Search for:

In brief

Bank Negara Malaysia (“BNM“), the Central Bank of Malaysia, has on 15 December 2021 issued an exposure draft of the Payment System Operator policy document (“PSO Exposure Draft“). The PSO Exposure Draft is intended to apply to all approved operators of a payment system under the Malaysian Financial Services Act 2013 and Malaysian Islamic Financial Services Act 2013 (“PSO“). The objectives of the PSO Exposure Draft are to:

  1. ensure the safety, efficiency and reliability of payment systems;
  2. preserve public confidence in the payment systems and the use of payment instruments; and
  3. ensure payment systems are aligned with relevant international standards.

Key takeaways

  1. Under the PSO Exposure Draft, PSOs, will:
  • be subject to enhanced obligations and requirements in relation to corporate governance, risk management and operational requirements and access and participation rule requirements; and
  • have to ensure that they maintain liquid net assets of at least six months of their current operating expenses.
  1. The PSO Exposure Draft will also affect other participants in the payment chain and persons who deal with PSOs, including direct and indirect participants of payment systems and outsourced service providers, to the extent that obligations are passed on to them by the PSOs.
  2. PSOs should immediately undertake a gap analysis to begin planning for compliance with the final policy document as the PSO Exposure Draft does not contemplate a transitional period before it comes into force.
  3. For further information and to discuss what this development might mean for you, please get in touch with us.

In more detail

The key requirements and standards that BNM is proposing to introduce are set out below.

No.SubjectKey Requirements and Standards
1.        Corporate GovernanceThe Board of a PSO is generally tasked with establishing policies that promote safety, efficiency, and reliability of payment systems. This entails having to implement control functions (e.g., risk management, compliance) that are competently staffed with reporting measures in place.The Board must include an appropriate combination of personnel with calibre and independent directors.
2.        Risk Management and Operational RequirementsPSOs are required to establish and implement risk management frameworks (including a technology risk management framework, liquidity risk management framework, credit risk management framework and cyber resilience framework), risk monitoring and reporting requirements, collateral management practices, management and control systems to mitigate operational risks, a business continuity plan and a disaster recovery plan.These frameworks and plans should address:controls in safeguarding the confidentiality, integrity and availability of information;maximum tolerable downtime and recovery time objectives for all critical business functions; andand identification of scenarios that may prevent its ability to provide its critical operations and services with the appropriate plans for its recovery or orderly wind-down.
3.        Adequate Capital and Liquid Net Assets RequirementAt the minimum, PSOs must maintain liquid net assets equivalent to at least six (6) months of current operating expenses.PSOs are also required to maintain:adequate liquid resources in all relevant currencies to ensure smooth settlement under normal or stress scenarios; andsufficient financial resources to cover its credit exposure to each participant. 
4.        Outsourcing Arrangements and InterlinkagesPSOs will be accountable for services provided by an outsourced service provider.PSOs must ensure appropriate due diligence is undertaken on the provider.PSOs will need to ensure that it monitors the service providers and allow BNM to exercise its regulatory and supervisory powers including have unrestricted access to their systems, information and documents.PSOs must have contingency plans to secure business continuity.
5.        Access and Participation RulesAccess criteria to a PSO’s payment system should be fair, open, objective, transparent and risk-based, to commensurate with the risk profile of the participants. Procedures on suspension or orderly exit upon breach of, or inability to meet, participation requirements should be clearly outlined and disclosed.Rules and procedures established by PSOs must be clear, comprehensive, up-to-date and fully disclosed to its participants. Processes for proposing, implementing and communicating changes to rules and procedures must also be clear and fully disclosed.PSOs must publicly disclose their fees and relevant information that would allow participants to assess the total cost of participating in the payment system and/or services offered by a PSO. PSOs must provide a timely notice to their participants of any changes to its fees.Under a tiered-participation arrangement (i.e., where an indirect participant relies on services provided by a direct participant of a PSO to access a PSO’s payment system), PSOs shall:establish rules and procedures with the direct participants to enable the PSO to obtain information on the indirect participants to identify and monitor risk;identify the significant dependencies between direct and indirect participants that may adversely affect the PSO; andregularly review the risks associated with the tiered-participation arrangements and institute appropriate mitigating measures.

The PSO Exposure Draft will have far reaching implications on PSOs. Changes will need to be made to their operational day-to-day requirements and interactions with participants across the payment infrastructure as well as their service providers. It is imperative for PSOs to undertake a gap analysis to determine the refinements that it will need to make to comply with the requirements of the PSO Exposure Draft.


For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

LOGO Malaysia_Wong & Partners_KualaLumpur

This client alert was issued by Wong & Partners, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “partner” means a person who is a partner or equivalent in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome. 


Brian Chia heads the Corporate, Commercial & Securities Practice Group of Wong & Partners and the M&A Practice Group of Baker McKenzie member firms in the Asia Pacific region. Brian has been ranked as a Band 1 practitioner in the area of Corporate and M&A in Chambers Asia Pacific since 2011 and in Chambers Global since 2013. He has been recognised as a Leading Individual in Corporate and M&A by Legal 500 Asia Pacific since 2011 and was inducted into its Hall of Fame in 2021. Brian has been among IFLR1000's Highly Regarded individuals for Corporate and M&A since 2011 and is named as an Elite Practitioner by Asialaw Profiles. Brian played a pivotal role in building and leading the corporate, commercial and securities practice, which was recognised as the Malaysia Deal Firm of the Year by Asian Legal Business in 2012, 2013, 2015 and 2017.


Sue Wan Wong is a partner in the Corporate, Commercial & Securities Practice Group of Wong & Partners and she also drives the Firm's fintech practice. Chambers FinTech Legal ranks the practice as the sole Band 1 firm in Malaysia and lists Sue Wan as a Notable Practitioner. She was recognised as a Notable Practitioner for M&A in 2020 and 2021 by IFLR1000, having previously been named as Rising Star in 2018 and 2019. She is also ranked as a Distinguished Practitioner for Corporate and M&A since 2020 by Asialaw Profiles, which has also recognised her expertise in Labour & Employment and Insurance & Reinsurance previously. Sue Wan was named as Woman Lawyer of the Year in 2018 by Asian Legal Business, and was recognised in 2015 in their inaugural The ALB 40 Under 40 list which showcases the brightest legal minds in Asia. Sue Wan is a member of the US-ASEAN Business Council (Financial Services Committee) and she was the former Secretary of the Fintech Association of Malaysia.


Yee Syuan Cham is an Associate in Baker McKenzie Kuala Lumpur office.

Write A Comment