Bank Negara Malaysia imposed administrative monetary penalties totalling more than RM7 million on three development financial institutions on 30 July 2025, penalising Bank Islam, Bank Rakyat, and Bank Simpanan Nasional for breaches of the Development Financial Institutions Act, the Islamic Financial Services Act, and the central bank's technology risk management and anti-money laundering and counter-terrorism financing policy requirements. All three institutions have settled their respective penalties in full, BNM confirmed in disclosing the enforcement actions.
The enforcement package represents one of the more substantial penalty exercises issued by Malaysia's central bank against the development finance sector and signals that BNM has elevated its scrutiny of operational resilience and financial crime compliance standards among institutions that play an important role in the country's financial inclusion agenda. The action comes after an extended review period covering system performance data and compliance assessments from a span running from mid-2023 through late 2024.
BANK ISLAM PENALISED ON TWO COUNTS
Bank Islam received the largest combined penalty of the three institutions, totalling RM3.445 million across two separate enforcement actions. The first penalty, amounting to RM1.745 million, related to prolonged service disruptions between June 2023 and December 2024 that affected automated teller machines, electronic banking platforms, and card services, leaving customers unable to access their accounts and transact through critical digital and physical channels over a period that BNM deemed unacceptable. The second penalty of RM1.7 million was imposed for failures in the bank's AML and counter-terrorism financing sanctions screening processes, indicating that Bank Islam's financial crime controls did not meet the standards required under BNM's prevailing policy framework.
Bank Rakyat was fined RM2.85 million for failing to meet system availability requirements set by the regulator, with BNM documenting multiple outages between June 2023 and December 2024 that affected critical banking services on which the institution's customers depend. The penalty underscores BNM's position that sustained failure to meet prescribed uptime standards constitutes a material regulatory breach that warrants financial sanction rather than merely supervisory guidance, and that institutions managing critical infrastructure for large customer populations carry a correspondingly high obligation to ensure reliability.
BSN FACES SIMILAR DISRUPTION CHARGES
Bank Simpanan Nasional received a penalty of RM995,000 for service disruption failures between June 2023 and October 2024, reflecting system availability shortcomings that overlapped with the periods identified at Bank Islam and Bank Rakyat. The concentration of similar failures across all three institutions during broadly overlapping timeframes points to shared vulnerabilities in how Malaysian development financial institutions have managed technology infrastructure investment and operational risk governance, a pattern that BNM's enforcement action appears designed to address through financial consequences rather than administrative guidance alone.
The combined enforcement action serves as a reminder to institutions across the Malaysian financial system that operational resilience — defined by the regulator as the sustained ability to maintain continuous, reliable access to critical banking services — has become a core regulatory expectation carrying material compliance risk. Shortcomings in system availability, when allowed to persist over extended periods, will attract penalties of a scale calibrated to create genuine financial consequences, and deficiencies in AML and sanctions screening frameworks compound the exposure for affected institutions. BNM's approach in this instance makes clear that both operational and financial crime compliance dimensions are being monitored with equal rigour.