Bank Negara Malaysia (BNM) has imposed two separate administrative monetary penalties on Bank Islam Malaysia Berhad totalling RM3,445,000, the central bank announced on 30 July 2025. The twin actions reflect failures on two distinct regulatory fronts: the first, valued at RM1,745,000, relates to prolonged service disruptions that affected customers between June 2023 and December 2024; the second, of RM1,700,000, addresses deficiencies in the bank's sanctions screening compliance under anti-money laundering and counter-financing of terrorism (AML/CFT) regulations.

The combination of an operational resilience penalty and an AML/CFT enforcement action in a single announcement is unusual and signals that BNM's examination of Bank Islam identified material weaknesses across more than one supervisory dimension. Regulators in Malaysia have increasingly emphasised that operational soundness and financial crime compliance are equally non-negotiable, with deficiencies in either category now attracting formal monetary penalties.

SERVICE DISRUPTIONS ACROSS EIGHTEEN MONTHS

The system availability failures for which the RM1,745,000 penalty was imposed span the same June 2023 to December 2024 window that has also featured in BNM's concurrent action against another Malaysian institution. The duration of the period — approximately eighteen months — suggests that the disruptions were not isolated incidents but a recurring pattern that BNM found inconsistent with its Technology Risk Management requirements and Operational Risk Management Policy.

Bank Islam serves a large retail and commercial customer base under a fully Shariah-compliant banking model. Disruptions to digital banking and payment services are particularly consequential for customers who rely on the bank for regular transactions, payroll processing, and zakat or tabung haji-related payments. The penalty reflects BNM's assessment that repeated failures to maintain minimum system uptime are a supervisory matter, not merely an IT management issue.

Malaysian banks have faced growing pressure from the central bank to invest in technology infrastructure resilience. BNM has issued guidance setting out minimum system availability standards and required institutions to maintain business continuity arrangements capable of restoring critical services within prescribed recovery windows. The penalties issued to Bank Islam suggest those standards were not consistently met.

SANCTIONS SCREENING GAPS ATTRACT SEPARATE FINE

The second penalty — RM1,700,000 for sanctions screening failures — addresses a distinct and separately prosecuted breach. Sanctions screening is a fundamental obligation under Malaysia's AML/CFT framework, requiring banks to check customers, transactions, and counterparties against designated lists maintained by domestic and international authorities. Failures in this area carry heightened regulatory and reputational risk, as they can inadvertently expose a bank to transactions involving sanctioned parties.

BNM has been sharpening its AML/CFT enforcement posture in recent years, aligning its supervisory expectations more closely with the standards set by the Financial Action Task Force. The RM1,700,000 penalty for sanctions screening failures indicates that Bank Islam's controls in this area fell below the threshold BNM considers adequate, and the public nature of the announcement serves as a deterrent signal to the broader industry.

Bank Islam said it has been working to address the identified weaknesses and cooperated fully with BNM's examination process. For the regulator, the July 2025 enforcement round — which encompasses multiple institutions across operational and AML/CFT compliance categories — demonstrates a broadening of the supervisory toolkit beyond verbal guidance and into formal financial sanction.