Bank Negara Malaysizla (BNM) has revised its Operational Risk Reporting (ORR) Policy Document, strengthening the reporting framework through which financial institutions submit operational risk information to the regulator. The revised policy was issued on 30 January 2026 and announced on 6 February 2026, superseding the previous version dated 10 April 2025.
The framework sets out requirements for reporting Loss Event Data (LED) and Key Risk Indicators (KRI) through BNM’s ORR system. The revised requirements took effect on 30 January 2026, according to the regulator’s published notice.
Loss-event data enables institutions to record and assess operational incidents, including their causes and financial consequences. Key risk indicators provide information that can help identify emerging weaknesses, deteriorating controls or changes in operational risk exposure. Used together, these measures can support more informed risk assessments and earlier management intervention.
The effectiveness of the framework depends on the quality and consistency of the information reported. Inconsistent incident classifications, incomplete records or unclear accountability for data collection can make it harder to identify recurring problems across business units. Financial institutions therefore need reliable reporting processes, clearly assigned responsibilities and appropriate internal validation.
What financial institutions should consider Institutions should review their data collection, classification and escalation procedures against the revised policy requirements. Risk and compliance teams should ensure that relevant personnel understand reporting responsibilities and that the information submitted through the ORR system is complete, accurate and consistent with applicable definitions.
Reporting should also inform corrective action. When an operational incident occurs, management should assess its underlying cause, determine whether similar weaknesses exist elsewhere and monitor whether remedial measures have been effective. Repeated incidents may point to deficiencies in systems, processes or oversight that require broader intervention.
The revised framework reinforces the importance of treating operational risk information as a management resource as well as a regulatory reporting obligation. Its value will depend on whether institutions use reliable data to identify patterns, address control weaknesses and reduce the likelihood of recurring operational failures.