Cybersecurity
Q1 : How should a Platform Operator prepare a suitable backup facility which will enable it to continue providing its trading services or alternative arrangements for order execution in the event of an emergency?
(Key references: Paragraph 12.18(b) of the VATP Guidelines)
Q2 : How quickly should a Platform Operator rectify the situation or restore its service in the event of material system failure and ensure data integrity after system recovery?
A Platform Operator is expected to restore its trading and custody services (including fully activating its contingency plan where necessary) as soon as possible and, in any case, no later than 12 hours after the occurrence of the failure. If the Platform Operator provides service to retail clients directly or indirectly (eg, through other licensed corporations), the restoration time should be shorter.
In addition, there should be proper data backup to ensure that the Platform Operator has an accurate record of client virtual assets held for each client. Transaction and client virtual asset data (eg, snapshots of critical databases) should be readily accessible to recover the production system to its latest state. As such, in addition to the daily offline backup, there should be instantaneous backup of transaction and client virtual asset data as soon as they are generated (eg, through the adoption of real-time data mirroring technology) to ensure prompt data recovery when necessary.
(Key references: Paragraphs 12.17 and 12.20 of the VATP Guidelines)
Last update: 31 May 2023