Featured Product

    RBNZ Consults on Guidance for Managing Cyber Risks

    October 20, 2020

    RBNZ launched consultation on the guidance for what regulated entities should consider when managing cyber resilience. The draft guidance, which is open for feedback until January 29, 2021, outlines the expectations of RBNZ around cyber resilience and draws heavily from leading international and national cybersecurity standards and guidelines. RBNZ will publish a summary of submissions and final guidance in March or April 2021. RBNZ is also developing a detailed framework for information gathering and sharing, for which it plans to consult stakeholders in mid-2021.

    The guidance has four parts—namely, governance, capability building, information sharing, and third-party management. Third-party management is an area of growing importance and the guidance includes a special subsection on the use of cloud computing services in light of the rapid adoption of cloud services by financial sector firms. The guidance is aligned with international standard and guidelines on cyber resilience and provides a set of high-level principle-based recommendations. The draft cyber risk management guidance would apply to all entities RBNZ regulates. This includes registered banks, licensed non-bank deposit-takers, licensed insurers, and designated financial market infrastructures. The consultation paper also seeks feedback on how information gathering and sharing by RBNZ with relevant public-sector bodies can help to build cyber resilience.

    The consultation paper discusses views of RBNZ on a collaborative approach to information gathering and sharing. In the multi-agency landscape, RBNZ plans to promote information gathering and sharing with other relevant government agencies (for example, National Cyber Security Center, Computer Emergent Response Team NZ, and the Financial Market Authority). RBNZ considers that there are merits in following the broad pattern observed in the international practices of establishing a cyber data collection. As a principle, RBNZ will tailor reporting requirements to ensure they stay relevant and minimize the reporting burden. At a very high level, this includes: 

    • A regular but fairly infrequent data collection (perhaps annually or once every few years) on cyber capabilities and resources dedicated to building cyber resilience
    • Establishing an obligation to report cyber incidents to the prudential authority, perhaps with a materiality threshold for reporting incidents as soon as reasonable after they are detected
    • An information collection plan that is applicable to all regulated entities of RBNZ

     

    Related Links

    Keywords: Asia Pacific, New Zealand, Banking, Insurance, PMI, Guidance, Cyber Risk, Operational Risk, Cloud Computing, RBNZ

    Related Articles
    News

    EU Amends CRD4 and CRD5 as Part of Capital Markets Recovery Package

    EU published Directive 2021/338, which amends the Markets in Financial Instruments Directive (MiFID) II and the Capital Requirements Directives (CRD 4 and 5) to facilitate recovery from the COVID-19 crisis.

    February 26, 2021 WebPage Regulatory News
    News

    EU Committee Recommends Systemic Risk Buffer of 4.5% in Norway

    The Standing Committee of the European Free Trade Association (EFTA) recommended that a systemic risk buffer level of 4.5% for domestic exposures can be considered appropriate for addressing the identified systemic risks to the stability of the financial system in Norway.

    February 25, 2021 WebPage Regulatory News
    News

    PRA Clarifies Approach to Onshoring of Credit Risk Rules for UK Banks

    In a recent statement, PRA clarified its approach to the application of certain EU regulatory technical standards and EBA guidelines on standardized and internal ratings-based approaches to credit risk, following the end of the Brexit transition.

    February 25, 2021 WebPage Regulatory News
    News

    FSB Sets Out Work Priorities for 2021

    In a recently published letter addressed to the G20 finance ministers and central bank governors, the FSB Chair Randal K. Quarles has set out the key FSB priorities for 2021.

    February 25, 2021 WebPage Regulatory News
    News

    EU Publishes Corrigendum to Revised Capital Requirements Regulation

    EU published, in the Official Journal of the European Union, a corrigendum to the revised Capital Requirements Regulation (CRR2 or Regulation 2019/876).

    February 25, 2021 WebPage Regulatory News
    News

    ESAs Issue Statement on Application of Sustainability Disclosures Rule

    ESAs published a joint supervisory statement on the effective and consistent application and on national supervision of the regulation on sustainability-related disclosures in the financial services sector (SFDR).

    February 25, 2021 WebPage Regulatory News
    News

    EC Consults on Crisis Management and Deposit Insurance Frameworks

    EC published a public consultation on the review of crisis management and deposit insurance frameworks in EU.

    February 25, 2021 WebPage Regulatory News
    News

    HKMA Enhances Loan Guarantee Scheme to Alleviate Pressure on SMEs

    HKMA announced that enhancements will be made to the Special 100% Loan Guarantee of the SME Financing Guarantee Scheme (SFGS) and the application period will be extended to December 31, 2021.

    February 24, 2021 WebPage Regulatory News
    News

    EBA Proposes Standards for Supervisory Cooperation Under IFD

    EBA launched consultations on the regulatory and implementing technical standards on cooperation and information exchange between competent authorities involved in prudential supervision of investment firms.

    February 24, 2021 WebPage Regulatory News
    News

    BoE Addresses Banks in Scope of First Resolvability Assessment

    BoE issued a letter to the CEOs of eight major UK banks that are in scope of the first Resolvability Assessment Framework (RAF) reporting and disclosure cycle.

    February 24, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 6629