For Fintech · Payments · Digital Banks · Insurers · Takaful Operators

BNM asks for evidence, not assurances.

RMiT is assessed on what your infrastructure does — cryptography, access control, logging, third-party arrangements, incident response. Two regulators watch the same breach on two different clocks: the Bank on detection, the PDP Commissioner within 72 hours. AuditCore maps your stack against both before your next composite audit does.

Free Website Check → See Plans

What the law expects from you

The obligations that apply specifically to fintech & insurance — with the statute doing the expecting.

BNM RMiT — technology risk framework

Financial institutions must run a board-approved technology risk management framework with control standards for cryptography, access management, and system resilience. The policy is not the control — the configuration is.

BNM RMiT — incident notification

A cyber incident must be reported to the Bank on detection, with a full root-cause account to follow. That is only possible if your logging can detect it in the first place.

PDPA 2024 s.9 & s.12B

Your payment processor, KYC vendor, and cloud host are processors and are now directly liable — and a personal-data breach carries its own 72-hour notification duty, separate from the BNM channel.

Act 854 — Cyber Security Act 2024

Banking and finance is a designated National Critical Information Infrastructure sector: risk assessments, independent audits, and incident reporting to NACSA are statutory, not optional.

What we usually find

The three most common findings when we audit fintech & insurance. All fixable — once they're visible.

The framework says one thing, the configuration another

Policy documents promise TLS minimums, key rotation, and log retention. The running configuration disagrees. RMiT is assessed on the running configuration.

Third parties nobody declared

SDKs, analytics, and outsourced processing that never reached the third-party arrangement register. Each one is an unassessed dependency inside a regulated stack.

Pricing models with no explanation route

Automated underwriting, credit limits, and premium pricing decide outcomes for real customers. The AIGE guidelines recommend documented logic, an explanation for the affected person, and a human to appeal to.

The profiles that apply to you

A paid AuditCore scan runs your codebase and configuration against every check in these profiles — plus the core security set.

BNM RMiT · 17 checks InsurTech · 14 checks