Shariah non-compliance starts in the batch job, not the contract
Islamic banks spend much of their governance effort on getting contracts approved. Most of the non-compliance I have seen arose later, in systems and sequences no committee member could see, and finance should fund its prevention as an operating control.
When people outside the industry ask how an Islamic bank ensures its products comply with Shariah, they usually imagine a committee of scholars reviewing contracts. That picture is accurate as far as it goes. Our Shariah Committee approves every new product and every material change to an existing one, its rulings bind the bank, and Bank Negara Malaysia expects its members to be qualified, independent of management and accountable for what they approve. In my experience the contracts that reach the committee are almost always sound.
Where non-compliance arises is later, in operations. A contract approved in a meeting room is executed millions of times by systems, batch jobs and branch staff, and each execution has to follow the approved steps in the approved order. When it does not, the income from that transaction may not be the bank's to keep. I have come to think that finance, which owns the ledgers those steps are recorded in, carries more responsibility for this than our organisation charts suggest.
How a sequencing breach happens
Much personal financing in Malaysian Islamic banking is structured as tawarruq, also called commodity murabahah. The bank buys a commodity from one broker, sells it to the customer at cost plus an agreed profit payable in instalments, and then, acting as the customer's agent, sells the commodity to a second broker for cash, which is paid to the customer. Each step is a real sale. The bank must own the commodity before it sells it to the customer, and the customer must own it before it is sold on.
In 2022 our Shariah review team, testing a sample of personal financing contracts, found cases where the system had recorded the sale to the customer a few minutes before the bank's own purchase was confirmed by the broker. The cause was mundane. A batch job that submitted purchase orders had been rescheduled during a system upgrade, and nobody had tested whether the sequence of confirmations was preserved. The financing documents were correct. The order of events was not. Our Shariah Committee ruled that the profit on the affected contracts could not be recognised as the bank's income.
The sample suggested a problem limited to a few hundred contracts in a single quarter. I asked for the full population since the upgrade to be tested instead, which took eleven weeks. The review found 1,140 affected contracts and RM8.4 million of profit that had to be purified, RM2.1 million more than the sample-based estimate. The event was reported to Bank Negara Malaysia, as its Shariah governance framework expects for actual non-compliance, and the contracts were rectified under the committee's direction.
Purification is the cost of a control failure
Purification means that income the Shariah Committee has ruled non-compliant is not kept by the bank. It is set aside and channelled to charitable purposes the committee approves. Accounting for it is straightforward. What interests me is how it is perceived. In many banks, purified income is treated as a Shariah matter, reported to the Shariah Committee and mentioned briefly in the annual report. It rarely appears in the operational-loss reporting that the board risk committee reviews.
I think that is a mistake of classification. RM8.4 million of purified income is RM8.4 million the bank earned and could not keep because a control failed. It is economically the same as a fraud loss or a processing error, and its causes are the same kind of causes: an untested change, a missing reconciliation, a manual workaround. Since 2023 we have reported non-compliance events and their income effect in the same operational-loss schedule the Board Risk Management Committee sees for every other control failure. Directors who would never second-guess a Shariah ruling are perfectly able to ask why a batch job was not tested.
Treating the loss this way also changes behaviour in the business. When purification was a Shariah matter, product and operations teams saw it as someone else's concern. When it appears in the same table as other operational losses, with the responsible unit named, it receives the same root-cause analysis and the same follow-up.
Budgeting for the review function
The second consequence is budgetary. Shariah review, which tests compliance in operations, and Shariah audit, which provides independent assurance, are control functions. In some banks they are funded as a cost of regulatory compliance, staffed to the minimum and asked to work by sample. Our 2022 breach was found by sampling, and the sample understated it by a third.
As CFO I now treat these functions the way I treat internal audit and credit review: their budgets are set by the risk they cover, not by last year's headcount. Since 2023 we have added automated sequence checks that compare broker confirmation times with contract booking times for every commodity murabahah transaction, so that a breach shows up within a day rather than in a quarterly sample. The checks cost RM3.6 million to build. The review team has grown by six people, and it now spends less time testing samples and more time examining changes before they reach production.
None of this alters who decides what is compliant. That remains the Shariah Committee's responsibility, and finance should not presume to interpret rulings. What finance can do is make sure that the steps the committee approved are the steps the systems perform, that departures are found quickly and in full, and that their cost is visible to the people who govern operational risk.
My advice to directors of Islamic banks is modest. Ask whether non-compliance events appear in the same reporting as other operational losses. Ask whether the Shariah review function tests system changes before they go live or only samples transactions afterwards. And ask what share of the income purified in the last three years came from contracts that were sound on paper. If the answer is most of it, as I suspect it often is, the governance effort may be pointed at the wrong end of the process.