Featured Product

    HKMA Sets Out Guidance on Adoption of Cloud Computing

    August 31, 2022

    The Hong Kong Monetary Authority (HKMA) has set out guidance for authorized institutions on supervisory expectations with respect to the adoption of cloud computing.

    Given the increasing trend of the adoption of cloud computing and the risks it presents, HKMA considers it appropriate to set out its supervisory expectations on this area in a holistic manner. The supervisory expectations on cloud computing, as outlined below, have been developed with reference to the results of a round of on-site examinations by HKMA between 2021 and 2022: 

    • Governance framework. Institutions should put in place an effective governance framework, overseen by the Board of Directors and senior management, for cloud computing to enable them to formulate a cloud strategy suitable for their circumstances and have it updated from time to time. A proper due diligence process should be established to assess the capabilities and suitability of a cloud service provider before the engagement and regularly during the engagement.
    • Ongoing risk management and controls. Institutions should clearly understand their roles and responsibilities under the agreement with the cloud service provider and put in place corresponding controls to ensure the effective discharge of their responsibilities. A comprehensive set of risk management procedures should be developed to enable the institution to continually identify, monitor, and mitigate the risks posed by cloud computing. Also, effective controls should be established to ensure the security of the information assets and their compliance with relevant statutory requirements regarding customer data confidentiality. A viable and effective contingency plan should be developed to cope with situations involving a disruption of cloud computing services.
    • Protection of access and other legal rights. There should be suitable arrangements to guarantee audit rights of institutions, along with the supervisory access to information stored in the cloud and relevant risk management controls for the purposes of undertaking on-site examinations. A clear and enforceable cloud service provider engagement agreement should be in place to protect institutions’ interests, risk management needs, and ability to comply with supervisory expectations.
    • Risk management capabilities. Institutions should equip staff overseeing cloud operations with the knowledge and skills required to securely use and manage the risks associated with cloud computing. 

    Authorized institutions should apply this guidance proportionately and in a way that is commensurate with the criticality of their cloud adoption and the potential impact that cloud computing may have on their risk profile. Institutions should note that the below principles serve to complement, and should be read in conjunction with, the relevant existing HKMA guidance, including SPM Modules SA-2 on “Outsourcing,” OR-2 on “Operational Resilience,” and TMG-1 on “General Principles for Technology Risk Management.”



    Keywords: Asia Pacific, Hong Kong, Banking, Regtech, Cloud Computing, Operational Resilience, Operational Risk, Basel, Outsourcing Risk, HKMA

    Featured Experts
    Related Articles

    BIS Paper Examines Business Model for Lending by Banks and Bigtechs

    BIS recently published a paper that studies the lending business model for big tech firms in comparison with the traditional bank intermediation process.

    August 31, 2022 WebPage Regulatory News

    HKMA Expects Banks to Join Commercial Data Interchange by End-2022

    The Hong Kong Monetary Authority (HKMA) plans to amend the Supervisory Policy Manual module IC-7 to reflect its regulatory expectations in respect of the Commercial Data Interchange (CDI) and its Link with the Commercial Credit Reference Agency (CCRA).

    August 26, 2022 WebPage Regulatory News

    FSI Paper Suggests Global Regime for Critical Service Providers

    The Financial Stability Institute (FSI) of the Bank for International Settlements published a brief paper that examines the macro-prudential concerns of operational resilience with respect to cloud service providers and big tech firms and offers ideas on how to address these concerns.

    August 25, 2022 WebPage Regulatory News

    CFTC Issues Rule on IBOR Swaps, Extends RFI for Climate Risk

    The Commodity Futures Trading Commission (CFTC) finalized a rule modifying the interest rate swap clearing requirements and extended, from August 08, 2022 to October 07, 2022, the comment period on a Request for Information (RFI) on climate-related financial risks.

    August 24, 2022 WebPage Regulatory News

    ECB Penalizes Crédit Agricole SA for Breach of EU Law

    The European Central Bank (ECB) has imposed administrative penalties on Crédit Agricole SA for violating the banking law in European Union.

    August 23, 2022 WebPage Regulatory News

    ESMA Proposes Improvements to Third Country Benchmarks Regime

    The European Securities and Markets Authority (ESMA) published its response to the European Commission consultation on the regime applicable to the use of benchmarks administered in a third country.

    August 19, 2022 WebPage Regulatory News

    OSFI Issues Guidance on Capital & Liquidity Treatment of Cryptoassets

    The Office of the Superintendent of Financial Institutions (OSFI) extended the comment period for the revised guidelines on third-party risk and climate risk management (Guidelines B-10 and B-15, respectively).

    August 18, 2022 WebPage Regulatory News

    APRA Finalizes Reporting Standards for Updated Basel Capital Framework

    The Australian Prudential Regulation Authority (APRA) finalized the reporting standards to support the updated capital adequacy and credit risk capital requirements for authorized deposit-taking institutions.

    August 18, 2022 WebPage Regulatory News

    FCA Issues Updates on LIBOR Transition and Enhanced SM&CR Status

    The Financial Conduct Authority (FCA) issued a statement for issuers and bondholders of outstanding LIBOR-linked bonds, encouraging the market participants to continue the transition of outstanding LIBOR-linked bonds to fair alternative rates.

    August 16, 2022 WebPage Regulatory News

    FI Updates Deactivated Validation Rules for Banks and Investment Firms

    The Swedish Financial Supervisory Authority (FI) has updated the lists of deactivated European Banking Authority (EBA) validation rules for periodic reporting, via Fidac, for banks and investment firms.

    August 16, 2022 WebPage Regulatory News
    RESULTS 1 - 10 OF 8476