Malaysia's leading securities regulator, the Securities Commission (SC) has issued guidelines on technology risk management practices among capital market entities.
In formulating the guidelines, the commission said it has taken into account feedback received from the public consultation paper on the "proposed regulatory framework on technology risk management", published last year.
The aim is to implement an effective technology risk framework, project management, service provider management and cyber security management.
As per the guidelines, a capital market entity should identify the extent of the potential threat and vulnerabilities to its IT environment by scoping information risk assessments across different business functions followed by risk monitoring, review and reporting.
It suggests the development of appropriate strategy against cyber threats identified to ensure "continuous delivery of its services and minimise or contain the impact of a cyber security incident".
Use of AI and ML
The commission noted that many entities use artificial intelligence (AI) and machine learning (ML) technologies for many purposes including advisory services, risk management, client identification and monitoring, selection of trading algorithms and portfolio management.
Those adopting AI/ML has been asked to implement governance framework and processes to oversee development of these emerging technologies.
The SC noted that entities need to begin with clear goals and contingency plan to promptly suspend these applications whenever required.
Additionally, the entities have to conduct validation and testing on its AI and ML systems to
ensure privacy, data protection and resilience. The data and models used for AI and ML driven decisions should also be reviewed to guard against the use of biased data or algorithms.
The release said the guidelines will be applicable to all capital market entities licensed, registered, approved, recognised or authorised by the commission.
The new initiative is expected to come into effect in the third quarter of 2024 to allow ample time for capital market entities to comply.
