Bank Negara Malaysia (BNM) has imposed an administrative monetary penalty of RM2,850,000 on Bank Rakyat, the country's largest cooperative bank, for failing to meet the central bank's system availability requirements across multiple service disruptions that occurred between June 2023 and December 2024. The penalty was announced on 29 July 2025 and marks one of the more significant enforcement actions taken against a Malaysian lender for operational resilience failures in recent memory.
The disruptions affected retail customers who were unable to access banking services during the outages. BNM determined that the frequency and duration of the failures constituted breaches of its Operational Risk Management Policy and Technology Risk Management regulatory requirements, both of which set binding standards for the uptime and reliability that licensed banks must maintain for their customers at all times.
REPEATED FAILURES OVER EIGHTEEN MONTHS
The enforcement action covers a period of roughly eighteen months, during which BNM found that Bank Rakyat experienced multiple incidents serious enough to trigger regulatory scrutiny. The pattern of repeated disruptions — rather than a single isolated outage — appears to have been a significant factor in the regulator's decision to impose a formal monetary penalty rather than issue a supervisory directive or private reprimand. BNM's published guidance makes clear that systemic, recurring failures attract a higher level of regulatory response than isolated technical incidents.
Bank Rakyat serves more than eight million members through its cooperative banking model, giving it a substantial retail footprint among Malaysian households. Service outages for an institution of that scale carry broad consequences: members relying on the bank for salary payments, loan repayments, and daily transactions face direct financial and operational inconvenience when systems go down, and the regulator views that harm as a central element of its enforcement calculus.
BNM's technology risk framework, which has been progressively tightened in recent years, sets explicit expectations for system availability across licensed financial institutions. Banks are required to maintain a minimum uptime threshold for critical services and to implement robust business continuity arrangements capable of restoring operations within defined recovery time objectives. The framework applies equally to cooperative banks, development banks, and commercial institutions.
SIMULTANEOUS ACTION AGAINST BSN
The action against Bank Rakyat was announced alongside a separate penalty of RM995,000 imposed on Bank Simpanan Nasional (BSN) for similar system downtime violations. The two fines, announced on the same day, send a clear signal from BNM that operational resilience is a priority supervisory concern across the public banking sector, where government-linked institutions have sometimes been seen as operating under softer scrutiny than their private commercial counterparts.
BNM has been investing in its own supervisory technology to improve its ability to monitor real-time system performance data reported by licensed institutions. The regulator has stated publicly that it expects all banks — cooperative, development, and commercial alike — to treat technology resilience as a core risk management discipline rather than a secondary operational matter.
For Bank Rakyat, the penalty is accompanied by an implicit expectation of remediation. Banks that receive BNM enforcement notices are typically expected to submit a corrective action plan and to demonstrate to supervisors that the underlying failures have been addressed to a standard sufficient to prevent recurrence. The cooperative's scale and membership base mean that any repetition of the disruptions is likely to attract continued — and potentially more severe — regulatory attention.