The recent Sessions Court ruling ordering a local bank to pay RM166,000 for failing to monitor anomalous transactions represents a critical inflection point for corporate governance in Malaysia. By holding the institution liable for ignoring sudden, uncharacteristic account activity, the court effectively dismantled the legacy defence that merely having a secure system—such as sending automated SMS alerts—absolves an organisation of its duty of care.

The ruling sets a clear legal baseline: financial institutions cannot remain passive when faced with glaring transactional anomalies. It reinforces the expectation that financial compliance requires active, intelligent monitoring of escalation triggers, particularly when a transaction drastically deviates from established customer behaviour.

However, if our institutions are currently facing legal liability for missing traditional, rudimentary anomalies, they are alarmingly exposed to the incoming wave of AI-driven financial manipulation. What used to be neatly divided into IT risk versus finance risk is now one combined problem. Cybersecurity and financial compliance can no longer sit in separate rooms.

AI does not necessarily create new categories of fraud; it amplifies existing ones with devastating precision. The 2024 Arup incident, where a multinational engineering firm lost US$25mil after an employee transferred funds based on a deepfake video call with fabricated “senior management,” serves as the global anchor case. It proves an uncomfortable reality: we can no longer trust the channel. Relying on email authenticity, or even live video confirmation, is now an outdated assumption.

Furthermore, AI enables virtually undetectable fraud at scale. Instead of a single large, suspicious transfer, malicious actors can execute hundreds of micro-transactions over time. In this modern “One Cent Thief” scenario, each transaction sits comfortably below automated detection limits and approval thresholds, yet aggregates into significant corporate losses.

This is where our current regulatory frameworks face a critical gap. The Cybersecurity Act 2024 provides a strong foundation for strengthening system resilience and reporting breaches. However, AI introduces a fundamentally different risk. It does not necessarily hack the system; rather, it manipulates how human decisions are made. While current cybersecurity laws protect the infrastructure, they do not fully address the deception embedded within the financial workflow itself.

To survive this shift, corporate boards and audit committees must recognise that the answer is not simply telling employees to “be careful.” Financial approval systems must be actively redesigned to withstand deception. High-risk actions—such as large payments, urgent transfers, or changes to vendor bank details—must trigger mandatory, independent, out-of-band verification using pre-approved contact channels.

Equally critical is the human factor. Fraud often succeeds not because a policy does not exist, but because an employee is pressured by urgency or perceived authority into bypassing it. Corporate culture must empower people to pause, question, and escalate suspicious, time-sensitive instructions. Crucially, no employee should ever be penalised for slowing down a transaction to exercise independent judgment.

The future of financial security is not just building stronger firewalls. It is disciplined human decision-making, better audit trails, and structured verification built directly into financial processes. As the recent court ruling demonstrates, the expectation of accountability is not new. The law is simply evolving to demand that our internal controls are robust enough to manage exactly how decisions are made and acted upon.

A recent Chinese court ruling—declaring that replacing a worker with AI to cut costs does not legally justify termination—serves as a stark warning: rapid technological adoption cannot bypass established labour protections.

For Malaysia, where TalentCorp projects nearly 700,000 workers will face disruption from AI, digitalisation and the green economy within three to five years, this is a legal reality we must urgently confront.

Under the Industrial Relations Act 1967, terminations require “just cause or excuse.” While companies will inevitably claim “redundancy” to justify AI-driven layoffs, procuring an enterprise AI license is not a legal blank cheque. The burden remains on employers to prove a role has genuinely ceased to exist.

If a company dismisses junior staff but uses algorithms to produce the exact same volume of work—still requiring human prompting, editing, and supervision—the role has simply evolved, not disappeared. Claiming redundancy here could be successfully challenged in the Industrial Court as a sham.

However, the most profound threat to our workforce is not the legally actionable layoff; it is “invisible displacement.” This silent attrition occurs when departing employees are simply not replaced because AI absorbs their workload. No termination letter is issued, and no legal claim arises, but entry-level opportunities permanently evaporate.

We must acknowledge the employer’s reality: in a hyper-competitive global landscape, it is economically irrational to artificially sustain obsolete roles. The law can punish unfair dismissals, but it cannot compel companies to create new jobs.

While TalentCorp anticipates the emergence of 120 new high-value roles, placing the burden entirely on workers to aggressively upskill is a flawed strategy. We cannot rely on 20th-century labour laws to manage 21st-century technological disruption. We urgently need a new “digital social contract” bridging statutory reform and corporate governance.

First, the Human Resources Ministry must establish modernised guidelines explicitly defining “technological redundancy.” The Industrial Court should not be left to interpret AI displacement using decades-old precedents designed for factory closures. We need clear statutory definitions that distinguish genuine business restructuring from opportunistic AI cost-cutting.

Second, corporate governance must evolve. Adopting enterprise AI is a profound human resources event, not merely an IT procurement. Environmental, Social, and Governance (ESG) standards should encourage internal workforce impact audits. Before defaulting to silent attrition or redundancy, employers hold a duty of care to explore how at-risk workers can be transitioned to manage the very AI systems replacing their tasks.

AI will undoubtedly alter existing roles, but more importantly, it will dictate the jobs companies choose not to create tomorrow. True job security in the algorithmic age requires not just an agile workforce, but modernised labour laws and a corporate sector willing to take responsibility for its technological upgrades.

The government’s plan to restrict children under 16 from accessing social media by June, using the framework of the Online Safety Act (ONSA), signals a strong commitment to youth protection. However, a “total lockout” approach and the proposed MyKad-based age verification raise critical practical and cybersecurity concerns.

A sweeping ban is a blunt regulatory tool that is notoriously difficult to enforce. Banning youths will inevitably drive them to use Virtual Private Networks (VPNs) or migrate to encrypted messaging apps like Telegram, rendering them entirely invisible to parents and regulators. What we need is to foster digital literacy alongside these restrictions.

In this context, Meta’s recent rollout of revamped “Teen Accounts” offers a highly instructive case study. By placing younger users under strict default settings for privacy, disabling recommendations for sensitive content, and embedding mandatory parental controls, Meta has provided a tangible blueprint for what “safety by design” looks like in practice, rather than relying on reactive moderation after the fact.

From a regulatory standpoint, this is a significant and welcome shift. By mandating safe, highly restricted environments, we give youths a secure “training ground” to develop digital resilience.
Rather than pursuing an unenforceable blanket ban, policymakers should use this model to establish an industry-wide baseline. The Malaysian Communications and Multimedia Commission (MCMC) regulatory sandbox should pivot from testing how to block youths entirely, to testing how to protect them. The upcoming ONSA subsidiary instruments should make these strict default privacy settings and restricted algorithmic feeds a mandatory licensing condition for all platforms operating in Malaysia.

This brings us to a major cybersecurity concern. The Communications Minister recently suggested standardising “age verification” using official government documents like the MyKad. If this verification requires platforms to directly collect and store MyKad, we are facing a massive risk.

Social media platforms suffer massive data breaches. The 2021 Facebook data leak exposed details of 533 million users, and in 2023, hackers posted email addresses linked to 200 million Twitter accounts. If social media giants cannot guarantee the absolute security of user data based on these past incidents, trusting them to directly verify and store our MyKad could expose millions to severe identity theft. Trading one potential harm for another, more severe one is a deeply flawed policy.

Furthermore, if age verification requires platforms to collect and store MyKad, it does not meet the spirit of data minimisation under Section 6 of Malaysia’s Personal Data Protection Act (PDPA). The General Principle of the PDPA dictates that personal data processed must be “adequate but not excessive” in relation to its purpose. We cannot create a system where ONSA requirements actively conflict with the spirit of the PDPA.

If age verification is deemed absolutely necessary, we must look to privacy-preserving global best practices. Rather than submitting MyKad to tech companies, Malaysia should adopt the “double-blind tokenised approach” recommended by Australia’s eSafety Commissioner.

This approach involves an independent, regulated third party that verifies a user’s age. This verifier then provides a secure token to the social media platform, confirming only that the user meets the age requirement. Crucially, the platform never receives or handles the user’s personal identification documents, thereby protecting their privacy.

We must protect our youths, but not at the expense of their digital literacy or national data security. By pivoting towards mandated “safety by design” and privacy-preserving tokenisation, Malaysia can create a gold-standard regulatory framework that avoids the dangerous pitfalls of blunt bans and mass data collection.

The recent US$375mil verdict against Meta in a New Mexico court represents a watershed moment in digital governance. While the staggering financial penalty has dominated headlines, the true significance lies in the legal precedent it establishes for corporate risk and product liability in the tech sector.

Crucially, the jury did not penalise the platform merely for a failure in content moderation. The liability was rooted in the finding that the platform’s core recommendation algorithms actively steered underage users towards harmful material, violating unfair practices laws. This verdict effectively signals the death knell for the industry’s legacy playbook of reactive content moderation.

For multinational tech companies operating in Malaysia, this global legal shift arrives at a critical juncture. Under our Online Safety Act 2025 (ONSA), tech executives face personal liability for platform failures. However, the legislation provides a crucial defence clause, allowing leadership to avoid liability if they can demonstrate they took “reasonable steps” to prevent the offence.

The New Mexico verdict serves as a stark warning on how courts and regulators will interpret this threshold moving forward. Relying on after-the-fact measures, such as launching new parental controls or relying on human moderators only after a crisis has occurred, is no longer a viable legal strategy. As public scrutiny intensifies, this landmark verdict demonstrates that relying on reactive fixes is an increasingly perilous legal position when the underlying product design remains fundamentally flawed.

Instead of viewing legislation like ONSA as a hostile threat, the tech industry must embrace “safety by design” as its ultimate corporate shield. Implementing mandatory Algorithmic Impact Assessments before launching new features is no longer just red tape. It is the most effective way to transform unpredictable litigation risks into a predictable, manageable compliance framework.

By building architectural safety measures into their code from the outset, platforms provide a clear, auditable trail of these “reasonable steps”, thereby protecting their executives and ensuring regulatory certainty. Beyond mere legal compliance, there is a profound governance and reputational imperative. Tech giants play an undeniable role in shaping society, and the loss of parental trust is a devastating blow to long-term brand equity.

Ensuring the safety of children and making parents feel secure that their families are protected online is not just a moral obligation. It is foundational to maintaining a platform’s social license to operate.

Ultimately, robust digital governance is a competitive advantage. By proactively pivoting from reactive moderation to structural safety by design, tech platforms can simultaneously protect their leadership under ONSA, fulfill their societal responsibilities, and secure the enduring trust of their user base.

Just as we require safety certifications for physical infrastructure, we must now demand Algorithmic Impact Assessments from our digital landlords. The message is unequivocal: the future belongs to these algorithmic platforms, but their deployment requires a social license to operate.