Skip to content
Book a demo

GRC for Malaysian financial institutions

GRC,simplified.

One GRC platform for banks, takaful operators, insurers and capital market firms regulated by BNM and the SC.

Book a demoExplore the platform
Screens show a sample organisation. Some are in preview.A two-minute film with music and on-screen titles, no narration. Separate tools for risk, compliance, internal audit, cyber security, data protection, finance and HR come together into one platform: Sastrum. It then shows onboarding an organisation, built-in GRC packs, a policy drafted in one click, dashboards for each leadership role, one enterprise view with each function's data kept separate, and Lumina suggesting actions with their sources, reviewed and accepted by a person.

Who it is for

Same regulations. Smaller teams. Smaller budgets.

  • Islamic banks
  • Development financial institutions
  • Takaful operators and insurers
  • Capital market intermediaries
  1. BNM's Risk Management in Technology (RMiT) policy sets detailed technology controls and expects evidence at inspection.
  2. The Cyber Security Act 2024 makes NCII entities report incident details to NACSA within six hours.
  3. The 2024 PDPA amendments added a data protection officer, 72-hour breach notification and fines of up to RM1 million.

Same BNM policy documents. Same RMiT expectations. Same penalties.

A fraction of the team and budget.

Our aim Affordable, easy-to-use, enterprise-grade GRC for every small and mid-size firm.

Industry content packs

Packs for the industries we serve in Malaysia.

A pack is the regulations, controls, risks, policies and audit tests for one industry, mapped before you start. Banking and finance ships today; the rest follow.

  • Available

    Banking and finance

    Islamic banks, DFIs, takaful operators, capital market intermediaries

    Maps to BNM RMiT, Shariah governance, PayNet, PDPA

  • Coming

    IT and ITES

    Software and services firms, data centres, MSPs

    Maps to Cyber Security Act 2024, PDPA, ISO 27001

  • Coming

    Telecom

    MCMC licensees and network providers

    Maps to Cyber Security Act 2024 (NCII), MCMC, PDPA

  • Coming

    Manufacturing

    Electronics, automotive and process plants

    Maps to ISO 27001, IEC 62443, PDPA

  • Coming

    Energy and utilities

    Energy Commission licensees, water and gas utilities

    Maps to Cyber Security Act 2024 (NCII), ISO 27001

Why this matters now

GRC failures now cost real money, not just audit points.

Malaysia figures; the breach cost is the ASEAN average.

What makes it different

Same breadth as the global suites. Built for smaller firms.

One control library that every framework maps to, with six things the global suites do not give a smaller firm.

  1. Your regulator, already inside.

    BNM RMiT, Shariah governance, PDPA and PayNet content comes as a pack, mapped to controls, risks and policies.

    See the frameworks

  2. Live in minutes.

    Describe your organisation. Sastrum scopes your risk universe, suggests your controls and drafts your first policies, the same day.

    See risk scoping

  3. AI a regulator can audit.

    Lumina suggests and drafts, and shows the clauses it relied on. A named person approves every decision, and every AI action is logged.

    Lumina drafts. People sign.

    How Lumina works

  4. One record, separate lanes.

    Risk, compliance and audit share the same controls and evidence. Each keeps its own data and approvals. The board sees one view across three lines of defence.

    Explore the platform

  5. One licence.

    Governance, compliance, audit and incidents under one licence. In our cloud, your private cloud or on your premises, with the same features.

    Security and deployment

  6. Platform plus people.

    With the product come our services: virtual CISO, managed GRC and security testing.

    Talk to us

Our experience, built into the product

20years of GRC advisory and regulatory audits

We did not start from a blank page. Every lesson from those years has gone into the product, so you buy the learning with the software.

  • GRC advisory
  • Regulatory audits
  • Learning, built in

Built with a national bank against 300 tendered requirements.

What we are working on now

This is just the start.

  • Board

    Board-level risk simulation

    Coming soon

  • Chief Risk Officer

    Risk quantification and predictive risk

    Coming soon

  • Chief Compliance Officer

    Continuous compliance and regulation-change impact simulation

    Coming soon · Q4 2026

  • CISO

    Continuous control monitoring and quantum computing impact simulation

    Coming soon

  • Chief Internal Auditor

    Automatic work papers

    Coming soon

  • Data Protection Officer

    Continuous data protection

    Coming soon

Build the next chapter with us.

See Sastrum run on your own regulators, help shape it for your sector, or join as a founding customer.

  • See it running

    Thirty minutes, opened on a risk universe already scoped to your sector and regulators.

    Book a demo

  • Partners

    Design partners shape the content for their sector or country. Consultants, integrators and regulatory experts take Sastrum to each launch market.

    Become a partner

  • Founding customers

    Founding-customer terms and a seat on our product council.

    Claim the early-bird offer

Born in India. Built for the world.