Tier confirmation
Transaction value and volume tested against the tiers.
BNM Payment Services Technology Readiness
BNM payment services technology readiness is preparing a payment company for BNM's Technology Requirements for Payment Services Regulatees (BNM/RH/PD 040-1) before they take effect. BNM's Technology Requirements for e-money issuers, merchant acquirers, money services businesses and payment system operators come into effect on 12 March 2027. We confirm your tier, close the gaps from your 90-day gap analysis, and build the evidence BNM will ask for.
BNM Payment Services Technology Readiness
What it is
A readiness engagement against the Technology Requirements for Payment Services Regulatees (BNM/RH/PD 040-1): tiering, gap assessment, remediation planning and evidence building.
Why organisations need it
The policy was issued on 12 March 2026, takes effect one year later, and required a gap analysis and action plan within 90 days of issuance. It applies proportionately through four tiers and covers governance, technology risk, operations, cyber security, digital services, cloud, fraud detection, payment devices and QR codes. With the deadline approaching, many payment companies still have open gaps.
What the engagement covers
Gap refresh
Updating your 90-day gap analysis.
Governance and risk
Board, framework and policies.
Operations and cyber
Controls and evidence.
Digital, cloud and fraud
Appendix requirements.
Evidence pack
Ready for BNM review.
What the business gets out of it
Deadline met
Ready by 12 March 2027.
Right-sized
Tier-appropriate controls.
Evidence ready
Not just controls.
Board clarity
Progress reported.
Practical
Plans your team can execute.
How it works
How the engagement runs
01
Tiering
Confirming applicable requirements.
02
Assessment
Current state.
03
Plan
Sequenced remediation.
04
Support
Policies and evidence.
05
Readiness review
Before the effective date.
Deliverables
What you receive
Tiering memo
Your tier and why.
Gap assessment
Updated.
Remediation plan
Sequenced.
Policy updates
Where needed.
Evidence pack
For supervision.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
On 12 March 2027, one year after it was issued on 12 March 2026. The policy also required a gap analysis and action plan within 90 days of issuance, so BNM expects regulatees to already know their gaps and be closing them.
The policy applies proportionately through four tiers, based on annual transaction value and volume, with tier one entities subject to RMiT. Your tier decides how much of the policy applies to you, so confirming it is the first step of the engagement.
Prepare it now and engage with BNM rather than waiting. A late gap analysis with a credible action plan is far better than none. We can help build it quickly, starting with your tier and the areas where the policy asks the most of you.
No. This is a compliance readiness service covering governance, technology risk, operations, cyber security, digital services, cloud, fraud detection, payment devices and QR codes. Technical testing is performed separately, and we check that its results are evidenced.
Typically two to four months, depending on your tier and how many gaps are open. The work runs from confirming your tier, through the gap assessment and remediation plan, to building the evidence BNM will ask for.