BNM found AI adoption rising across Malaysia's financial sector

Bank Negara Malaysia published a 37-page discussion paper on 5 August 2025 to explain how artificial intelligence was being adopted across the financial sector and to gather industry feedback. The paper was explicitly non-binding. It described BNM's proposed posture and questions for consultation rather than announcing a finished AI regulation.[1]

The evidence showed a sector moving quickly. Among banks and development financial institutions, 71% had implemented at least one AI application in 2024, up from 56% a year earlier. Adoption among insurance and takaful operators rose to 77% from 58%. More than 60% of banks and insurers viewed AI as a strategic priority for the following one to three years.[1]

Those numbers did not mean autonomous systems were making every important decision. BNM said most near-term applications augmented rather than replaced people and were concentrated in non-financial-risk work. Customer analytics, internal operations, technology and cyber risk, and fraud and anti-money-laundering work were the most common reported areas.[1]

Financial service providers reported more than eight times as many pilot or exploratory AI applications in 2024 as in the previous year. Limited and full deployments grew by 30%. The largest share of reported projects was customer analytics and marketing at 28%, followed by internal operational improvements at 22%, technology and cyber risk at 10%, and fraud and AML at 8%.[1]

Generative AI was attracting attention, especially for staff chatbots, claims assessment, HR onboarding and internal communication. Yet senior use lagged the organisational enthusiasm: only one in five providers said senior leaders and C-suite executives were actively using internal or public GenAI tools for their own work. Customer-facing GenAI remained limited, and providers had not indicated plans to use it in financial-risk areas at the time of the survey.[1]

BNM framed its regulatory posture around parity, proportionality and technology neutrality. In plain language, the same risks should receive the same regulatory treatment, scrutiny should match the seriousness and likelihood of harm, and firms should be judged on outcomes rather than being forced to use one technical method. The paper said existing outcome-focused requirements remained broadly adequate at that stage because many AI risks were familiar and most applications were not replacing humans in critical decisions.[1]

That was not permission to deploy first and govern later. Providers were expected to manage models across their full lifecycle, keep controls proportionate to complexity and intended use, handle personal information responsibly, and validate reliability. The paper highlighted accountability, fairness, transparency, explainability, reliability, ethics and security as responsible-AI principles that could be embedded into existing institutional processes.[1]

BNM proposed prioritising what it called win-win-win uses: applications that benefit consumers, improve business outcomes for providers and support regulatory objectives such as stability, development and inclusion. Fraud and AML detection was one example because better monitoring can reduce losses, lower false positives and strengthen trust. Permission-based personal financial management was another because it could help people budget and save while giving providers more relevant ways to serve them.[1]

The counterweight was equally clear. Hallucinated customer advice, biased outcomes, weak model monitoring, data leakage, deepfake-enabled fraud and opaque third-party systems could all erode trust. BNM said supervisory focus could escalate if AI moved into critical functions, replaced more human decision-making or created risks that existing rules did not adequately address. That makes the paper a map of regulatory direction, not a permanent ceiling on future requirements.[1]