When Bank Negara Malaysia (BNM) removed the cap on digital insurer and takaful operator (DITO) licences in July 2024, the reading in the market was almost unanimous: the floodgates were about to open.
The regulator had signalled five licences back in November 2022. Now it was saying it would license whoever met the requirements, however many that turned out to be.
Bank Negara has not published how many applications it has received, and it does not comment on individual applicants, so nobody outside Sasana Kijang can give you a number.
But if you spend your time in this sector, as I have throughout my career, the absence is loud. The consortium chatter that preceded the digital banking licences is not there.
I want to argue that this is not a failure of the framework. It is the framework working, and it is worth understanding why before anyone concludes that a thin field means an easy licence.
Removing the cap didn’t lower the bar. It exposed it.
The cap was never the hard part. When there were five licences, the competitive question was whether you were in the top five.
Take the cap away and that question disappears but the requirement underneath it doesn’t move an inch.
You are no longer racing anyone. You are simply being asked whether you can do this.
That is a much less flattering question, and the pre-application consultation is where a lot of people have discovered it.
Consultation with BNM is mandatory before you file. It is designed to make sure applications arrive prepared.
As one senior executive at a licensed insurer put it to me, parties went in with a deck and came out understanding that they were being asked for a business: an actuarial function, a Shariah committee, a capital plan, a conduct framework, and a distribution model that genuinely reaches the people the framework exists for.
That is a different exercise from having a good idea about insurance.
Removing the cap didn’t open the field. It just made it obvious that the constraint was never scarcity of licences. It was scarcity of applicants who could actually do the thing.
What the Digital Banking Experience Could Teach DITO Applicants
The second reason for the regulator’s approach is, I think, the more important one, and you can see it if you look at what happened next door.
Five digital banks were licensed in 2022 under an explicit mandate to serve underserved and unserved segments.
They operate under foundational-phase asset limits for up to five years.
The part that matters is that graduation out of those restrictions is tied to inclusion outcomes, not simply to growth.
GXBank’s deputy chief executive Hildah Hamzah said it plainly in public in July: a bank that doesn’t serve the developmental inclusion mandate doesn’t graduate, and a bank that doesn’t graduate will not be profitable.
Views on how consistently that mandate has been met across the cohort vary, and I’ll leave others to grade individual banks.
One industry specialist familiar with both frameworks framed it to me better than I can: if you license on the strength of a shareholder balance sheet and a promise, you eventually get an institution that optimises for the shareholder.
The underserved customer is the hardest customer to serve profitably. If the operator wasn’t built to serve them, they don’t get served.
So the question for DITO applicants is not “can you fund this”.
Capital is the easy part; the framework asks for RM30 million of entry capital in the foundational phase, which is not a number that troubles a serious sponsor.
The question is whether serving the underserved is what the applicant actually does, or a slide in the pack that justifies the licence.
That is the right question. It is also a brutal one to answer if you have never done it.
Which is why operating history is now worth more than capital
Here is the arithmetic problem facing anyone still considering an application.
You cannot manufacture supervised operating history before the deadline. Whatever you have on 31 December 2026 is what you will be assessed on.
The operator that keeps coming up in my conversations is Ouch!, the only digital family takaful operator to have been approved into Bank Negara’s regulatory sandbox.
It ran a live book under supervision from August 2023 until it stopped writing new business at the end of September 2025, issuing more than 2,100 certificates entirely digitally, retakaful-backed by Swiss Re, with a first MFRS 17 audit cycle completed and an unqualified opinion from EY.
It is in supervised run-off and is eligible to apply for a licence under the DITO framework.
What strikes me about it isn’t the technology, and I say that as someone who is instinctively sceptical when an insurtech leads with AI.
It is that they spent the sandbox years on the product and the segment rather than on the fundraise narrative.
They focused on small-ticket family cover, sold digitally end to end, to people who had mostly never bought takaful before.
When the regulator asks what evidence you have that you can reach the underserved, that is evidence. Most applicants will have an intention.
On the commercial question I’ll state my own view rather than hide behind someone else’s.
Price this the way you would price any hard-to-replicate asset. Work out what a credible de novo applicant must spend, and how long it would take, to arrive where this company already is.
That includes the capital, the actuarial function, the Shariah committee, the audit cycle, the retakaful relationship and the years of supervised operating record.
Then look at the valuation. On that basis it is one of the more sensibly priced positions I have seen in this sector in some time. That is not a sentence I get to write often about an insurtech.
The caveats, which are real
None of that makes the outcome safe, and I’d distrust anyone who told you otherwise.
No licence has been granted. Any licence remains subject to Bank Negara’s assessment, including fit-and-proper assessment of board and Shariah appointments.
Ouch! is in run-off and not writing new business today. The AI capabilities the company describes, including machine-learning underwriting, agentic operations and governance tooling, are in development, not in production.
And a thinner field is emphatically not evidence that any particular application succeeds. If anything the inference runs the other way.
The regulator is not grading on a curve. It said it would license whoever meets the requirements, and it means both halves of that sentence.
What’s actually at stake
The protection gap that DITO was created to close has not moved. Roughly 46% of Malaysians hold no personal financial protection.
Family takaful penetration is around 19.6% of the population. Those numbers do not improve because a policy document exists.
If the window closes with two or three licensed operators rather than a dozen, that is a defensible outcome.
Better a small number who can execute the mandate than a crowd who cannot.
What would not be defensible is the window closing with operators who were licensed because they could fund it, and who spend the next five years discovering that the underserved customer was always the hard part.
The rest of us should stop reading the quiet as disinterest and start reading it as a standard.
Disclaimer: This article is an opinion piece. The views and opinions expressed are solely those of the author and do not necessarily reflect those of Fintech News Network. Fintech News Network does not endorse or assume responsibility for the author’s opinions, interpretations or conclusions.
Featured image: Edited by Fintech News Malaysia, based on image by starmultikharisma via Magnific
