Bank Negara Malaysia issued an updated Operational Risk Reporting (ORR) policy document and an accompanying FAQ, setting mandatory requirements for reporting entities to submit Loss Event Data (LED) and Key Risk Indicators (KRI) through the ORR system. The requirements took effect on 30 January 2026 and supersede the ORR policy document issued on 10 April 2025. The framework applies to all reporting entities, including financial institutions, payment instrument issuers, registered merchant acquirers and payment system operators, and requires entity-level consolidation, validation and reconciliation of submissions with internal databases, systems and financial accounts. Oversight sits with the Group Chief Risk Officer or Chief Risk Officer, who must appoint up to two reporting entity administrators and up to 10 submission officers, complete ORR user self-registration via KijangNet, and update changes to key ORR user roles within one working day. Reporting covers operational risk events including those in foreign and offshore subsidiaries or branches that resulted in financial-related losses, with amounts reported in Ringgit Malaysia using the reporting entity’s internal exchange rate; the LED module covers events from 22 September 2014 onwards and the KRI module covers data from 1 October 2014 onwards (or from onboarding for later onboarded entities), while indirect financial losses are excluded from reported loss amounts. Bank Negara Malaysia also sets event-based timelines, including T+1 working day for high-reputational-impact actual events (from the date of event confirmation) and T+2 working days for confirmed events with losses of at least RM1 million, alongside specific deadlines for critical categories such as robbery and theft, cyber incidents, customer information breaches and Shariah non-compliance events. Payment-related fraud is reported by the 15th calendar day of the month following detection, while KRI submissions are due by the 15th calendar day of the following month for monthly indicators, by 15 April/July/October/January for quarterly indicators, by 28 July and January for semi-annual complaint KRIs (15 July and January for other semi-annual KRIs), and by 15 January for annual indicators.
Bank Negara Malaysia 2026-02-06
Bank Negara Malaysia updates Operational Risk Reporting requirements for Loss Event Data and Key Risk Indicators submissions through the ORR system
Bank Negara Malaysia's updated Operational Risk Reporting policy requires entities to submit Loss Event Data and Key Risk Indicators via the ORR system from 30 January 2026. Applicable to financial institutions and others, it mandates consolidation and validation of submissions, overseen by the Group Chief Risk Officer. Reporting includes operational risk events with financial losses in Ringgit Malaysia, with specific timelines for event-based reporting and KRI submissions.