On 16 Apr 2025, the HKMA issued guidance reinforcing existing cyber risk management expectations for Authorized Institutions, emphasizing proactive measures against DDoS attacks through enhanced network effect awareness, multi-layered defense strategies, and calibrated incident response protocols. The guidance builds on the 2022 anti-DDoS circular and leverages the upgraded Cyber Intelligence Sharing Platform to foster sector-wide resilience.
This article was generated using SAMS, an AI technology by Timothy Loh LLP.
Opening Bank Accounts: Duties of Banks in Hong Kong to Combat Tax Evasion
Hong Kong money laundering laws require banks to assess the risk of tax evasion in evaluating bank account opening applications. Prospective customers applying
Opening a Bank Account in Hong Kong: Latest Regulatory Developments
For many new businesses, opening a bank account is a mission critical task. Unfortunately, as a result of significant growth in laws intended to combat money l
SPOTLIGHT ON
FAMILY OFFICES
Introduction and Context
On 16 Apr 2025, the Hong Kong Monetary Authority (HKMA) issued guidance to Authorized Institutions (AIs) on strengthening protection against Distributed Denial-of-Service (DDoS) attacks, building upon existing requirements in the Supervisory Policy Manual (SPM) module TM-C-1 and the 2022 circular on anti-DDoS protection. The guidance addresses key lessons from recent global and local DDoS incidents to enhance sector-wide cyber resilience.
Key Observations and Recommendations
The HKMA highlighted three critical areas requiring AIs' attention: (1) Network effects from group office infrastructure dependencies necessitate AIs to actively engage group entities in incident response, ensuring local management oversees impact assessments and customer communications during group-level DDoS containment; (2) Evolving DDoS techniques (volumetric, protocol, application-layer attacks) demand AIs to critically review defense robustness and adopt multi-layered defensive strategies; (3) Incident response appropriateness requires AIs to calibrate handling processes, including periodic technical simulations to validate anti-DDoS configurations and avoid amplifying incident impacts through misconfigurations or inappropriate customer messaging.
Supporting Initiatives and Next Steps
The HKMA reiterated the importance of leveraging the enhanced Cyber Intelligence Sharing Platform (CISP), which now includes formal threat intelligence sharing guidelines, a verbal intelligence forum, and cross-sector (banking, insurance, capital markets) platform integration. AIs are encouraged to actively monitor threats and share intelligence via CISP to strengthen collective cyber resilience. The HKMA will continue monitoring cyber trends and providing further guidance as needed.
View the full article:Source
