Draft Regulation on Capital Market IT Governance: 8-Hour Initial Cyber Incident Notification and Mandatory Domestic Data Center Localization

The Financial Services Authority (Otoritas Jasa Keuangan– “ OJK ”) is currently preparing a Draft Regulation on the Implementation of Information Technology (“ IT ”) in the Capital Market, Financial Derivatives, and Carbon Exchange Sectors (“ Draft Regulation ”). The Draft Regulation requires all financial sector business actors (Pelaku Usaha Sektor Keuangan– “ PUSK ”) connected to trading systems to implement comprehensive information technology governance, risk management, and cybersecurity resilience frameworks. [1]