Bank Negara Malaysia issues revised policy document on e-KYC for financial institutions

29 April 2024

Bank Negara Malaysia (“BNM”) issued a revised policy document on Electronic Know-Your-Customer (e-KYC) (“Revised Policy Document”) and a revised set of Frequently Asked Questions on the Revised Policy Document on 15 April 2024.

The Revised Policy Document and the revised set of Frequently Asked Questions supersede a previous policy document by the same name (“Superseded Policy Document”) and a set of frequently asked questions, both issued on 30 June 2020.

The Revised Policy Document came into effect on its date of issuance, i.e. 15 April 2024.

Application

As in the case of the Superseded Policy Document, the Revised Policy Document applies to the following entities (severally “FI” and collectively “FIs”) which propose to implement electronic Know-Your-Customer (“e-KYC”) solutions for on-boarding of customers:

licensed banks, licensed investment banks and licensed life insurers under the Financial Services Act 2013 (“FSA”);
licensed Islamic banks and licensed family takaful operators under the Islamic Financial Services Act 2013 (“IFSA”);
prescribed development financial institutions under the Development Financial Institutions Act 2002;
approved issuers of designated payment instruments under the FSA;
approved issuers of designated Islamic payment instruments under the IFSA; and
licensed money services businesses under the Money Services Business Act 2011.

The application of the Revised Policy Document may be extended to any other institution that may be specified by BNM.

The Revised Policy Document does not apply to agent banking channels governed by BNM’s policy document on Agent Banking dated 30 June 2022.

Purpose

The Revised Policy Document sets out the minimum requirements and standards that a FI must observe in implementing e-KYC for on-boarding of individuals and legal persons. These requirements seek to:

enable safe and secure application of e-KYC technology in the financial sector;
facilitate BNM’s continued ability to carry out effective supervisory oversight of FIs; and
ensure effective anti-money laundering, countering financing of terrorism and countering of proliferation financing (AML/CFT/CPF) control measures are in place.

Responsibilities of the board

A FI must obtain its board approval on its overall risk appetite and internal framework governing the implementation of e-KYC for both individuals and legal persons.

The board is to set and ensure the effective implementation of appropriate policies and procedures to address risks associated with the implementation of e-KYC (including operational, information technology and money laundering, terrorism financing, proliferation financing and fraud risks).

Identification and verification (IDV) of customers through e-KYC

General requirements

In line with requirements in BNM’s policy document on Anti-Money Laundering, Countering Financing of Terrorism, Countering Proliferation Financing and Targeted Financial Sanctions for Financial Institutions issued on 5 February 2024 (“the FI-AML Policy Document”), a FI must ensure and be able to demonstrate on a continuing basis that appropriate measures for the identification and verification of a customer’s identity through e-KYC are secure and effective. Such measures are to be proportionate to the risk dimensions of e-KYC.

A FI is required to adopt an appropriate combination of authentication factors when establishing measures to verify the identity of a customer being on-boarded through e-KYC. The strength and combination of the authentication factors shall be commensurate to the risks associated with inaccurate identification for a particular product or service. For the aforesaid purposes, a FI may give regard to the key basic authentication factors which, among others, include:

something the customer possesses (e.g. national identity document such as an identity card, registered mobile number, company’s certificate of incorporation);
something the customer knows (e.g. PIN, personal information, transaction history); and
in the case of individuals, something the customer is (e.g. biometric characteristics).

IDV through e-KYC for individuals

In identifying and verifying an individual’s identity through e-KYC, a FI may undertake, among others, the following measures:

Document verification – i.e. ensuring that the government issued ID to support e-KYC customer verification is authentic by utilising appropriate fraud detection mechanisms;
Biometric matching – i.e. verifying the customer against a government issued ID by utilising biometric technology; and/or
Liveness detection – i.e. ensuring the customer is a live subject and not an impersonator (e.g. through use of photos, videos, synthetic human face masks) by utilising liveness detection.

IDV through e-KYC for legal persons

When implementing e-KYC for legal persons, a FI is required to have due regard to the areas of listed as customer due diligence (CDD) requirements for legal persons in the FI-AML Policy Document, including but not limited to:

identification and verification of a legal person as an entity to establish the existence of a legitimate business¹;
identification and verification of the authorised person appointed by the legal person to establish business relations and conduct transactions on its behalf; and
identification and reasonable measures for verification of beneficial owners of the legal person.

In identifying and verifying the authorised person via electronic means, a FI shall ensure that:

electronic communication or documents that capture collective decision making by the directors of the legal person (e.g. digital forms of Directors’ Resolution or Letter of Authority) to appoint the authorised person and establish business relations are maintained in accordance with relevant record keeping requirements specified in paragraph 24 of the FI-AML Policy Document;
the electronic means adopted to identify and verify the authorised person are within the legal person’s constitution or any other document which sets out the powers of the legal person; and
the authorised person is identified and verified through e-KYC as an individual, having due regard to the measures set out in the Revised Policy Document for identifying and verifying a customer who is an individual.

The electronic means to capture collective decision making by the directors of the legal person on the appointment of the authorised person may, without limitation, include the following:

utilising electronic technologies that identify and verify the directors, and subsequently capture evidence of directors’ consent (e.g. audited/circulated email trails, providing agreement or disagreement through personal secure authentication links for directors to consent, video-conferencing to verify consent, digital signatures and use of secure electronic voting platforms); and/or
using third parties (e.g. Digital Company Secretaries) that may provide confirmation on the legitimacy of relevant evidence such as the Directors’ Resolution or Letter of Authority;

A FI is required to undertake its own risk assessment to clearly define parameters for classifying potential legal persons (e.g. higher risk) that are not allowed to establish business relations through e-KYC.

Ensuring effective e-KYC implementation

Where the decision to verify a customer’s identity through e-KYC is automated using artificial intelligence, machine learning or other forms of predictive algorithms, whether in whole or in part, a FI is to ensure that the e-KYC solution is continuously able to accurately distinguish between genuine and non-genuine cases of customer on-boarding. For this purpose, a FI shall take steps to measure and assess the False Acceptance Rates (FAR) using the formula set out in paragraph 8.21 of the Revised Policy Document and applying the considerations and requirements listed in Appendix 2 of the Revised Policy Document.

Paragraph 8.22 of the Revised Policy Document requires a FI to ensure that the technology provider appointed to provide the e-KYC solution conducts the following:

ensure that the e-KYC solution, encompassing the three e-KYC modules namely document verification, biometric matching and liveness detection has been assessed by a credible external independent assessor in accordance with the scope and criteria as provided in Appendix 3 of the Revised Policy Document; the FI must also ensure that the technology provider has put measures in place to address the gaps or weaknesses identified from such assessment in a timely manner; and
ensure that the relevant certification(s) is obtained for the various modules under e-KYC solution, where such certification is available.

A FI that has yet to implement e-KYC or wishes to change its e-KYC solution or technology provider used is required to ensure the following:

perform due diligence on the identified technology provider and the e-KYC solution; the due diligence which must be validated by an independent party, shall include: (i) assessing whether the technology provider has a good track record, experience and expertise in offering solutions involving regulated entities and products; and (ii) assessing the e-KYC solution’s technical capabilities (e.g. parameters, methodology of models used); and
the requirements in paragraph 8.22 of the Revised Policy Document are fulfilled before implementing the e-KYC solution.

A FI is to review or revalidate the requirements under paragraph 8.22 of the Revised Policy Document for continued relevance at least once every three years, or where there are any material changes to the e-KYC solution.

To ensure effective overall implementation of e-KYC, a FI is required to conduct an independent assessment on its own processes, procedures and controls prior to first-time implementation of an e-KYC solution and undertake a review of the independent assessment on a regular basis, as may be determined by the FI.

Addressing ongoing vulnerabilities

A FI shall continuously monitor, identify and address potential vulnerabilities in the e-KYC solution. Where potential vulnerabilities are detected, the FI shall identify and adopt immediate mitigation measures as necessary, including for higher risk products.

Additional safeguards to facilitate deployment

To facilitate deployment of e-KYC solutions for products with higher risks arising from inaccurate identification, a FI is to observe the considerations and safeguards specified in Appendix 4 (as specified, amended or superseded from time to time) of the Revised Policy Document.

Specific requirement for money services business sector

FIs in the money services business sector that wish to utilise e-KYC for customer on-boarding are required to comply with the e-KYC identification and verification (IDV) requirements for customers who are individuals and legal persons (as applicable) in the Revised Policy Document and the FI-AML Policy Document.²

Reporting requirements

In monitoring the effectiveness and accuracy of e-KYC solutions utilising artificial intelligence, machine learning or other forms of predictive algorithms, a FI shall maintain a record of the performance of the e-KYC solution segregated on a monthly basis. The records shall be made readily available for review by BNM.

A FI shall submit the record stated in the preceding paragraph through the electronic platform mentioned in paragraph 9.3 of the Revised Policy Document on a half-yearly basis as follows:

for the period of January to June of each year, the record shall be submitted no later than 4 August of the same year; and
for the period of July to December each year, the record shall be submitted no later than 4 February the following year.³

Regulatory process

The regulatory process applicable to a FI seeking to implement e-KYC is as follows:

a FI which is a licensed person (namely a licensed bank, licensed investment bank, licensed insurer, licensed Islamic bank or licensed family takaful operator) or a prescribed development financial institution may implement and utilise an e-KYC solution after 14 working days from the receipt by BNM of the complete set of documents and information referred to in Appendix 5 of the Revised Policy Document; and
a FI which is a licensed money-changing operator, licensed remittance service provider, approved non-bank issuer of designated payment instruments or designated Islamic payment instruments is required to obtain the written approval from BNM prior to implementing e-KYC; such FI must submit a complete set of documents and information referred to in Appendix 5 of the Revised Policy Document with its application.

It should be noted that where a significant portion of the e-KYC services is operated by a third party, the FAQs to the Revised Policy Document clarifies that this is likely to be considered as a material outsourcing arrangement. The prior written approval of BNM as such may nevertheless be required by a licensed person under such circumstances in accordance with BNM’s Outsourcing Policy Document issued on 23 October 2019.

Safeguards for higher risk financial products

Appendix 4 of the Revised Policy Document sets out the e-KYC safeguards for higher risk financial products, namely current account, savings account and unrestricted investment account with funds placement and withdrawal flexibilities as well as funds transfer features.

Enforcement

Where BNM deems that the requirements in the Revised Policy Document have not been complied with, it may take appropriate enforcement action against the FI, including the directors, officers and employees, or direct the FI to undertake corrective action to address any identified shortcomings, and/ or suspend or discontinue implementation of e-KYC.

Comments

The major revisions introduced under the Revised Policy Document were proposed in an Exposure Draft of the policy document on Electronic Know-Your-Customer issued by BNM on 23 February 2023.

The Revised Policy Document has introduced substantial enhancements to the e-KYC requirements under the Superseded Policy Document. In particular, the Revised Policy Document has extended the use of e-KYC to on-boarding of legal persons, whereas the Superseded Policy Document applied only to the use of e-KYC for on-boarding of individuals.

The requirement for the FI’s e-KYC solution technology provider to subject the three modules of the e-KYC solution, namely document verification, biometric matching and liveness detection, for assessment by a credible external independent assessor as well as the guidance provided in Appendix 3 of the Revised Policy Document for such assessment are new requirements that will assist in ensuring the effectiveness and robustness of the e-KYC solution.

In addition, Appendix 4 of the Revised Policy Document has suggested alternative safeguards for on-boarding of an individual who does not have any existing bank account with another licensed person and thus is unable to perform a credit transfer as a safeguard in relation to higher risk financial product. The FAQs to the Revised Policy Document also clarifies that it remains the responsibility of the FI offering such products to build in technical capabilities (e.g. name matching with fuzzy logic) that would enable the FI (as the fund transfer sending bank) to detect and block any fund transfer attempts to other accounts outside of the FI with the same customer’s name.

Article by Lee Ai Hsian (Partner) and Javene Fan (Associate) of the Banking and Finance Practice of Skrine.

¹ Appendix 1 of the Revised Policy Document provides examples of verification methods to establish business legitimacy.

² This requirement may have been included in the Revised Policy Document out of abundance of caution as entities in the money services business sector are already categorised as reporting institutions under the FI-AML Policy Document (in particular, see Paragraph 14C of the FI-AML Policy Document).

³ If the deadline falls on a non-working day, the deadline will be extended to the next immediate working day, unless specifically notified in writing by BNM on the revised deadline.

This article/alert contains general information only. It does not constitute legal advice nor an expression of legal opinion and should not be relied upon as such. For further information, kindly contact skrine@skrine.com.

Search

Bank Negara Malaysia issues revised policy document on e-KYC for financial institutions