Regulatory authorities have issued a draft document outlining new cybersecurity regulations for the financial industry and are now soliciting feedback from the public.

In a move to enhance the standardization of cybersecurity management within the financial sector, a joint draft of the "Financial Industry Cybersecurity Management Measures (Exposure Draft)" has been prepared by the People's Bank of China, the National Financial Regulatory Administration, the China Securities Regulatory Commission, and the State Administration of Foreign Exchange.

Key Components of the Draft Measures

The proposed measures are structured into five chapters containing a total of 33 articles. The first chapter outlines general provisions, specifying the legal basis, scope of application, overarching cybersecurity protection requirements, and industry self-regulation expectations.

The second chapter details the obligations for cybersecurity protection. It establishes general requirements for network operation security, network data protection, and personal information protection. It provides principle-based stipulations on cybersecurity responsibility systems, governance frameworks, classified protection systems, the use of commercial cryptography, technological innovation applications, and information service security management. This section also introduces identification requirements for critical information infrastructure within finance and imposes specific compliance obligations on operators. These obligations cover organizational structure, operational safeguards, supply chain security, risk assessments, and emergency response plans for cybersecurity incidents.

The third chapter focuses on coordinated supervision and management. It clarifies the principles for collaborative oversight by the State Council's financial management departments and the coordinated implementation of special tasks.

The fourth chapter addresses legal liabilities, setting out the consequences for violations of the measures. The fifth and final chapter contains supplementary provisions, defining key terms, explaining authority for interpretation, and specifying the effective date.

Rationale Behind the New Regulations

An accompanying explanatory note for the draft measures highlights the growing reliance of financial services on networks amid the sector's digital transformation, with financial networks becoming increasingly interconnected. The note points to converging risks, including the high complexity of network operations, the broad scope of supply chain security, the occurrence of organized and high-intensity cyber-attacks, and the tight integration of emerging technologies with business applications. These factors collectively pose a potential threat to financial stability and security.

The formulation of these measures is described as a necessary step by financial regulators to establish a clear baseline for cybersecurity compliance within the industry and the associated legal liabilities for breaching it. The overarching goal is to safeguard the continuous and stable operation of the financial system and help prevent the escalation of cybersecurity risks into broader financial risks.