Security controls for Internet trading services

Our Ref.: B1/15C G16/1C 27 October 2017 The Chief Executive All Registered Institutions Dear Sir / Madam, Security controls for Internet trading services The Hong Kong Monetary Authority (HKMA) issued a circular in May 2016 to strengthen the security controls related to Internet share trading services provided by Registered Institutions (RIs). Following the requirements in the circular, banks generally have provided an option for customers to undertake two-factor authentication (2FA) before conducting Internet trading transactions, and some have even gone further and made 2FA a mandatory requirement. In view of the growing prevalence and sophistication of cyber attacks targeted at customers, the HKMA consulted the industry in January 2017 on introducing mandatory 2FA for Internet trading. Separately, the Securities and Futures Commission (SFC) commenced a consultation on the baseline requirements on cybersecurity controls for Internet trading in May 2017. During the SFC consultation, the banking and the securities industries have reached a consensus on the implementation of mandatory 2FA for Internet trading in Hong Kong. Against this background, I am writing to draw your attention to a circular issued by the SFC today, enclosing the Guidelines for Reducing and Mitigating Hacking Risks Associated with Internet Trading. The guidelines specify the baseline requirements for strengthening cybersecurity controls of Internet trading services provided by intermediaries, including RIs. RIs should also take note of the Frequently Asked

• 2 - Questions and consultation conclusions paper enclosed with the circular. RIs which offer Internet trading services should implement the requirements set out in the guidelines according to the stipulated timeline. The HKMA will assess the compliance of RIs with the guidelines in its supervisory process. The HKMA will incorporate the requirements of the guidelines in the Supervisory Policy Manual module TM-E-1 on “Risk Management of E-banking” in due course. Yours faithfully, Raymond Chan Executive Director (Banking Supervision) Encl. c.c. SFC (Attn: Ms Julia Leung, Executive Director (Intermediaries))