Otonoco AI Sign in
RMiT revised · November 2025

Find your RMiT gaps before BNM does.

In one announcement in July 2025, BNM fined three banks a combined RM7.29 million, including penalties for breaching RMiT and for prolonged service disruptions. Months later, RMiT itself was rewritten.

Nakhoda maps your technology-risk policy to the current RMiT and shows every gap, paragraph by paragraph.

Start free trial Check my RMiT risk first
For banks, insurers, takaful operators and DFIs SaaS or inside your environment

2-minute RMiT risk check

1. Has your technology-risk policy been re-mapped to the November 2025 RMiT?
2. Do your critical vendor contracts require them to tell you about incidents immediately?
3. Is technology risk a standing item on your board's agenda?

Answer all three to see your result. Nothing you click here is stored.

A quick indicator, not a regulatory assessment.

In production at a leading Malaysian fund manager Independent security audit passed Backed by Antler Malaysia
One announcement, July 2025

Technology risk is now an enforcement line item

RM2.85M

A development financial institution, for breaching RMiT requirements.

RM1.745M

A bank, for prolonged disruptions to its services.

RM995k

A savings institution, for breaching RMiT requirements.

Source: Bank Negara Malaysia enforcement announcement, 30 July 2025.

What changed in November 2025

Last year's policy is mapped to last year's RMiT.

  1. Critical functions mapped

    Board and senior management identify critical technology functions and how they depend on each other.

  2. Every provider watched

    Due diligence and continuous monitoring of every service provider, subcontractors included.

  3. Stand-in processing

    A fallback for the services that are hardest to substitute.

  4. A stronger CISO

    The CISO's independence and authority are reinforced.

How a gap check works

One policy in. One clear list of gaps out.

  1. Upload one policy

    Into your own private workspace, encrypted in transit and at rest.

  2. Assessed against RMiT

    Every requirement marked met, partial or gap, with the paragraph cited.

  3. Fix what matters first

    Export the findings with each paragraph cited, and ask Nakhoda how to close every gap.

RMiT gap check

technology-risk-policy-v7.pdf
Illustrative
  • GapNo stand-in plan for hard-to-substitute services
  • PartialVendor monitoring stops at tier-one suppliers
  • PartialCritical technology functions not mapped
  • MetCISO reports independently to the board

In the real report, every finding cites its RMiT paragraph.

Your next examination will look for these gaps. Find them first.

Upload your technology-risk policy and Nakhoda checks it against the current RMiT, paragraph by paragraph.

Need team access, or Nakhoda deployed inside your own environment? Email [email protected].

Questions

Who is it for?

Heads of Compliance, CROs, CISOs and IT risk teams at banks, insurers, takaful operators and development financial institutions supervised by BNM.

Can it run inside our own environment?

Yes. Institutions can use Nakhoda as SaaS or have it deployed inside their own environment.

Is this a regulatory assessment?

No. It shows where your documents fall short of the requirement, with the paragraph cited so your teams can check it. It does not replace your own assessment or BNM's.

Can my whole team use it?

Yes. Start with the free trial on your own policy. For team access or deployment inside your own environment, email [email protected].