HKMA Issues New Guidance on Adoption of Cloud-based Regtech Solutions

The HKMA (Hong Kong Monetary Authority) has recently issued new guidance on the adoption of cloud-based regtech solutions. According to the HKMA, banks that were open to using cloud-based technology displayed greater operational resilience during the Covid-19 pandemic.

BrokerShow Virtual Expo·Malaysia Special Coverage — Know the dynamics of expo and view the leadership insights​

However, the HKMA notes, many banks still possess legacy systems that are “tightly coupled to existing infrastructure and inflexible to changes”.  Such systems present a barrier to adoption of cloud-based solutions. Therefore, the HKMA offers guidance on the use of APIs to create an abstraction layer between a legacy system and a regtech solution. The new practice guide outlines the benefits of using cloud-based regtech solutions in the banking sector, including enhanced geographical mobility, reduced IT costs, and improved operational effectiveness.

The guidance sets out four elements for banks looking to ensure readiness for the adoption of cloud-based regtech solutions. These include defining a cloud strategy, establishing a governance committee, assigning cloud responsibility and putting in place a cloud assessment framework.

When a bank is ready to adopt a cloud-based regtech solution, it should evaluate areas including business requirements, different approaches, and security and privacy standards, and perform due diligence on the tools and vendors to choose the most suitable solution based on a risk-based and value-driven approach.

When implementing cloud-based regtech solutions, banks should also consider adopting an API methodology, introducing flexibility in their architecture designs, and putting in place continuous monitoring of cloud activities, the HKMA says.

Guidance is also provided on the commonly seen cloud-based regtech solutions, the organisational value drivers that lead to adoption, and contractual considerations that could impact banks’ direct control and visibility into security, availability, and confidentiality elements of cloud-based solutions.