The Financial Markets Authority opened consultation on the standard conditions for financial institutions in July, including a proposed ‘business continuity and technological systems’ condition. This condition, similar to that for financial advice providers, comes on the back of the FMA’s information sheet which aims to help licensed entities enhance the resilience of their cyber and operational systems.

The recently publicised hack of Booster Financial Services brings this issue back into stark relief. In this Financial Law Insight we take a look at what the information sheet means for licensed entities and how they might best put the requirements, and regulator expectations, into practice.

Background

Cyber matters have been a developing priority for the FMA. CEO Samantha Barrass canvassed the topic as part of a wide-ranging speech to the Financial Services Council Connect back in March, pointing out that “cyber security remains a significant risk across the sector, around the world.” Barrass noted that “as recent high-profile events have shown, none of us is immune to this threat so a good response plan is essential and indeed an important factor in your licence to operate.”

Reputational focus

A key driver for improving the resilience of cyber security and operational systems is the potential fallout when things go wrong. The reputational damage alone will have bigger consequences than any regulatory warnings.

As the FMA rightly points out, weaknesses in security and resilience exist to be exploited because companies may not be investing enough in robust technology systems. Or worse, they continue to use unsupported or legacy systems which expose them to threats.

What does the information sheet say?

The key messages from the information sheet – noting it is information and not guidance with a capital ‘G’ – is that the FMA expects entities to have adequate technology architecture and cyber security systems in place. And that these systems are tested on a regular basis to ensure data and technology is secure and operating effectively.

The information sheet suggests entities self-assess against the Cybersecurity Framework developed by the National Institute of Standards and Technology (a non-regulatory agency of the United States Department of Commerce). That framework consists of five steps: identify, protect, detect, respond, and recover.

The FMA also cross-refers to guidance from CERT NZ and RBNZ, and describes the National Cyber Security Centre’s Incident Management guidance as being of use. Suggestions include having a plan in place to respond to incidents and get things back up and running. Although the information sheet relies on heavy lifting done by others, it is still a useful starting point.

What’s our take?

One point that has not been highlighted in the information sheet is the need for entities to properly consider what information or systems can be done away with. A good clean out every now and then reduces the possibility of a cyber breach or inadvertent disclosure.

Entities should also be wary of developing new platforms or functionality on top of increasingly old architecture. That’s just asking for trouble. And on that note, the liberal copying and pasting of developer code may well create vulnerabilities to be exploited, so is best avoided where possible.

The FMA has set out a fairly broad requirement to be notified of incidents. This includes where data or information has been compromised. However, in our view, licensed entities should be wary of reflexively engaging with the FMA in these circumstances.

If an incident involves the loss of customer information, such as identification documents or payment details, then the Office of the Privacy Commissioner is the first port of call. There is no regulatory obligation to report privacy breaches to the FMA unless you want to give them a courtesy heads up. We suggest taking a considered approach in doing so. Ask yourself ‘is this something that actually reflects on my licensed activities or capability to discharge my financial markets regulatory obligations?’

Licensed financial advice providers have clearer obligations in this context under their ‘business continuity and technology systems’ condition. Financial institutions look set to have a similar condition imposed on their CoFI ‘conduct’ licences.

When should I notify the FMA?

Licensed entities that do not have an express ‘business continuity and technology systems’ condition only need to report to the FMA in respect of cyber incidents where there’s been:

• a material change of circumstances in relation to the licence; or
• a contravention, or likely contravention, of a market services licensee obligation in a material respect.

Material change

A material change of circumstance in the context of a cyber incident is a change that adversely affects the licensee’s capacity to perform the licensed service in an effective manner (it is unlikely that a cyber incident would result in a licensed entity no longer meeting the eligibility criteria).

The key thing to assess is whether an incident is a ‘material change’, and if it is, whether it actually impacts the entity’s capability to effectively perform that service.

The large majority of cyber incidents will not result in a material change. Nor will they impact an entity’s ability to operate. An incident like the denial of service attack on the NZX website and announcement platform – which affected disclosure and subsequently halted trading for several days – is reportable. The equivalent would be an incident impacting a MIS manager’s ability to process applications and withdrawals, price units, and monitor investments. Or a crowdfunding platform being taken offline preventing applications for shares.

The loss of customer information on its own, while having consequences reputationally and under the Privacy Act, will not usually materially impact the performance of a licensed service under the Financial Markets Conduct Act (‘FMC Act’).

Contravention of licensee obligation

Market services licensee obligations are imposed on a licensee by a condition of licence or under the FMC Act (and, if applicable, terms of the offer, court order, governing documents, or KiwiSaver Act).

Importantly, the various ‘minimum standards’ developed by the FMA in respect of licence applications are not market services licensee obligations; they cannot be ‘breached’. They merely set out base requirements to obtain a licence. They do not contain ongoing licensee obligations except to the extent they are reflected in actual licence conditions.

Any references in the FMA’s information sheet to minimum standards, such as the ‘operational infrastructure minimum standard’ and the need for IT systems to be secure and reliable, are only relevant in so far as a licence condition subsequently references that initial base line requirement.

The ‘compliance’ standard condition simply requires that entities have adequate and effective systems, policies, processes and controls that are likely to ensure market services licensee obligations are met in an effective manner. If an entity has obtained a licence then it must be assumed that its systems are fit for purpose. So long as an entity has not been completely neglectful in terms of maintaining or updating systems as necessary, a cyber incident is unlikely to breach the compliance condition.

Nor will an incident be a breach of the ‘governance’ condition or the generic specific condition attaching to all licences. This generic specific condition requires licensees to “maintain the same or better standard of capability, governance and compliance as was the case when the FMA assessed its application” which is essentially the same as the compliance condition.

No express obligations

The problem the FMA has is that there are no express requirements in the FMC Act regarding cyber security and operational infrastructure. Nor has the FMA put in place a standard condition regarding cyber security and operational infrastructure for its licensed cohort (other than financial advice providers; financial institutions – banks, insurers, and deposit takers – are likely to join them).

The lack of an express condition for other licence types means there is currently no specifically prescribed need for licensed entities to report to the FMA about minor or straightforward incidents occurring in the ordinary course of business.

Is ‘self-reporting’ mandatory?

Only genuinely disruptive breaches require notification. And even then, entities need to consider the extent to which an incident actually materially affects the licensed business or licensed part of the business (particularly where multiple licences are held or more complex distributions structures are involved). After all, the FMA does not have a statutory mandate (or expertise) to assist a licensee to actually deal with or remedy a cyber breach.

Outsourcing

The FMA is also keen for licensed entities to keep a watch over their outsource providers. This makes sense in respect of core providers, but it is not a given that those obligations extend to, as the FMA has phrased it, “supply chains and third-party vendors.” The generic ‘outsourcing’ condition attaching to licences is clear, with the explanatory note providing that:

This condition only covers outsource arrangements related to the licensed business where you rely on the outsource provider to meet your market services licensee obligations.

Licensed entities should therefore focus their attention on providers they have delegated key functions to in order to meet their regulatory requirements (being obligations under the FMC Act and those imposed by licence conditions). For example, core functions ‘outsourced’ by a MIS manager could include administration management, registry services, and investment management (custody is excluded from outsource considerations under the FMA’s licensing process).

Licensed entities should ensure that they have agreements in place with their key outsource providers. Importantly, these agreements should contain appropriate protections and safeguards to facilitate a quick response to any cyber (and privacy) incidents. These agreements should also contemplate adequate oversight of the outsourced arrangements and the performance of the provider. And, in the event the provider is at fault, the agreement should allow for suitable recourse for poor performance (including a mechanism to facilitate handover to a new service provider).

Future focus

The FMA is heightening its focus on cyber and operational resilience and carrying out a review of entity obligations. This aligns with the increasing digitisation of financial services, the growing prevalence of cyber-attacks, and the increasing numbers of technology incidents reported.

The review of entity obligations should, in our view, have taken place before the release of any information sheet. Putting in place some well-defined obligations in the form of a standard condition, as is already the case for financial advice providers and proposed for financial institutions, would give licensed entities certainty as to the extent of their obligations and provide a clear line as to when a breach is ‘reportable’. Essentially, the information sheet involves the FMA expressing its views as to how licensed entities should conduct themselves in relation to cyber security issues without doing the hard yards of first putting in place appropriate licence conditions.

Looking ahead, licensed entities should keep an eye out for a review of licensee obligations and the possibility of having a say in relation to any proposed new ‘cyber and business continuity’ licence conditions in the months ahead. In the meantime, now is an opportune time to review your incident response plans, even if you aren’t technically subject to an express cyber security regulatory obligation.

If you don’t already have a written plan to follow in the event of a privacy or cyber breach, we suggest you put one in place!

Start a conversation

If you would like assistance with applying the FMA’s Cyber Security & Operational Systems Resilience Information Sheet, or with how financial service providers should otherwise be managing their cyber and privacy risks and compliance, please contact Catriona Grover, David Ireland, Hayley Miller, Campbell Featherstone, or Mark Schroder, or email the team at bankingandfinancialmarkets.nz@dentons.com.