Featured Product

    RBNZ Consults on Guidance for Managing Cyber Risks

    October 20, 2020

    RBNZ launched consultation on the guidance for what regulated entities should consider when managing cyber resilience. The draft guidance, which is open for feedback until January 29, 2021, outlines the expectations of RBNZ around cyber resilience and draws heavily from leading international and national cybersecurity standards and guidelines. RBNZ will publish a summary of submissions and final guidance in March or April 2021. RBNZ is also developing a detailed framework for information gathering and sharing, for which it plans to consult stakeholders in mid-2021.

    The guidance has four parts—namely, governance, capability building, information sharing, and third-party management. Third-party management is an area of growing importance and the guidance includes a special subsection on the use of cloud computing services in light of the rapid adoption of cloud services by financial sector firms. The guidance is aligned with international standard and guidelines on cyber resilience and provides a set of high-level principle-based recommendations. The draft cyber risk management guidance would apply to all entities RBNZ regulates. This includes registered banks, licensed non-bank deposit-takers, licensed insurers, and designated financial market infrastructures. The consultation paper also seeks feedback on how information gathering and sharing by RBNZ with relevant public-sector bodies can help to build cyber resilience.

    The consultation paper discusses views of RBNZ on a collaborative approach to information gathering and sharing. In the multi-agency landscape, RBNZ plans to promote information gathering and sharing with other relevant government agencies (for example, National Cyber Security Center, Computer Emergent Response Team NZ, and the Financial Market Authority). RBNZ considers that there are merits in following the broad pattern observed in the international practices of establishing a cyber data collection. As a principle, RBNZ will tailor reporting requirements to ensure they stay relevant and minimize the reporting burden. At a very high level, this includes: 

    • A regular but fairly infrequent data collection (perhaps annually or once every few years) on cyber capabilities and resources dedicated to building cyber resilience
    • Establishing an obligation to report cyber incidents to the prudential authority, perhaps with a materiality threshold for reporting incidents as soon as reasonable after they are detected
    • An information collection plan that is applicable to all regulated entities of RBNZ

     

    Related Links

    Keywords: Asia Pacific, New Zealand, Banking, Insurance, PMI, Guidance, Cyber Risk, Operational Risk, Cloud Computing, RBNZ

    Related Articles
    News

    EC Regulation Sets Out Standards for Reporting and Disclosure of MREL

    EC published the Implementing Regulation 2021/763 that lays down implementing technical standards for supervisory reporting and public disclosure of the minimum requirement for own funds and eligible liabilities (MREL).

    May 12, 2021 WebPage Regulatory News
    News

    EBA Report Notes Loan Origination Should Remain in Supervisory Focus

    EBA published a report that examines the convergence of prudential supervisory practices in 2020 and offers conclusions of the EBA college monitoring activity.

    May 12, 2021 WebPage Regulatory News
    News

    APRA Decides to Standardize Submission Date for Quarterly Reporting

    APRA announced the standardization of quarterly reporting due dates for authorized deposit-taking institutions.

    May 11, 2021 WebPage Regulatory News
    News

    ECB Working Group Publishes Recommendations on EURIBOR Fallbacks

    The private sector working group of ECB on euro risk-free rates published the recommendations to address events that would trigger fallbacks in the Euro Interbank Offered Rate (EURIBOR)-related contracts, along with the €STR-based EURIBOR fallback rates (rates that could be used if a fallback is triggered).

    May 11, 2021 WebPage Regulatory News
    News

    Bundesbank Publishes Supporting Documentation for Reporting by Banks

    Bundesbank published a list of "EntryPoints" that are accepted in its reporting system; the list provides taxonomy version and name of the module against each EntryPoint.

    May 11, 2021 WebPage Regulatory News
    News

    EBA Publishes Phase 1 of Reporting Framework 3.1

    EBA published the phase 1 of its reporting framework 3.1, with the technical package covering the new reporting requirements for investment firms (under the implementing technical standards on investment firms reporting).

    May 10, 2021 WebPage Regulatory News
    News

    IOSCO Sees Support for Mandatory Sustainability Reporting

    The Sustainable Finance Taskforce of IOSCO held two roundtables, with global stakeholders, on the IOSCO priorities to enhance the reliability, comparability, and consistency of sustainability-related disclosures and to collect views on the practical implementation of a global system architecture for these disclosures.

    May 10, 2021 WebPage Regulatory News
    News

    APRA to Finalize Capital Adequacy Standard Revisions by January 2022

    Asia Pacific Australia Banking APS 111 Capital Adequacy Regulatory Capital Basel RBNZ APRA

    May 10, 2021 WebPage Regulatory News
    News

    ESMA Issues Guidelines on Outsourcing to Cloud Service Providers

    ESMA published the final guidelines on outsourcing to cloud service providers.

    May 10, 2021 WebPage Regulatory News
    News

    EBA Publishes Data on Deposit Guarantee Schemes

    EBA published annual data for two key concepts and indicators in the Deposit Guarantee Schemes (DGS) Directive—available financial means and covered deposits.

    May 10, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 6967