Duty LXD-6994
Provides financial services, in Singapore
Quoine Pte Ltd v B2C2 Ltdsince 4 lines
[2020] SGCA(I) 02
- Treat a contract concluded between two automated systems as binding from the moment one system's offer is accepted by the other, even if neither party knew beforehand that it would be made or on what terms: the Court of Appeal so held for algorithmic trading on a cryptocurrency exchange.
- Be ready to show the state of mind of your programmers when they programmed the software: the majority held that, for contracts made by deterministic algorithms, knowledge of a counterparty's mistake and any unconscionable taking advantage of it is judged by the programmers' state of mind.
- Do not keep an algorithm running to take advantage of a mistake you have learned of before the contract is formed: the majority held that the inquiry into the knowledge of a programmer or the person running the algorithm extends from the point of programming to the point the contract is formed, so later knowledge counts.
- Do not cancel completed automated trades unless your contractual documents, express or implied, entitle you to: the Court held that none entitled the exchange operator unilaterally to cancel the disputed trades.
MAS Notice FSM-N05, Technology Risk Management Requirements for Bankssince 4 lines
Monetary Authority of Singapore Notice FSM-N05 on Technology Risk Management, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 5, 6 and 9 · Read the law's page
- Applies to every bank in Singapore, that is a locally incorporated or branch full bank or wholesale bank; reached by declaring that you are a bank.
- Make all reasonable effort to keep critical systems highly available, with no more than 4 hours of unscheduled downtime in total for each critical system in any 12 months (paragraph 5).
- Set a recovery time objective of no more than 4 hours for each critical system, and validate and document at least once every 12 months how you test recovery and when the objective is validated (paragraph 6).
- Implement IT controls to protect customer information from unauthorised access or disclosure (paragraph 9).
MAS Notice FSM-N05, Report of Relevant Incidents by Bankssince 3 lines
Monetary Authority of Singapore Notice FSM-N05 on Technology Risk Management, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 7 and 8 · Read the law's page
- Applies to every bank in Singapore, that is a locally incorporated or branch full bank or wholesale bank; reached by declaring that you are a bank.
- Notify the Monetary Authority of Singapore as soon as possible, and not later than 1 hour, after you discover a relevant incident (paragraph 7).
- Submit a root cause and impact analysis report within 14 days of discovering the relevant incident, or any longer period the Authority allows, covering an executive summary, the root cause, the impact on compliance, operations and customers, and the remedial measures taken (paragraph 8).
MAS Notice FSM-N06, Cyber Hygiene Requirements for Bankssince 6 lines
Monetary Authority of Singapore Notice FSM-N06 on Cyber Hygiene, issued under section 29(1) of the Financial Services and Markets Act 2022, paras. 4.1 to 4.6 · Read the law's page
- Applies to every bank in Singapore, that is a locally incorporated or branch full bank or wholesale bank; reached by declaring that you are a bank.
- Secure every administrative account on an operating system, database, application, security appliance or network device to prevent unauthorised access or use (paragraph 4.1).
- Apply security patches to every system within a timeframe commensurate with the risk of each vulnerability, and where no patch exists put controls in place to reduce the risk (paragraph 4.2).
- Keep a written set of security standards for every system, make each system conform to it or add risk-reducing controls, restrict unauthorised network traffic at the network perimeter, and run malware protection on every system where it is available (paragraphs 4.3 to 4.5).
- Implement multi-factor authentication for administrative accounts on critical systems and for all accounts on any system used to access customer information through the internet (paragraph 4.6).
- You need not comply to the extent you cannot control a system directly or indirectly through its provider and it is not reasonable to switch to a provider you could control (paragraph 3.1).