Chief Information Officer / Singapore / Southeast Asia
Three platform choices and the price of each
- Home broadband subscribers
- 268,000
- December 2025, northern Peninsular Malaysia
- Company revenue
- RM 512m
- Calendar year 2025
- Technology colleagues led
- 126
- Plus about 60 contractor staff
Decisions & consequences
01Moving 71,000 card arrangements between processors instead of asking customers to start again
By 2022 our in-house billing system could not put broadband, the streaming-television add-on and a resold mobile SIM on one account. I led the selection of a convergent billing platform, a RM 21 million programme due to go live in November 2023. The new platform used a different card processor from our long-standing one. The old processor's stored tokens were useless to the new one, and 71,000 subscribers, 28 per cent of our base, paid by card auto-debit.
The cheap option was asking those customers to re-enter card details in our app. We piloted it with 3,000 customers in August 2023: 61 per cent re-registered within forty-five days. The rest would have drifted to manual payment, where late payment ran at 11 per cent against 2 per cent. The chief commercial officer wanted the November date for a broadband-and-mobile bundle before the school holidays. The chief financial officer preferred the cheaper route.
I recommended a direct transfer of card data between the two processors under PCI DSS controls, so that card numbers never passed through our systems. It cost RM 1.6 million, mostly eleven extra weeks of project team and parallel running, and the bundle moved to February 2024. Commercial colleagues estimated RM 2.3 million of bundle revenue deferred, and our chief executive accepted that price.
We ran both systems in parallel for two cycles on 6,000 accounts and matched every transferred token to an account. At cutover, 69,300 arrangements charged successfully; 1,700 failed on expired or replaced cards, and each of those customers was contacted. Auto-debit success was 96.1 per cent in the first cycle against a prior average of 96.8 per cent, and 96.7 per cent by May 2024.
Payment portability is now a written criterion in every platform selection. What I would do differently: I should have raised token transfer during the 2022 evaluation, when it would have cost a clause rather than a launch date.
Keeping subscriber login on our own two sites while everything else moved to the cloud
In 2022 Corvanthe Equity asked us to close our Bayan Lepas data room by late 2024 and move every workload to a public-cloud region in Malaysia. The plan assumed a saving of RM 4.2 million a year. Most of it made sense: billing, customer management, the portal and our data warehouse did not need to sit near the network.
Subscriber authentication did. Every household router asks our authentication servers for permission to connect after a restart, and receives its address and name resolution from systems beside them. In northern Peninsular Malaysia, thunderstorms cause short power cuts that restart thousands of routers together. If those systems depended on a link to the cloud, a link failure on a stormy evening would disconnect households whose fibre was intact.
I proposed a split, keeping authentication, address assignment, name resolution and terminal provisioning on our own equipment in a smaller Bayan Lepas room and a co-location hall in Ipoh. That needed RM 3.8 million of capital and reduced the annual saving to RM 2.6 million. The fund's operating partner and our chief financial officer argued for the full move; the cloud provider offered a local caching design. I took both designs to the audit and risk committee in September 2023 with failure scenarios for each, and the committee supported the split.
Migration finished in November 2024. A March 2025 switchover test between the owned sites took nineteen minutes for name resolution against a two-minute design; we corrected it before the storm season. In July 2025 a configuration error at our cloud-connection provider cut both private links for three hours and forty minutes. The portal, new orders and contact-centre screens stopped, yet about 41,000 routers restarted by power cuts that evening reconnected normally.
The 2025 saving was RM 2.5 million. What I would do differently: both links came from one provider, accepted on price. A second provider, added in October 2025, costs RM 210,000 a year; I should have required it from the start.
Deleting 403,100 identity-card images that our collections team wanted to keep
Amendments to Malaysia's personal data law introduced breach notification and a formal data protection officer role. In early 2025 we mapped every place where subscriber personal data was held. The mapping found 412,000 scanned identity documents dating from 2011, mostly MyKad copies with some passports, collected at installation. They sat in the old billing archive, a document share and folders kept by installation contractors. The images were useful to almost nobody, yet a breach would have exposed most of our past and present subscribers.
Our head of collections objected. RM 14.8 million of former-subscriber debt was with external recovery agents, and he wanted the images as evidence. Two contractor firms said that a new installation step would slow their crews. Our legal adviser told us that the law's retention principle required a current purpose for each record, and that recovering particular accounts was a purpose for those accounts only.
We kept 8,900 images linked to open recovery cases, disputes or legal holds, sealed in one restricted store, and deleted the other 403,100, with a destruction certificate from each contractor. The installation app now records that the installer sighted the card, the date and the installer's name, and stores no image. Registration of resold mobile lines follows the host operator's own process and was outside the change. Reworking the app and fourteen contractor agreements cost RM 640,000.
The cost to collections was real. Recoveries on debt older than three years fell from RM 410,000 in 2024 to RM 268,000 over the following twelve months, and I report that figure beside the reduction. During a contractor audit in June 2025 we found two supervisors holding copies on personal phones. We ended one contract and retrained the other firm's staff.
What I would do differently: I announced the change to contractors by letter and briefed them afterwards. Bringing their supervisors into the design first would have surfaced the phone copies sooner and made the new procedure theirs as well as ours.