HKMA Sets Out Sound Practices for Data Protection by Banks
The Hong Kong Monetary Authority (HKMA) has set out sound practices with respect to customer data protection for all authorized institutions.
HKMA assessed the adequacy and effectiveness of authorized institutions’ customer data protection controls. The findings reveal that the authorized institutions have put in place effective control measures to protect their customer data; however, some areas still need further improvements. For areas that required improvement, the concerned authorized institutions have subsequently taken appropriate remedial actions to strengthen their controls. In the course of the examinations, HKMA has observed some sound practices for customer data protection, which are grouped into four areas and can be summarized as follows:
- Data Governance—Authorized Institutions should put in place effective data governance framework encompassing risk management process and data security strategy covering customer data protection. The effective data governance framework will ensure that the roles and responsibilities of relevant departments and staff (for example, data owner and three lines of defense) are clearly defined. The framework evaluates the adequacy and effectiveness of the authorized institutions' controls such as identity and access management and encryption controls to safeguard customer data against elevated risk of data breach. Authorized Institutions should also conduct regular assessments to ensure continuous compliance with relevant laws, regulations and their internal policies.
- Customer data inventory management— Authorized Institutions should identify and document the location of their customer data residing in different parts of its networks, systems, and premises, to facilitate the prevention and detection of loss or leakage of customer data. Institutions should develop clear policies and procedures for maintaining and updating an effective customer data inventory covering all relevant systems and parties, including third parties that process or store customer data. The customer data inventory must be regularly reviewed to ensure completeness and accuracy.
- Controls over transmission and storage of customer data— Authorized Institutions should adopt effective security measures to minimize the risk of data breach when handling customer data in transit, at rest and at end of life. The institutions should develop data loss prevention policies and measures that are implemented for internal and external communications (for example, e-mail, cloud storage service, and file transfer protocol). Authorized Institutions should take effective measures to address the risk of unauthorized downloading of customer data to portable storage media.
- Physical and logical security controls of customer data— Authorized Institutions should implement proper physical and logical security controls to prevent customer data from unauthorized access or theft. The institutions should put in place various physical security controls (for example, surveillance cameras and disallowing use of electronic devices) and multi-factor authentication for premises and systems where massive customer data are processed or stored. Authorized Institutions should perform periodic security assessments of customer data protection through on-site inspections covering areas such as network security, physical and logical access controls of operating environments.
Keywords: Asia Pacific, Hong Kong, Banking, Data Protection, Data Governance, Cyber Risk, Internal Controls, Operational Risk, Basel, Cloud Service Providers, Third-Party Arrangements, Regtech, HKMA
Featured Experts
María Cañamero
Skilled market researcher; growth strategist; successful go-to-market campaign developer
Nicolas Degruson
Works with financial institutions, regulatory experts, business analysts, product managers, and software engineers to drive regulatory solutions across the globe.
Patrycja Oleksza
Applies proficiency and knowledge to regulatory capital and reporting analysis and coordinates business and product strategies in the banking technology area
Previous Article
FDIC Publishes Draft Principles on Climate-Related Financial RisksNext Article
OSFI Revises Guideline on IFRS 9Related Articles
BIS and Central Banks Experiment with GenAI to Assess Climate Risks
A recent report from the Bank for International Settlements (BIS) Innovation Hub details Project Gaia, a collaboration between the BIS Innovation Hub Eurosystem Center and certain central banks in Europe
Nearly 25% G-SIBs Commit to Adopting TNFD Nature-Related Disclosures
Nature-related risks are increasing in severity and frequency, affecting businesses, capital providers, financial systems, and economies.
Singapore to Mandate Climate Disclosures from FY2025
Singapore recently took a significant step toward turning climate ambition into action, with the introduction of mandatory climate-related disclosures for listed and large non-listed companies
SEC Finalizes Climate-Related Disclosures Rule
The U.S. Securities and Exchange Commission (SEC) has finalized the long-awaited rule that mandates climate-related disclosures for domestic and foreign publicly listed companies in the U.S.
EBA Proposes Standards Related to Standardized Credit Risk Approach
The European Banking Authority (EBA) has been taking significant steps toward implementing the Basel III framework and strengthening the regulatory framework for credit institutions in the EU
US Regulators Release Stress Test Scenarios for Banks
The U.S. regulators recently released baseline and severely adverse scenarios, along with other details, for stress testing the banks in 2024. The relevant U.S. banking regulators are the Federal Reserve Bank (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC).
Asian Governments Aim for Interoperability in AI Governance Frameworks
The regulatory landscape for artificial intelligence (AI), including the generative kind, is evolving rapidly, with governments and regulators aiming to address the challenges and opportunities presented by this transformative technology.
EBA Proposes Operational Risk Standards Under Final Basel III Package
The European Union (EU) has been working on the final elements of Basel III standards, with endorsement of the Banking Package and the publication of the European Banking Authority (EBA) roadmap on Basel III implementation in December 2023.
EFRAG Proposes XBRL Taxonomy and Standard for Listed SMEs Under ESRS
The European Financial Reporting Advisory Group (EFRAG), which plays a crucial role in shaping corporate reporting standards in European Union (EU), is seeking comments, until May 21, 2024, on the Exposure Draft ESRS for listed SMEs.
ECB to Expand Climate Change Work in 2024-2025
Banking regulators worldwide are increasingly focusing on addressing, monitoring, and supervising the institutions' exposure to climate and environmental risks.