Regulatory Alerts2024-05-09
Added · Updated
Notice on Technology Risk Management
Operators and settlement institutions of designated payment systems, as well as digital payment token service providers, must establish frameworks to identify critical systems and maintain high availability, limiting unscheduled downtime to 4 hours annually. These entities are required to set a recovery time objective of no more than 4 hours for each critical system and validate this through testing at least once every 12 months. Upon discovering a relevant incident, entities must notify the Authority within 1 hour and submit a root cause and impact analysis report within 14 days. The notice takes effect on 10 May 2024 for operators and settlement institutions, and on 6 November 2024 for digital payment token service providers.