BNM RMiT Appendix 11: What Malaysian Banks Must Do to Detect and Stop Digital Fraud
Short answer: Appendix 11 of Bank Negara Malaysia’s (BNM) Risk Management in Technology (RMiT) policy document sets minimum fraud detection standards for retail digital banking. Banks must build a risk profile for each customer, detect and block suspicious transactions in real time, contact the affected customer within 30 minutes of a block, and update fraud rules promptly as new techniques appear.
What is Appendix 11?
Appendix 11 is the fraud detection section of the RMiT policy document (reference BNM/RH/PD 028-98), issued on September 25, 2026. The document supersedes several earlier instruments, including the Specifications on Fraud Detection Standard dated March 27, 2024. Fraud detection now sits inside the main technology risk framework, and paragraph 12.4 links the two. It requires fraud detection capabilities and rules to be updated in a timely manner when new modus operandi appear.
Who does it apply to?
Appendix 11 covers financial transactions carried out through digital services for retail customers. BNM’s RMiT FAQ (updated July 1, 2026) adds that for corporate and other non-retail segments, the controls apply on a risk-based and proportionate basis.
What does Appendix 11 require?
What happens if a bank has gaps?
Paragraph 12.2 sets out the consequence. A bank that has not implemented the specified digital services controls must be ready to show that its alternatives are equivalent or superior, and it must assume liability for fraud arising from the gap. Appendix 11 also encourages banks to exceed the minimum standards and keep upgrading their detection capability, so the requirements are a baseline, not a target.
Five questions to test readiness
- Can the bank score every digital transaction against that customer’s own profile before funds move?
- Does the system treat a new device, password reset, limit increase or new payee as a signal, and track what happens next?
- Can it detect device changes and attempts to bypass device fingerprinting?
- Can operations verify and contact the customer within 30 minutes, including at peak hours?
- How long does a new fraud rule take to move from a fraud team finding to production, and when was the playbook last validated?
How Clari5 supports Appendix 11
Clari5 provides real-time enterprise fraud risk management to 80+ banks across 30+ countries, and Chartis Research named Clari5 a Category Leader in Enterprise Fraud Solutions in its 2026 Quadrant Update.
Clari5 Enterprise Fraud Risk Management (EFRM) addresses the main Appendix 11 requirements as follows.
Frequently asked questions
When was the updated RMiT policy document issued?
BNM issued the updated RMiT policy document (reference BNM/RH/PD 028-98) on September 25, 2026. It updates the revision BNM issued in November 2025. The effective date remains November 28, 2025, unless a provision states a different date.
How fast must banks contact customers after a blocked transaction?
Within 30 minutes of the transaction, including during peak periods (Appendix 11, paragraph 5). The bank must also notify the customer immediately when it blocks a transaction.
Does BNM require banks to use artificial intelligence for fraud detection?
No. Appendix 11 requires banks to detect account takeover and identity fraud carried out with advanced artificial intelligence tools. It does not prescribe a specific technology for detection.
Does Appendix 11 apply to corporate banking?
It is aimed at retail digital services. BNM’s FAQ says non-retail segments apply the controls on a risk-based and proportionate basis.
