The FMA has proposed a new business continuity and technology systems condition for managers of registered schemes (but not restricted schemes) (‘MIS’), providers of discretionary investment management services (‘DIMS’), derivatives issuers, and prescribed intermediary services (being peer-to-peer lenders and crowdfunding service providers).

In this Financial Law Insight we take a look at the FMA’s proposed condition and the implications for licensees. We also set out key areas of focus for those licensees wishing to make submissions.

What does the condition do?

The condition requires licensed entities, such as MIS managers, DIMS providers, and derivatives issuers, to have and maintain a business continuity plan that is appropriate for the scale and scope of their business. The condition also requires licensees to ensure the operational resilience of technology systems.

Such a condition is already in place for providers of a financial advice services. A similar condition will also apply to financial institutions.

So far, so good.

Shortcomings with the proposed condition

The proposed condition will require licensed entities, such as MIS managers and DIMS providers, to notify the FMA within 72 hours of any event that materially impacts the operational resilience of the licensee’s ‘critical technology systems’. Details of the event and impact on the entity’s service and clients must also be provided to the FMA within this timeframe.

In our view, the proposed 72-hour notification requirement cuts across and is inconsistent with the overriding existing statutory requirement in the Financial Markets Conduct Act 2013 (‘FMC Act’). Under section 412(3) of the FMC Act a licensee must ‘as soon as practicable after the licensee forms the belief’ that a material contravention of a condition has occurred, or is likely to occur, send a report to the FMA.

The framing of the FMC Act reporting requirement as being ‘as soon as practicable’ clearly intends for the licensee to be able to assess and respond to the material problem – including to confirm whether the problem is in fact material – and subsequently report, rather than unnecessarily devoting time and resource in the middle of the assessment and response phase to report to the regulator.

In practice, the existing ‘as soon as practicable’ requirement means a licensee is already under a statutory obligation to report material problems – once they form the belief it is material – in a timely manner, having regard to the particular circumstances and resources of the licensee. There is already a need to report promptly once the belief is formed, thus there is no need to prescribe a timeframe within the condition itself.

Inconsistent timeframes

Putting aside the validity of the reporting timeframe, there is also a lack of clarity regarding the 72 hour requirement, noting that licensed financial advice providers have up to 10 working days to report.

A 72 hour timeframe could readily occur across a weekend (or a long weekend at that) giving a licensee very little time to prepare the substantive report the FMA requires under the proposed condition. Setting a reporting timeframe by reference to hours rather than working days is generally impracticable. In our view, such a tightly defined reporting deadline should only be imposed in very limited circumstances where time is of the essence to enable an urgent and informed regulatory response to be implemented.

There will be very few events that could occur in respect of a DIMS, MIS, or other licensee that requires such urgent reporting to the FMA – noting, in any event, that the FMA is not in a position to help a licensee respond to system issues. The FMA does not have any internal expertise to assist licensees with such matters and nor should it. The FMA is a regulator, not a support agency.

Removing or relaxing the reporting timeframes would allow licensees to focus on fixing the system error, without unnecessary regulatory interference, and to then report as soon as practicable – preferably once a materiality assessment has been completed and substantive details of the incident are available.

It is at that point the FMA can readily assess matters and decide what regulatory action to take, if any, in relation to the licensee’s breach, such as a censure for the failure or requiring the licensee to develop an action plan to ensure the error does not happen again.

Notably, such regulatory action available to the FMA requires a set statutory process to be followed. The FMA is not intended to act as a rapid response advisory agency.

What is practicable?

Ultimately, the FMA is imposing its own notions of ‘as soon as practicable’ for different licensees – 10 working days for financial advice providers and 72 hours for other licence types. As mentioned, these requirements are far stricter than what the FMC Act already imposes.

What is practicable will be fact specific to the licensee and the nature of the particular cyber incident. In some cases a licensee may well be able to report within 72 hours, but only if that is practicable. In other scenarios it will not be practicable to report that readily.

In our view, there is nothing to be gained by requiring licensees to report to the FMA within 72 hours. They should be given time to focus on the task at hand and report to the FMA when practicable to do so – with sufficient detail to make the reporting worthwhile.

What will likely result, in practice, is that licensees will be forced to simply file a short holding report to the FMA in order to meet the FMA’s arbitrary 72-hour deadline. Frankly, that reporting deadline is unlikely to provide enough time for a licensee to gain sufficient information or details to make the report worthwhile. What’s more, it risks distracting critical resource away from dealing with the issue identified.

Double the trouble

The proposed condition is also potentially unfair. Taking the proposed condition to its logical extreme would result in a possible ‘double jeopardy’ scenario whereby a licensee has some ‘interruption to normal transmission’ that is material and therefore reportable. 

The licensee would, as per section 412 of the FMC Act, be under a pre-existing statutory duty to send a report to the FMA ‘as soon as practicable’. However, if that report is not sent within the proposed 72-hours then the licensee would be under a further obligation to send a report to the FMA detailing the failure to report within the 72 hour timeframe. 

Unless, of course, the FMA is of the view that failure to report within the 72 hour timeframe is not material and therefore not reportable. In any case, there is an inherent lack of clarity within the condition and the way in which it intersects with pre existing statutory obligations.

Confidentiality of information

Finally, we note that the proposed condition contains a reference to the ‘preservation of confidentiality, integrity and availability of information’. This overlaps with the territory of the Office of the Privacy Commissioner. Such overlap exposes a licensee to potential regulatory action from both the Privacy Commissioner and the FMA in respect of what would be the same material breach.

The Privacy Act 2020 already has a clear statutory requirement for agencies, which include all licensees, to protect and safeguard the personal information of clients or investors against loss, access, disclosure, or misuse (in particular, information privacy principle 5 regarding the storage and security of personal information, and section 114 of the Privacy Act which provides a statutory obligation to notify the Privacy Commissioner of a notifiable privacy breach).

The FMA has a legitimate interest in being made aware of the occurrence of a failure in a licensee’s critical technology systems. However, we can only hope that the FMA and the Privacy Commissioner will work together to minimise any duplication of effort and resource faced by a licensee in the event of a notifiable breach.

Conclusion

The increasing digitisation of financial services and the growing prevalence of cyber-attacks means it is fundamentally good business practice to have proper systems and protections in place. Reputational damage and financial loss are a key driver on this front.

The requirement to maintain business continuity and technology systems is therefore valid. All entities licensed by the FMA should have proper continuity plans and systems in place to ensure ongoing capability to provide licensed services. If they do not, then perhaps they should not have been licensed in the first place.

However, a 72 hour timeframe within which to report material events would impose an unnecessary regulatory burden on licensees. Their time would be better devoted to actually resolving the material cyber breach at hand, free from regulator distraction. This aspect of the proposed condition feels like unnecessary regulatory overreach.

If you have concerns about the scope of the proposed business continuity and technology systems condition, and the tight reporting timeframe, then you have until Friday, 1 September 2023 to make a submission to the FMA. We encourage MIS managers, DIMS providers, derivative issuers, peer-to-peer lenders, and crowdfunding service providers to have their say.

Start a conversation 

If you would like assistance with a submission to the FMA about the proposed business continuity and technology systems condition please contact Catriona Grover on +64 4 498 0816, David Ireland on +64 4 498 0840, Mark Schroder on +64 9 375 1120 or email the team at bankingandfinancialmarkets.nz@dentons.com.