If you run a bank, insurer, e-wallet, or fintech in Malaysia, Bank Negara Malaysia’s Risk Management in Technology (RMiT) rules are not optional. This is the basic standard that decides whether your systems pass BNM checks. Auditors no longer accept one-time security tests that claim everything is fine for a year. They want clear proof that you keep finding and fixing problems all the time.
The technology risk management framework Malaysia applies to:
- Licensed banks, Islamic banks and investment banks
- Insurers and takaful operators
- Development financial institutions
- Approved e-money issuers
- Designated payment system operators
- Non-bank registered merchant acquirers and intermediary remittance institutions with more than 5% market share of transaction value or volume
Under the rules issued on 28 November 2025, financial institutions must run a continuous testing cycle that includes:
- Quarterly vulnerability assessments of critical systems
- Annual intelligence-led penetration tests on infrastructure, critical systems and digital services
- Red-team exercises at least once every three years
Suitably accredited external testers must do these tests. This guide explains the core BNM RMiT penetration testing mandates, how to scope the work correctly, why pure automated tools fall short, and how to select vendors that satisfy auditor expectations.
Regulatory Mandates for Testing Under RMiT
BNM RMiT sets clear rules on the testing you must do and how often. Auditors check the records. They want proof the work happened, and the problems got fixed.
Annual Intelligence-Led Penetration Testing:
You must run one intelligence-led penetration test every year. The testers must be properly accredited. They look at the real threats that hit Malaysian banks, insurers, e-wallets and payment firms. Then they attack your systems the same way those threats would.
The test must cover:
- Internal and external network infrastructure
- Critical systems
- Digital services (web, mobile and all external-facing applications)
The attack scenarios must be realistic and based on current threats. BNM also requires the same type of intelligence-led penetration test before you introduce new systems for new products or services. This stops new holes from appearing by accident.
Keep the report. It must show real problems that were found and used. It must show what got fixed and when. Senior management and the board must see the results quickly so they can track the fixes.
Senior management and the board must see the results in good time. They are expected to track the fixes and confirm that problems are closed. This is part of the technology risk oversight that BNM checks.
Quarterly Vulnerability Assessments:
Every three months, you must run a vulnerability assessment on the external and internal network components that support all critical systems. New weaknesses appear all the time when software vendors release updates. Checking every three months means you find them before attackers do.
Keep clear records for each assessment:
- What you checked
- What you found
- What you fixed first
- What you actually closed
If the number of open issues keeps rising from one quarter to the next, auditors will ask why the fixes are not keeping up.
Compromise Assessments & Red Teaming:
You must also run these two activities at least once every three years:
- Red team exercise: A team acts like real attackers who have already got inside. They try to move through your systems, steal data or disrupt operations. This tests how well you detect and stop them.
- Independent compromise assessment: Testers look for signs that attackers are already inside the technology infrastructure of your critical systems without you knowing. Results go to senior management and the board.
These tests check your detection and response, not just your walls. You must keep proper records and show the fixes.
What happens if testing is weak or missing?
BNM can take action when the required testing is not done properly. This can include requiring an independent review, ordering a remediation plan, imposing administrative monetary penalties, or asking the board for extra oversight. Recent cases show that gaps in cybersecurity controls under RMiT have led to real financial penalties. Proper testing and clear records reduce this risk.
Defining the Core VAPT Scope for Malaysian Financial Services
BNM RMiT does not let you pick and choose freely. The policy requires testing of critical systems, digital services (including web and mobile), and both internal and external network infrastructure. Auditors expect the scope to match the real risk in a Malaysian financial institution.
Critical Scope Components:
Web and Mobile Banking Applications
These are the portals where customers log in, move money, pay bills, apply for loans, manage investments and pull account data. They hold customer information and real money, so they sit at the top of the risk list.
Testing should include:
- Login and session controls
- Fund transfers and payments
- Account viewing and management
- Admin functions that customers never see
Testers check whether one customer can reach another customer’s data, whether admin users can skip audit trails, whether sessions can be hijacked, whether input fields allow injection attacks, and whether sensitive data is stored in a weak way.
Core API Endpoints and Third-Party Integrations
APIs link your systems to payment gateways, KYC providers, Anti-Money Laundering (AML) screening tools, credit bureaus and other partners. Attackers often hit APIs because they sit behind the front-end and sometimes have weaker checks. Testing your APIs helps make sure hackers can’t exploit these hidden doorways.
Testing should cover:
- Authentication that blocks unauthorised calls
- Data returned only to the right users
- Rate limiting that stops automated attacks
- Input checks that block injection
- Encryption of data in transit
- Logging that records API activity
Cloud Infrastructure
Many Malaysian banks and fintechs now run parts of their systems on AWS, Azure or Google Cloud. Simple mistakes here (public storage, weak identity rules, open ports) have caused real leaks. Cloud security testing helps you spot simple misconfigurations before someone takes advantage of them.
Testing should check:
- Storage is encrypted, and access is limited
- Databases need strong login controls
- Network rules only allow needed traffic
- Logging catches unusual activity
- Backups are encrypted and locked down
- Virtual machines expose only the ports they need
Internal Systems and Employee Access
External tests alone miss a lot. Compromised staff accounts, or insider problems, still cause serious incidents in Malaysian financial firms.
Network penetration testing helps you fix critical vulnerabilities before anyone gets the chance to exploit them.
Testing should include:
- Workstations, email and file servers
- HR and finance systems
- Checks that weak passwords do not work on critical systems
- Limits so staff only access systems needed for their job
- Controls that stop malware from email
- File permissions that block unauthorised viewing
- Admin access that needs approval and logging
- Fast removal of access when staff leave
Disaster Recovery and Backup Systems
Attackers often go after backups so the institution cannot recover from ransomware. BNM expects strong operational resilience, so these systems should sit inside the overall testing plan.
Testing should verify:
- Backups are encrypted
- Access to backups is tightly controlled
- Recovery actually works (by restoring test data)
- Backup copies sit in a different location
- Remote deletion of backups is blocked
- Even if backups sit with a third party, the financial institution remains responsible for proving they are tested and protected.
Why Automated Scans Fail BNM RMiT Audit Standards
Many Malaysian banks, insurers and fintechs still rely on vulnerability scanners and think this meets BNM RMiT rules. Auditors reject this approach often. The policy asks for intelligence-led penetration testing by properly accredited testers, not tool reports alone.
The Scanner Deficit:
Automated scanners only find known issues that match their database. They miss new attack paths that sit inside your business logic.
They cannot:
- Spot a fund transfer rule that lets someone move money past the daily limit
- Find a login flow that can be tricked into giving higher access
- Understand threats that hit Malaysian banks, Islamic banking systems or Ringgit transactions
- Rank findings by real business damage (a problem in a test server is not the same as one in live production)
- Keep false positives low, so teams waste time chasing issues that do not work in practice
- Properly test APIs that need multi-step calls and role checks
- Prove an issue can be used end-to-end to take over an account or move money
Scanners report possible problems. They do not prove real risk the way auditors expect.
Auditor Expectations:
BNM auditors want proof of deep manual testing. They check for:
- Evidence that testers found and used real vulnerabilities, not just listed them
- Business logic flaws that only human testers catch (wrong transfer limits, broken permission checks, portfolio changes that should not be possible)
- Testing shaped by real threats facing Malaysian financial institutions, not generic checklists
- Full attack chains that move from first access to data theft or fund movement
- Testers who hold proper accreditation (such as CREST) and know the local environment
These points form the core RMiT bank negara requirements that auditors check during reviews. Generic scanner output fails these checks.
How Qualysec Meets the Standard:
Qualysec is a CREST-accredited security company that focuses heavily on manual testing, using 80% human effort alongside automated scans, built specifically for Malaysian financial institutions.
The process works like this:
- Automated tools find the basic known issues
- Manual testers find business logic problems and multi-step attack paths that tools miss
- Testing follows real threats that hit Malaysian banks, e-wallets and payment systems
- Every finding comes with clear proof (screenshots or logs) that the issue can be used
- Reports show the business impact, simple steps to repeat the problem, and clear fix advice
- Results link directly to BNM RMiT requirements so auditors can see the connection
- Retesting confirms the fixes actually worked
This gives the depth and proof that BNM expects from intelligence-led penetration testing.
Vendor Selection Checklist: How to Choose an RMiT-Compliant VAPT Partner
Picking the wrong VAPT partner leads to failed audits, slow fixes and extra pressure from BNM. Use this checklist to choose a partner that meets the actual RMiT rules.
Regulatory and Industry Expertise:
Look for these points:
- CREST accreditation – this remains one of the strongest practical proofs that the firm has been independently assessed for technical skill, methodology and ethical standards suitable for financial-services work
- ISO 27001 certification – shows the vendor itself runs a mature information-security management system
- Proven experience with BNM RMiT audits at Malaysian banks, insurers or fintechs
- Full awareness of the Malaysia Cyber Security Act 2024 and the related NACSA licensing rules for penetration-testing service providers
- Clear track record with local financial institutions
- Local presence or deep understanding of the Malaysian operating environment
Qualysec: CREST-accredited VAPT vendor in Malaysia
Qualysec is a CREST-accredited global VAPT specialist. The accreditation confirms the firm has the validated technical expertise needed to test critical financial infrastructure under BNM RMiT. Qualysec also aligns with the vendor-licensing requirements under the Cyber Security Act 2024 and related NACSA rules. The team runs intelligence-led penetration testing that combines human expertise with targeted automation, giving the depth Malaysian auditors expect.
Testers know the threats that hit Malaysian banks, insurance firms and fintechs. They have worked with local institutions, so they understand both the rules and the real attack patterns. You get global methods plus local knowledge.
Quality of Reporting:
Good reports make audits easier. Check that the vendor delivers:
- Short executive summaries written in plain language for the board
- Technical findings that include proof the issue can be used (not just a list of possible problems)
- Risk ratings that match BNM thinking, not random severity scores
- Clear fix steps that your IT team can follow
- Evidence for every finding (screenshots or logs)
- Retesting results that confirm the fixes worked
- Mapping that shows how each finding links to BNM RMiT requirements
- A simple timeline of the testing phases
See how we write our security reports.
Objectivity and Conflict of Interest:
Stay clear of vendors who also sell remediation or tools. That creates pressure to inflate findings or push certain products.
Ask these questions:
- Do they only do testing, or do they also sell fixes and tools?
- Are they independent from your internal IT team?
- Do they have ties to other vendors you already use?
- Do they report problems honestly even when the fixes will cost time or money?
- Do they give specific fix advice without pushing particular products?
Vendors that stay independent give cleaner results that auditors trust.
Conclusion and Strategic Roadmap
BNM RMiT requires continuous, rigorous testing conducted by qualified vendors. Automated scanning alone does not meet the standard. Auditors expect clear evidence of deep manual penetration testing that finds real problems and proves they can be used.
Manual testing from CREST-accredited firms such as Qualysec meets this expectation and delivers the BNM RMiT penetration testing depth that auditors look for. It shows serious risk management that stands up to review. Malaysian banks, insurers, e-wallets, and fintechs that work with Qualysec get teams who know both global methods and local BNM RMiT rules. Proper VAPT reduces the chance of costly findings during BNM checks.
Simple roadmap to stay compliant
Follow these steps:
- Choose a vendor with CREST accreditation and proven Malaysian financial services experience
- Set the testing scope to cover all critical systems, digital services, networks, APIs and cloud components required under BNM RMiT
- Run the yearly intelligence-led penetration test and the vulnerability assessments every three months
- Review findings with the testers so you understand the real risk and the fix effort
- Track every fix and retest to confirm the problems are closed
- Keep clear records that show the work, the findings and the fixes for BNM auditors
Evidence pack auditors usually ask for
- Signed scope document
- Tester accreditation details
- Full test report with proof of exploitation
- List of findings and risk ratings
- Remediation plan with owners and dates
- Retest results showing issues are closed
- Board or senior management review records
This approach meets the regulatory rules and lowers the chance of a real breach.
Read our quick guide on security compliance for financial institutions to see how to stay audit-ready.
Frequently Asked Questions
Does Bank Negara Malaysia (BNM) require VAPT to be done by a CREST-accredited firm?
BNM does not name CREST in the policy. It requires properly accredited penetration testers. CREST is a widely recognised benchmark that shows the vendor meets strong international standards. Many BNM auditors accept it as solid proof of competence for Malaysian financial institutions.
How often do financial institutions in Malaysia need to conduct penetration testing under RMiT?
You must run:
- One full intelligence-led penetration test every year
- Vulnerability assessments every three months
- A red team exercise at least once every three years
- An independent compromise assessment at least once every three years
The yearly test is the baseline. The other activities are also fixed requirements.
What applications fall under the mandatory VAPT scope for BNM RMiT?
The policy requires coverage of:
- Critical systems
- Digital services (web and mobile applications)
- Internal and external network infrastructure
- Related APIs and external-facing systems
Auditors expect all systems that support critical banking, payment, or customer services to be included. Nothing important should be left out.
Can we use automated vulnerability scanners to satisfy the BNM RMiT penetration testing mandate?
No. Scanners support the quarterly vulnerability assessments. They do not replace the yearly intelligence-led penetration test. Auditors expect manual testing that finds business logic flaws and proves real exploitation is possible.
Does the Malaysia Cyber Security Act 2024 affect BNM RMiT vendor selection?
Yes. Vendors must meet any licensing or operational rules that apply under the Act (and related NACSA requirements). Choosing a partner that already aligns with both BNM RMiT and the national cybersecurity law reduces risk for your institution. Qualysec designs its security testing to cover all these combined expectations.
