Management Summary
- Purpose / Background: This document serves as the formal Notice of Issuance of the "Code of Practice pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance" (Cap. 653) for designated Retail Payment System Infrastructure Operators (RPSIOs). It provides mandatory practical guidance to ensure these operators comply with their statutory obligations regarding the security of critical computer systems.
- One-line conclusion: Designated RPSIOs must align their cybersecurity framework with this Code by the effective date of 15 October 2026 to ensure full compliance with Cap. 653 Category 1 and 2 obligations.
- Key Changes:
- Formal establishment of regulatory standards for RPSIOs under the new Cap. 653 framework.
- Provision of specific, operational guidance for Category 1 (foundational) and Category 2 (advanced) statutory obligations.
- Integration of HKMA oversight into the broader national critical infrastructure protection mandate.
- Clearer definition of technical security expectations for retail payment systems deemed critical to Hong Kong’s infrastructure.
- Key Dates / Deadlines: 15 October 2026 (Effective date).
- Applicability / Impact scope: Retail Payment System Infrastructure Operators designated by the Monetary Authority as Critical Infrastructure Operators (CIOs) under Section 12 of the Ordinance.
- Recommended management actions:
- Perform a gap analysis between current security protocols and the requirements outlined in the new Code.
- Review internal policies regarding Category 1 and Category 2 obligations to ensure alignment with the Ordinance.
- Update incident response and system security documentation to reflect the standards specified in the Code.
- Schedule briefing sessions for technical and compliance teams to ensure understanding of the new regulatory mandates.
- Document compliance status internally to prepare for potential HKMA regulatory assessments.
Detailed Summary
1) Document overview
- Nature: Regulatory Notice issued by the Monetary Authority pursuant to Section 8(1) of the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653).
- Purpose: To provide practical guidance for designated RPSIOs on meeting statutory obligations concerning computer system security.
- Scope: Applies strictly to RPSIOs designated by the Monetary Authority as Critical Infrastructure Operators (CIOs).
2) Main requirements
- Compliance with Obligations: Operators must adhere to Category 1 obligations (general/foundational security requirements) and Category 2 obligations (advanced protection/reporting requirements) as defined under the Ordinance.
- Guidance Utility: The Code functions as the official interpretation of how RPSIOs should execute their duties under Cap. 653 to safeguard critical computer systems.
3) Key changes
- Transition from general oversight to a specific, ordinance-backed cybersecurity mandate for critical retail payment infrastructure.
- Formalization of the relationship between HKMA’s supervisory role and the statutory requirements of Cap. 653.
4) Important dates & transition
- Effective Date: 15 October 2026. All designated operators are expected to be in compliance as of this date.
5) Impact and risks
- Compliance: Failure to comply with the Code may result in regulatory enforcement actions under the Ordinance.
- Operational: Operators must integrate the Code’s requirements into their existing Risk Management Frameworks (RMF) and cybersecurity operating procedures.
6) Compliance action checklist
- [ ] Download the Code of Practice from the official HKMA website.
- [ ] Verify the firm’s designation status as a "Critical Infrastructure Operator" under Section 12.
- [ ] Map current operational controls against the requirements for Category 1 and Category 2 obligations.
- [ ] Implement remediation plans for any identified gaps prior to the effective date.
- [ ] Update the Compliance Register to include Cap. 653 audit requirements.
7) Appendices/attachments summary
- N/A (Note: The provided text is a summary notice; the Code of Practice itself is hosted on the HKMA website as referenced in the document.)