Cybersecurity Regulation in Singapore’s Financial Sector: Protecting FinTech ‘ants’ in a Jungle Full of ‘Elephants’

Abstract

The financial services sector is a prime target for cyber attackers: for four years in a row, it has been the single most attacked industry globally. It is thus only logical that Singapore’s regulators have identified cybersecurity as the ‘first priority’ on the way towards a Smart Financial Centre and developed bespoke cybersecurity rules. This paper analyses the implications of Singapore’s cybersecurity regulation for domestic FinTech firms and the impact of prospective international legal harmonisation in cyberspace. It argues that the increasing complexity and interconnectedness of the financial services ecosystem increases the risks of contagion and creates new entry points for cyber-attackers. This calls for additional measures to ensure cybersecurity of smaller and less sophisticated parties – FinTech innovators that may lack the resources and expertise to competently implement the ‘default’ cybersecurity rules and fend off advanced cyber-attacks. Internationally, Singapore is in an excellent spot to lead by example in the Asia-Pacific region, through developing and implementing novel regulatory approaches to cybersecurity – but true international harmonisation in this area remains only a distant possibility.