Featured Product

    RBNZ Consults on Guidance for Managing Cyber Risks

    October 20, 2020

    RBNZ launched consultation on the guidance for what regulated entities should consider when managing cyber resilience. The draft guidance, which is open for feedback until January 29, 2021, outlines the expectations of RBNZ around cyber resilience and draws heavily from leading international and national cybersecurity standards and guidelines. RBNZ will publish a summary of submissions and final guidance in March or April 2021. RBNZ is also developing a detailed framework for information gathering and sharing, for which it plans to consult stakeholders in mid-2021.

    The guidance has four parts—namely, governance, capability building, information sharing, and third-party management. Third-party management is an area of growing importance and the guidance includes a special subsection on the use of cloud computing services in light of the rapid adoption of cloud services by financial sector firms. The guidance is aligned with international standard and guidelines on cyber resilience and provides a set of high-level principle-based recommendations. The draft cyber risk management guidance would apply to all entities RBNZ regulates. This includes registered banks, licensed non-bank deposit-takers, licensed insurers, and designated financial market infrastructures. The consultation paper also seeks feedback on how information gathering and sharing by RBNZ with relevant public-sector bodies can help to build cyber resilience.

    The consultation paper discusses views of RBNZ on a collaborative approach to information gathering and sharing. In the multi-agency landscape, RBNZ plans to promote information gathering and sharing with other relevant government agencies (for example, National Cyber Security Center, Computer Emergent Response Team NZ, and the Financial Market Authority). RBNZ considers that there are merits in following the broad pattern observed in the international practices of establishing a cyber data collection. As a principle, RBNZ will tailor reporting requirements to ensure they stay relevant and minimize the reporting burden. At a very high level, this includes: 

    • A regular but fairly infrequent data collection (perhaps annually or once every few years) on cyber capabilities and resources dedicated to building cyber resilience
    • Establishing an obligation to report cyber incidents to the prudential authority, perhaps with a materiality threshold for reporting incidents as soon as reasonable after they are detected
    • An information collection plan that is applicable to all regulated entities of RBNZ

     

    Related Links

    Keywords: Asia Pacific, New Zealand, Banking, Insurance, PMI, Guidance, Cyber Risk, Operational Risk, Cloud Computing, RBNZ

    Related Articles
    News

    APRA Sets LAC for D-SIBs, Proposes to Enhance Crisis Preparedness

    APRA issued a letter on the loss-absorbing capacity (LAC) requirements for domestic systemically important banks (D-SIBs) and published a discussion paper, along with the proposed the prudential standards on financial contingency planning (CPS 190) and resolution planning (CPS 900).

    December 02, 2021 WebPage Regulatory News
    News

    EC to Review Macro-Prudential Rules while ESRB Assesses Policy Stance

    The European Commission (EC) launched a call for evidence, until March 18, 2022, as part of a comprehensive review of the macro-prudential rules for the banking sector under the Capital Requirements Regulation (CRR) and Directive (CRD IV).

    December 01, 2021 WebPage Regulatory News
    News

    FSB Sets Out Good Practices for Crisis Management Groups

    The Financial Stability Board (FSB) published a report that sets out good practices for crisis management groups.

    November 30, 2021 WebPage Regulatory News
    News

    APRA Penalizes Heritage Bank for Incorrect Reporting of Capital

    The Australian Prudential Regulation Authority (APRA) found that Heritage Bank Limited had incorrectly reported capital because of weaknesses in operational risk and compliance frameworks, although the bank did not breach minimum prudential capital ratios at any point and remains well-capitalized.

    November 29, 2021 WebPage Regulatory News
    News

    OSFI Releases Annual Report 2021-2022

    The Office of the Superintendent of Financial Institutions (OSFI) released the annual report for 2020-2021.

    November 29, 2021 WebPage Regulatory News
    News

    OSFI Updates Timeline for Implementation of Certain Basel Rules

    Through a letter addressed to the banking sector entities, the Office of the Superintendent of Financial Institutions (OSFI) announced deferral of the domestic implementation of the final Basel III reforms from the first to the second quarter of 2023.

    November 29, 2021 WebPage Regulatory News
    News

    EC Defers Adoption of Regulatory Standards for Disclosures Under SFDR

    EIOPA recently published a letter in which EC is informing the European Parliament and Council that it could not adopt the set of draft regulatory technical standards for disclosures under the Sustainable Finance Disclosure Regulation (SFDR) within the stipulated three-month period, given their length and technical detail.

    November 29, 2021 WebPage Regulatory News
    News

    FCA Releases MIFIDPRU Application Forms and Third Set of Rules on IFPR

    The Financial Conduct Authority (FCA) published the third in a series of policy statements that set out rules to introduce the UK Investment Firm Prudential Regime (IFPR), which will take effect on January 01, 2022.

    November 29, 2021 WebPage Regulatory News
    News

    APRA Finalizes Capital Adequacy Standards for Banks

    The Australian Prudential Regulation Authority (APRA) published, along with a summary of its response to the consultation feedback, an information paper that summarizes the finalized capital framework that is in line with the internationally agreed Basel III requirements for banks.

    November 29, 2021 WebPage Regulatory News
    News

    CPMI-IOSCO Seek Comments on Access to Central Clearing and Portability

    The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) issued a consultative report focusing on access to central counterparty (CCP) clearing and client-position portability.

    November 29, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 7751