Malaysian banks have fewer than two years to meet the first of several deadlines under the most sweeping overhaul of central bank regulatory reporting in two decades. Many are still working out the scale of the change.
Under Bank Negara Malaysia’s transition to granular reporting, approximately 100 existing reports will be retired across three phases tentatively ending in 2031, to be replaced with transaction-level data submissions. The first phase, due by the end of 2027, retires 27 reports across deposits, payments, and financial derivatives.
For banks, this is more than a technical migration. It is a shift to a fundamentally different reporting paradigm, atomised data rather than aggregated data, and one that must be implemented without disrupting customer-facing operations or forcing unsustainable investment into legacy systems.
“This is where Finexus, a Malaysian technology firm with 25 years of banking experience, believes middleware will play an increasingly important role. In its view, banks will need practical ways to bridge existing infrastructure to the central bank’s evolving requirements, rather than rebuild everything from the ground up,” said Joanne Loh, Director, Strategy and Transformation.
Why it matters now
The central bank’s initiative rests on four principles: collecting data once, standardising requirements, automating collection, and providing an agile platform for iterative change.
It spans three of the central bank's principal reporting platforms including:
The aim is to eliminate duplicate reporting between the core subject areas in:
What makes this urgent is timing. Banks are already carrying large programmes tied to Basel III, e-invoicing, and payments modernisation. Waiting too long means the granular reporting change gets pushed into the same limited pool of people, systems, and budget, while the first reports are already moving toward retirement at the end of 2027.
Four implementation risks banks underestimate
The first is bandwidth. Many banks simply may not have enough resources and time to redesign data and reporting processes while other regulatory and business programmes are still in flight.
The second is data inconsistency during the transition. Both aggregated and granular forms will run in parallel for an extended period. If the figures fail to reconcile, the bank is at risk of non-compliance, with gaps surfacing only when regulators flag them.
The third is fragmented data ownership. Banks maintaining regulatory data across multiple host systems with limited cross-platform visibility face a structural problem under granular reporting. A single source of truth becomes a precondition for accuracy, and every future policy change multiplies the cost of remediation across each fragmented system.
The fourth is operational pressure. Banks are required to run existing reporting in parallel with the new requirements. Without automation and digitalisation, this could be detrimental to the bank’s day-to-day operations and overall cost profile.
These risks are intertwined: a bank without a unified data layer cannot reconcile easily, and one that cannot reconcile burns bandwidth on manual reviews. The institutions that come through will be those that address all four together.
A blueprint for compliance without disruption
Finexus has built AIRStream, as a middleware layer for the transition to granular reporting. The name reflects its purpose: to carry streams of regulatory data through existing bank infrastructure and into the central bank’s new reporting model, with zero disruption to current reporting systems.
On non-Finexus platforms, AIRStream draws data from STATsmart, ESS and CCRIS without requiring new capabilities or changes to source data collection, then generates reconciliation reports between aggregated and granular datasets. For banks already using Finexus platforms such as STARWORKS NSRS, STARWORKS ESS and STARWORKS CCRIS, the connection is direct and system-to-system, with the same results.
Reconciliation runs continuously, with granular datasets cross-checked against aggregated submissions, host systems, and the bank’s general ledger. This ensures full compliance and minimises penalty exposure.
AIRStream also centralises workflow on a single platform, with real-time central bank policy and code updates, dynamic extract-transform-load processing with source-level enhancement, API-driven submission to the central bank, maker-checker-approver workflow, customisable bank verification rules and new fields, and seven-year data retention capacity.
Each bank is provided with a dedicated tenancy in Finexus -owned data centres in Malaysia. The centres meet RMiT-Cloud Technology Risk Assessment guidelines and PCI DSS Level 1 standards, and support 24x7 IT operations through a cloud-based SaaS deployment. In effect, AIRs functions as an extension of the bank’s host-system database for regulatory reporting.
“At Finexus, backed by extensive experience in regulatory reporting, we support financial institutions in streamlining compliance, enhancing operational efficiency, and future-proofing their operations as the industry transitions towards a more granular, digital-first reporting framework,” said Chareeyan, Head, Regulatory Reporting.
Why local experience matters
Regulatory reporting in Malaysia carries its own supervisory logic. BNM and PIDM have specific expectations around reporting conventions, submission formats, and compliance workflows that differ from any other jurisdiction. Understanding them takes time inside the system, not just familiarity with the regulations on paper.
Finexus has spent 25 years there. Its Regulatory Reporting solutions are used by every bank in Malaysia to meet BNM's policy requirements. More than 50 financial institutions run on Finexus Cloud. Thirty of them have been returning clients for over a decade.
That depth of tenure means the validation logic built into Finexus' systems reflects more than two decades of real submissions and real supervisory feedback. It is the kind of institutional knowledge that only accumulates by being continuously present through every policy shift and reporting cycle BNM has introduced since modern requirements came into force.
The road to 2031
Granular reporting is set to drastically change how Malaysian banks manage regulatory data, controls, and reporting operations. Finexus believes the window for preparation is narrowing, and that banks may be better served by building on existing systems rather than replacing them outright. Banks that begin assessing readiness now, particularly as the 2027 Phase 1 deadline approaches, will retain optionality. Those that wait will not.
