Regulations governing the activities of financial services providers in Asia, Japan and the Pacific stem from national laws, international standards, and frameworks established by regional corporations. This creates a dynamic environment for providers operating in multiple countries, as they must achieve compliance with the unique laws in each jurisdiction.
The following are some of the main regulations, frameworks, and government agencies that touch IAM and digital identity in the APJ region.
Consumer Data Right (CDR)
The Consumer Data Right (CDR) is a legislative, regulatory, and standards framework for consumer data portability in Australia.
It allows consumers to securely share their personal information with trusted third-party providers (TPPs) in banking and energy, or Data Recipients. The purpose of the CDR is to provide convenience and better services for consumers. It gives individuals more control over when and how they share their personal data, helping them receive better offers and personalized services customized to their identities.
The Australian Treasury leads the CDR policy and program delivery. It also works closely with the Office of the Australian Information Commissioner (OAIC) and the Australian Competition and Consumer Commission (ACCC) for enforcement and compliance of the policy.
The CDR policy is obligatory for Australian banks and energy retailers with more than 10,000 customers, which are considered Data Holders. Consumers can opt into the framework, and Data Recipients can participate by getting accredited by the ACCC.
When consumers visit an accredited Data Recipient’s website or application, they can consent to share their data with them. The consumer will then be prompted to verify their identity with the current Data Holder. Upon successful authentication, their data is securely made available to the Data Recipient via financial-grade API (FAPI). Data Recipients must offer users a summary of the data they’ve consented to share and allow them to withdraw this permission at any time.
Risk Management in Technology (RMiT)
Risk Management in Technology (RMiT) is a policy released by the Bank Negara Malaysia (BNM), which also oversees its enforcement. The policy went into effect in January 2020. RMiT outlines the minimum regulatory standards financial service providers in Malaysia must meet regarding technology risk management.
The policy aims to encourage public confidence in the country's financial services and mitigate the risk of cybersecurity threats that could allow unauthorized access to consumer data.
RMiT applies to licensed banks, insurers, electronic money issuers, and payment system operators in Malaysia, among others. These providers must take the appropriate measures to keep customer information and IT systems secure, continuously assess their risk profiles, and implement dedicated programs for combatting cybersecurity risks.
The BNM released an RMiT policy document in June 2023, providing further guidance and updates to the regulation. The document clarifies requirements and provides recommendations for access controls, password policies, and authentication mechanisms to prevent system vulnerabilities.
Data Transfer Rules
The Asia-Pacific Economic Cooperation (APEC) has a few systems in place relating to privacy protection of data transfers between different countries in the region. This includes the APEC Cross-Border Privacy Rules (CBPR) and the Privacy Recognition for Processors (PRP), which require participating businesses to abide by certain data privacy policies across jurisdictions.
However, an update to this framework is currently underway. Referred to as the Global Cross-Border Privacy Rules (CBPR) Framework, it will include countries outside of the APEC region, such as the United States, Canada, Mexico, and the United Kingdom.
The basis for the new framework is that the Internet has supported unprecedented connectivity between providers and consumers around the world, resulting in the necessary sharing of data across borders. The framework hopes to enable seamless cross-border data transfers to support commerce while upholding consumer data privacy to build trust in digital transactions.
Among other requirements, the Global CBPR Framework requires participating Members to implement reasonable security safeguards to protect data privacy and prevent its misuse. They must also clearly state the type of data they’re collecting and for what purpose and give consumers the choice to opt out of certain data collection and transfers.
National Digital ID (NDI)
The National Digital ID (NDI) in Singapore helps consumers and businesses more easily transact with the federal government and privately owned businesses.
Singpass is the national digital identity scheme that was released in 2003 as part of the NDI initiative. Today, users can manage their digital identity and securely access online services by logging into the app. Specifically for financial services, the Singpass app supports one-tap access to Internet banking services and managing insurance policies, among other use cases.
To use the app, consumers must verify their identities using biometric authentication, a six-digit PIN, or multi-factor authentication. This helps to keep their private data secure and supports a passwordless environment.
Singpass also makes it more convenient to sign up for new services. Consumers can enter their personal information into the app once. Then, they can provide consent to digital and in-person service providers to retrieve the personal data required to fill out forms or paperwork.
Businesses like financial service providers can also use the app as an authentication gateway for customers. This prevents consumers from needing to remember individual credentials for each service provider, supporting a more seamless customer experience.
Personal Data Protection Act (PDPA)
The Personal Data Protection Act (PDPA) 2012 is a Singapore law that governs the collection and use of consumer information. This is the first piece of legislation of its kind in the country. The Act recognizes providers’ need to access and share personal data while also protecting individuals’ right to privacy.
Under the PDPA, companies must obtain consent from individuals to collect, use, or disclose their data. Consumers have the right to withdraw their consent at any time. Companies should also only collect and use data that a reasonable person would consider appropriate. In addition, providers need to employ security mechanisms to prevent unauthorized access to personal data.
Recent amendments took effect in 2021 and 2022, which updated requirements of the Act to include consumer notification of a data breach and increased financial penalties for noncompliance.
Another amendment surrounding data portability has yet to come into effect. However, it will require organizations to transfer any data specified by the consumer to the appropriate receiving organization.
