Reserve Bank concerned about ASX’s technology, cyber risks and overall risk management

The Reserve Bank has revealed its concerns about the risk culture of the ASX, which ‘lags other financial institutions’.

The Reserve Bank says market operator ASX has more to do to address key concerns around technology and cyber risks.

Australian Securities Exchange chief executive Helen Lofthouse says more time is needed to address the Reserve Bank’s concerns around its technology, cyber and operational risks, just days after new laws governing the country’s sharemarket cleared the Senate.

The central bank on Wednesday released its 2024 assessment of the ASX Clearing and Settlement (CS) Facilities, revealing shortfalls in the market operator’s governance and risk management.

Three of the bank’s 22 Financial Stability Standards were only “partly observed”.

The report found the ASX’s overall risk culture “lags that of major financial institutions”.

“The RBA is concerned about the responsiveness of ASX’s risk management priorities to the evolution of key risks. ASX also does not have an orderly wind-down plan,” it said.

On operational risk management practices, it found a “fundamental uplift” was required.

The ASX’s regulatory reporting also needed to be delivered “in a more timely, transparent and complete way” and the bank said it would closely supervise management of these priorities in the period ahead.

The RBA noted changes to ASX changes to board reporting and Internal Audit process, but said more time was needed to measure the results.

“ASX also needs to maintain focus on facilitating constructive stakeholder engagement during the next phase of CHESS Replacement and other projects to upgrade clearing systems,” it said.

“Significant further work is required to ensure the bank’s key areas of concern are addressed. It is critical that the multiple large-scale technology projects currently underway, including CHESS Replacement, are managed in a way that supports stability of the financial system.”

This year’s assessment contains 29 recommendations in total, of which 11 were new. The 2023 Assessment contained 41 recommendations in total, of which 27 were new.

Ms Lofthouse said that the ASX was still in the middle of that turn around and recognised that the downgrades in this year’s Assessment meant additional focus was required.

ASX chief Helen Lofthouse says more time is needed to address the concerns of the RBA. Picture: John Feder

“ASX is committed to implementing all the recommendations and we must ensure we are addressing any underlying issues, and considering these matters holistically as we make improvements. We’re highly cognisant of the importance of strengthening our risk culture and overall framework for managing risk.”

The scathing assessment came as the financial market infrastructure bill, aimed squarely at the ASX, passed the Senate earlier this month and introduces a string of new powers for the Australian Securities & Investments Commission and the RBA in the wake of a string of scandals and market outages at the nation’s biggest sharemarket.

The bill introduces a crisis management and resolution regime for clearing and settlement (CS) facilities, following the ASX’s failed replacement of its clearing, settlement, and depositories CHESS system. The new laws swap some powers over financial markets between ASIC and the RBA, which act as co-regulators for the ASX.

During the RBA’s assessment period, the ASX has made changes in key areas such as lifting capability in internal audit, increasing stakeholder engagement on CHESS replacement, uplifting board reporting, establishing and progressing the technology remediation road map, as well as closing several key actions related to the current CHESS system.

Ms Lofthouse said while the RBA has acknowledged this progress, more time was needed to confirm the changes are having the desired impact.

“There is still work to do to transform ASX, and I look forward to further engaging with the RBA on this year’s Assessment to ensure we are moving promptly and prioritising the right actions as part of a fulsome response plan,” he said.

ASIC started Federal Court proceedings against ASX last month as it said there was a “collective failure” by the ASX board and executives in February 2022 when it told investors its CHESS replacement project was “on track for go live” in April 2023.

It’s understood that if the legal case is successful the maximum penalty is $555m.

Recommendations by the RBA to ASX include placing a high priority on remediating ageing technology assets, reducing the complexity of vendor management frameworks and ensuring that appropriate controls and processes are in place for all key vendors supporting the CS facilities.

It also wants an independent review of its internal strategy completed to address the “overall heightened level of risk”.