BNM MCIPD: Customer Information and Permitted Disclosures

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

What MCIPD Governs and Why It Predates PDPA Thinking

The confidentiality duty MCIPD places on a bank over its customers' information, how that duty sits within BNM's supervisory framework, and why the policy document's logic, built around permitted disclosure gateways rather than consent, reads differently from a PDPA-first analysis.

Break

The Permitted Disclosure Gateways

Working through the categories of disclosure MCIPD permits a bank to make without breaching its confidentiality duty, and the documentation and internal approval trail each category needs before a disclosure actually happens.

MCIPD and PDPA Together: What Applies When

Why a bank has to satisfy both MCIPD and PDPA for the same piece of customer information, where the two frameworks ask for the same thing and where they ask for something different, and the practical sequencing of an MCIPD check and a PDPA check on the same disclosure request.

Lunch

Building the Disclosure Request Decision Workflow

Designing a practical workflow for handling an incoming request to disclose customer information: who assesses it against MCIPD first, what has to be documented before approval, and escalation points for a request that does not cleanly fit a permitted category.

Common Disclosure Scenarios

Working through disclosure requests a bank handles routinely, to credit reporting agencies, under a court order or regulatory request, to a group company, and at the customer's own request, and applying the decision workflow to each.

Break

Workshop: Assessing a Disclosure Request

Participants assess a set of realistic disclosure request scenarios against MCIPD's permitted disclosure gateways and PDPA together, document their decision and reasoning, and compare their assessment against the group.

Wrap-Up and Q&A

Key takeaways, next steps, and close.