Bursa Malaysia, Stockbroking Industry Issue Cyber Resilience Enhancement Recommendation Paper

KUALA LUMPUR, Nov 11 (Bernama) -- Bursa Malaysia Bhd in collaboration with Malaysia’s stockbroking industry today announced a recommendation paper comprising a series of cyber resilience enhancements to strengthen the integrity of the stockbroking ecosystem.

The exchange said in a statement that these enhancements are developed as part of the industry’s collective response to the unauthorised trades incident in late April 2025.

The recommendation paper is the collective output of an industry working group formed in June 2025, comprising representatives from both bank-backed and non-bank participating organisations (POs) as well as cybersecurity experts, chaired by Bursa Malaysia chief regulatory officer Julian M Hashim.  

“The industry working group was tasked with assessing current industry cybersecurity practices to identify vulnerabilities, developing industry-wide standards for information technology (IT) risk management and incident response, as well as recommending regulatory and operational improvements,” said the exchange.

Bursa Malaysia chief executive officer Datuk Fad’l Mohamed said the exchange's priority is to protect investors and uphold the trust they place in the securities market.

"These enhancements represent the industry’s commitment to every investor that cybersecurity safeguards are taken seriously, and are of prime importance.

"By strengthening the cyber resilience of the stockbroking ecosystem, we are actively taking steps to fortify the marketplace where investors can trade with confidence, knowing their investments are protected against cyber threats,” he said.

According to the statement, Bursa Malaysia will adopt a two-pronged oversight approach to guide the implementation of the enhancements, focusing on -- enhancing Bursa Malaysia’s IT security standards (ITSS) for brokers by incorporating the recommended cybersecurity and regulatory standards outlined in the recommendation paper.

It will also strengthen the exchange’s oversight of independent software vendors (ISVs) which are order management systems (OMS) providers.  

“The recommendations are broadly aligned with the Securities Commission Malaysia’s Guidelines on Technology Risk Management (GTRM), and Bank Negara Malaysia’s Risk Management in Technology (RMiT) framework," it added.

The exchange said the recommendation paper aimed to raise industry-wide cybersecurity standards and resilience by setting clear expectations for brokers, including the responsibility to exercise effective oversight over their third-party technology service providers – such as ISVs that provide OMS - to ensure compliance with Bursa Malaysia’s requirements.

The enhancements are grouped into nine key pillars, forming a comprehensive framework for cybersecurity and regulatory controls including security access controls; threat detection and protection; patch management; infrastructure and operational resilience; and recovery planning.

They include oversight of technology service providers; incident management; training and awareness; and dedicated cybersecurity role establishment.

Bursa Malaysia stressed that the recovery planning and incident management pillars are subject to full compliance within three months of the issuance of the recommendation paper, given their critical role in operational resilience and incident response preparedness.

“For pillars that involve system changes or infrastructure upgrades, full compliance is targeted by Dec 31, 2026.

“For queries regarding the recommendation paper, brokers can email rswg-secretariat@bursamalaysia.com,” it added.

-- BERNAMA