Securities Commission’s Artificial Intelligence Regulation
By: Stevie Heong, Director, Technology Advisory
Securities Commission (SC) released their Guidelines on Technology Risk Management (GTRM) in late 2023 and they already had a dedicated section for the (then) upcoming AI industry. It is a short two pager Appendix 3, comprise four main points, looking extremely threadbare in a 2026 era that features ubiquitous use of AI. But we understand, back in 2023, the SC should be commended for taking those steps in predicting the need for AI regulation, something that Bank Negara (BNM) would do well to emulate.
Fast forward to 2026 and SC’s regulation is like a sand wall against the growing tide of AI adoption. BNM is carrying out a consultation paper on Ethical Adoption of AI, but many fear by the time the regulation appears, it would be obsolete. AI adoption is not just fast paced, it is light speed. Robo-advisors picking your investments, algorithms spotting fraud, models flagging suspicious trades, large language models sprouting out in the thousands daily (and closing just as fast).
SC surround’s its AI philosophy around four central themes.
First, accountability. Someone has to own it. You can't just plug in an AI tool and shrug when it goes sideways. There needs to be a real person — or team — responsible, plus a way to hit the "off" switch fast.
Second, transparency and explainability. If your AI rejects someone's loan or flags their account, you need to explain why. Not in convoluted mumbo jumbo, but in plain terms. "The computer said cannot, wor!" doesn't cut it.
Third, fairness. Your AI shouldn't discriminate. Say your credit model keeps rejecting applicants from a certain postcode, or certain demographics.
Fourth, accuracy and reliability. Test it properly. Protect the data it runs on. Keep it secure. We have false positives and false negatives, and we have the concept of confidentiality, integrity and availability, the three pillars of information security.
If we look at this, it’s very basic but give SC credit. They predicted the adoption of AI in its nascent years. Now it’s up to other regulators to pick up the gaps. One thing is for sure, AI efficiency and AI security can no longer be unrelated. If you want the benefit that AI brings to the organization, take it with the risk. As a wise man once said, “If you pray for rain, you gotta deal with the mud.”
So where do you start? Map out every place you're using AI or Machine Language. Assign a clear owner to each. Document how the models make decisions, build in bias checks and a kill-switch, and keep records you'd be comfortable showing a regulator. Don't wait for an audit to find the gaps. Find them yourself first.
If you're not sure your AI setup would survive that kind of scrutiny, now's the time to get it reviewed. Better to fix it on your terms than the SC's.