Regulatory and Legal Risk
Domain focus
Regulatory and legal risk covers changes in laws and BNM policy documents, supervisory action, litigation, contract enforceability, sanctions and licensing.
Core rules
- Regulatory risk includes both breach risk and change risk. Banks need horizon scanning, impact assessment, policy updates and training when BNM issues a new policy document.
- BNM's guidelines and policy documents are binding expectations; breach can lead to enforcement action under the Financial Services Act 2013, including fines and restrictions.
- Legal risk includes unenforceable security, defective documentation, netting uncertainty, sanctions breaches and data privacy under the PDPA 2010.
- Cross-border exposures need analysis of governing law, local security perfection and country risk.
- "Fit and proper" requirements apply to directors and senior officers.
Worked example
A bank takes a charge over Malaysian land but does not register it under the National Land Code. The loan defaults and the bank cannot enforce the security. The loss is a legal risk event, not merely a credit loss. The control is legal review and perfection before drawdown.
Traps
Do not treat regulatory risk as only operational risk. Do not assume BNM guidance is optional. Do not ignore netting enforceability. Do not overlook sanctions screening. Do not assume foreign law governs Malaysian security.