A torrent of technology-driven innovation in financial markets and services has reshaped how markets are structured; how companies access and deploy capital; how investors respond and react to information and
how customers receive and use financial services in their new innovative form. Faster response to rapid technological advancement and shifting market dynamics require fresh thinking as to how regulation can best foster the responsible development of this digital industry. Similarly, as an international financial marketplace, Labuan IBFC is no exception to a more agile and iterative rulemaking process. The Authority has been promoting digital innovation for business solutions that are tailored to current market needs, whilst ensuring businesses are conducted in a conducive and safe operating environment.
Regulatory enhancement for digital businesses
Current digital transformation megatrends are fast changing the way financial institutions operate. These require rapid regulatory responses that are appropriate to the nature and complexity of the financial institutions’ digital and virtual operations. The Authority recognises that no single regulatory model fits all, and divergent regulatory frameworks in a complex, fast-moving landscape can add complexity, create uncertainty and dampen innovation. Against this backdrop, the Authority developed the appropriate prudential policy measures to safeguard the Labuan financial institutions (LFIs) from the cyber vulnerabilities and prepare the market to embrace digital transformation in the new norm operating landscape. The measures were aimed at:
- enhancing business contingency planning to minimise material consequences arising from any major operational disruptions; and
- strengthening cyber resilience for digital operations to ensure operational agility and efficiency.
Enhancing market practices for business contingency and cyber resilience
As part of initiatives to ensure that LFIs maintain operational resilience and effectively manage the emerging cyber risks and other related vulnerabilities arising from digital transformation, the Authority had embarked on regulatory policy enhancements as depicted in the diagram below.
The following are the key policy enhancements that are being undertaken by the Authority:
(i) Guiding Principles on Business Continuity Management which provided principle-based requirements for LFIs to:
- maintain a sound and effective business continuity management (BCM) with board and senior management oversight;
- assess and mitigate risks from major disruptions, concentration of critical business functions and outsourcing arrangements as part of its BCM;
- adopt recovery strategies that reflect the magnitude of the potential disruption risks to the LFI’s critical business operation;
- develop the IT disaster recovery plan for critical business functions and related technology infrastructure to provide assurance to relevant internal and external stakeholders of LFI’s preparedness in the event of a major disruption;
- conduct a continuous organisation-wide awareness and testing for business continuity and resumption plans;
- develop an effective communication plan to address the reputational risks; and
- undertake periodic review and maintenance of approaches and strategies for business continuity to assess the LFI’s operating environment and business circumstances.
(ii) Digital Governance Framework that is intended to inculcate effective management of cyber risks by requiring the LFIs to:
- ensure that its digital governance and cyber risk management is overseen and approved by the board and senior management;
- maintain enterprise-wide strategies to preserve data confidentiality, systemsecurity and resilience in a systematic and consistent manner;
- implement robust security controls that are matched with the risk and complexity of its digital services on continuous basis;
- effect obligations of the external service provider for the outsourced IT systems and digital services in the service legal agreement; and
- conduct awareness programme and participate in trainings for emerging cyber risks and digital-related issues to mitigate cyber threats and vulnerabilities.
Labuan IBFC has been progressive in embracing the rapid evolving fintech development in line with international standards of compliance, transparency and prudential requirements, and will continue to benefit Labuan IBFC moving forward.
Labuan IBFC is pleased to announce that its annual conference, Connecting Digital Ecosystems (CoDE) Asia, will be held on Thursday, 21 October 2021.
Growing into its third edition, CoDE Asia 2021 is themed "Future Forward: Next Gen Digital Ecosystems”, as it continues to focus on current and emerging developments in the digital finance industry as well as its surrounding ecosystems.
Sign up now to receive future updates and complimentary access to the virtual conference.
