When Microsoft committed USD 2.2 billion to Malaysia and Oracle pledged USD 6.5 billion for its first public cloud region in the country, the underwriting assumptions were clear: a stable energy market, a government-backed investment corridor, and a predictable regulatory environment. On 1 July 2025, one of those assumptions changed materially.

Malaysia’s state utility Tenaga Nasional Berhad (TNB) restructured its non-domestic tariff framework under Regulatory Period 4 (RP4), valid through 31 December 2027. For data centre operators above 100 MW, it was a reclassification into a new ultra-high-voltage (UHV) category – an effective cost increase of 10% to 14% before the variable monthly fuel surcharge is applied. For projects approaching their 2027-2028 refinancing windows, the question is no longer theoretical: do the original financial models still hold?

Southeast Asia’s Most Aggressive Digital Infrastructure Ramp

To understand what is now at stake, consider the scale of what was built. According to Knight Frank’s Data Centre Research Report 2024, Malaysia recorded 429 MW of annual capacity take-up in 2024, the highest in Southeast Asia ahead of Indonesia at 93 MW, Thailand at 31 MW, Vietnam at 3 MW and the Philippines at 1 MW. Google and AWS each committed over USD 2 billion to Malaysian digital infrastructure. In the first 10 months of 2024 alone, Malaysia secured MYR 141.72 billion (US$ 31.56 billion) in total digital investments – triple the 2023 total, according to MIDA. Johor absorbed approximately 80% of national IT capacity, with a colocation vacancy rate of roughly 1%. Knight Frank identified 61 upcoming facilities representing 1,313 MW of additional capacity nationally. It is precisely that concentration of capital –⁠ and the project finance structures supporting it –⁠ that made the July 2025 tariff revision so consequential.

When the Cost Base Shifted Overnight

The revision was signalled in December 2024 but its full financial consequences only emerged to a narrow set of large operators weeks before the 1 July effective date. Under RP4, the base tariff rose from 39.95 sen per kWh to 45.40 sen per kWh (a 13.6% increase). For UHV-category facilities, effective rates are estimated between 58 and 70 sen per kWh depending on load factor. Public Investment Bank calculated that a 100 MW facility would face an additional RM 63 million (approximately US$ 15-20 million) per year. Gary Goh, Founder and Director of Sprint DC Consulting, told Reuters that with many in the industry unprepared for the scale of increases, some investors may now adopt a wait-and-watch approach: “For a 100-megawatt facility, this could translate to an additional USD 15 million to USD 20 million per year without considering fuel surcharge.”

The government has been unambiguous about the direction of travel. Siti Safinah binti Salleh, chief executive officer of Malaysia’s Energy Commission, stated that the restructuring was deliberate and consequential: “If all the costs are bundled, no one knows how much you are spending on generation costs, of which 70% is actually fossil fuel costs. Restructuring the tariff was a very important step to ensure that the foundation for energy economics is right.” For lenders, this is a policy signal that tariff architecture will continue moving in the same direction. Mahadhir Aziz, president of the Data Centre Association of Malaysia, was equally direct on this issue: “Data centres or digital infrastructure businesses, while they may have invested in land and buildings here, can actually still reconsider their investments. The government would have to look at this now, at least regionally.”

Where the DSCR Math Breaks Down

The structural risk sits in project-financed data centres underwritten on pre-July 2025 cost assumptions now approaching 2027-2028 refinancing. The trend toward non-recourse project finance structures for larger developments – as documented by Mayer Brown and corroborated by White & Case’s Asia data centre financing analysis – means minimum DSCR covenants of 1.25x are standard. That covenant is not a buffer. It is the floor.

A representative 200 MW facility with USD 85 million EBITDA and USD 60 million in debt service sits at a DSCR of 1.42x. Apply a US$ 30-35 million annual power cost increase consistent with the Reuters-reported US$ 15-20 million per 100 MW, and EBITDA compresses to US$ 50-55 million. Against the same debt service, DSCR falls to 0.85x-0.92x – a covenant breach triggering lender engagement protocols, margin step-ups and potentially cash sweep mechanisms.

The load factor variable compounds this further than most pre-2025 models assumed. In November 2025, Parliament was informed that Malaysia’s data centres were consuming only 603 MW, roughly 47% of the 1,276 MW declared to the grid. The government has since mandated 85% utilisation of declared demand or monthly makeup charges apply; a penalty that hits under-performing facilities at precisely the moment they approach refinancing. Add the new monthly Automatic Fuel Adjustment surcharge replacing the previous semi-annual ICPT and cashflow volatility in 2024-vintage models is structurally underestimated.

A compounding ESG risk runs alongside. Malaysia’s grid is approximately 77% fossil fuel dependent, with renewables contributing roughly 9% of output. For project finance structures with sustainability-linked loan margin ratchets tied to carbon-free energy targets, that grid reality creates a second covenant risk sitting directly alongside the tariff exposure, and one that pre-2025 underwriting did not price.

The Questions Every Lender Is Now Running

With tariff and ESG covenant risk compounding on the same balance sheet, the refinancing review is more complex than original loan committees modelled. Is power cost pass-through contractual and enforceable or subject to tenant consent at renewal? What is the actual load factor and does it breach the 85% utilisation mandate? Has the sponsor secured renewable PPAs under Malaysia’s Corporate Renewable Energy Supply Scheme (CRESS)?

By 2035, data centres are projected to account for 52% of Peninsular Malaysia’s total electricity consumption – a figure cited by Deputy Prime Minister Fadillah Yusof at the Energy Asia conference. The tariff revision is a regulatory response to that trajectory, not a one-off event.

Malaysia’s hyperscale market remains one of Southeast Asia’s defining digital infrastructure opportunities. The tariff shock does not change that thesis. What it does is introduce a credit differentiation cycle – separating well-structured assets from those built on assumptions the July 2025 revision has made obsolete. The time to stress-test covenant headroom, verify pass-through enforceability and secure CRESS commitments is now, before the 2026 lease renewal cycle locks in a cost base lenders will scrutinise at refinancing. Portfolios that move first will refinance from strength. Those that wait will negotiate from necessity.

Malaysian banks are deploying Artificial Intelligence (AI) at breakneck speed. But ask them to quantify the risk exposure from unexplainable algorithmic decisions, and you’ll uncover the industry’s next major challenge.

When AI denies business loans to viable SMEs or flags legitimate transactions as suspicious – and banks can’t articulate why – the risk cascades: regulatory penalties, discrimination lawsuits, reputational damage and customer attrition. Yet most institutions are measuring AI performance without measuring AI explainability risk.

Malaysian banks are accelerating AI adoption at remarkable speed. According to the Asian Institute of Chartered Bankers, 57% of financial institutions are already in early-stage AI implementation. Bank Negara Malaysia (BNM) released its “Discussion Paper on Artificial Intelligence” in August 2025 and Oracle’s multi-agent AI investigators are transforming compliance workflows across institutions.

However, when AI denies a business loan or flags a transaction as suspicious, can the bank document the decision-making process well enough in the face of regulatory scrutiny? Not with vague references to “insufficient creditworthiness.” Can they provide specific, defensible reasoning that satisfies regulators, courts and increasingly sophisticated customers?

The answer, more often than anyone wants to admit, is no.

Quantifying the Explainability Risk Exposure

Hong Leong Bank’s partnership with DCAP Digital illustrates both promise and risk. The collaboration uses AI-powered credit scoring to assess underbanked SME borrowers, particularly in motorcycle financing where over 61,000 units were registered in May 2025 alone.

Without explainability infrastructure, banks could possibly face three compounding risks:

1. Regulatory risk when BNM demands justification for algorithmic decisions
2. Legal risk when rejected applicants claim discrimination
3. Reputational risk when customers migrate to competitors offering transparent decision-making

These AI systems analyse hundreds of data points to generate credit scores. When the algorithm says no, explaining which specific factors drove that decision becomes exponentially more complex than traditional credit assessments. More critically, without systematic documentation, banks can’t defend those decisions when challenged by regulators, courts or customers.

The Regulatory Compliance Challenge

Regulators globally are converging on explainability requirements. Singapore’s Monetary Authority (MAS) emphasises transparency and explainability in AI governance frameworks. The European Union (EU) AI Act mandates clear explanations for algorithmic credit decisions. Even as US federal oversight shifts, state regulators are affirming that “the algorithm decided” is no longer legally defensible.

Bank Negara’s AI governance discussion paper emphasizes fairness, transparency and accountability. The AICB’s AI Governance Framework includes explainability as a core principle. But principles and practical implementation are very different.

Consider the risk exposure: A pattern of AI-driven loan rejections disproportionately affecting specific sectors could trigger BNM investigations. Legal discovery in discrimination cases would force banks to produce documentation they don’t have. Reputational damage compounds when media coverage frames it as “algorithms discriminating against people.”

The Risk Management Gap

Explainability techniques like SHAP and LIME allow data scientists to reverse-engineer AI decisions. Financial institutions globally are integrating these tools into workflows.

But deploying explainability tools requires different skillsets than deploying AI models. Banks need internal teams capable of interrogating models, documenting their logic and translating technical explanations into language that risk officers, compliance teams and regulators understand.

The AICB’s Future Skills Framework notes that 40,000+ banking employees will see roles evolve due to automation. That’s a massive skills transformation while AI deployment accelerates and risk exposure accumulates.

Alternative Data: Expanding Credit Access While Multiplying Risk

Malaysia’s push toward alternative credit scoring adds risk complexity. Bank Negara’s Financial Sector Blueprint encourages “forward-looking and alternative data” for credit assessment – utility payments, e-commerce transactions, digital platform engagement.

Malaysia has a RM90 billion MSME funding gap partly because traditional assessments exclude businesses without conventional lending histories. Alternative data bridges that gap.

But it multiplies explainability risk. When banks deny credit based on “atypical digital payment patterns,” how do legal teams defend it when regulators investigate discrimination or plaintiff attorneys pursue class actions?

Building Risk-Resilient Explainability Infrastructure

Bank Negara’s discussion paper on AI addresses explainability, noting existing policies are “adequate for the time being” but may require enhancement as AI complexity increases.

Risk-mature institutions are treating explainability as first-line defence, investing in:

Explainability-by-design: Embedding SHAP, LIME or similar tools into AI workflows from the start, reducing regulatory scrutiny and legal discovery exposure.

Cross-functional risk teams: Pairing data scientists with compliance officers and legal counsel who can translate technical outputs into plain language, ensuring risk functions can defend decisions when challenged.

Documentation standards: Creating systematic records of how AI models make decisions. When regulators or courts ask “why did this happen?” two years from now, banks need retrievable, defensible answers.

Scenario and discrimination testing: Stress-testing AI systems for explainability and fairness. Identifying patterns that could be interpreted as discriminatory before they become regulatory issues.

The Risk Management Imperative

Banks that master AI explainability won’t just avoid regulatory penalties. They’ll gain competitive advantage in risk management and customer trust.

In a market where 57% of institutions are deploying similar AI technologies, differentiation won’t come from having AI. It’ll come from managing AI risks better than competitors.

Gartner forecasts that ‘death by AI’ legal claims will surge to over 2,000 cases by late 2026, driven largely by inadequate risk controls around opaque algorithmic systems. Banks can build explainability infrastructure now or scramble when the first regulatory investigation forces the issue.

Malaysia’s AI governance framework provides solid foundations. Bank Negara is asking the right questions. The industry is moving with appropriate urgency. But frameworks don’t manage risk. Implementation does.

The banks investing in explainability infrastructure now aren’t just preparing for compliance. They’re managing existential risks: litigation exposure from unexplainable decisions, regulatory penalties from inadequate governance and customer attrition from eroded trust.

The question isn’t whether Malaysian banks can master AI explainability. It’s whether they can afford not to, before the first discrimination lawsuit, regulatory investigation or reputational crisis forces the issue. Right now, most institutions are accumulating risk faster than they’re building defences.

Closing that gap isn’t a 2026 priority. It’s a 2026 survival requirement.