FMA finalises new standard condition for business continuity and technology systems
The Financial Markets Authority (FMA) – Te Mana Tātai Hokohoko has decided to introduce a new standard condition that will require certain market participants to have an appropriate business continuity plan, maintain the operational resilience of technology systems it uses and report any event materially affecting operational resilience to the FMA within 72 hours.
The new condition will take effect from Monday, 1 July 2024 and apply to:
- Managers of registered schemes (other than restricted schemes).
- Providers of discretionary investment management services or DIMS.
- Derivative issuers in respect of regulated offers.
- Peer-to-peer lending providers.
- Crowdfunding service providers.
The introduction of the standard condition reflects the FMA's concerns about the financial services sector's heavy reliance on technology and the increasing risk of cyberthreats.
The decision to introduce the new standard condition follows consultation undertaken by the FMA in July last year. The FMA's Regulatory Impact Statement (RIS), acknowledges submissions seeking a longer period for reporting adverse events to the FMA and more guidance on the meaning of materiality. However, the standard condition and accompanying explanatory as finalised is substantially the same as the condition proposed in the consultation. It also broadly aligns with a similar standard condition that already applies to licensed financial advice providers1 and that has been finalised for financial institutions under the incoming Conduct of Financial Institutions legislation.2
The RIS also notes that the FMA is investigating options for secure reporting tools and that the FMA has developed a notification template for submitting reports.
Please let us know if you have any questions about the new standard condition.
1Standard condition 5
2Standard condition 5
