The Securities and Exchange Commission (SEC) is offering guidelines that will allow capital market investors to do virtually everything they need to do on their internet-connected devices and at their convenience. These are contained in a guideline on Minimum Information Technology Operating Standards for Capital Markets Operators (CMOS) recently released to the public.
According to the SEC, the new regulatory framework being revised aims to impose the mandatory adoption of information and communication technologies (ICTs), in particular web-based applications and devices, for virtual transactions on the capital market.
The provisions of the document apply to all categories of CMOs, except in sections where reference is otherwise made to specific categories of CMOs. The objective of the guidelines is to establish a threshold of operational efficiency in the Nigerian capital market through the effective adoption of information technology to conduct business operations and ensure security, confidentiality, integrity and the reliability of information systems.
A draft copy of the framework indicates that the new framework, once approved, will apply to all capital markets operations, with particular emphasis on investor-facing functions such as securities trading, fund management, share registration and clearing and custody services, among others. .
The new rules require all capital market operators to have a well-secured and functioning website as well as a functioning email system, hosted privately or using a cloud service provider, with a domain name owned and registered by the capital market operator. Once the rules come into force, the use of free email providers and private email providers like Yahoomail, Gmail and Hotmail, among others, will become unacceptable for official transactions.
Also Read: Market Gains Over N520 Billion in Bullish Start to Week
Under the proposed framework, stockbrokers will be “required to have websites and web applications that allow investors to securely create and manage their stock accounts online, ask questions, and receive customer support using chat-bots or other interactive programs from web browsers”. As the largest and most important business group, digitization of brokerage operations is expected to improve market accessibility for retail investors and drive market penetration and inclusion.
According to the guidelines, “All CMOs are required to have a functioning website, websites must contain correct, current and relevant information, websites must not display errors or system messages revealing information on the underlying configuration of web applications, websites must use the network protocol HTTPS (not just HTTP) and other measures to ensure secure interoperability, adequate security measures must be in place to ensure protection against availability attacks (especially denial of service attacks), integrity attacks and confidentiality attacks as well as attacks regular audits and vulnerability tests must be carried out to identify and correct vulnerabilities in the systems underlying operating systems, databases, web servers and third party software/applications”.
“Applicable system and web application updates (patches) should be regularly applied as they become available, access to databases and back-end systems should only be possible through front-end web applications and not directly from the Internet, and should grant only minimal privileges to databases and back-end systems, websites that allow file downloads should check file types and scan for malicious code. Website must be wholly domiciled in the CMO and not a third party and the development, hosting and maintenance of the Websites may involve third parties, in which case all applicable requirements set forth herein to ensure availability, confidentiality and integrity of the website must be included as mandatory elements of the terms of the contract and the SLA”.
In addition, fund and asset managers, who manage the country’s burgeoning collective investment funds, will also be mandated to “have websites and web applications that allow investors to securely create and manage security of online investment accounts, to make inquiries using chat-bots or other interactive programs from Internet browsers”.
Fund and asset managers are also “required to have mobile apps that provide free access to their entire service offering and allow retail investors to securely create and manage investment accounts. investing online, ask questions and receive integrated customer support”.
In a major move that could finally close the gap that fuels unclaimed dividends, all registrars, central securities depositories and clearing houses will now be required to digitize their operations, as a regulatory requirement rather than a as an optional service.
The directive also states that all central securities depositories and clearing houses must have databases integrated with APIs that registrars and brokers can populate based on SEC approval, while all registrars, central securities depositories and clearing houses are required to have websites and web applications that allow investors to securely create and manage their online profiles, ask questions and receive customer support at using chat-bots or other interactive programs from web browsers.
Additionally, custodians and trustees are required to have websites and web applications that allow their customers to securely create and manage their online accounts, make inquiries and receive customer support. using chat-bots or other interactive programs from their web browsers.
While securities exchanges had made autonomous efforts to automate their systems, the new rules require all exchanges, including stock, debt, derivatives and commodities exchanges, to “have secure trading with robust features that include real-time quotes, charting tools, news feeds, trade monitoring and premium research”. All exchanges are also required to “have a monitoring system that provides live tracking real time of all trading activities”.
According to the SEC, the objective of the new framework “is to establish a threshold of operational efficiency in the Nigerian capital market through the effective adoption of information technology to conduct business operations and provide security, confidentiality, integrity and reliability of information systems.
The SEC noted that given the increased reliance of financial services and related business operations on technology, there is an urgent need to put in place rules defining minimum operating standards for the use of IT technologies. information by all capital market operators.
“This will help operators harness the huge operational benefits that come from adopting the technology and also manage the cybersecurity threats and other risks that come with using the technology. It would also have a positive impact on the effectiveness and efficiency of the Commission to oversee and regulate all capital market operators in the market,” the SEC said.
