meta_id 3603230

On October 15, 2026, the Hong Kong Monetary Authority (HKMA) published a Sectoral Code of Practice pursuant to the Protection of Critical Infrastructures (Computer Systems) Ordinance for retail payment system infrastructure operators designated as Critical Infrastructure (CI) operators. The Code provides practical guidance on how designated retail payment system infrastructure operators (Designated RPSIs) comply with category 1 and category 2 obligations under the Ordinance. The Code establishes baseline security requirements for protecting critical computer systems (CCSs) of Designated RPSIs. Key obligations include maintaining an office in Hong Kong; notifying the HKMA of operator changes and material changes to computer systems; establishing and maintaining a computer-system security management unit; submitting and implementing a computer-system security management plan; conducting computer-system security risk assessments; and arranging computer-system security audits. The security management plan must be endorsed by the Board of Directors or senior management and reviewed at least every two years. Designated RPSIs must implement controls across multiple domains including access control, privileged access management, cryptography, physical security, configuration management, patch management, remote connection security, backup and recovery, network security, application security, log management, cloud computing security, and supply chain management. The Code references the Cyber Resilience Assessment Framework (C-RAF) for relevant control principles and maturity assessment guidance. Risk assessments must include vulnerability assessments and penetration testing conducted by qualified security professionals. Computer-system security audits must assess implementation of the management plan and compliance of security controls. The HKMA may issue written directions requiring appropriate actions if non-compliance or defective compliance occurs; failure to comply with such directions constitutes an offence. The Code is not subsidiary legislation, and failure to comply with its provisions does not itself constitute an offence. However, the HKMA may review and amend requirements according to technological developments and industry best practices. Designated RPSIs should apply enhanced security measures commensurate with their circumstances and computer-system security risks.