Management Summary
- Purpose / Background: The HKMA has issued a new Code of Practice (the "Code") under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) to provide regulatory guidance for Stored Value Facility (SVF) Licensees designated as Critical Infrastructure Operators (CIOs).
- One-line conclusion: Designated SVF Licensees must align their computer system security frameworks with this Code to meet new statutory category 1 and 2 compliance obligations effective 12 June 2026.
- Key Changes:
- Formal establishment of regulatory expectations for critical infrastructure computer system security.
- Provision of structured guidance for fulfilling specific statutory obligations under the Ordinance.
- Mandatory compliance alignment for SVFs identified as CIOs by the Monetary Authority.
- Key Dates / Deadlines: Effective date: 12 June 2026.
- Applicability / Impact scope: Limited to Stored Value Facility (SVF) Licensees that have been specifically designated by the Monetary Authority as Critical Infrastructure Operators under section 12 of the Ordinance.
- Recommended management actions:
- Identify if the institution has received a formal designation notice from the Monetary Authority under section 12.
- Conduct a gap analysis between current cybersecurity controls and the requirements set out in the Code.
- Update internal policies and technical security standards to reflect the Code's specific category 1 and 2 obligation requirements.
- Brief the Board and relevant Risk/Compliance committees on the new statutory oversight requirements.
- Implement enhanced monitoring and reporting mechanisms to ensure continuous compliance with the Ordinance.
Detailed Summary
1) Document overview
This document serves as the formal Notice of Issuance of the Code of Practice issued pursuant to section 8(1) of the Protection of Critical Infrastructures (Computer Systems) Ordinance (Chapter 653). Its purpose is to guide designated SVF Licensees in meeting their statutory security obligations.
2) Main requirements
The Code provides practical guidance for:
- Compliance with Category 1 obligations under the Ordinance.
- Compliance with Category 2 obligations under the Ordinance.
- Overall management and security of computer systems designated as critical infrastructure.
3) Key changes
- Transition from general best practices to a formal statutory framework under Chapter 653.
- Clarification of the specific standard of care required for SVFs designated as CIOs compared to general regulatory expectations.
4) Important dates & transition
- Effective Date: 12 June 2026. All designated entities are expected to be in compliance by this date.
5) Impact and risks
- Compliance Risk: Failure to comply with the Code may result in regulatory enforcement under the Ordinance.
- Operational Impact: SVFs may need to overhaul or upgrade existing computer system security protocols to meet the new statutory thresholds.
- Reporting: Increased burden on reporting security incidents or system changes as necessitated by the Ordinance.
6) Compliance action checklist
- Verify status of designation as a CIO under section 12 of the Ordinance.
- Download the full Code from the HKMA website: [HKMA SVF Regulatory Resources](https://www.hkma.gov.hk/eng/regulatory-resources/regulatory-guides/svf-and-rps/stored-value-facilities-and-retail-payment-systems/).
- Map existing technical controls to the specific category requirements in the Code.
- Formalize internal audit procedures to verify adherence to these requirements.
7) Appendices/attachments summary
- *Note: * This document does not contain individual technical appendices; it serves as the formal issuance notice for the standalone Code of Practice document hosted on the HKMA portal.