BOCM paid RM88,000 for the AMP imposed by BNM on Aug 2.

In a statement, the central bank said BOCM failed to obtain BNM’s prior approval in relocating two of its systems to new data centres in December 2022 and February 2023, in breach of paragraph 48(1)(a) of the Financial Services Act 2013 (FSA) read together with paragraph 12.1(b) of the Policy Document on Outsourcing (Outsourcing PD).

“The two systems are core banking systems, and their relocation is deemed as a significant modification to the existing approved outsourcing arrangement as it may materially change the level and/or type of risk to which BOCM is exposed,” it said.

Under the Outsourcing PD, BNM said a financial institution is required to obtain BNM’s written approval before significantly modifying any existing approved material outsourcing arrangement.

“This is to ensure BNM’s continued ability to effectively supervise financial institutions.

“The non-compliance was a result of gaps in BOCM’s oversight over its outsourcing activities and outsourcing-related internal policies and procedures,” it added.

BOCM has taken appropriate measures to strengthen its oversight over outsourcing practices, including institutionalising periodic reviews of its outsourcing arrangements.

Additionally, it improved coordination with its group functions that perform material activities on behalf of BOCM to ensure compliance with applicable local laws and regulations at all times.

In deciding the imposition of the AMP, BNM said it considered the relevant aggravating and mitigating factors, including the facts of the case and BOCM’s past non-compliance record.