Consequences of regulatory breach
6. What are the potential consequences for breaching financial services rules on cloud outsourcing?

Under the Financial Services Act 2013 ("FSA"), Bank Negara Malaysia ("BNM") may issue a direction in writing if it believes that a financial institution, its director, chief executive officer or senior officer has, among other things, breached or contravened any provision of the FSA or any standards or direction issued under the FSA (this includes the guidelines issued by BNM with respect to the FSA and for the purpose of carrying out the regulatory objectives of the FSA). An institution, its director, chief executive officer or senior officer that fails to comply with such direction commits an offense and will, on conviction, be liable to imprisonment for a term not exceeding 10 years, a fine not exceeding MYR 50 million or both.

Based on the Licensing Handbook, the Securities Commission Malaysia ("SC") can institute an action against any person contravening the requirements specified in the Licensing Handbook, including administrative actions against capital markets services license holders as provided under the Capital Markets and Services Act 2007 ("CMSA"). Under the CMSA, where a person contravenes or fails to give effect to the Licensing Handbook issued by the SC, the SC may take any one or more of the actions set out below:

  1. Direct the person in breach to comply with any requirement of the Licensing Handbook.
  2. Impose a penalty in proportion to the severity or gravity of the breach on the person in breach, but which in any event should not exceed MYR 1 million.
  3. Reprimand the person in breach.
  4. Require the person in breach to remedy the breach or to mitigate its effect, including making restitution.