Live 308 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network

Regulatory news and audio briefings from financial regulators worldwide — financial crime, AML, sanctions, fraud, digital assets and compliance

Regulatory heat map

Where it's moving right now · select a region to filter
Category
Country
Regulator
Showing
category: prudential × subcategory: op_resilience × regulator: hkma × Clear all

Filtered

2 segments
HKMA HKMA — Hong Kong Monetary Authority Source document ↗
HKMA — Hong Kong Monetary Authority Prudential & Capital ✓ 9 claims 1 hr ago

HKMA issues Code of Practice for designated retail payment system infrastructure operators

The HKMA has issued a Code of Practice under Hong Kong's Protection of Critical Infrastructures (Computer Systems) Ordinance for retail payment system infrastructure operators that it designates as critical infrastructure operators. This short segment covers what the Code binds, the statutory obligations it addresses, and the effective date operators need to work back from.

  • The Code is issued under section 8(1) of the Protection of Critical Infrastructures (Computer Systems) Ordinance (Chapter 653).
  • It applies to Retail Payment System Infrastructure Operators designated by the Monetary Authority as Critical Infrastructure Operators under section 12 of the Ordinance.
  • The Code provides practical guidance on compliance with category 1 and category 2 obligations under the Ordinance.
  • Under section 8(3), the Code takes effect on 15 October 2026.
Source document
HKMA HKMA — Hong Kong Monetary Authority Source document ↗
HKMA — Hong Kong Monetary Authority Prudential & Capital ✓ 23 claims 4 hrs ago

HKMA sets statutory cyber code for designated payment system infrastructure operators

The Hong Kong Monetary Authority has published a sectoral Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance for retail payment system infrastructure operators designated as critical infrastructure operators. It sets baseline requirements for protecting critical computer systems, from designation and governance through to risk assessment, penetration testing and logging. This segment covers what the Code binds, how it is enforced, and where it leans on existing frameworks.

  • The Code binds Retail Payment System Infrastructure operators designated by the Monetary Authority as Critical Infrastructure operators.
  • Breach of the Code is not itself an offence, but failure to comply with MA written directions, assessed against the Code, is an offence.
  • Security management plans must be endorsed by the Board, a delegated sub-committee or senior management, and reviewed at least once every two years.
  • System logs must be retained for a minimum of 6 months, secured so they cannot be deleted or altered, and user access rights reviewed at least annually.
  • Risk assessments must include a vulnerability assessment and a penetration test conducted by qualified professionals.
Source document