> ## Content Index > Fetch the complete content index at: https://www.krishnasridhar.com/llms.txt > Use this file to discover other available public pages before exploring further. # Bank Negara's AI Paper Is Still a Draft. Four Other Regulators Already Finished Theirs. - URL: https://www.krishnasridhar.com/bnm-ai-paper-still-a-draft/ - Published: 2026-08-29T13:37:01.000Z - Updated: 2026-08-29T13:37:01.000Z - Description: Over 70% of Malaysian banks already run AI. The rulebook is still a draft. Four other regulators have already decided what prove it means. - Author: Krishna Note # Bank Negara's AI Paper Is Still a Draft. Four Other Regulators Already Finished Theirs. Bank Negara Malaysia is the country's central bank — and the regulator that every licensed bank and insurer in Malaysia has to answer to. Right now, it's working out the rules for how those banks are allowed to use AI. Here's where that stands: over 70% of Malaysian banks and insurers already have at least one AI system live, Bank Negara's own governor said in July. The rulebook for how they're supposed to govern that AI is still a draft — released for public comment in August 2025, feedback closed that October, nothing binding since. Most of the industry is already doing the thing the rulebook hasn't finished describing. That's not unusual — regulators everywhere move slower than the technology. What's worth seeing is how far ahead of Malaysia some of them already are: | Regulator | Who they are | Where they are now | What they actually make banks do | | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Bank Negara Malaysia (BNM)** | Malaysia's central bank | Still a draft, not law | Follow 7 broad principles (fairness, accountability, explainability); likely to get folded into BNM's existing tech-risk rulebook rather than a new law | | **The EU** | The European Union — its law applies to any bank operating there | Became binding law on 2 Aug 2026 | If AI decides something like a loan or insurance price, the bank must log every such decision, prove a human checked it, and pass an outside inspection *before* the system goes live | | **MAS** | Singapore's central bank and financial regulator | Not law, but a detailed practical guide released March 2026 | Build the record-keeping into the AI system itself — because checking every single AI decision by hand isn't realistic once it's running at scale | | **FCA** | The UK's financial regulator | Running a live test programme, no new law yet | Puts real banks and AI tools in front of the regulator directly, testing what actually goes wrong, before writing any rule | | **Malaysia's AI Bill** (separate from BNM — this one covers every industry, not just banking) | A new, economy-wide law being drafted by the Ministry of Digital | Public comment period closed 31 July 2026 | Sorts AI into three risk tiers; the riskiest tier needs documented human checks, policed by a new watchdog body | The gap isn't mainly about speed. It's about what everyone else has already decided "being responsible" has to mean in practice. ## What "prove it" actually looks like Here's the plain version. Say a bank's AI system turns someone down for a loan. Under the EU's new law, it's not enough for the bank to have a policy that says "a human always checks AI decisions." The bank has to produce, for that one case: which system made the call, what data it used, and proof a specific person reviewed it — on demand, after the fact. A written policy isn't evidence anymore. A record is. Singapore's regulator is pushing banks toward the same idea from a different angle: instead of testing whether an AI model "seems fair" once, in a lab, build the checking and the record-keeping into the system permanently, so it's automatic rather than something someone has to remember to do. Bank Negara's own governor said something close to this himself in July: **"responsibility cannot be delegated to an algorithm."** Good instinct. The honest follow-up question for any Malaysian bank is simpler than it sounds: if someone asked to see the actual proof behind that sentence tomorrow — not the policy, the record — could you produce it? ## Why waiting for the rulebook might be the costlier choice Right now, Bank Negara is taking the lightest path of the five: extend its existing rules a bit, rather than write a whole new law. That's a reasonable place to start. But every regulator that's gone further — the EU with binding law and real fines, Singapore with a working system, the UK by testing it live — has landed on the same answer: don't just say you check AI decisions, prove you do. If that's where the rest of the world keeps ending up, it's a fair bet Malaysia gets there too, eventually. Building that proof now, while it's still optional, is a choice a bank gets to make on its own terms. Building it later, once it's the law, usually happens on someone else's deadline — with a lot less say in how it's built. Sources: [BNM Governor's remarks, AICB Nexus Conference, via Fintech News Malaysia](https://fintechnews.my/59532/ai/bnm-ai-banks/?ref=krishnasridhar.com); [BNM AI discussion paper analysis, HHQ](https://hhq.com.my/posts/bank-negara-malaysias-discussion-paper-artificial-intelligence-in-the-malaysian-financial-sector/?ref=krishnasridhar.com); [EU AI Act August 2026 banking deadline, Patech Labs](https://www.patechlabs.com/news/eu-ai-act-august-2-2026-deadline-banks-high-risk-ai?ref=krishnasridhar.com); [MAS AI Risk Management Guidelines and Project MindForge, Origin Pi](https://originpi.com/blog/mas-ai-risk-management-2026/?ref=krishnasridhar.com); [FCA Supercharged Sandbox](https://www.fca.org.uk/firms/innovation/supercharged-sandbox?ref=krishnasridhar.com); [Malaysia AI Governance Bill consultation, Baker McKenzie](https://www.bakermckenzie.com/en/insight/publications/2026/07/malaysia-public-consultation-on-the-ai-governance-bill?ref=krishnasridhar.com). [← All notes](https://www.krishnasridhar.com/blog/)