 2024.

The enforcement action taken is in line with the approach and processes outlined in the published Enforcement Approach document.

^[1] BNM imposed the AMP pursuant to section 234(3)(b)(i) of the FSA.