Technology Risk Management for Capital Market Entities (SC Guidelines)
The Securities Commission's Guidelines on Technology Risk Management, issued on 1 August 2023 and revised on 19 August 2024, replaced the 2016 Guidelines on Management of Cyber Risk, which stopped applying on 18 August 2024. The change is more than a new name. The guidelines reach beyond cyber security to technology risk across systems, change, third parties and new technology, and the 2024 revision added specific obligations: reporting near-miss events to the SC, carrying out a cyber security assessment before deploying a system, and penetration testing before deploying new critical systems. The SC may also appoint an independent party to review a capital market entity's compliance, including through a technology audit, and the revision added guidance on using artificial intelligence and machine learning ethically.
This one-day course is for directors, senior management, compliance, risk and technology leads at fund managers, stockbrokers, investment banks, trustees, platform operators and other SC-regulated entities. It is built around the decisions that sit with the board and senior management rather than technical implementation, and closes with a board-level tabletop exercise. Banks and other BNM-regulated institutions should see BNM RMiT Compliance instead, and entities that also hold national critical information infrastructure duties can add Cyber Security Act 2024 readiness.
HRD Corp SBL-Khas Claimable
Programme Agenda
9:00 AM - 9:15 AM
Welcome and Programme Overview
Introduction to the session, objectives, and housekeeping.
9:15 AM - 10:15 AM
From Cyber Risk to Technology Risk
What the Guidelines on Technology Risk Management replaced and why, the 2023 issue and 2024 revision, who the guidelines apply to, and how they sit alongside the Capital Markets and Services Act 2007, the SC's outsourcing expectations, the PDPA and the Cyber Security Act 2024.
10:15 AM - 10:30 AM
Break
10:30 AM - 11:30 AM
Board and Senior Management Accountability
What the board must approve, oversee and challenge: the technology risk management framework, risk appetite, resourcing and the assurance it receives. What a useful board pack on technology and cyber risk contains, and the questions directors should ask when it falls short.
11:30 AM - 12:30 PM
Change, Testing and Third Parties
Change management as a control, the cyber security assessment required before any system is deployed, penetration testing before new critical systems go live, and managing third-party and cloud service providers. Building these gates into release processes without stalling delivery.
12:30 PM - 1:30 PM
Lunch
1:30 PM - 2:20 PM
Incidents and Near-Miss Reporting
Incident management and notification to the SC, what counts as a near-miss event and how to report it, client communication, evidence preservation, and how SC reporting interacts with PDPA breach notification.
2:20 PM - 3:15 PM
Technology Audits, Independent Reviews and AI
Technology audit expectations, preparing for an independent review appointed by the SC, and applying the guidance on ethical use of AI and machine learning to trading, advice, surveillance and client-facing tools.
3:15 PM - 3:30 PM
Break
3:30 PM - 4:45 PM
Board-Level Tabletop Exercise
A simulated incident unfolding during market hours. Participants make the calls that sit with the board and senior management, including when to report to the SC, what to tell clients and what to hold, then debrief against the guidelines.
4:45 PM - 5:00 PM
Wrap-Up and Q&A
Key takeaways, next steps, and close.
Key Outcomes
- Explain how the Guidelines on Technology Risk Management replaced the 2016 cyber risk guidelines and what the 2024 revision added
- State what the SC expects the board and senior management to own in technology and cyber risk
- Build pre-deployment security assessments and penetration testing of critical systems into change processes
- Recognise and report near-miss events and incidents to the SC
- Prepare for a technology audit or an SC-appointed independent review
- Apply the SC's guidance on ethical AI and machine learning use
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Level Awareness, for board and senior management. Suitable for directors, senior management, compliance, risk and technology leads at SC-regulated entities. No technical background assumed.
Duration 1 Day (8 Hours) | 9:00 AM to 5:00 PM
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Facilitated board-level tabletop exercise and debrief, plus a written knowledge check
Certificate Certificate of Completion issued to all participants upon full attendance