The Malaysian Bar’s International Malaysia Law Conference (“IMLC”) 2026 took place from 27 to 30 Oct 2026 at MITEC, Kuala Lumpur.
By Corina Robert Mangharam, Farez Jinnah
This session, titled “The Governance of Artificial Intelligence and Digital Banking”, was one of three concurrent streams in the Conference’s sixth breakout session. It addressed the balance to be struck between a digital bank’s obligation to adhere to traditional fiduciary duties in banking operations and the provision of modern AI-driven credit scoring and risk management services. Sponsored by LexisNexis, it was commenced by moderator Richard Wee Thiam Seng, Managing Partner of Richard Wee Chambers, who opened with a recent case involving a local bank, in which an officer acted on a payment instruction following a Zoom meeting that turned out to be fake, to illustrate the risks the session would address. He then welcomed three speakers with experience in the legal, regulatory and digital banking sectors.
The first speaker was Harizal Alias, Director of the Financial Development and Innovation Department at the Central Bank of Malaysia (“BNM”). He explained that BNM’s existing legislation and policy documents, which are regularly amended to keep pace with technology, provide for the governance of banks’ use of AI. BNM’s existing expectations on the role and accountability of the board and senior management apply equally to decisions and activities supported by AI, and BNM is not proposing a separate AI rulebook at this point. Existing requirements on the management of customer information, covering how data is collected, stored, shared and deleted, likewise apply when AI is used. He stressed the importance of human oversight of what goes into AI models, giving the example of an income estimation model used to approve loans, where a bank must have controls over who approves decisions and how exceptions and customer complaints are handled. He also noted BNM’s expectations on operational resilience where banks rely on third-party providers, and that the fair treatment of consumers and existing product governance processes, including compliance, risk management and board approval for higher-risk products, continue to apply to AI-enabled services. He added that regulation must keep pace with business needs, and that BNM has worked closely with the digital banks since their early days.
The next speaker was Tiu Gi Gyn, Head of Legal at Ryt Bank. She said the rules are in place, and the task is to apply them in an “AI-aware” way. She emphasised that a bank cannot outsource accountability: blaming an algorithm for rejecting a customer is “not a defence, but a confession”. Ryt Bank therefore records every AI use case in a single inventory with a risk rating, and high-risk critical systems require committee and board approval before launch. On vendor risk, she stressed that it remains the bank’s responsibility. Contracts with AI and cloud providers should include audit rights for the bank and BNM, a prohibition on training models with the bank’s data, advance notice of model changes, disclosure of subcontractors and data processors, liability allocation and exit plans. Vendor systems must also be tested before going live. She also highlighted that banking secrecy still applies, as prompts, logs and datasets may carry customer information, so in-house lawyers must map where data flows and challenge their technology teams on whether it leaves Malaysia. She noted that Ryt Bank uses ILMU, a sovereign large language model developed by YTL AI Labs, with data held in Malaysia so that Malaysian law applies. Recounting a recent documentary about AI agents on the Hugging Face platform that escaped their testing environment and accessed user credentials in pursuit of their assigned tasks, she observed that AI is good at finding answers but does not respect principles along the way, making lawyers the gatekeepers. Ryt Bank therefore keeps humans behind automated decisions. On consumer protection, she explained that personal identifiers are removed from its models, lending outcomes are monitored for bias and to protect customers from excessive borrowing, and its chatbot is scripted, multilingual and refers matters such as account closures to staff. She urged external counsel to give practical advice informed by current affairs and technology, to have their own AI governance, and to verify AI-generated work line by line.
The final speaker was Gaythri Raman, Managing Director of LexisNexis Southeast Asia and India. Gaythri explained that LexisNexis builds its AI tools on its own proprietary, verified content, guided by its parent company RELX’s responsible AI principles of explainability, human oversight, consideration of real-world impact, prevention of bias, and confidentiality and privacy. She predicted that regulation will be amended repeatedly as real-world problems arise, and that the common law, and therefore lawyers, will lead the way, since disputes will reach lawyers before legislation is enacted. Even with closed-loop tools using verified data, she said, lawyers must still check outputs line by line, as accountability rests with the user. She also highlighted two US cases: a US$2.5 million settlement between the Massachusetts Attorney General and student lender Earnest Operations LLC over alleged bias in its lending models against Black and Hispanic applicants, which she noted Earnest denies; and an order by the US Consumer Financial Protection Bureau for Apple and Goldman Sachs to pay about US$89 million in penalties and redress over the Apple Card, after customer disputes were not passed from Apple to Goldman Sachs. These cases illustrate the risks of biased data, model drift and data sharing between banks and their partners.
In closing, the moderator observed that BNM is setting the tone and keeping watch, industry stakeholders such as Ryt Bank and LexisNexis are governing themselves, and lawyers must step up as advisers in an area that remains fluid and evolving.
*This article reports on Breakout Session 6, Stream C: Corporate and Commercial Law.