Bank Negara Malaysia announced today that it has imposed penalties on two major banks, Maybank and CIMB, on 29 July 2024 for prolonged service disruptions. The fines in question were due to the banks’ non-compliance with paragraph 48(1)(a) of the Financial Services Act 2013 (FSA), paragraph 58(1)(a) of Islamic Financial Services Act 2013 (IFSA, and paragraph 10.32 of the Risk Management in Technology (RMiT) Policy Document.
Paragraph 10.32 of the RMiT Policy Document states that financial institutions cannot have a cumulative unplanned downtime of more than four hours on a rolling 12-month basis and in the cases of a downtime, it must not exceed 120 minutes per incident.
BNM found that Maybank failed to promptly recover from unexpected system disruptions, with its platform and MAE app experiencing multiple unplanned downtime between 1 June 2023 to 31 May 2024. As a result, the bank has been fined RM4,320,000 for these offences, which it paid on 8 August 2024.
As for CIMB, the bank experienced prolonged service disruptions on 8 and 9 April 2024, affecting its online platforms, ATMs, as well as debit and credit cards. Due to the bank’s failure to promptly restore the affected systems, it has been fined a total of RM760,000, which had been paid on 12 August 2024.
In response to BNM to the penalty, CIMB put out a statement on its website, apologising for the unplanned downtime and stating that it will continue to invest in its critical customer infrastructure. As of writing, Maybank has yet to release a statement of its own, but BNM’s press release stated that the bank has “has taken the necessary actions to close these gaps as part of its multi-year infrastructure investments to prevent future non-compliance.”
[UPDATE: 6:00 PM, 12 August 2024] Maybank has released a statement regarding the penalty, reiterating its commitment to enhancing customer experience and communication. It added that “internal measures to further strengthen and monitor our systems are in place to ensure optimum performance.”
