Ravi Kittane’s Post

Recently, the Monetary Authority of Singapore (MAS) shared its "Guidelines on Consumer Protection Measures by Digital Payment Token Service Providers" [PS-G03]. While the guidelines are comprehensive in safeguarding consumer assets and ensuring transparency, one critical aspect seems to be missing: business continuity. Key aspects covered include: Segregation of customers' assets and the maintenance of trust accounts with a safeguarding person to ensure customers' assets are protected and can be returned in the event of the service provider's insolvency. Implementation of risk management systems and controls to safeguard customers' assets, including storing a significant portion of these assets in cold wallets (systems not connected to the internet) to mitigate the risk of cyber attacks and unauthorized access. Disclosure of policies on storing customers' assets, handling losses from fraud or negligence, and managing conflicts of interest to ensure transparency and protect customer interests. Provisions for issuing statements of account to customers, detailing transactions, balances, and movements of assets, to maintain transparency and accountability. While these guidelines are focused on protecting consumer assets and ensuring transparency and accountability in the operations of digital payment token service providers, they do not directly mention "business continuity" plans or strategies.   Business continuity would involve plans to ensure the continued operation of services in the face of disruptions, which, while related to some of the risk management and safeguarding practices mentioned, is not explicitly covered in the document excerpts provided. Chris Ekai Rohan Ehsan Jaidev Iyer Andrea Perlak Mark Armour, cABCF Mark Bittinger Lori Souza MBA, BSIT Oonagh van den Berg (Lady) James Burnie FRSA #MAS #ConsumerProtection #DigitalPayments #Fintech #RiskManagement #BusinessContinuity #SingaporeFinance #FinancialRegulation #Cybersecurity #Transparency #Accountability

Recently, the Monetary Authority of Singapore (MAS) shared its "Guidelines on Consumer Protection Measures by Digital Payment Token Service Providers" [PS-G03]. While the guidelines are comprehensive in safeguarding consumer assets and ensuring transparency, one critical aspect seems to be missing: business continuity. Key aspects covered include: Segregation of customers' assets and the maintenance of trust accounts with a safeguarding person to ensure customers' assets are protected and can be returned in the event of the service provider's insolvency. Implementation of risk management systems and controls to safeguard customers' assets, including storing a significant portion of these assets in cold wallets (systems not connected to the internet) to mitigate the risk of cyber attacks and unauthorized access. Disclosure of policies on storing customers' assets, handling losses from fraud or negligence, and managing conflicts of interest to ensure transparency and protect customer interests. Provisions for issuing statements of account to customers, detailing transactions, balances, and movements of assets, to maintain transparency and accountability. While these guidelines are focused on protecting consumer assets and ensuring transparency and accountability in the operations of digital payment token service providers, they do not directly mention "business continuity" plans or strategies.   Business continuity would involve plans to ensure the continued operation of services in the face of disruptions, which, while related to some of the risk management and safeguarding practices mentioned, is not explicitly covered in the document excerpts provided. Chris Ekai Rohan Ehsan Jaidev Iyer Andrea Perlak Mark Armour, cABCF Mark Bittinger Lori Souza MBA, BSIT Oonagh van den Berg (Lady) James Burnie FRSA #MAS #ConsumerProtection #DigitalPayments #Fintech #RiskManagement #BusinessContinuity #SingaporeFinance #FinancialRegulation #Cybersecurity #Transparency #Accountability

We're delighted to be part of Risk Live Hong Kong 2024 hosted by Risk.net today! Speaking on a keynote panel during the morning session, Sonford Yuen, Chief Risk Officer of ZA Bank, highlighted that as risks are becoming inter-related in the digital era, tackling individual risks in silos is no longer effective. It's imperative for banks to redesign their #RiskManagement framework to remain resilient. With over 40% participants from the audience choosing cybersecurity and data risk as the top concern for banks in 2024, Sonford acknowledged the trend and called it an 'ongoing battle' for banks. He concluded by stressing the importance of leveraging technologies to combat technology risks, adding that banks should continue investing in upgrading data analytic capabilities in a world where scammers are increasingly using #AI and #BigData to create personalised phishing messages. #ZA #ZABank #YourFutureBankForNow #DigitalBanking #Fintech

The DORA Regulation, or simply DORA, brings about a requirement for financial entities to conduct testing of their ICT risk-management framework. Important financial entities are required to conduct what DORA calls advanced testing via threat-led penetration testing (TLPT), i.e., red-team penetration testing. Our Counsel Costin Sandu begins herewith a series of posts aiming to raise awareness on the testing requirements for financial entities under DORA, as well on practical action and pain points that both financial entities subject to TLPT and testers must consider when planning for or conducting DORA TLPT. Today, we clarify what entities will be subject to TLPT in Romania pursuant to DORA; to start with, we note that the National Bank of Romania is about to be designated as the Romanian supervising authority for TLPT testing irrespective of whether the tested entities are subject to NBR supervision or not. NBR stated that the following entities will be subject to TLPT in Romania: G-SII and O-SII banks (which include the top 5 Romanian banks plus CEC Bank, Alpha Bank and OTP Bank); central depositories (such as Depozitarul Central); central counterparties; stock exchanges; insurers with at least 10% market share; and other entities individually designated by the NBR to conduct TLPT relying on the criteria set out in DORA (art. 26.8) and in particular on the far-more-detailed ones from the DORA TLPT RTS (currently pending finalisation and publication); specific criteria may also be laid down in the awaited Romanian law implementing DORA. It is also noteworthy that the NBR will conduct a periodic process of designation and review of the entities required to conduct TLPT in Romania. Any entity that is subject to TLPT must reflect TLPT in their ICT risk-management framework, subject to the DORA requirements. Keep an eye on our page for our next DORA post! #DORA #DORARegulation #DORAAwareness #TLPT #redteaming #practicalDORA #1DORAtesting #Cybersecurity 

With the Asia-Pacific banking sector being increasingly targeted by cyberthreats, we're examining the urgent need for comprehensive data loss prevention strategies.   Read this whitepaper to discover why APAC banks are at risk, explore the critical role of DLP in safeguarding trillions of dollars in assets, and familiarize yourself with five strategic approaches for enhancing data security amid digital transformation.   #DataSecurity #DataLossPrevention #APACBanking #CentificInsights Centific

I had the opportunity to spend the week with CROs in the largest banks and insurance companies in Japan. There were many commonalities and parallels that I could draw with my experience in India and SE Asia. Invariably, CROs in Japan want to address the “unknown unknown” (we don’t know what we don’t know). Key topics of discussion included: - Non-financial risk and operational resilience (sometimes even starting with something as basic as risk taxonomy). - Cyber (bringing together cyber, fraud, and AML). - Geopolitical risks, especially given most Japanese FIs now have multi-country operating models - Compliance (operating model in multi-country model)   I believe the amount of effort banks and regulators have put into credit risk in the last 20 years is now going to be put into NFR (same story across multiple countries).   One strategic shift I could see is that multiple large FIs are bringing in CROs who have a long history of working in business lines outside of Japan. This is quite a refreshing and bold move, and it would be great to see how it plays out.

Banks face a labyrinth of regulatory changes that add new risks, modify internal controls, and enforce stringent reporting standards. Non-compliance can lead to significant financial penalties and operational disruptions. #cybersecurity #banking #riskanalysis #dataanalysis #fraudprevention

My Article / #temenos in #IFN News about cybersecurity and developing an advanced cybersecurity strategy for Traditional and Islamic Banks. #cybersecurity #AI #Banking #technology #digital #islamicbanking #islamicbanks #digitaltransformation

In an era where secure identity verification and fraud prevention are more critical than ever, how can banks ensure they meet these demands while delivering exceptional customer experiences? Join us at the Temenos Regional Forum 2024: ASEAN as we dive into the next generation of integrated solutions with Uniken. We’ll showcase how our technologies provide certainty in identity, authentication, and security—helping banks not only meet regulatory requirements but exceed client expectations, both in person and online. Don’t miss this chance to learn how we’re pioneering the future of banking. Register now and be part of the conversation: https://lnkd.in/dQuP_ijt #TRF2024 #BankingInnovation #Cybersecurity #IdentityVerification #APAC

The recent ECb #cyber #stresstest showed vulnerability of the banking system . Most attacks in the last two years were assumed to originate in #Russia and perhaps #China . Given that both countries invest in #Cyber #warfare , it would be an Omission if #Europe didn’t fortify its infrastructure . A small “hickup” in popular software earlier this month sent waves to global infrastructure . What would be the impact of a full scale attack to the European banking sector or Europe’s payments systems . That said , unless ECB links its cyber stress test to #capitalrequirements or #fines like the FEd does , then we should see little improvement on the matter . I remain very curious to see how DORA will be supervised and graded in SREP . “The central bank said the results of the test would feed into its annual supervisory review and evaluation process, which assesses risks at each bank and sets their capital requirements. It did not expect any direct impact on the amount of capital it wants banks to have” FT article