SEBON's New IT Policy Enforced: Stricter Rules on Algorithmic Trading and Cybersecurity
The Securities Board of Nepal (SEBON) has implemented the 'Information Technology Policy, 2083', which sets strict standards for cybersecurity, data localization, and algorithmic trading for capital market institutions. The new policy mandates an ISO/IEC 27001-based Information Security Management System, annual audits, a 24-hour monitoring center, and data storage within Nepal. Additionally, AI and machine learning-based trading require human oversight and regulatory approval.
The Securities Board of Nepal (SEBON) has implemented the 'Information Technology Policy, 2083'. The Board stated that the policy was enforced with the objective of making the securities and commodity exchange market modern, technology-friendly, and secure.
As the use of artificial intelligence (AI), big data, and financial technology (fintech) has increased in the capital market, the Board introduced the new policy, repealing the previously enforced 'Information Technology Policy, 2076'. The new policy has made the provisions related to information technology systems, cybersecurity, risk management, and data protection of market infrastructure institutions, securities dealers, and other stakeholders more organized and stringent. Under this, institutions including the Nepal Stock Exchange (NEPSE), CDS and Clearing Limited (CDSC), clearing houses, securities brokers, and merchant bankers must operate their information technology systems in accordance with the standards specified in the policy.
The new policy has given special priority to the cybersecurity systems of capital market institutions. Market infrastructure institutions are required to mandatorily implement an Information Security Management System (ISMS) based on the international standard ISO/IEC 27001.
- Market infrastructure institutions must conduct audits of their information technology systems every year, and other participating institutions every two years.
- If serious weaknesses are found during the audit, the concerned institution must rectify them within 30 days and submit a report to the Board.
- Regular vulnerability assessment and penetration testing (VAPT) of sensitive information technology systems must be conducted.
- To identify and control cyber attacks and other security risks in a timely manner, institutions must establish their own Security Operations Center (SOC) for 24-hour monitoring or obtain services through a Managed Security Service Provider (MSSP).
Capital Market Data Must Be Stored Within Nepal
Another important provision of the new policy relates to data storage. To securely keep data and records related to the securities and commodity exchange market, data storage within Nepal has been mandated. This is called Data Localization. In addition, a policy has been adopted to establish and develop a Central Data Bank to systematically collect, protect, and utilize data related to the capital market. This is expected to make the availability, security, and management of market-related data more effective.
Algorithmic Trading to Be Brought Under Regulation
To organize the use of new technology in the capital market, the policy also covers artificial intelligence (AI), machine learning (ML), fintech, and algorithmic trading. A Regulatory Sandbox will be arranged to facilitate the testing and use of new financial technologies and services. Under this, new technology-based financial services and tools can be tested under regulatory supervision.
Similarly, prior approval from the concerned market operator must be obtained before using an algorithmic trading system. The policy also includes provisions that human oversight must be mandatory when using AI and machine learning in market regulation and trading, and the decision-making process of AI must be explainable. This aims to make technology-based trading and decision-making processes transparent and accountable.
The new policy has prioritized the use of digital signatures to make trading and regulatory processes in the securities market more digital and secure. Priority will be given to the use of digital signatures in agreements between investors and securities brokers, customer identification details (KYC), financial statements, and regulatory documents submitted to the Board. In some cases, its use has been made mandatory.
Similarly, Multi-Factor Authentication (MFA) has been made mandatory to prevent unauthorized access to sensitive information and trading systems. This is expected to ensure user identity and reduce the risk of unauthorized individuals accessing the system.
In the event of a serious cyber incident that directly affects market operations, the concerned institution must inform the Securities Board of Nepal on the same day. The policy also has provisions requiring information about other significant cyber and information technology-related incidents to be provided to the Board within the specified time.