Liyana Halim · Chief Product Officer · Singapore / Southeast Asia

Ready for a risk or technology committee, and to chair one in time

My contribution to a board

What I would add to a board is a working knowledge of how small businesses in Southeast Asia adopt, pay for and abandon digital products, and of the risks that travel with them. Many listed companies in Singapore and Malaysia depend on small enterprises as distributors, suppliers, tenants or customers, and many are now asking those enterprises to order, invoice and pay through digital channels. I have spent twenty-three years building such channels from the small-business side, in four countries, and I know where they fail: on weak connections, at onboarding, in local tax rules and in the gap between what a system claims and what it does.

I would also bring a practitioner's view of technology and data risk that is concrete rather than general. I have reported fraud losses, data-protection matters and model risk to an audit and risk committee, and I have been the executive whose decision those reports concerned. I know what a management paper on a new digital product tends to omit: usually the rate at which honest customers are turned away, and the cost of the controls that would stop dishonest ones. A board weighing digital channels, artificial intelligence or a payments partnership needs a director who will ask for both numbers.

I should be equally clear about what I would not bring. I am not a finance professional, and I would not claim the accounting expertise that an audit committee needs from at least one of its members. On such a committee I would contribute as a member who understands systems, controls and data. I would be most useful on a risk committee or a technology and data committee, and ready to chair the latter after a year, once I understood the company's businesses and its people. A chair should be earned inside the board, not offered on arrival.

Committee contribution

Chair and member readiness
Capacity	Committees
Ready to chair	A board technology, data or digital committee, after a year as a member
Ready to join	Board Risk Committee · Technology and Data Committee · Audit Committee, as a member without the accounting-expertise role

Capacity and preferences

Time available: 25 days per year
Current directorships: 2
Sectors: Consumer and retail groups that sell through independent shops and small distributors · Telecommunications companies with large small-business customer bases · Logistics and delivery companies serving small merchants · Insurance and financial-services distribution to micro enterprises, where no conflict with Rimbunara's lending partners exists
Company type: A company listed in Singapore or on Bursa Malaysia, operating in at least two Southeast Asian markets, with no commercial relationship with Rimbunara, its partner lenders or its largest investors' small-business software holdings
Company stage: An established listed company moving its relationships with small businesses onto digital channels, or a recently listed one still building its oversight of technology and data risk

The seat I am pursuing

I am pursuing one independent non-executive directorship at a company listed in Singapore or Malaysia, probably with revenue between US$300 million and US$3 billion and operations in at least two Southeast Asian countries. The best fit would be a business that depends on many small enterprises: a consumer-goods or retail group selling through independent shops, a logistics company serving small merchants, a telecommunications company with a large small-business base, or an insurer or financial-services group reaching micro enterprises through partners. These companies are digitising their relationships with small businesses, and their boards would benefit from a director who has built those relationships from the other side.

I want to join a risk committee or a technology and data committee, and in time to chair the latter. I would hold only one such seat while I remain an executive. Rimbunara's work deserves most of my attention, and a board deserves a director who reads its papers properly.

Governance learning and readiness

IICA Independent Directors’ Databank: Not yet registered

The IICA Independent Directors' Databank is an Indian requirement for people seeking independent directorships of Indian companies, and it does not apply to the Singapore and Malaysian boards I am considering. I have not registered, and I would do so only if an Indian board were to consider me. My preparation follows the expectations of the markets I know: a course for first-time directors of listed companies in Singapore, and, should a Malaysian board approach me, Bursa Malaysia's Mandatory Accreditation Programme, which directors of its listed issuers must complete after appointment.

A course for first-time directors of listed companies, run by a Singapore professional body for directors, completed in 2024
Every Rimbunara board meeting since July 2021 as a presenter, and the Audit and Risk Committee twice a year since 2022
Four years on the board, and three on the Audit and Programme Committee, of the Langkah Usaha Foundation
Study of the Singapore Code of Corporate Governance and its practice guidance with Rimbunara's general counsel and company secretary
Documenting Rimbunara's machine-learning practice against Singapore's Model AI Governance Framework with the general counsel

Judgement in practice

Naming my own decision in an incident paper

When the invoice-financing fraud surfaced in April 2025, management's first draft to the Audit and Risk Committee described the cause as a fraud ring exploiting gaps in partner controls. That was true and incomplete. I had approved the launch with a fraud model trained mostly on Malaysian data, and nobody had tested it against Philippine patterns. I rewrote the paper to say so, set out the six-week pause and what it would cost, and proposed a rule that no feature which moves money launches in a market without a trust-and-safety review on that market's data. The committee adopted the rule. What I would bring to another board is the expectation that an incident paper names the decision that failed and who took it, because a committee cannot judge a remedy without knowing exactly what it is remedying.

Refusing to take on our lenders' credit losses

During the same incident two of our lending partners proposed that Rimbunara absorb part of any future fraud losses so that financing volumes could continue at their earlier level. Our commercial team saw it as a way to protect referral revenue and the partners' goodwill. I recommended against it to our chief executive and to the committee. Sharing losses would have made us a taker of credit risk without the capital, licences or underwriting processes to be one, and it would have weakened the lenders' own incentive to underwrite carefully. The committee agreed, and one lender reduced its limit with us, which cost revenue. On a board I would test every partnership proposal the same way: is a risk moving to the party least equipped to carry it, and does the paper admit that it is?

Asking a charity what happened after the course

At the Langkah Usaha Foundation, programme reports in 2022 counted how many hawkers and home-based sellers had been trained, a figure that grew every year. As a new member of the Audit and Programme Committee, I asked what happened to trainees afterwards. Nobody knew. I proposed, and the committee agreed to fund, a short follow-up survey six months after each course, asking whether participants still used the tools and whether their sales had changed. The first results were sobering: fewer than half were still using what they had learnt. The charity has since shortened its courses and added a follow-up visit to every trainee's stall. Boards should measure what a programme changes, not only what it delivers, and I would ask that of any company's digital initiatives.

My first year on a board

My first year would be organised around three questions rather than a reading list. Where does the company meet small businesses, and what happens to them there? I would ask to use the ordering, invoicing and payment channels it offers distributors, suppliers or customers, as one of them would, and to spend a day with the staff who support those channels. What does the board already receive about technology and data risk, and what is missing? I would read two years of risk committee papers and incident reports, and meet the head of information security, the data-protection officer and the internal auditors, ideally once without management in the room. And how does this board actually decide on technology? I would follow one significant investment from first paper to final vote before forming a view of the process.

Chairing would wait; in that first year I would be a member and a learner. On a Bursa Malaysia board I would complete the Mandatory Accreditation Programme within the period its rules set, and on a Singapore board whatever training the exchange expects of a first-time director of a listed issuer. When the year closed I would invite the chair to tell me plainly which of my questions had helped and which had only added to the length of meetings.

Conflicts and their management

Rimbunara comes first, and my conflicts follow from that. I would refuse a seat at any company selling accounting, invoicing, payroll or payment-collection software to small businesses; at any lender or financing platform that partners with Rimbunara or competes with our partners; and at any company in which our largest investors hold small-business software interests. Before an appointment went ahead I would ask Rimbunara's board for written consent and set out my share options, my two current directorships and any family connection relevant to the company.

Some conflicts would surface only later. A listed company might decide to offer its small-business customers invoicing or financing tools of its own, and Rimbunara could then become its supplier, partner or competitor. If that happened I would declare it at the next meeting, leave every discussion of the subject and resign if the overlap looked permanent rather than occasional. Time is the other pressure: Rimbunara's board calendar and planning cycle would run alongside the company's, so I would fix a year of dates in advance and protect twenty-five days for the board, its committees and the reading they require.

My independence statement

I am a full-time executive of Rimbunara and hold share options in it. A board I join should have no business with Rimbunara, its partner lenders or the small-business software companies its largest investors own, and I would put my shareholdings, directorships and any relevant family connections in writing before an appointment was discussed further. Whether I count as independent under the Singapore Code of Corporate Governance or Bursa Malaysia's listing requirements is for the nominating committee and the board to decide on what I disclose, not something I can declare about myself.

Board and committee exposure

Presented to the Board or a committee

Rimbunara Technologies Pte. Ltd.

Board of directors: product strategy, pricing, platform consolidation and machine-learning features

December 2019–present

Has written the product paper for every quarterly board meeting since July 2021; not a director and holds no vote.

Reported to a committee

Rimbunara Technologies Pte. Ltd.

Audit and Risk Committee: trust and safety, fraud losses, data protection and model risk

January 2022–present

Reports twice a year and after any material incident, including the 2025 invoice-financing fraud and the controls that followed it.

Served as a director

Rimbunara Payments Pte. Ltd.

Board of the wholly owned Singapore collections subsidiary

March 2022–present

Director in an executive capacity; approves the subsidiary's annual accounts, its contracts with licensed payment partners and its operational risk register.

Served as a director

Langkah Usaha Foundation

Board of a Singapore charity that trains hawkers and home-based sellers to use digital tools

March 2022–present

Unpaid non-executive board member; Rimbunara neither funds nor supplies the charity.

Member of a committee

Langkah Usaha Foundation

Audit and Programme Committee

March 2023–present

Member of the committee that reviews the charity's accounts, its internal controls and the results of its training programmes; not its chair.