Financial services institutions (FSIs) must prepare to keep operating through technology disruptions, not simply recover afterwards. Bank Negara Malaysia’s updated Risk Management in Technology (RMiT) policy reflects this shift, moving institutions away from checklist compliance and towards resilience they can demonstrate in practice.
That shift was central to the “RMiT: A New Era of Financial Services in Malaysia” executive roundtable organised by Frontier Enterprise and hosted by Hitachi Vantara in Kuala Lumpur. The discussion brought together banking and insurance leaders to examine how regulatory requirements, evolving cyberthreats, and growing AI adoption are reshaping expectations for enterprise data infrastructure.
One recurring theme throughout the discussion was that resilience is no longer simply about restoring systems after an outage. Instead, organisations are expected to demonstrate that critical services remain available, recover quickly from disruption, and provide evidence that their controls continue to operate effectively.
Cyrus Daruwala, Independent Consultant & Head of FSI at Frontier Enterprise, framed resilience as the ability to respond to sudden changes in data-hosting rules, vendor availability, and even access to technical personnel. For FSIs, this means knowing which data and capabilities remain within their control and whether essential services can continue if a cloud provider, technology partner, or external support team becomes unavailable.
Matthew Hardman, Chief Technology Officer, Asia Pacific, Hitachi Vantara, observed that organisations have fundamentally changed the way they think about resilience. While backup and recovery may once have been sufficient, systems and their underlying data have since become considerably more complex.
Today, financial institutions operate across hybrid environments that combine cloud services, structured and unstructured data, AI workloads, and edge applications. As these environments become increasingly interconnected, resilience has evolved into a continuous operational capability rather than a disaster recovery exercise.
Regulation raises the stakes
The discussion also highlighted how regulatory expectations are becoming more demanding across the region.
Participants noted that financial institutions must not only protect customer information but also demonstrate recoverability, governance, and operational continuity. The growing emphasis on data sovereignty, cyber resilience, and third-party risk means technology decisions are increasingly being scrutinised at board level.
Daruwala’s presentation also highlighted how data sovereignty is renewing the case for hybrid and on-premises environments. The challenge is to keep critical data accessible and under institutional control while balancing security, storage requirements, and cost, rather than treating cloud adoption or data repatriation as an all-or-nothing decision.
Developments such as Hong Kong’s Protection of Critical Infrastructures (Computer Systems) Ordinance illustrate the growing regulatory emphasis on accountability. As Hardman put it: “You can’t just say it worked. You must prove that it actually did. You have to show that information.”
Rather than viewing compliance as a reporting exercise, organisations are increasingly expected to demonstrate how decisions were made, how data was protected, and how essential services can continue operating during disruptive events.
Regulators, increasingly sophisticated cyberthreats, and rising customer expectations are among the major forces shaping resilience strategies across the financial sector.
As public concern grows over data privacy, data location, recoverability, cyberattacks, and ransomware, regulators are taking a more interventionist role.
AI introduces new governance challenges
AI adoption also featured prominently during the discussion, particularly as financial institutions explore new use cases while remaining accountable for automated decisions.
Daruwala cautioned that AI investment can be driven by hype and fear of missing out rather than a clearly defined business problem. He urged institutions to proceed one use case at a time, establish what each initiative is intended to solve, and determine whether the expected return can justify rising compute, storage, and tokenisation costs.
He also stressed that AI-assisted decisions must remain explainable and subject to human oversight, particularly in areas such as lending, fraud detection, and customer risk assessment. Because models and their underlying data change over time, financial institutions must be able to reconstruct the conditions behind earlier AI-assisted decisions.
As AI models are continuously retrained using evolving datasets, organisations must preserve historical data to explain how previous decisions were made. The same prompt may generate different outputs days or even hours later.
“When a regulator asks you to show why you approved a particular loan, you’re going to ask the AI how it did it. But the AI may have been retrained since then. The data has changed. The logic has changed. All that information has changed,” Hardman explained.
Maintaining immutable data can help organisations preserve historical records and provide evidence for compliance and governance. Once written, the data cannot be altered or overwritten, giving institutions a reliable record of the information available when a decision was made.
Industry weighs resilience against innovation
During the roundtable discussion, banking and insurance executives shared many of the operational challenges they are facing as they modernise their technology environments.
Among the issues raised were cross-border payment security, ransomware preparedness, disaster recovery capabilities, AI investment priorities, and increasingly stringent regulatory expectations. Several participants observed that balancing innovation with compliance has become one of the industry’s most significant challenges.
One bank executive, for example, was concerned that cross-border payment data could be intercepted as it passed through SWIFT, clearing houses, or third parties. “If somebody intercepts that payment, we wouldn’t know because it did not reach us,” the executive said.
For one insurer exploring AI use cases, regulatory compliance and the need to justify ROI to its board are two barriers to innovation. “How can we justify these investments to the board? Most of the time, they’re expensive,” one of its executives noted.
The discussion underscored that resilience today extends beyond technology architecture to include governance, investment priorities, and organisational readiness.
Building resilience for the future
Achieving that resilience requires organisations to treat it as a business outcome rather than a technology purchase. This means defining the required operational result before discussing infrastructure products.
In practice, institutions must be able to continuously protect, detect, recover, and prove the integrity of their data.
Daruwala said the build-versus-buy decision should account for whether an institution has the expertise to develop and maintain a system over the long term, continue investing in it, and do so cost-effectively. Even newly deployed systems become legacy technology over time, making modernisation a continuing discipline rather than a one-off project.
Looking ahead, Joe Ong, Vice President and General Manager of Hitachi Vantara ASEAN, outlined the priorities FSIs should address over the next 12 to 24 months to build more resilient data infrastructure.
“Financial institutions should make resilience part of their day-to-day operations, rather than treating it as a capability tested only during a crisis,” he said.
Ong recommended that FSIs start by identifying the services customers depend on most, along with the data, technology, and third parties that support them. They must then test whether those services can continue when a dependency fails, recover within the required timeframe, and restore data that can be trusted.
“With institutions adopting more AI and operating across increasingly complex environments, they will also need stronger assurance that their data remains available, trusted, and auditable,” Ong added. “A recovery plan on paper is not enough; boards and senior management need evidence that it will work under realistic conditions.”
Ultimately, Ong said resilience should be measured not by whether an institution has a recovery plan, but by whether its leaders can demonstrate that critical services can withstand disruption, recover as intended, and continue to earn customer trust.
