Featured Product

    HKMA Sets Out Sound Practices for Data Protection by Banks

    April 04, 2022

    The Hong Kong Monetary Authority (HKMA) has set out sound practices with respect to customer data protection for all authorized institutions.

    HKMA assessed the adequacy and effectiveness of authorized institutions’ customer data protection controls. The findings reveal that the authorized institutions have put in place effective control measures to protect their customer data; however, some areas still need further improvements. For areas that required improvement, the concerned authorized institutions have subsequently taken appropriate remedial actions to strengthen their controls. In the course of the examinations, HKMA has observed some sound practices for customer data protection, which are grouped into four areas and can be summarized as follows:

    • Data Governance—Authorized Institutions should put in place effective data governance framework encompassing risk management process and data security strategy covering customer data protection. The effective data governance framework will ensure that the roles and responsibilities of relevant departments and staff (for example, data owner and three lines of defense) are clearly defined. The framework evaluates the adequacy and effectiveness of the authorized institutions' controls such as identity and access management and encryption controls to safeguard customer data against elevated risk of data breach. Authorized Institutions should also conduct regular assessments to ensure continuous compliance with relevant laws, regulations and their internal policies.
    • Customer data inventory management— Authorized Institutions should identify and document the location of their customer data residing in different parts of its networks, systems, and premises, to facilitate the prevention and detection of loss or leakage of customer data. Institutions should develop clear policies and procedures for maintaining and updating an effective customer data inventory covering all relevant systems and parties, including third parties that process or store customer data. The customer data inventory must be regularly reviewed to ensure completeness and accuracy.
    • Controls over transmission and storage of customer data— Authorized Institutions should adopt effective security measures to minimize the risk of data breach when handling customer data in transit, at rest and at end of life. The institutions should develop data loss prevention policies and measures that are implemented for internal and external communications (for example, e-mail, cloud storage service, and file transfer protocol). Authorized Institutions should take effective measures to address the risk of unauthorized downloading of customer data to portable storage media.
    • Physical and logical security controls of customer data— Authorized Institutions should implement proper physical and logical security controls to prevent customer data from unauthorized access or theft. The institutions should put in place various physical security controls (for example, surveillance cameras and disallowing use of electronic devices) and multi-factor authentication for premises and systems where massive customer data are processed or stored. Authorized Institutions should perform periodic security assessments of customer data protection through on-site inspections covering areas such as network security, physical and logical access controls of operating environments.

     

    Keywords: Asia Pacific, Hong Kong, Banking, Data Protection, Data Governance, Cyber Risk, Internal Controls, Operational Risk, Basel, Cloud Service Providers, Third-Party Arrangements, Regtech, HKMA

    Featured Experts
    Related Articles
    News

    EBA Clarifies Use of COVID-19-Impacted Data for IRB Credit Risk Models

    The European Banking Authority (EBA) published four draft principles to support supervisory efforts in assessing the representativeness of COVID-19-impacted data for banks using the internal ratings based (IRB) credit risk models.

    June 21, 2022 WebPage Regulatory News
    News

    EP Reaches Agreement on Corporate Sustainability Reporting Directive

    The European Council and the European Parliament (EP) reached a provisional political agreement on the Corporate Sustainability Reporting Directive (CSRD).

    June 21, 2022 WebPage Regulatory News
    News

    PRA Consults on Model Risk Management Principles for Banks

    The Prudential Regulation Authority (PRA) launched a consultation (CP6/22) that sets out proposal for a new Supervisory Statement on expectations for management of model risk by banks.

    June 21, 2022 WebPage Regulatory News
    News

    EC Regulation Amends Standards for Calculating Credit Risk Adjustments

    The European Commission (EC) published the Delegated Regulation 2022/954, which amends regulatory technical standards on specification of the calculation of specific and general credit risk adjustments.

    June 21, 2022 WebPage Regulatory News
    News

    BIS Hub Updates Work Program for 2022, Announces New Projects

    The Bank for International Settlements (BIS) Innovation Hub updated its work program, announcing a set of projects across various centers.

    June 17, 2022 WebPage Regulatory News
    News

    EIOPA Issues Cyber Underwriting Proposal, Statement on Open Insurance

    The European Insurance and Occupational Pensions Authority (EIOPA) published two consultation papers—one on the supervisory statement on exclusions related to systemic events and the other on the supervisory statement on the management of non-affirmative cyber exposures.

    June 17, 2022 WebPage Regulatory News
    News

    US Senate Members Seek Details on SEC Proposed Climate Disclosure Rule

    Certain members of the U.S. Senate Committee on Banking, Housing, and Urban Affairs issued a letter to the Securities and Exchange Commission (SEC)

    June 16, 2022 WebPage Regulatory News
    News

    EIOPA Consults on Review of Securitization Framework in Solvency II

    The European Insurance and Occupational Pensions Authority (EIOPA) published a consultation paper on the advice on the review of the securitization prudential framework in Solvency II.

    June 16, 2022 WebPage Regulatory News
    News

    UK Authorities Issue Regulatory and Reporting Updates for Banks

    The Prudential Regulation Authority (PRA) issued a statement on PRA buffer adjustment while the Bank of England (BoE) published a notice on the statistical reporting requirements for banks.

    June 15, 2022 WebPage Regulatory News
    News

    BCBS Issues Climate Risk Principles while HKMA Expresses Its Support

    The Basel Committee on Banking Supervision (BCBS) issued principles for the effective management and supervision of climate-related financial risks.

    June 15, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8280