Western financial firms have been warned that China’s new cybersecurity rules could pose a risk to their work by making their data vulnerable to hacking.
The warning by a leading lobby group said draft rules proposed by China Securities Regulatory Commission seek to make it mandatory for investment banks, asset managers and futures companies with operations in China to share data with the CSRC.
The latest regulatory proposal comes at a time when a string of western investment banks and asset managers are expanding their presence in China, either by setting up wholly-owned units or by taking a bigger share in existing joint ventures.
The draft ‘Administrative Measures for the Management of Network Security in the Securities and Futures Industry’ were released by the CSRC on April 29, ahead of a month of public consultation on the proposals.
The draft rules would also allow regulator-led testing, and help set up a centralised data backup centre.
The Asia Securities Industry and Financial Markets Association (ASIFMA) sent a letter to the CSRC dated May 27 expressing concerns from its members about the draft rules, as they anticipate risks in sharing sensitive data.
Feedback Being Studied: CSRC
Morgan Stanley and HSBC are among the large corporates who have benefited in recent months from China‘s opening up of its financial sector to foreigners, following Goldman Sachs and JPMorgan, which won nods to run local units last year.
ASIFMA, which has more than 160 members comprising leading financial institutions from both the buy and sell side, banks, law firms and market infrastructure service providers, did not confirm the letter and declined to comment on its content.
In response to a request for comment, the CSRC said that ASIFMA submitted its opinion on May 31, two days after the consultation period ended.
“However, we still highly value the feedback forwarded by relevant associations,” it said, adding the regulator was “carefully studying the opinions and suggestions” and will continue to communicate with them.
The proposed new data rules for financial firms also comes against the backdrop of Beijing’s tightened oversight of data security mainly in the tech sector as part of a wider regulatory crackdown, which has roiled the country’s stock markets and stalled offshore company listings.
‘Huge Risks’
The draft rules require the sharing of data by financial firms for various purposes, but the lobby group is concerned that passing on sensitive data will make companies in the sector vulnerable to “hackers and other bad actors.”
Global banks and asset managers are also pushing back on a requirement to introduce a sector-wide data backup centre.
“This not only poses huge risks to all core institutions and operating institutions on an individual basis, but also brings significant systemic risks for the sector in China and globally given the inter-connectedness of the global financial sector, if the data is compromised or leaked,” the ASIFMA letter said.
The draft rules also stipulates that the CSRC could conduct penetration-testing – a simulated cyber attack against the operational system – and system scanning on securities, futures and fund firms.
However, ASIFMA flagged concerns of global banks that regulator-led or regulator-commissioned penetration testing pose “real risks to firms due to the potentially disruptive nature of penetration testing and the sensitivity of testing results.”
“Testing systems and applications without operational context could create significant disruption to firm operations,” the lobby group added.
The regulator has not set any timeline for the issuance of the final rules or for their implementation.
• Reuters with additional editing by Jim Pollard
ALSO SEE:
China Data Laws Make Disputes More Challenging, Says Forensic Firm
China Plans Cybersecurity Rules for Firms Wanting to List Abroad
China’s Critical Data Rules Not Aimed at Firms Planning Foreign IPOs – Regulator
China’s Tech Crackdown Seen Leading to State-Supervised Data Trading Markets
