KUALA LUMPUR, 11 November 2025 — Bursa Malaysia Berhad (KLSE:BURSA), together with the nation’s stockbroking community, has introduced a comprehensive set of cyber resilience enhancements aimed at fortifying Malaysia’s capital-market infrastructure.
The measures outlined in a new Recommendation Paper released to all participating brokers—represent a collective response to the unauthorised trades incident in April 2025 and mark one of the most extensive cybersecurity initiatives in the Exchange’s history.
Industry-Led Collaboration for Market Protection
Formed in June 2025, the industry working group comprised representatives from both bank-backed and independent brokers as well as cybersecurity experts, chaired by Julian M Hashim, Chief Regulatory Officer of Bursa Malaysia.
The group’s mandate: assess vulnerabilities, establish unified industry standards for IT risk management and incident response, and recommend enhancements to regulatory oversight.
“Our priority is to protect investors and uphold the trust they place in our securities market,” said Dato’ Fad’l Mohamed, Chief Executive Officer of Bursa Malaysia.
“By strengthening the cyber resilience of the stockbroking ecosystem, we are taking proactive steps to ensure investors can trade with confidence, knowing their investments are protected.”
Julian M Hashim added that the recommendations were designed to be “actionable and scalable”, enabling adoption across brokers of different sizes and complexity levels.
Nine Key Pillars of the Cyber Resilience Framework
The Recommendation Paper, reviewed by independent cybersecurity specialists, outlines nine core pillars to elevate cybersecurity and operational standards across the trading ecosystem:
- Security Access Controls: Restrict system and data access based on roles to prevent unauthorised entry.
- Threat Detection and Protection: Deploy monitoring tools to identify and mitigate cyber threats.
- Patch Management: Ensure timely software updates to close security gaps.
- Infrastructure and Operational Resilience: Build redundancy and recovery capabilities to minimise downtime.
- Recovery Planning: Implement structured procedures for rapid restoration of critical systems.
- Oversight of Technology Service Providers: Strengthen accountability among Independent Software Vendors (ISVs) and Order Management System (OMS) providers.
- Incident Management: Create an end-to-end framework for timely detection, reporting, and resolution of cybersecurity and operational events.
- Training and Awareness: Embed a culture of vigilance through continuous education.
- Dedicated Cybersecurity Roles: Assign qualified personnel or external experts to lead cybersecurity governance and execution.
Alignment with Regulatory Standards
The framework aligns closely with the Securities Commission Malaysia’s Guidelines on Technology Risk Management (GTRM) and Bank Negara Malaysia’s Risk Management in Technology (RMiT) framework, ensuring consistency with national and international best practices.
Bursa Malaysia will adopt a two-pronged oversight approach:
- Upgrading its IT Security Standards (ITSS) for brokers to include the new cybersecurity requirements; and
- Enhancing supervision of Independent Software Vendors (ISVs) that provide trading and order-management solutions.
Implementation Timeline
- Immediate Priority (within 3 months): Full compliance for governance-related standards under Recovery Planning and Incident Management.
- By 31 December 2026: Full implementation for system-related and infrastructure-upgrade standards, allowing firms time to align resources and integrate controls into existing operations.
Brokers may direct queries regarding implementation to the RSWG Secretariat via rswg-secretariat@bursamalaysia.com.
“The enhancements raise the bar for cyber resilience across Malaysia’s securities industry,” said Dato’ Fad’l Mohamed. “Our investors can be assured that maintaining market integrity remains our foremost priority.”
