.svg)
Bank Negara Malaysia (BNM), Malaysia’s central bank, launched an exposure draft on open finance in November 2025 seeking public feedback on a system which it states will offer consumers a safer and more structured framework for sharing their financial information than existing data-sharing arrangements.
The bigger picture
The exposure draft reflects a growing regional trend towards open finance in the Asia-Pacific region, with New Zealand consulting on its open banking regulations in August 2025 and Australia releasing new rules for porting merchant payment data onto its open finance platform around the same time, albeit for a very different reason as an attempt to counter lower consumer adoption levels as the next phase is laid out.
At a local level, the open finance exposure draft is the latest in a series of modernisation initiatives that BNM started in 2025, with the central bank releasing discussion papers on artificial intelligence in August 2025 and asset tokenisation in October 2025.
The open finance exposure draft, however, is the most comprehensive of the three and goes far beyond only setting out BNM’s overall approach but also detailing, among other things:
- Governance requirements, including setting out the responsibilities of the board of directors and senior management in implementing and overseeing risk management frameworks.
- Participation and information sharing rules, including regulations for financial institutions to participate as data providers or consumers and overarching principles for participants, including inclusivity and accessibility.
- Transitional arrangements for the migration of financial institutions.
- Consent management regulations, including rules on obtaining consent, managing and monitoring consent, consent validity and renewal, consent revocation and recordkeeping requirements.
- Customer protection provisions, including rules for the management of customer information, complaint and dispute handling and other business conduct requirements.
- Technology risk management requirements, including standards for technology operations and cyber risk management.
Why should you care?
Arguably the main cause for concern in the exposure draft is its mandatory implementation for select financial institutions. Specifically, paragraphs 8.4 and 8.6 of the exposure draft require mandated financial institutions to participate in the open finance platform as data providers and data consumers regardless of whether they choose to do so, effectively requiring these financial institutions to implement the necessary systems and platforms to enable participation in the open finance system as early as January 1, 2027 in accordance with Appendix 2, which is no small feat, even for the largest of institutions. Appendix 1 of the draft specifies that mandated financial institutions will comprise the following:
- Conventional and Islamic banks with at least 100,000 customers.
- E-money institutions with at least 5m active users.
Another part of the exposure draft that financial institutions should pay close attention to is its scope, or rather its lack of. Currently, BNM has not issued a definitive list of use cases to be implemented under the open finance platform. Although it does provide three illustrative examples in Chapter 1 of the draft, financial institutions will do well to take heed that this list may expand once the final version of the draft is released for implementation.
Perhaps the key question about open finance in Malaysia, however, is whether it will see any meaningful consumer adoption. Although often hailed as a milestone in enabling financial inclusivity and access for consumers, open banking and finance has not had the adoption rates it had originally intended to have. For example, in the UK, one of the earliest adopters of open banking, still only reported a 20 percent adoption rate among its consumers in 2025. Indeed, Australia, which can arguably be seen as Malaysia's closest equivalent on a regional level based on population size and financial inclusion rates, announced a reset of its consumer data right rules in 2024 that was primarily driven by low consumer adoption rates.
The uniqueness of Malaysia’s consumer banking industry does not lend itself to high adoption rates either. Although not a legal requirement, many companies in Malaysia often require their employees to open accounts with specific banks to receive salary payments in order to minimise payroll costs. Many Malaysian banks offer so-called “salary customers” incentives to stay with them. The same is true of the Malaysian civil service, proportionally one of the world's largest, which in addition to paying salaries into government-owned banks, offers civil servants in-house mortgages, vehicle and consumer finance at competitive rates. Effectively, this gives consumers very little impetus to move between financial institutions, and incentivising them to do so may prove an expensive proposition in one of the world's most price sensitive regions.
With the odds seemingly stacked against it, perhaps the main question for financial service providers in Malaysia is whether the implementation of an open finance regime will allow them to expand their business, whether this may be through acquiring additional customers or learning more about the entire financial status of their existing ones. However, it could simply be the case that BNM is jumping on a trendy financial initiative without regard for the uniqueness of the Malaysian consumer market.
Next steps
Financial institutions should respond to the consultation by March 1, 2026 if they wish to make their views known to BNM for consideration.
Financial institutions that fall under the definition of mandated financial institutions or are likely to fall under the definition of them soon should also prepare for implementation of the open finance rules in accordance with the timelines and consider the operational and compliance costs of doing so.
Finally, financial institutions that are considering marketing their products via open finance should consider the likely increased cost of doing so in the Malaysian market and may do well to consider adopting a wait and see approach to consumer adoption of the platform.
