HKMA issues binding Sectoral Code of Practice imposing cyber-security obligations on designated critical-infrastructure banks
The HKMA issued a binding Sectoral Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance, effective 2 June 2026, requiring Authorized Institutions designated as critical-infrastructure operators to meet baseline cyber-security obligations for their critical computer systems — enforceable through Monetary Authority directions whose breach is a criminal offence.
Change
On 2 June 2026, the HKMA's Monetary Authority brought into operation a Sectoral Code of Practice under Section 8(1)(b) of the PCICSO for Authorized Institutions designated as critical-infrastructure operators. It sets baseline requirements for protecting designated critical computer systems and details how Designated AIs comply with category 1 and category 2 statutory obligations. Non-compliance with the Code is not itself an offence, but the MA can issue written directions for non-compliant or defective compliance, and breaching such a direction is an offence.
Why it matters
The Monetary Authority issued this Sectoral Code of Practice under the PCICSO, effective 2 June 2026, to set the baseline cyber-security requirements for the critical computer systems (CCSs) of Authorized Institutions designated as critical-infrastructure operators. The Code establishes how the MA will bilaterally designate CCSs and the information Designated AIs must supply for that process, then sets out the operative obligations: maintaining a Hong Kong office and notifying the MA of its address and any change; notifying operator changes and material changes to CCSs; establishing and maintaining a computer-system security management unit with a suitably qualified supervisor; and submitting and implementing a computer-system security management plan endorsed by the board or senior management, reviewed at least once every two years. The plan must address a detailed control set spanning access control, privileged access, cryptography, patch and change management, backup and recovery (including a secure tertiary data backup), network and application security, logging with a minimum six-month retention, supply-chain and cloud risk, monitoring and detection, and training. Designated AIs must also conduct periodic computer-system security risk assessments — including vulnerability assessment and penetration testing — and arrange independent security audits, on the periods specified in the Ordinance. The Code is not subsidiary legislation and non-compliance with it is not itself an offence, but it is the benchmark against which the MA assesses compliance: the MA may issue written directions to require remedial action for non-compliance or defective compliance with category 1 or category 2 obligations, and failing to comply with such a direction is an offence.
Implications
- — Authorized Institutions designated as critical-infrastructure operators must establish and maintain a computer-system security management unit and submit a board- or senior-management-endorsed computer-system security management plan covering the Code's full control set for their designated critical computer systems; failing to do so exposes the institution to Monetary Authority written directions, breach of which is a criminal offence.
- — Designated AIs must conduct periodic computer-system security risk assessments — including vulnerability assessments and penetration tests — and arrange independent security audits of their critical computer systems on the periods set under the Ordinance, retaining the supporting reports and evidence to demonstrate compliance to the Monetary Authority on request.
- — Designated AIs must notify the Monetary Authority of their Hong Kong office address, operator changes, and material changes to designated critical computer systems within the periods specified in the Ordinance, in the form the Monetary Authority requires.
- — Designated AIs relying on third-party and cloud service providers for critical computer systems must extend the Code's supply-chain and cloud-security controls to those providers and avoid over-dependence on a single or few suppliers, because supplier nodes fall within the protected scope of the designated critical computer systems.
Who is affected
- — Authorized Institutions designated by the HKMA as critical-infrastructure operators, and their security, technology-risk and operational-resilience functions
- — Boards and senior management of Designated AIs responsible for endorsing the computer-system security management plan
- — Third-party and cloud service providers operating or supporting designated critical computer systems for Designated AIs
What to watch
- — Designated AIs must review and, where required, resubmit the computer-system security management plan to the Monetary Authority at least once every two years from its adoption to maintain compliance.