Type to search

China Cybersecurity Rules Seen as Big Risk For Finance Firms

Western financial firms have been warned that China’s new cybersecurity rules could pose ‘significant systemic risks’ to their operations

Shanghai business district
Western financial firms in China have been warned that new cybersecurity rules could pose a significant risk to their operations for a range of different reasons. They provided feedback to the CSRC on the new laws in recent days. Photo: Reuters.


Western financial firms have been warned that China’s new cybersecurity rules could pose a risk to their work by making their data vulnerable to hacking.

The warning by a leading lobby group said draft rules proposed by China Securities Regulatory Commission seek to make it mandatory for investment banks, asset managers and futures companies with operations in China to share data with the CSRC.

The latest regulatory proposal comes at a time when a string of western investment banks and asset managers are expanding their presence in China, either by setting up wholly-owned units or by taking a bigger share in existing joint ventures.

The draft ‘Administrative Measures for the Management of Network Security in the Securities and Futures Industry’ were released by the CSRC on April 29, ahead of a month of public consultation on the proposals.

The draft rules would also allow regulator-led testing, and help set up a centralised data backup centre.

The Asia Securities Industry and Financial Markets Association (ASIFMA) sent a letter to the CSRC dated May 27 expressing concerns from its members about the draft rules, as they anticipate risks in sharing sensitive data.


Feedback Being Studied: CSRC

Morgan Stanley and HSBC are among the large corporates who have benefited in recent months from China‘s opening up of its financial sector to foreigners, following Goldman Sachs and JPMorgan, which won nods to run local units last year.

ASIFMA, which has more than 160 members comprising leading financial institutions from both the buy and sell side, banks, law firms and market infrastructure service providers, did not confirm the letter and declined to comment on its content.

In response to a request for comment, the CSRC said that ASIFMA submitted its opinion on May 31, two days after the consultation period ended.

“However, we still highly value the feedback forwarded by relevant associations,” it said, adding the regulator was “carefully studying the opinions and suggestions” and will continue to communicate with them.

The proposed new data rules for financial firms also comes against the backdrop of Beijing’s tightened oversight of data security mainly in the tech sector as part of a wider regulatory crackdown, which has roiled the country’s stock markets and stalled offshore company listings.


‘Huge Risks’

The draft rules require the sharing of data by financial firms for various purposes, but the lobby group is concerned that passing on sensitive data will make companies in the sector vulnerable to “hackers and other bad actors.”

Global banks and asset managers are also pushing back on a requirement to introduce a sector-wide data backup centre.

“This not only poses huge risks to all core institutions and operating institutions on an individual basis, but also brings significant systemic risks for the sector in China and globally given the inter-connectedness of the global financial sector, if the data is compromised or leaked,” the ASIFMA letter said.

The draft rules also stipulates that the CSRC could conduct penetration-testing – a simulated cyber attack against the operational system – and system scanning on securities, futures and fund firms.

However, ASIFMA flagged concerns of global banks that regulator-led or regulator-commissioned penetration testing pose “real risks to firms due to the potentially disruptive nature of penetration testing and the sensitivity of testing results.”

“Testing systems and applications without operational context could create significant disruption to firm operations,” the lobby group added.

The regulator has not set any timeline for the issuance of the final rules or for their implementation.


• Reuters with additional editing by Jim Pollard



China Data Laws Make Disputes More Challenging, Says Forensic Firm

China Plans Cybersecurity Rules for Firms Wanting to List Abroad

China’s Critical Data Rules Not Aimed at Firms Planning Foreign IPOs – Regulator

China’s Tech Crackdown Seen Leading to State-Supervised Data Trading Markets



Jim Pollard

Jim Pollard is an Australian journalist based in Thailand since 1999. He worked for News Ltd papers in Sydney, Perth, London and Melbourne before travelling through SE Asia in the late 90s. He was a senior editor at The Nation for 17+ years.


AF China Bond