HONG KONG: SFC Cybersecurity Review on Internet-Mobile Trading Systems

Wednesday October 19 2016

The Securities and Futures Commission (SFC) has announced the commencement of a cybersecurity review in the fourth quarter of 2016 with a focus on assessing the cybersecurity preparedness, compliance and resilience of brokers’ internet/mobile trading systems.

According to the SFC the number of security breaches has increased, compromising the securities trading transactions through customers’ accounts.

Whilst general awareness of cybersecurity seems to have improved, cyber threats have also evolved in tandem with the rapid development of technology-enabled business.  In light of the latest incidents, licensed corporations are advised by the SFC to critically review and enhance their controls to combat cyber-attacks.  This would involve

• Strengthening threat, intelligence and vulnerability management to pro-actively identify and remediate cybersecurity vulnerabilities;

• Implementing reliable preventive, detective and monitoring measures to protect sensitive information and trading systems;

• Being vigilant in monitoring unusual or questionable logins/transactions in client accounts;

• Implementing effective user authentication and access controls to deter potential hacking attempts; and

• Establishing an effective contingency plan which covers, among others, possible cyberattack scenarios where trade and position data are impacted.

The review comprises three components:

• Issuance of a questionnaire to a mix of small to medium sized securities and futures brokers as well as leveraged foreign exchange traders.  The primary objective is to assess the cybersecurity aspects of internet / mobile trading systems.
• Onsite inspections of selected brokers for a deep dive review of their information technology and other related management controls and an assessment of their design and effectiveness in preventing and detecting cyber-attacks.
• Benchmarking the SFC regulatory requirements and market practices in Hong Kong against requirements of major financial services regulators and other relevant market practices in Hong Kong or elsewhere.

Click on the link above for further details