Bank Negara Malaysia RMiT Update: New Authentication Rules for Fintech and Banks

Bank Negara Malaysia’s updated RMiT framework tightens authentication requirements for regulated financial institutions, moving away from SMS OTP toward phishing‑resistant methods (passkeys, device binding, adaptive MFA, and risk‑based authentication), mandating single‑device defaults, stronger phone‑change verification, and cooling‑off periods for new devices; the document is a MojoAuth blog post explaining these changes and how modern authentication platforms can help fintechs comply.