Report of the Council of Experts on
FinTech in Financial Institutions

June 2017
The Center for Financial Industry Information Systems

Table of contents
Introduction .................................................................................................................. 1
I.

Consideration of security measures related to FinTech ......................................... 2
1. Steps employed in consideration ...................................................................................... 2
2. Guidelines for identification of information systems subject to the Security Guidelines 2
3. Handling of technologies etc. related to FinTech used in critical information systems ... 3
4. Assumptions in consideration of ideal forms of security measures related to FinTech.... 4(1) The appearance of FinTech firms as new related parties in implementing security
measures ...................................................................................................................... 4(2) The appearance of business forms in which Financial Institutions would notnecessarily occupy positions of leadership ................................................................. 4(3) Types of FinTech operations ....................................................................................... 7(4) Perspectives that should be considered in examining security measures in FinTech
operations .................................................................................................................... 7(5) Relationship to open APIs ........................................................................................... 8

II. Topics in application of FinTech-related the Security Guidelines and ideal forms of
security measures ............................................................................................... 10
1. Matters that it would be beneficial to clarify in advance in consideration of topics ...... 10(1) Effects of security measures that should be targeted ................................................ 10(2) Domains subject to consideration in the Security Guidelines ................................... 10(3) Nature of simplified risk management measures .......................................................11(4) Handling of the Security Guidelines related to use of cloud services ........................11
2. Duties of related parties under existing the Security Guidelines .................................... 13(1) Duties of related parties ............................................................................................ 13(2) Approaches to inherent issues ................................................................................... 15
3. Issues inherent under Type I and the ideal form of security measures ........................... 16
4. Issues inherent to Type III and the ideal forms of security measures ............................. 17(1) Financial Institutions’ responsibilities under security measures ............................... 17(2) Responsibility for security measures remaining with FinTech firms ........................ 19(3) Handling of cases in which Financial Institutions do not bear responsibility........... 19
5. Cooperation among related parties ................................................................................. 20
6. Supplementary consideration based on the properties of Type II ................................... 21(1) Properties of Type II .................................................................................................. 21(2) Supplemental information ......................................................................................... 21
7. Treatment of information systems handling FinTech operations in terms of security
measures.......................................................................................................................... 23iIII. Handling of FinTech operations not subject to the Security Guidelines ............... 24
1. Handling of traditional subjects of the Security Guidelines ........................................... 24
2. Courses of action on handling of FinTech operations not subject to the Security
Guidelines ....................................................................................................................... 25(1) Courses of action on handling of category B ............................................................ 26(2) Courses of action on handling of categories C and D ............................................... 26
3. Statement of opinion on security measures in FinTech operations................................. 28
4. FISC’s role in working toward formation of socially agreed-upon rules ....................... 29
IV. Supplemental consideration of risk-management measures when using cloudservices ............................................................................................................... 31
1. Perspectives of supplemental consideration ................................................................... 31(1) Reflecting conditions after formulation of the Cloud Guidelines ............................. 31(2) Trends among other developed countries .................................................................. 31
2. Properties specific to cloud services ............................................................................... 32(1) Anonymous joint use................................................................................................. 33(2) Broad range of information processing ..................................................................... 34(3) Technical advancement ............................................................................................. 34
3. Thinking on controls for outsourcees handling critical information systems ................. 35
4. Supplemental consideration of risk-management measures ........................................... 36(1) Ascertaining Cloud facilities subject to controls ...................................................... 36(2) Clear description of auditing authority etc. ............................................................... 37(3) Implementing audits .................................................................................................. 37(4) Assignment of auditors and other monitoring staff ................................................... 37(5) Points to note when implementing objective evaluation ........................................... 37
V. Ideal form of security measures for open APIs based on collective consideration............................................................................................................................ 38
1. Control-related issues in open APIs ................................................................................ 38
2. Ideal form of security measures in open APIs ................................................................ 38
VI. Thinking on future revisions to the Security Guidelines etc. ................................ 40
1. Adoption of the basic principles of security measures ................................................... 40
2. Clarification of the Security Guidelines ......................................................................... 40(1) Clarification of the subjects of the Security Guidelines............................................ 40(2) Clarification of the definitions and positioning of the high Security Guidelines andminimum necessary Security Guidelines .................................................................. 40(3) Clarification of the positioning of technical guidelines ............................................ 40ii

3. Enhancement of external control guidelines ................................................................... 40(1) Reflecting shifts in the focus of controls ................................................................... 40(2) Consolidation of control guidelines in light of diverse forms................................... 41
Conclusions ............................................................................................................... 42
List of Members and Observers of the Council of Experts on FinTech in Financial Institutions........................................................................................................................................... 44VII. References .......................................................................................................... 47
Reference 1.

FinTech-related trends among Banking and Related Financial Institutions 48

1.

Trends among domestic Financial Institutions .......................................................... 48

2.

Sample definitions of FinTech from regulators and others ....................................... 49

3.

Trends among Japanese regulators and others .......................................................... 50

4.

Trends in other developed countries ......................................................................... 53

Reference 2.

Procedures for application of the Security Guidelines ............................... 55

Reference 3.

Thinking on types of FinTech operations ................................................... 56

1.

Types of FinTech operations subject to consideration .............................................. 56

2.

Basic patterns of related parties when implementing security measures in FinTech
operations .................................................................................................................. 56

3.

Patterns of FinTech operations by type ..................................................................... 59

Reference 4.

Overview of existing Security Guidelines (related to outsourcing) ............ 60

Reference 5.

Thinking on the principle of equivalency ................................................... 77

1.

Processes through implementation of security measures in accordance with the basic
principles thereof ....................................................................................................... 77

2.

Allocation of duties related to security measures in FinTech operations and theprinciple of equivalency ............................................................................................ 78

Reference 6. Prospectus on establishment of the Financial Mechanization Foundation(tentative name) (excerpted) ...................................................................................... 80
Reference 7.

Cloud usage ................................................................................................. 81

Reference 8.

Trends among overseas regulators regarding use of cloud services ........... 82

1.

Basic thinking on risk management in cloud services .............................................. 82

2.

Thinking on controls ................................................................................................. 82

3.

Thinking on auditing authority.................................................................................. 83

4.

Thinking on locations of data storage ....................................................................... 84

5.

Thinking on advanced nature of technology ............................................................. 84

6.

Thinking on business continuity planning ................................................................ 85

7.

Other matters ............................................................................................................. 85

Reference 9.

Collective consideration of the checklist used in API connection .............. 86

Reference 10. Topics addressed by the Council and countermeasures against them ........ 87iii

Introduction
In recent years, efforts to deliver innovative financial services through use of information
technology (IT), referred to generally as FinTech, have been advancing rapidly among
Financial Institutions, industry organizations, regulators, and others. (See References,
Reference 1)
Amid expectations that FinTech will see widespread use in the future as a result of theadvancement of such efforts, the Center for Financial Industry Information Systems (“FISC”
hereinafter) is expected to consider in advance the ideal forms of security measures related to
FinTech, in tempo with developments among Banking and Related Financial Institutions.
Already, the FISC Council of Experts on Outsourcing in Financial Institutions (“Outsourcing
Council” hereinafter), which completed its activities in June of last year, has proposed the
new frameworks of a risk-based approach and IT governance and effected considerable
progress in thinking on security measures in financial information systems, reflecting
consideration of matters including developments in the leading Western nations.
The Council of Experts on FinTech in Financial Institutions (“FinTech Council” hereinafter)
was established to identify explicit, practical guidelines regarding the ideal form of security
measures for FinTech in Japanese Financial Institutions, based on such findings of the
Outsourcing Council.
Participants in this the Council included academic experts, Financial Institutions, IT solution
providers, and others as committee members, along with observers from regulators and others.
The Council’s deliberations were intended to enable Financial Institutions in Japan to enjoy
the maximum benefits of FinTech innovations suited to customer needs while maintaining
system security. These deliberations are summarized in this report.
Accordingly, the content of this Report is useful for reference by a wide range of parties
involved in IT governance and IT management at Financial Institutions, including not only
the system risk management sections but also top management, management, sections
responsible for systems, system auditing sections, and others. It also is hoped that it will bereferred to by not only Financial Institutions but all parties involved in financial information
systems, such as IT solution providers (including Cloud solution providers) and firms
involved in FinTech.

1

I. Consideration of security measures related to FinTech
1. Steps employed in consideration
First of all, since the operations related to financial services known generally as FinTech(“FinTech operations” hereinafter) are broad ranging, there is a need for guidelines to use indetermining whether or not the information systems handling such operations are (or shouldbe) subject to the Security Guidelines1.
Next, what kinds of additional consideration should be conducted in applying the Security
Guidelines to the information systems that handle FinTech operations subject to suchguidelines needs to be considered.
(See References, Reference 2)
If an information system handling FinTech operations qualifies as one such as an information
system with critical externalities or an information system containing sensitive information(“critical information system” hereinafter), then in accordance with the basic principles of
security measures the high Security Guidelines must be applied when setting the goals to beachieved by such security measures, from a social and public perspective. For this reason, if
they have new properties that have not been included among the assumptions of the Security
Guidelines through now, then the technologies and other aspects of FinTech used in criticalinformation systems must reflect the high Security Guidelines.
At the same time, if an information system handling FinTech operations is one other than acritical information system (“general information system” hereinafter), then a Financial
Institution employing a fully risk-based approach would be able to decide on security
measures on its own, and thus regarding such cases there is no need for any particular
additional consideration in the Council of matters such as goals to be achieved.
However, it is anticipated that at a Financial Institution employing a simplified risk-based
approach, under which the minimum necessary Security Guidelines are identified as the goals
to be achieved by security measures2, the high Security Guidelines would need to be applied
since the handling of the Security Guidelines is not defined clearly in light of the projected
appearance of wide-ranging FinTech operations in the future.
In this way, there is a need to make clear in advance the issues involved in connection withmatters such as application of the Security Guidelines with regard to FinTech and the ideal
form of security measures, after first making clear the assumptions such as matters assumed
in existing the Security Guidelines and those not necessarily envisioned by existing the
Security Guidelines, so that application of the Security Guidelines to information systems
handling FinTech operations will not be a mere formality.

2. Guidelines for identification of information systems subject to the
Security Guidelines

1

This stands for the FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions. As used here, thisrefers not only to the current Version 8 and Version 8 after additions and amendments but also includes the outcome of the FISC Report of
the Council of Experts on Outsourcing in Financial Institutions.
2With regard to the simplified risk management measures that are a precondition of minimum necessary Security Guidelines, the Council ofExperts has made recommendations based on the state of security measures in each of the cases of use of cloud services and outsourcing,and efforts have advanced to ensure that high Security Guidelines are not applied uniformly.

2Ever since the first edition of the Security Guidelines was formulated more than 30 years ago,the guidelines have applied to the “computer systems of Banking and Related Financial
Institutions”3. Computer systems of Banking and Related Financial Institutions refers to
information systems that handle financial operations, and for which the Banking and Related
Financial Institutions bear responsibility for system security. Accordingly, information
systems handling FinTech operations identified as being subject to the Security Guidelines arethose that handle FinTech operations that qualify as financial operations and for which the
Banking and Related Financial Institutions bear responsibility for system security.
Financial operations refer to operations related to the financial services that Banking andRelated Financial Institutions provide to their customers under industry laws and otherconsiderations. Accordingly, since information systems handling e-commerce operations
intended to sell products or other merchandise, even if such services are provided tocustomers, would not be considered to be information systems handling operations related tofinancial services, they would not be subject to the Security Guidelines. Also, information
systems used only within Banking and Related Financial Institutions (e.g., HR and payroll
systems or management information systems) are not subject to the Security Guidelines4.
At the same time, FinTech operations conducted by businesses other than Banking andRelated Financial Institutions solely as service users, unrelated to Banking and Related
Financial Institutions or the customers of Banking and Related Financial Institutions are notsubject to the Security Guidelines because they do not involve any responsibility on the partof Banking and Related Financial Institutions to implement security measures.

3. Handling of technologies etc. related to FinTech used in criticalinformation systems
Conceivable technologies etc. related to FinTech expected to be used in critical information
systems include block-chain technologies and AI 5 . In considering these, since it isconceivable that cases of use (use cases) of such factor technologies may be broad ranging,
there is a need to move forward with consideration while focusing on technological properties
suited to each use case. Since, indeed, under current conditions no use cases in criticalinformation systems have appeared yet, instead of considering such cases immediately, thetiming at which consideration would be feasible will be identified while observing matterssuch as the state of appearance of use cases in the future.

Since the first version of the Security Guidelines (December 1985), these have been referred to as “companies in the industry conducting
financial operations, including finance, insurance, securities, and credit.”
The first edition of the Security Guidelines stated, “These guidelines assume application to systems related to services provided by
Banking and Related Financial Institutions to their customers. For this reason, they also include portions that may be referred to regarding
guidelines for security measures for internal systems used by Banking and Related Financial Institutions.” The same thinking basicallyholds today.
5
Artificial intelligence3

43

4. Assumptions in consideration of ideal forms of security measuresrelated to FinTech(1) The appearance of FinTech firms as new related parties in implementing security
measures
Security Guidelines have been formulated with the following two parties considered relatedparties in implementing security measures in financial information systems: Financial
Institutions themselves and IT solution providers serving as outsourcees performing technicalroles in development and operation of information systems6.
However, companies handling FinTech operations involve technological properties similar to
those of IT solution providers along with business properties involving matters such asplanning of business models for financial services, and it is not necessarily the case thatexisting the Security Guidelines clearly envisioned their application to related parties
possessing such technological and business properties simultaneously7.
Accordingly, when making clear the issues inherent to application of the Security Guidelines
to FinTech operations, it would be beneficial to consider the roles related to security measuresthat should be fulfilled by newly appearing FinTech firms and other parties after firstcategorizing and sorting out the three related parties of Financial Institutions, IT solution
providers, and FinTech firms.
(2) The appearance of business forms in which Financial Institutions would notnecessarily occupy positions of leadership
The Security Guidelines have assumed that Financial Institutions would bear responsibility totheir customers for security measures for information systems handling operations related tofinancial services provided by Financial Institutions to customers. This is a natural conclusion
under conditions in which Financial Institutions take leadership in all decision-making
regarding the financial services that they provide to their customers.
At the same time, in recent years FinTech firms have arisen as intermediaries between
customers and Financial Institutions8. These include some service providers that are provided
by customers with the IDs, passwords, and other information needed to use the services ofFinancial Institutions and, as a result, provide financial-related services to customers directly
themselves after obtaining customer-related data from the Financial Institutions and adding
their own value to the data thus obtained. While based on data obtained from the Financial
Institutions, the services of such FinTech firms add elements such as innovative user
experiences unavailable from the services provided by Financial Institutions to their

In addition to “IT solution providers,” the Security Guidelines also user terms such as “vendors” and “computer makers.” This document
refers to parties of a technical nature collectively as “IT solution providers.” It also uses IT solution providers in a sense that includes“Cloud service providers.”
7
The FISC Report of the Council of Experts on Outsourcing in Financial Institutions identifies, under II. IT Governance and IT
Management: 2 (3) User Roles and Responsibilities, the following as the main roles and responsibilities of related parties having a businessnature in security measures” (i) Planning business models with consideration for security measures, (ii) Achieving results of investment,and (iii) Providing business requirements.
8
FinTech firms serving as intermediaries between customers and Financial Institutions may include, in addition to those discussed here,
those using open data such as branch locations and interest rates provide on Financial Institutions’ websites.
64

customers, and as such these services are well received by customers and their use isadvancing9.
In some cases, the services that such FinTech firms provide directly to their customers are
decided on entirely under the leadership of the FinTech firms, and they are able to obtaincustomer-related data from the Financial Institutions in a unidirectional manner without
negotiating with the Financial Institutions in any way. In such a case in which the Financial
Institution employs a fully passive stance, it is understood that the Financial Institution bears
no responsibility for security measures to its customers, since it has no means of governance.
Accordingly, it would be proper to understand such services not to be subject to the Security
Guidelines even if they are financial services provided to customers of the Financial
Institutions10.
On the other hand, there also are cases in which even though the services are provided to thecustomers directly by the FinTech firms, negotiation has taken place between the FinTech
firms and the Financial Institutions, and as a result the Financial Institutions can decide on thedata that they provide to the FinTech firms. Also, it is conceivable that in some cases the
Financial Institutions may decide which data they will receive from FinTech firms. In suchcases in which the Financial Institution has the right to decide which customer-related data11
it will provide or receive, the Financial Institution can be considered to be demonstrating
leadership, if only in part, and thus it would be proper to understand the Financial Institution
to bear some responsibility for security measures.
For these reasons, even when a Financial Institution bears only partial responsibility forsecurity measures for information systems in services provided by FinTech firms it will needto consider the ideal form of security measures, as a case subject to the Security Guidelines12.
Such partial responsibility for security measures on the part of Financial Institutions comesfrom the fact that originally the Financial Institutions are—even with their customers’
consent—providing to third parties customer-related data that they are responsible formanaging, or updating customer-related data in accordance with data received from third
parties. For this reason, they must focus on the risk properties of such data provided or
received and consider the ideal forms of security measures accordingly. In doing so, based ona risk-based approach it would be appropriate regarding data provision to focus on the degreeof sensitivity, which is one risk property of the data, in addition to the volume of data. The
degree of sensitivity refers to the degree of damages that a customer would be expected toincur in a case such as if the data were to be used by the FinTech firm beyond the extent towhich the individual concerned has consented, or were to be leaked by the FinTech firm 13.
The Financial System Council’s Financial System Working Group Report (published December 27, 2016) states, “In recent years,
increasing numbers of businesses have been engaged in settlement as entrusted by customers, by communicating settlement instructions
using IT means or obtaining or providing to customers information on accounts with Financial Institutions, as intermediaries between
Financial Institutions and customers.
10
The British Open Banking Standard (February 8, 2016) addresses “screen-scraping,” identifying as issues in unilaterally obtaining
customer-related data from Financial Institutions “Access to the host system is uncontrolled and unregulated” and “Consumers are
uncertain about the procedure and have little recourse to their bank in case something goes wrong.” It also must be noted thatscreen-scraping is not immediately identifiable as a problem and involves obtaining data without negotiating with Financial Institutions.
11
The data provided by Financial Institutions to FinTech firms may include, for example, customer transaction histories. Data that Financial
Institutions obtain from FinTech firms may include, for example, settlement instructions.
12
Under Operation 90-1, the Security Guidelines include guidelines on use of services, which differs from outsourcing, as a case in which
Financial Institutions do not play a leading role. Noting that “Financial Institutions find it difficult or inefficient to choose from multiple
service providers or conduct risk management on their own, similarly to the case of outsourcing management,” under these guidelines thedegree of responsibility borne by Financial Institutions for security measures should be understood in a more limited way than in the caseof general outsourcing. However, they cover “mutual system networks between Financial Institutions,” not the customer services
considered here.
13
The FISC Report of the Council of Experts on Outsourcing in Financial Institutions identifies as highly sensitive information personal
information for which the highest objective of security measures should be set, noting, “Since leakage of sensitive information without theconsent of the person concerned could lead not only to economic damages but also to broad-ranging damage such as infringement on
fundamental human rights, its handling has an inherent social and public nature.
95

With regard to receiving data as well, in addition to the scale of updating of data inaccordance with such data received, it would be appropriate to focus on the method by which
the FinTech firm confirms customer identity—i.e., whether it confirms properly that the data
received from the FinTech firm are based on customer instructions.
Fig. 1. Business forms in which Financial Institutions would not necessarily occupy
positions of leadership
Financial services
Provision ofcustomer-related data

Financial-related services
Customers

FinTechfirms

Receipt ofcustomer-related data

Financial
Institutions

Financial Institutions are understood to bear responsibility to theircustomers for security measures in the areas in which they havedecision-making authority (i.e., demonstrate leadership).

6

(3) Types of FinTech operations
Based on the appearance of new related parties and forms of business as outlined above, thepatterns of FinTech operations by type that should be considered the assumptions of thisexamination are as shown in Fig. 2. (See References, Reference 3)
Fig. 2. Types of related parties for security measures in FinTech operations
Type IFI

FTType II

IT

FI

FT

Type III

a

FI

IT

FT

a′

FI

IT

b

FI

IT

FT

IT

a″

FT
b′

FI

FT

FI

IT

IT

FT
c

c′

FI: Financial Institution; FT: FinTech firm; IT: IT solution provider (including Cloud solution provider)→: Full responsibility for security measures: Partial responsibility for security measures: Responsibility for subsidiaries

Type I involves three basic patterns of outsourcing relations, in each of which the Financial
Institution bears full responsibility for security measures. Type II is a derivative of Type I in
which responsibility for subsidiaries has been added. While Type III resembles Type I, in it
the Financial Institution bears only partial responsibility for security measures.
In this Report, practical consideration will be given to the presence or absence of any inherent
issues in a case in which existing the Security Guidelines are applied to the above sevenpatterns in three types.
(4) Perspectives that should be considered in examining security measures in
FinTech operations
In clearly identifying the location of issues, it would be beneficial to share in advance theperspectives from which issues will be considered.
First of all, consideration should be conducted based on the perspective stated in theCouncil’s guiding principles of “Aiming to enable Japan’s Financial Institutions to adapt tocustomer needs and enjoy the benefits of innovation to the maximum extent, while
maintaining system security.”
Then, in implementing FinTech operations, since it is expected that a wide range of types will
be deployed there is a need to take care to ensure that the effects of the Security Guidelines
will not, for example, be restricted when employing a specific type. Security Guidelines are
the basis of security measures for information systems, and that fact itself must not harm thediversity of business models that Financial Institutions may employ. If there were to be any
7strains that would have a restrictive effect on adoption of a specific type, then that would need
to be addressed as an issue (i.e., one regarding the neutrality of the Security Guidelines).
On the other hand, as long as Financial Institutions bear responsibility under security
measures then in order to fulfill this responsibility then in implementing security measures
their feasibility—that is, their ability to control outsourcees and subcontractors whenoutsourcing—needs to be secured fully. However, if there are cases in which amid the wide
range of types of FinTech operations Financial Institutions’ control capabilities as necessary
to fulfill such responsibilities under security measures do not necessarily function fully, thenthat would need to be addressed as an issue (i.e., one regarding the efficacy of the Security
Guidelines).
Next, since the above perspectives of the neutrality and efficacy of the Security Guidelines
may not necessarily be achieved together in a well-balanced way, it is conceivable that whichof these perspectives to prioritize should be considered in advance.
While prioritizing neutrality would contribute to realizing maximization of enterprise value
by enjoying the benefits of innovation without harming the diversity of business models, italso would lead to the concern that Financial Institutions might not necessarily fulfill their
responsibilities to customers under security measures. On the other hand, if prioritizing
efficacy then it would be anticipated that FinTech firms or IT solution providers would need
to bear burdens specific to their businesses, or that the freedom of their businesses could be
restricted, and as a result the innovative nature of FinTech firms could be harmed.
Since it is conceivable that this issue of a tradeoff between neutrality and efficacy could arise
under diverse conditions, it also is conceivable that it could be difficult to make a judgment inadvance on which to prioritize, leading to the need to make such judgments on a case-by-casebasis in light of individual circumstances.
Under a simplified risk-based approach in particular, probably it would be appropriate toconsider whether it would be valid to prioritize neutrality or efficacy in formulating simplified
risk-control measures and other matters after first making clear the individual issues thatwould arise when applying existing the Security Guidelines.
(5) Relationship to open APIs
One method of realizing Type III is that known generally as an “open API.”14 Under an open
API, information systems are connected to each other based on agreement between FinTech
firms and Financial Institutions. This enables FinTech firms to combine diverse informationand implement harmonized security measures with Financial Institutions, making it possible
to provide customers with highly convenient and secure services.
Technologically, multilayered linkage of IT systems among businesses, from a many-to-manyand multistage approach, is possible using an API. For this reason, if the opening of Financial
Institutions’ APIs involves diverse related parties in linkage of financial information systems,
then the types of information combinations will be diverse as well, and this diversity would

14

The Financial System Council’s Financial System Working Group Report (released December 27, 2016) states, “As used here, API refers
to an interface that enables parties other than a bank to connect to the bank’s IT systems and use their functions. Of these, an open API
refers to an API provided by a bank to FinTech firms and others and permitting it to access the bank’s systems, subject to customers’
consent." http://www.fsa.go.jp/singi/singi_kinyu/tosin/20161227-1.html

8

open up the possibilities for innovative services15. Society expects the cultivation of anenvironment that would enable such open innovation.
On the other hand, when a large number of related parties is involved in system linkage, it isconceivable that there would be an increased possibility of the manifestation of unforeseenrisks within the interactions among such parties16. For this reason, to address such interactions
and similar matters, it is important to collect together related parties and consider security
measures from a multifaceted approach (“collective consideration” hereinafter) (Fig. 3).
Fig. 3. Linkage relationships through an open API

Customers

・・・

・・・

System linkage

・・・

FinTech firms
Financial Institutions
API connections
Service provision

As one example of collective consideration of thinking on security under an open API, in
October 2016 the Review Committee on Open APIs, in which the Japanese Bankers
Association (“JBA” hereinafter) serves as secretariat and members include Financial
Institutions, IT-related firms, and financial regulators (“Bank API Committee” hereinafter),was established17. FISC also is a member of this Council, and the Council refers to thedeliberations of the Bank API Committee18 in its own studies19.

15

Regarding the mechanism by which in a networked age open technologies stimulate innovation, refer to Ryojiro Kuni, Open Architecture
Strategies: Cooperation Models for the Networked Age (1999).
Ryojiro Kuni, in Social Capitalism: The Management Strategy of Connections (2013), notes, “By definition, emergent phenomena arisingfrom the combination of information communicated by diverse actors cannot be controlled fully. Attempts at such control will prevent the
emergent phenomena themselves from occurring.” He also notes, “One must be prepared for the possibility that chaos and accidents could
arise amid unanticipated interactions, particularly when linking numerous systems to each other. Thinking continually aboutcountermeasures for these will help to minimize damage when an accident occurs.”
17
https://www.zenginkyo.or.jp/news/detail/nid/6752/
18
https://www.zenginkyo.or.jp/news/detail/nid/7670/ The Report of Review Committee on Open APIs: Promoting Open Innovation(Interim Summary [Draft]) is referred to hereinafter as the “Bank API Report.”
19
In addition, in March 2017 the Ministry of Economy, Trade and Industry launched the Study Group for API-based Collaboration Involving
Credit Card Utilization, with the participation of credit card issuers, FinTech industry representatives, and others, which is considering
topics including what kinds of guidelines would prove satisfactory to both credit card issuers and FinTech firms from security and otherperspectives.
169II. Topics in application of FinTech-related the Security
Guidelines and ideal forms of security measures
1. Matters that it would be beneficial to clarify in advance inconsideration of topics(1) Effects of security measures that should be targeted
While consideration of information systems handling FinTech operations subject to the
Security Guidelines is based on the assumption of a tripartite relationship involving FinTech
firms in addition to Financial Institutions and IT solution providers, it would be beneficial to
make clear in advance the degree of effects of security measures aimed for.
The effects of security measures expected by society for financial information systems were
given concrete form for the first time through the formulation of the Security Guidelines 30
years ago, when it was common for businesses to provide their own IT resources. Since then,while the effects of security measures given concrete form in the Security Guidelines havereflected changes in society’s expectations for Financial Institutions, they can be considered
to have been maintained within the bipartite relationship between Financial Institutions and IT
solution providers without being affected by the change in Financial Institutions’circumstances as seen in their rising dependency on IT solution providers.
Accordingly, as Financial Institutions aim to enjoy the benefits of innovation, even when the
new related party of FinTech firms has appeared on the scene it is important to take care toensure that the effects of security measures remain equivalent to those of security measuresrealized under existing the Security Guidelines in a bipartite relationship (“principle ofequivalency” hereinafter).
In addition, when aiming to realize equivalent effects of security measures in both a bipartite
and a tripartite relationship, from the perspectives of neutrality and efficacy it is importantthat adjustments to existing the Security Guidelines be kept within the extent necessary. Thatis, it is important to take care to ensure that the burdens on Financial Institutions, IT solution
providers, and others will not increase beyond the necessary extent as a result of suchadjustments.
(2) Domains subject to consideration in the Security Guidelines
The existing the Security Guidelines consist of guidelines that apply to “things,” including
equipment guidelines that cover the buildings and equipment that contain computer systems,
and those similar to technical guidelines, which cover hardware and software, as well as thosethat apply to “people,” similar to operation guidelines that cover hardware, software, andother subjects. It would be beneficial first of all to make clear which of these guidelines
should be the main subject of consideration.
In a situation in which a diverse range of FinTech technologies is expected to appear in the
future, it is difficult for equipment guidelines and technical guidelines covering things20 to
identify practical security measures premised on specific individual technologies, and it
would not be appropriate to establish final individual security measures while the FinTech
environment is changing. For this reason, with regard to equipment guidelines and technical20

It must be noted that the technical guidelines include portions highly susceptible to the effects of technological changes and those that are
not.

10

guidelines it is sufficient if Financial Institutions decide on their own on security measures
suited to the risk properties of individual FinTech operations and employ IT governance inaccordance with the basic principles of security measures21.
At the same time, since it is conceivable that operation guidelines applying to people would
be applicable even in the event of the appearance of a diverse range of FinTech technologies
without being impacted by such varied and diverse technologies or other matters, in thisconsideration it would be appropriate to consider such operation guidelines as a main subject.
In addition, since FinTech operations may be realized in the form of outsourcing from
Financial Institutions to FinTech firms, among such operation guidelines it would beappropriate to consider guidelines related to outsourcing as a main subject.
(3) Nature of simplified risk management measures
In considering simplified risk management measures, it is beneficial to make clear in advancethe nature thereof.
First of all, simplified risk management measures are based on the precondition that that
controls have been established for critical information systems. Such controls are derived
through easing for general information systems. At the same time, as indicated by theexpression “minimum necessary guidelines22,” the also are binding to the extent that they
indicate the minimum level that must be implemented.
For this reason, if establishment of simplified risk management measures is inappropriate,
then the results would be not only to detract from neutrality and efficacy but also to bringabout chronically excessive or insufficient security measures. For this reason, in considerationof such matters it also is important both to take care to reflect accurately an awareness of theissues related to security measures faced by FinTech firms and other related parties in thefields in which individual information systems are used and to carry out such consideration
carefully.
(4) Handling of the Security Guidelines related to use of cloud services
It is said that among IT solution providers, many FinTech firms entrust operational
information systems to Cloud service providers. For this reason, it would be beneficial toconfirm in advance the positioning of guidelines on use of cloud services within the Security
Guidelines.
First of all, the Security Guidelines consider cloud services to be a form of outsourcing23.
Furthermore, the Security Guidelines related to use of cloud services, minus content specificto cloud services alone, are referenced as guidelines for outsourcing as a whole24. Since such
21

This refers to the four principles based on a risk-based approach proposed in the FISC Report of the Council of Experts on Outsourcing in
Financial Institutions .
22
Under “the significance of minimum necessary Security Guidelines,” the FISC Report of the Council of Experts on Outsourcing in
Financial Institutions notes, “‘simplified risk management measures’ refer in general to security measures for relatively low-risk
information systems, which are similar in nature to the categories for which the Security Guidelines indicate ‘Acceptable.’” It also notes,“These should be established within a scope intended to reduce the uncertainty of security measures.”
23
The Security Guidelines’ operation guideline (XIV) Use of Cloud Services notes, “When using cloud services, . . . appropriate risk
management needs to be employed in accordance with the thinking on outsourcing management.” In addition, the FISC Report of theCouncil of Experts on Outsourcing in Financial Institutions includes the Cloud within the scope of outsourcing in the overview of part 5.
Outsourcing.
24
Footnote 31 to the FISC Report of the Council of Experts on Outsourcing in Financial Institutions notes, “Among the guidelines for cloudservices, those applicable to outsourcing as a whole should be referred to, while those specified to the Cloud should not be used as general
guidelines for outsourcing.”

11

revisions to the Security Guidelines are conducted based on the findings of the Outsourcing
Council and the Council25, it must be noted at this point in time that no final version yet existsof the Security Guidelines for outsourcing (including cloud services) following suchadjustment.
For this reason, tentatively the Council needs to make clear an overview of guidelines related
to outsourcing within existing the Security Guidelines, to the extent needed for its
consideration.
Next, since it is not necessarily the case that the FISC Report of the Council of Experts on the
Usage of Cloud Computing by Financial Institutions (“Cloud Council” hereinafter), which
serves as the preconditions for the Security Guidelines related to use of cloud services,reflects the significance of critical information systems proposed in the report of its successor,
the Outsourcing Council, at present some uncertainty remains with regard to whether or not
the risk management measures of the Cloud Council report are applicable unchanged to
critical information systems.
In light of the fact that simplified risk management measures are derived based on the
management measures for critical information system by easing the degree of their controls, itwould be recommended to take note of such circumstances.
To resolve the above matters deserving of note, the Council will consider supplemental
management measures for cases in which cloud services are used, based on the findings of theReport of the Council of Experts on Outsourcing in Financial Institutions. Doing so would
make clear the relevant assumptions even when FinTech use cases involving use of cloudservices in critical information systems (e.g., block chain, AI) arise.

25

The FISC Report of the Council of Experts on Outsourcing in Financial Institutions states, “Revisions to the Security Guidelines etc. will
be conducted after completion of the work of the FinTech Council, taking into account the outputs of both the outsourcing and FinTech
councils.”

12

2. Duties of related parties under existing the Security Guidelines(1) Duties of related parties
First of all, in considering inherent issues, the “Overview of Existing Security Guidelines(Outsourcing)” was sorted under the tripartite relationship in Type I. (See References,
Reference 4)This involved categorizing the duties of each of the parties implementing security measures asshown below.
 Duties of Financial Institutions when using outsourcing: Duties A Duties of primary outsourcees: Duties B
Duties borne as Financial Institutions’ primary outsourcees: Duties B-1
Duties borne by Financial Institutions’ subcontractors: Duties B-2
 Duties borne as Financial Institutions’ subcontractors: Duties C
While the efficacy of security measures can be realized in FinTech as well through theappropriate performance by related parties of the above duties, since the inherent issues insuch a case are recognized in practical terms by the FinTech firms serving as new relatedparties, patterns sorted by types (a), (b), and (c) under Fig. 4 with a focus on the duties of
FinTech firms are as shown in Fig. 5.
Fig. 4. Patterns of related parties in implementing security measures in FinTech
operations
Type IFI

FTType II

IT

FI

FT

Type III

a

FI

IT

FT

a′

FI

IT

b

FI

IT

FT
b′

FI

FT

FI

IT

IT

FT
c

c′

FI: Financial Institution; FT: FinTech firm; IT: IT solution provider (including Cloud solution provider)→: Full responsibility for security measures: Partial responsibility for security measures: Responsibility for subsidiaries

13

FT

IT

a″

Fig. 5. Examples of duties of FinTech firms
Pattern (a)Duties B-1: Main duties borne as Financial Institutions’ primary outsourcees

Notea. Whenconsideringuse

Duty to provide to Financial Institutions the information they need for purposesof making objective evaluations

3

Duty to provide to Financial Institutions information on the locations of data

7b. Whenconcluding thecontract

Duty to conclude contracts with Financial Institutions on matters such asprotection of confidential information and performance of safe operations

11

Duty to clearly describe Financial Institutions’ auditing authority vis-a-vis
subcontractors

14

Duty to respond to prior review by Financial Institutions of subcontractors

25

Duty to take measures to prevent leakage when entrusted with data management
by Financial Institutions

28

Duty to employ sufficient management, including data deletion, when replacing
machines and components due to failure of storage devices or other reasons29

Duty to undergo everyday auditing by Financial Institutions

30

Duty to accept general auditing and evaluation of systems by Financial
Institutions

31

d. During
operation

Duties B-2: Main duties borne by Financial Institutions’ subcontractors
a. Whenconsideringuseb. Whenconcluding thecontractd. During
operation

Note

Duty to evaluate Financial Institutions’ subcontractors objectively(Simplified) Evaluation may be conducted based on public information,industry reputation and business performance, etc.

3

Duty to ascertain locations of data
(Simplified) Ascertaining locations of data may be omitted

7

Duty to conclude contracts with Financial Institutions’ subcontractors on
matters such as protection of confidential information and performance of safe
operations

11

Duty to clearly describe Financial Institutions’ auditing authority vis-a-vis
subcontractors(Simplified) Not requiring clear description of auditing authority is possible

14

Duty to conduct appropriate prior screening of subcontractors

25

Duty to take measures to prevent leakage when entrusting management of
Financial Institutions’ data to subcontractors

28

Duty to ensure sufficient management, including data deletion, is employedwhen replacing machines and components due to failure of storage devices orother reasons(Simplified) Verification of efficacy of deletion/destruction process may be
used instead

29

Duty to conduct everyday monitoring of subcontractors

30

Duty to conduct general auditing and evaluation of subcontractors’ systems(Simplified) Third-party certification or similar means may be used instead

31

14

Pattern (b)Duties C: Main duties borne as Financial Institutions’ subcontractors

Notea. Whenconsideringuse

Duty to provide to IT solution providers the information they need to implement
objective evaluation

3b. Whenconcluding thecontract

Duty to conclude contracts with IT solution providers on matters such asprotection of confidential information and performance of safe operations

11

Duty to clearly describe Financial Institutions’ auditing authority

14d. During
operation

Duty to undergo everyday auditing by IT solution providers

30

Duty to accept general auditing and evaluation of systems by IT solution
providers31

Pattern (c)Duties B-1: Main duties borne as Financial Institutions’ primary outsourcees

Notea. Whenconsideringuse

Duty to provide to Financial Institutions the information they need for purposesof making objective evaluations

3b. Whenconcluding thecontract

Duty to conclude contracts with Financial Institutions on matters such asprotection of confidential information and performance of safe operations

11d. During
operation

Duty to undergo everyday auditing by Financial Institutions

30

Duty to accept general auditing and evaluation of systems by Financial
Institutions(Simplified): Simplified risk-management measure already formulated;
Note: Indicates no. on References, Reference 4

31(2) Approaches to inherent issues
Based on the above sorting out of the issues, consideration by type based on the following
approach will be employed when considering inherent issues when applying existing the
Security Guidelines (i.e., those related to outsourcing) to FinTech operations.
 Would there be any problem with application of existing the Security Guidelines in thecase of Type I?
 Would it be appropriate to apply existing the Security Guidelines originally in the case ofType III?
Type II will be considered separately since it is a type in which different responsibilities are
assigned than for Type I.

15

3. Issues inherent under Type I and the ideal form of security measures
Under Type I, FinTech firms bear responsibility for Duties B or Duties C. Since originally theexisting the Security Guidelines were formulated with the two parties of Financial Institutions
and IT solution providers in mind, Duties B or Duties C were formulated with IT solution
providers’ ability to execute security measures in mind.
For this reason, when FinTech firms are responsible for Duties B or Duties C, the inherent
issue is involved of the possibility of a lack of balance vis-a-vis FinTech firms’ abilities to
execute security measures26 (e.g., the management resources that they possess).
Accordingly, when formally demanding of FinTech firms that they apply the Security
Guidelines similar to those demanded of IT solution providers, the result would be an
excessive burden of security measures borne by FinTech firms who do not have the sameability to implement such measures as IT solution providers, leading to an incentive to avoid
such a burden. This could introduce strains on FinTech firms’ choice of business models as aresult (from the perspective of neutrality). Alternatively, FinTech firms could prioritize
allocation of their internal management resources to security measures in an attempt to bearsuch excessive security measures, harming innovation as a result (from the perspective ofenjoying the benefits of innovation).
At the same time, even in the case of a tripartite relationship to which FinTech firms havebeen added, based on the concept that the effects of such security measures should beequivalent to those of security measures in a traditional bipartite relationship (i.e., theprinciple of equivalency), if Financial Institutions were simply to tolerate residual risk as
being adequate in light of the ability of FinTech firms to execute such security measures or toadjust risk-management measures to match the ability of FinTech firms to execute security
measures would not be effective solutions to the issue (from the perspective of efficacy).
Originally, Financial Institutions engage in outsourcing in order to employ the innovative
nature of FinTech firms in their own business operations, aiming to maximize their enterprisevalue. They do not necessarily engage in outsourcing in order to replace completely the roles
performed by IT solution providers with those of FinTech firms.
Accordingly, Financial Institutions should first confirm the abilities of FinTech firms to
execute security measures, and if the duties involved are beyond the abilities of FinTech firms
then it would be recommended to employ consideration for Financial Institutions and IT
solution providers dividing such responsibilities so that the efficacy of security measures canbe achieved without losing the innovative nature of FinTech firms.
In other words, to resolve this issue it would be appropriate to authorize explicitly thereasonable redistribution of the roles of the types of the three parties and their abilities to
execute security measures (e.g., management resources in their possession), while
maintaining the aggregate total of the duties required under existing the Security Guidelines
based on a bipartite relationship.

26

A basic part of the ability to execute security measures is the ability to ensure that internal controls related to security measures function
effectively. An example would be the ability to identify on one’s own a problem with security measures if it were to arise, to address it on
one’s own, and to implement continually on one’s own improvement activities through identifying the source of the problem andaddressing it (i.e., the ability to run through the PDCA cycle fully for security measures). This basic part of the ability to execute security
measures also should be demanded, at a minimum, from FinTech firms handling financial-related services. Accordingly, this ability to
execute security measures does not necessarily refer to a state that can be confirmed formally by checking to see whether individual
security measures have been completed at any point in time.

16

In redistribution of duties, if there are multiple related parties capable of bearing duties thenfrom the perspective of minimizing the social costs of security measures it is recommended toreallocate duties to a party that would bear fewer additional costs27.
(Rules for redistribution) (See References, Reference 5)
Based on tripartite agreement among Financial Institutions, IT solution providers, and
FinTech firms, outsourcing duties under the existing the Security Guidelines may be
redistributed28 among the three parties29.
In such redistribution, in accordance with the principle of equivalency there is a need to takecare to ensure that the burden on any related party does not increase beyond the necessary
scope. Redistribution of duties to related parties who would incur lower levels of additionalcosts contributes to minimization of the social costs of security measures.

The above rules also represent a valid way of thinking regarding types other than Type I as
well as critical information systems.

4. Issues inherent to Type III and the ideal forms of security measures(1) Financial Institutions’ responsibilities under security measures
Type III represents a pattern in which FinTech firms play a leading role in financial-related
services. The relationships between Financial Institutions and FinTech firms may take various
diverse forms that will not necessarily fit within the forms characterized as outsourcing. For
this reason, with regard to Type III there is a need to consider the ideal forms of security
measures to enable flexible adaptation to a wide range of forms of the relationships between
Financial Institutions and FinTech firms, ranging beyond the scope of outsourcing alone.
On this subject, regardless of the form of the relationship between the Financial Institution
and the FinTech firm there is a high likelihood that a look at the actual content of FinTech
operations from the Financial Institution’s point of view would show some elements incommon with outsourcing. On the other hand, while under existing the Security Guidelines
the guidelines related to outsourcing have been revised and supplemented in accordance withenvironmental changes and other developments, it is not necessarily the case that explicit
guidelines exist for other forms. Accordingly, the ideal form of security measures under TypeIII basically would be that of applying mutatis mutandis the guidelines for outsourcing, and in27

If a FinTech firm were to choose to minimize the costs it must bear, then it is clear that Financial Institutions would bear duties instead of
the FinTech firm, and it is possible that if the FinTech were to bear no duties under security measures, it might be expected that the
Financial Institutions would bear them. At the same time, if a Financial Institution were to choose to minimize the costs it must bear, thenthe FinTech firm might understate its ability to execute security measures to claim that it would not be able to bear any more costs if asked
to, in an attempt to avoid being asked to bear such costs. Accordingly, from a social perspective it is recommended that related parties
cooperate to consider ways to minimize the sum total of costs borne. Also, it is conceivable that agreement might be reached in advance on
schemes for providing returns to related parties suitable to the duties they bore, to ensure cooperation through means such as appropriate
disclosure of information.
28
For example, It is considered that Financial Institutions would control IT solution providers directly by taking on the responsibility of apart of Duties B-2 instead of FinTech firms based on tripartite agreement.
29
Since FinTech companies vary widely in size and types of businesses, it would not be appropriate to specify in advance fixed content for
the redistribution of duties. It would be sufficient for Financial Institutions to decide on the content of such distribution in a reasonable
manner for each category, in accordance with the state of the FinTech firms and IT solution providers that they use in outsourcing. They
also might want to hold training sessions and provide other support so that FinTech firms can fulfill their duties regarding security
measures instead of relying on revising the content of distribution.

17

the event of individual circumstances that cannot be handled under such measures it would beappropriate to revise them as necessary.
Next, when considering mutatis mutandis application of outsourcing guidelines there is a need
to note that originally outsourcing guidelines consist of guidelines on methods of control,
through implementation of objective evaluation and monitoring in management phases suchas when considering use and during operation, and guidelines on the content of controls,
through use of encryption as a measure for preventing leakage of data (Fig. 6).
Fig. 6. Control methods and content
Mainmanagement
phase

When considering use

When concluding thecontract

During operation

ControlmethodObjective evaluation

Conclusion ofcontract

Monitoring (everyday
monitoring, auditing)Content ofcontrols

Matters related to preservation of data, matters related to confirmation of identity,
matters related to service availability, matters related to failure management, etc.

Checklist

Contract

Monitoring/auditing items

First of all, regarding methods of controls in mutatis mutandis application of these guidelines,
as long as the Financial Institutions bear some responsibility under security measures, then it
can be considered that they should be implemented in the same way as with outsourcing,although with a difference in degree.
Fig. 7. Examples of items of interest to Financial Institutions under Type III
a. Whenconsideringuse

Implementation of objective evaluationb. Whenconcluding thecontract

Conclusion of contracts that include security measuresd. During
operation

Everyday monitoring

Should FinTech firms bear the same degree of responsibilities as the management
responsibilities borne by Financial Institutions under security measures? Alternatively,
should Financial Institutions bear the management responsibilities required of FinTech
firms? For example, do FinTech firms possesses the ability to execute security measuresneeded for such measures (e.g., the management resources they possess)?

Do FinTech firms conclude with Financial Institutions contracts that include security
measures? Also, do FinTech firms conclude contracts that include security measures with
IT solution providers (e.g., provisions regarding notification of leakage of data andcompensation for damages)?

Is it possible for FinTech firms to report to Financial Institutions on the status of
implementing security measures?
Development of a structure for auditing IT systems
Do FinTech firms undergo auditing and evaluation?

On the other hand, it could be considered sufficient regarding the content of controls if only
the portions leading to responsibilities under security measures are implemented. If FinTech
firms play a leading role in financial-related services, then Financial Institutions’ partial
responsibility for security measures comes from the provision or receipt of customer-related18

data. For this reason, the content of Financial Institutions’ controls is concentrated on whether
the data provided by FinTech firms is managed properly or whether FinTech firms properly
confirm that the data received from FinTech firms is based on customer instructions.
As described above, the duties borne by Financial Institutions when providing data to FinTech
firms, or receiving data from them, under Type III can be understood to be limited to portions
related to preservation for customer-related data or confirmation of identity. For this reason, if
it can be verified that FinTech firms implement effective security measures and realize theeffects thereof with regard to these portions, then Financial Institutions’ risk-management
measures can be considered to be sufficient.
Under Type III, matters other than the portions related to preservation of customer-related
data or confirmation of identity (e.g., stable operation of IT systems) are outside the scope ofinterest of Financial Institutions, and from the standpoint of Financial Institutions there is noneed for any particular controls for these. However, it must be noted that in the event that thedegree of system controls that should be carried out by FinTech firms overall were to
decrease due to the fact that they were not subjects of interest to the Financial Institutions and,as a result, the effects of security measures related to data preservation or confirmation ofidentity were to be harmed, then the Financial Institutions would need to implement somekind of additional controls on FinTech firms for such matters beyond their scope of interest as
well.
(Rules on mutatis mutandis application of outsourcing guidelines)
Under Type III, Financial Institutions can apply mutatis mutandis existing outsourcing
guidelines. In such a case, the duties of Financial Institutions are limited to portions related topreservation for customer-related data or confirmation of identity at FinTech firms.
If it is not possible to enjoy the benefits of security measures for portions subject to the duties
of Financial Institutions arising from portions for which Financial Institutions are notresponsible, then additional security measures will need to be taken for the portions not
subject to the duties of Financial Institutions.
(2) Responsibility for security measures remaining with FinTech firms
Under Type III, it is general practice for FinTech firms to entrust operation of information
systems to IT solution providers such as Cloud service providers. Accordingly, from theperspective of applying mutatis mutandis outsourcing guidelines society expects FinTech
firms to bear some part of Duties A in a form inseparable from the duties demanded of
Financial Institutions.
Furthermore, since FinTech firms themselves play a leading role in providing
financial-related services, they can be understood to bear chief responsibility to customers forsecurity measures.
Accordingly, FinTech firms are expected to play an active role in advancing efforts related tosecurity measures, through means such as formulating autonomous industry guidelines that
conform to the Security Guidelines. (This is covered in detail under “III. Handling of FinTech
operations not subject to the Security Guidelines.”)(3) Handling of cases in which Financial Institutions do not bear responsibility19

In cases of financial-related services in which Financial Institutions have a completely passive
approach, such as those in which FinTech firms play leading roles and obtaincustomer-related data from Financial Institutions in a unidirectional manner without any
negotiation with the Financial Institutions, Financial Institutions can be understood to bear no
responsibility for security measures.
However, since from the customer’s point of view this means that they would not be able torely on the Financial Institutions for assistance in the event that some kind of problem were toarise when using such financial-related services, it is recommended that the Financial
Institutions advise their customers in advance of the fact that they are using financial-related
services in which customer-related data are obtained from the Financial Institutions in aunidirectional manner.

5. Cooperation among related parties
As is clear from the considerations above, in implementation of appropriate security measuresin FinTech operations close cooperation among the three parties of Financial Institutions, IT
solution providers, and FinTech firms is essential, and if this is lacking then users could be
exposed to unforeseen damages.
The most pivotal part of such cooperation is appropriate disclosure of information (includingthat concerning system risks) by FinTech firms to Financial Institutions in each management
phase, such as when considering use and in the event of an incident. At the same time, if thiswere to be demanded of FinTech firms to an extent beyond the necessary scope, then it could
be detrimental to innovation on the part of FinTech firms by forcing excessive burdens onthem.
Accordingly, to enable cooperation and appropriate disclosure of information concerning
security measures, it is recommended that the three parties reach a consensus in advance(principle of cooperation).
Also, utilizing a Checklist30 for use in evaluation of outsourcees is recommended as a meansof such cooperation. For this reason, it is conceivable that the Checklist used ordinarily would
be considered a means of sharing information to promote cooperation, and that its content
could be revised—including simplification—as appropriate.
As seen above, under any pattern the three parties involved in FinTech operations—Financial
Institutions, IT solution providers, and FinTech firms—must balance the securing of IT
system security and enjoyment of the benefits of innovation, and need to take on security
measures through close cooperation.

30

The existing Security Guidelines call for “objective evaluation of outsourcees” when considering use of outsourcing. In actual evaluation,
it is common for Financial Institutions to use general checklists to evaluate the risks of outsourcing overall, including system risk. Possible
methods of using these include handing the checklists to outsourcees and asking them to conduct self-checks before interviewing themconcerning the results of these self-checks.

20

6. Supplementary consideration based on the properties of Type II
Based on the above consideration, the derivative form of Type II will be considered
individually below with regard to the types of properties it involves in light of security
measures and what kind of supplementation is necessary as a result.
(1) Properties of Type II
In general, Financial Institutions manage and control their subsidiaries based on individual
management contracts concluded with them, in accordance with each subsidiary’s position
and role within the financial group or its size or other matters. For example, a Financial
Institution might provide constant advice and guidance through means such as monitoring ofrisk-management status, or it might ascertain information in a timely and appropriate manner
through means such as establishment of an obligation to report on material facts in a timely
and appropriate manner. For this reason, under Type II, in which FinTech firms also bear
responsibility to such subsidiaries, in addition to controls for outsourcees controls for such
subsidiaries are added as well.
As a result, in the area of controls Type II may involve more points of contact on controls
than other types, while also securing effective disclosure of information, and as a result it canbe considered to facilitate the implementation of appropriate security measures throughcooperation among related parties—which should be an aim of FinTech operations—to agreater extent than other types, for both Financial Institutions and FinTech firms.
On the other hand, in the area of allocation of management resources, in a case in which theresults of objective evaluation show that FinTech firms lack full abilities to execute security
measures and also lack management resources that can be allocated additionally to security
measures, then under Type II the choice could be made to reinforce FinTech firms’
management resources through means such as increasing capital or dispatching personnel, notjust the method of reallocation of duties.
For the above reasons, from the perspectives of both controls and allocation of management
resources Type II can be considered a type that offers a possible solution for Financial
Institutions and FinTech firms vis-a-vis the objective of enjoying the benefits of innovation
while ensuring IT system security.
(2) Supplemental information
In some cases, business administration and outsourcing management are handled using
different contact sections, management items, and management cycles within Financial
Institutions (see Fig. 831). For this reason, it is anticipated that FinTech firms may need to
employ individual handling for separate cases even when they involve the same Financial
Institution. Since this is expected to lead to a burden on the part of FinTech firms, if there is acase that such a burden could be detrimental to innovation then it is recommended that thesections handling business administration and outsourcing management cooperate in taking
care to ensure that no excessive burden will be imposed on FinTech firms32.
31Here, Fig 8 looks at the example of an IT subsidiary. However, it is not the case that an IT subsidiary and a FinTech firm would requirecompletely identical business administration or outsourcing management. A FinTech firm would be subject to management by Financial
Institutions by category, in accordance with actual conditions such as its positioning within the financial group.
32
Financial Institutions conduct business administration and outsourcing management from different points of view. They cannot omit one or
the other of these. Also, as shown in Fig. 8, already a variety of efforts are underway to improve the efficiency of management.

21

Fig. 8. Fact-finding survey on business administration and outsourcing management (inthe case of an IT subsidiary)*1
Business administration
Contact
Examples ofManagement
section management items frequency

Outsourcing management
Contact
Examples ofManagement
sectionmanagement items frequency

Prior approval ofdecisions onimportant matters
 Changes inshareholders andexecutives
 Large-scale IT
investment
etc.
Business
Ascertain state ofadministration
implementing
sectionbusiness plans/
IT planning
Ascertaining state ofsectionrisk management
 Risk-managementrules
 Large-scale IT
system failuresetc.

Ascertaining state of
subcontractor
management
 Prior review of new
subcontractors
 Ascertaining state of
subcontractor
management
etc.

*2

RiskAscertaining state ofmanagement implementing
sectionsubcontracting/ Work performance
IT section
 Performance on useof production data
etc.

*2

Ascertaining state of IT
risk management
 Results of IT risk
evaluation
 System failures andanalysis resultsetc.

*1 Multiple banks with IT subsidiaries were surveyed.
*2 While management is implemented as needed or periodically depending on the management item, these are notnecessarily handled the same way in both business administration and outsourcing management.

【Efforts to increase the efficacy and efficiency of management】
Parent company and subsidiary occupying the same building
Parent company providing training
Omitting periodic reporting for subcontractors located on site
Sharing of rules between parent company and subsidiary
Sharing of email and other systems with parent company
etc.

22

7. Treatment of information systems handling FinTech operations interms of security measures
At first, the Council considered information systems handling FinTech operations based on
the assumption that in most cases these would be general information systems. However, in acase in which the manifestation of a risk in an information system handling FinTech
operations would have a serious impact on a service provided by a critical information
system33, the information system handling FinTech operations is considered a part of thecritical information system, and as such it needs to be handled in accordance with security
measures.
At the same time, since the scope subject to an individual information system is decided on by
the Financial Institution independently, there also is a possibility that an information system
handling FinTech operations could be handled under security measures as part of a criticalinformation system even though it would not have a serious impact on a service provided by
the critical information system.
In such a case, while there is a possibility that the judgment could be made that high Security
Guidelines must be applied to the information system handling FinTech operations as well, by
following the precedent of the higher-risk system, doing so would involve concerns that it
could result in restraining Financial Institutions’ efforts in the area of FinTech operations.
From the perspective of enjoying the benefits of innovation, it is recommended to address
such issues in advance. For this purpose, it is conceivable that information systems that satisfy
all of the following conditions could be identified clearly as separable subsystems that could
be treated independently.
(1) Separability of the impact of risk manifestation
It is possible to ensure that the impact of manifestation of risks such as system failure
occurring inside a subsystem will not affect other services provided by the system as awhole.
(2) Separability of risk properties
The properties of risks to the subsystem differ markedly in nature34 from those of thesystem as a whole.
(3) Separability of risk management
It is possible to implement risk management—i.e., risk evaluation, security measures, andfollow-up measures after manifestation of a risk—entirely within the relevant subsystem.
It is recommended that Financial Institutions consider handling of security measures for
information systems handling FinTech operations with the above concepts in mind.

33

For example, if a Financial Institution has no branch offices and no means of receiving settlement instructions other than through API
connection with a FinTech firm, then if the system handling API connection were down then even if the accounting backbone system is notdown the institution’s settlement services themselves would be suspended as a result.
34
For example, cases are conceivable in which although the system as a whole does contain customer information, the relevant subsystemdoes not.

23III. Handling of FinTech operations not subject to the Security
Guidelines
1. Handling of traditional subjects of the Security Guidelines
Information systems subject to the Security Guidelines are those that handle financial
operations and for which Banking and Related Financial Institutions bear responsibility forsuch security measures. Simply put, this refers to information systems handling the financial
operations conducted by Financial Institutions. Accordingly, the Security Guidelines do not
apply directly to information systems that handle non-financial operations conducted by
Financial Institutions, financial operations conducted by non-Financial Institutions, or
non-financial operations conducted by non-Financial Institutions.
However, since it is anticipated that in many cases information systems handlingnon-financial operations conducted by Financial Institutions are information systems operated
by those same Financial Institutions and subject to common security measures under policies
related to security measures, even if it would not be appropriate to apply fully to themunchanged the Security Guidelines that assume the nature of financial operations, it isrecommended that the beneficial portions of security measures for information systems
handling non-financial operations included in the Security Guidelines be referred to—that is,that they be incorporated as appropriate in ways suited to the actual conditions of Financial
Institutions’ operations35.
On the other hand, the thinking employed traditionally regarding financial operations
conducted by non-Financial Institutions (such as prepayment methods and funds transfers
conducted by non-Financial Institutions under the Payment Services Act) is that even though
they involve elements that are similar in functional terms to financial operations conducted by
Financial Institutions, and as such it cannot be denied that the security measures under the
Security Guidelines would be beneficial in part for such operations, for the following reasons
information systems handling such operations are not subject.
 Security Guidelines are voluntary guidelines formulated by FISC members. In general,voluntary guidelines differ from laws clearly established by a national or other government
and enforceable through means such as courts of law (hard law) in that they are a type ofarrangement reached privately (soft law)36, and as such their socially normative nature isunderstood to apply only to the parties who explicitly took part in the process of
formulation of such voluntary guidelines. The Security Guidelines were formulated mainly
by Financial Institutions among the members involved in handling of financial information
systems37, and parties such as representatives of non-Financial Institutions conducting
financial operations did not necessarily participate explicitly in the formulation process 38.
For this reason, it would not be reasonable to apply the Security Guidelines unilaterally tosuch non-Financial Institutions.
 While in fact the Security Guidelines are applicable beyond the framework of FISC
members to Financial Institutions regulated by the Financial Service Agency since they are
35

See Footnote 4
The description concerning soft law and hard law is cited from Hiroyuki Seshita, “Soft Law and hard Law,” in Chapter 1, Part 3 ofNobuhiro Nakayama, editor in chief, Basic Theory of Soft Law (2008).
37
As of the end of March 2017, Financial Institutions accounted for 542 of 644 FISC member companies, or 84%.
38
The Security Guidelines were established through consideration by the Specialized Committee on Security measures and its subsidiaryorganization, the Study Group on Revisions to the Security Guidelines, whose members consist mainly of FISC member representatives,
and then seeking the opinions of members.
36

24

mentioned in its inspection manual and other documents, it would be unreasonable to apply
them beyond this scope to non-Financial Institutions not regulated by the Financial Service
Agency.
Information systems handling non-financial operations conducted by non-Financial
Institutions have never been considered subject to the Security Guidelines.
Fig. 9 presents the thinking outlined above in visual form.

Non-financial
operations

Financial
operations

Fig. 9. Handling of the traditional scope of the Security Guidelines

Financial Institution

Non-Financial
Institution

Category A(Applicable)

Category C(Not subject)

Category B(Reference)

Category D(Not subject)

Note: Grey areas indicate those where Security Guidelines have normative application.

2. Courses of action on handling of FinTech operations not subject to the
Security Guidelines
The financial-related services generally referred to as FinTech are broad ranging and newtechnologies or new business models are expected to appear in the future, and under suchconditions it is expected that the Council sort out in advance the handling of FinTech
operations under the Security Guidelines.
It is thought that while generally Financial Institutions and non-Financial Institutions are
identified by the legal system through industry laws and other laws that make the subjects
relatively clear, the financial-related services referred to in general as FinTech should beapproached by clearly demarcating the boundaries between financial and non-financial
operations through means such as focusing on functional aspects and identifying specificoperations clearly, since the boundaries between such operations tend to be relatively
ambiguous39 in the case of FinTech.
However, even under such an approach it is difficult to identify individual operations inadvance under conditions in which a wide range of services will appear, and even if suchboundaries were made clear, handling under the Security Guidelines would vary even though39

For example, FinTech Law (2016), by Masakazu Masujima and Takane Hori, states, “The reorganization of the industry and changes tobusiness models effected by FinTech are dissolving not only the barriers between financial businesses but also those between finance andnon-financial industries.”25

in functional terms operations did not differ very much. There are concerns that doubts could
arise regarding the appropriateness of such handling of FinTech operations.
It is thought that traditionally users expect appropriate security measures to be implemented
in a seamless and inseparable way across FinTech operations as a whole, regardless ofwhether they are conducted by Financial Institutions or non-Financial Institutions, and thatwhether or not operations qualify as financial operations is not of primary importance tousers.
Accordingly, in order to meet such social expectations it would be beneficial first of all for
Financial Institutions in Japan to be able to obtain in FinTech operations a degree of trust insociety similar to that which they have built up in their traditional operations. In particular,
since the Security Guidelines, as rules agreed to in society, have played a role in the formationof such trust in society regarding information systems, when assuming as given the fact ofdiverse FinTech operations, it would be beneficial to sort out the degree to which the Security
Guidelines have a socially normative nature among the parties handling such operations,regardless of whether they are Financial Institutions or non-Financial Institutions.
(1) Courses of action on handling of category B
In this category, the Security Guidelines long have been referred to in the form of reference.
Under the actual conditions of Financial Institutions, in many cases the Security Guidelines
and other FISC guidelines are incorporated into security policies and security standards, andsecurity measures are implemented uniformly for both financial and non-financial
operations40.
Accordingly, even when FinTech operations include some that are considered non-financial
operations, if Security Guidelines regarding FinTech are in place then security measureswould continue to be implemented in reference to these guidelines, and there would be no
particular issues that need to be considered.
(2) Courses of action on handling of categories C and D
This category includes FinTech operations conducted as financial operations by non-Financial
Institutions, including financial-related services such as individual asset management inwhich FinTech firms play leading roles and P2P lending as conducted in the United States.
In considering handling of the Security Guidelines in this category, if we do not assume
systemic changes by regulators then a normative nature of the Security Guidelines vis-a-vis
non-Financial Institutions as well would be expected for purposes including earning users’
trust in security measures.
Next, such a normative nature could arise through the following two methods:(i) Direct normative nature
Non-Financial Institution FinTech firms become members of FISC individually. They
participate explicitly in the process of formulation of the Security Guidelines and

40

Part I, “Thinking on Security Guidelines,’ of the Security Guidelines, states, “A security policy must be formulated to enable unified
handling of information companywide.” In addition, it also states, “Each Financial Institution or other organization needs to formulate andimplement security standards suited to its usage of computer systems, the type and size of risks it faces, the importance of information it
must protect, and the size and properties of its own company (internal Security Guidelines), in accordance with its own security policies
and with reference to these guidelines.”

26

contribute to formulation of guidelines from a FinTech perspective, as well as complying
with the Security Guidelines.
(ii) Indirect normative nature
FinTech firms’ industry organizations become members of FISC. As representatives of theindustry, they participate explicitly in the process of formulation of the Security Guidelines
and contribute to formulation of guidelines from a FinTech industry perspective. They also
formulate voluntary guidelines for the FinTech that are consisted with the Security
Guidelines, and members of the industry organizations comply with these.
With regard to method (i) above, FISC members already include some FinTech firms, and it
is expect that they will take part in the process of formulation of the Security Guidelines in
the future. Regarding method (ii), FISC membership also already includes some industry
organizations, and some such organizations participate in consideration as members of theCouncil as well. Furthermore, these industry organizations plan to formulate voluntary
guidelines regarding security measures, and at present consideration is underway whilereferring to the Security Guidelines and reflecting points of view corresponding to the
distinctive properties of the industry organizations.
If as a result of progress on such initiatives the normative property of the Security Guidelines
also impacts FISC-member FinTech firms and industry organizations, then as a result it canbe expected that appropriate security measures would be implemented in a seamless andinseparable way in general for the financial-related services known as FinTech, by bothFinancial Institutions and non-Financial Institutions.
However, since ultimately the consideration of the industry organizations themselves must be
relied on with regard to whether or not the content of these voluntary guidelines is consistent
with the Security Guidelines and not all FinTech firms and industry organizations arenecessarily FISC members, it would be appropriate for the Council to issue some kind of
opinion on this topic.

27

3. Statement of opinion on security measures in FinTech operations
In light of the above points, the following opinion is offered concerning security measures in
FinTech operations as a whole.
Statement of opinion
The FISC Council of Experts on FinTech in Financial Institutions is highly interested in theideal form of security measures in information systems handling FinTech operations, whether
such FinTech operations are implemented by Financial Institutions or others. For this reason,businesses involved in FinTech operations are expected to implement appropriate security
measures that reflect the following Principles Applicable to Businesses Involved in Provisionof Financial-Related Services41, formulated by the Council.
(1) Businesses involved in provision of financial-related services shall implement
appropriate security measures for information systems for which they are responsible formanagement, with the goal of ensuring that their users may use such services with peaceof mind.
(2) In implementing security measures, businesses involved in provision of financial-related
services shall give consideration both to ensuring that the results of innovation contributeto increased convenience for users and to promoting cooperation in security measures sothat Financial Institutions and other businesses can utilize their own individual
advantages.
(3) In implementing security measures in cooperation with each other, businesses involved inprovision of financial-related services shall strive to form socially agreed-upon rules withregard to security measures, including the FISC Security Guidelines.
(1)
It is anticipated that businesses involved in provision of financial-related services would
include a wide range of businesses, including not only Financial Institutions and IT solution
providers but also FinTech firms. Since ensuring that users can use financial-related services
with peace of mind is of utmost importance for purposes of maximizing enterprise value, itwould not be appropriate if such businesses failed to implement any security measures for the
information system needed to provide such services.
(2)
As seen in FinTech, innovations in financial-related services are taking place at a remarkablepace, contributing in particular to improvements in user convenience through providing
innovative user experiences. Use of such services is advancing as a result. Accordingly, in
implementing security measures care should be taken to avoid impeding innovation.
In addition, as open innovation advances among Financial Institutions it is expected that to agreater extent than before multiple businesses will be involved, in multilayered ways and at
multiple stages, in provision of financial-related services. Even as relations among businesses
41

While the “basic principles of security measures” recommended in the FISC Report of the Council of Experts on Outsourcing in Financial
Institutions are basic principles applying mainly to FISC members, the “principles applicable to businesses involved in provision offinancial-related services,” while based on the “basic principles of security measures,” apply more broadly to businesses involved inprovision of financial-related services in general.

28

grow more complex in this way, it is possible to secure mutual advantages throughinvolvement in services through cooperation among multiple businesses. Accordingly,
business should cooperate with each other in implementing security measures as well.
(3)
Socially agreed-upon rules have been established with regard to security measures forfinancial information systems. These include the FISC Security Guidelines on Computer
Systems for Banking and Related Financial Institutions issued by the Center for Financial
Industry Information Systems, a voluntary guideline adopted by Banking and Related
Financial Institutions. Distinctive characteristics of these include the fact that in the process of
formulation of the Security Guidelines related parties with specialized and technicalknowledge, including representatives of industries involved in financial operations andinformation systems, were involved, and related parties who bear responsibility for security
measures in financial information systems and handle the field operations in which security
measures are implemented participate voluntarily in planning (See References, Reference 6).
It is recommended that businesses involved in financial-related services both strive toward theformation of socially agreed-upon rules and implement security measures that conform tosuch rules.

4. FISC’s role in working toward formation of socially agreed-upon rules
Traditionally, the main related parties in financial information systems have consisted of
Banking and Related Financial Institutions as well as IT solution providers, and since most ofthese are FISC members it is possible for the Security Guidelines to reflect sufficiently theintents and properties of providers of financial information systems. As a result, most of the
security measures needed for financial information systems can be checked using the Security
Guidelines.
However, under conditions in which it is anticipated that with advances in open innovationeven more businesses will be involved in provision of financial-related services in the future,
it can be expected that businesses other than FISC members might become involved, and insuch a case it probably would not be as easy to ensure that the Security Guidelines reflectsufficiently the intents and properties of all businesses involved.
In addition, since it is conceivable that individual businesses would formulate their own
voluntary guidelines if voluntary guidelines completely unrelated to the Security Guidelines
were to be formulated, then different rules would be applied and used among financial-related
services.
FISC needs to fulfill its role in society to address such issues that might arise in the future.
For example, if industry organizations of businesses involved in provision of financial-related
services were to consider their own voluntary guidelines, then FISC would participate in suchconsideration and provide support as needed to form socially agreed-upon rules, striving tosecure mutual consistency among such guidelines42.
In formation of socially agreed-upon rules, it would be beneficial to focus on the minimum
necessary Security Guidelines that FISC plans to formulate. Formulated as the minimal level
42

An example of formulation of voluntary guidelines already underway is the establishment of the Review Committee on Open APIs , forwhich the JBA serves as secretariat, in the banking industry. It is studying independent guidelines reflecting the intents and nature of thebanking industry. FISC both participates in this council and serves as secretariat in supporting the API Connection Checklist (tentativename) that it recommends. Also, the FinTech Association of Japan, a FinTech industry organization, is making progress on formulating its
own voluntary guidelines. FISC participates in its studies and provides support through means including explanation of the Security
Guidelines.

29

of guidelines that should be implement for information systems handling financial operations,these minimum necessary Security Guidelines can be considered to be guidelines that should
be taken into consideration not only by FISC members but by other businesses involved inprovision of financial-related services as well.
With regard to security measures in FinTech operations, collective consideration is underway
by a wide range of organizations, including various industry organizations, and theinterrelations among these, based on a look at the natures of the participants in suchorganizations and the scope of the matters they are considering, can be seen as shown in Fig.
10. From the perspective of ensuring consistency among the subjects of consideration by eachof these organizations, it is expected that efforts would advance based on collective
consideration, reflecting a consciousness of the interrelations among these.
Fig. 10. Examples of interrelations between organizations considering FinTech-related
security measures

Participants or scopeof consideration(Cybersecurity)

FinTech Association API/Security
Subcommittee(FinTech business association)

JBA Bank API Committee(FinTech firms, banks, and others related tobanking APIs)

Other
technical study
group
s

・・・

Other businessgroups・・・

Other
industries’
API studygroups・・・

Framework
Principles

Financial ISAC FinTech Security
WG

FISC FinTech Study Group(Wide range of FinTech-related parties, including banks, insurers, securities
companies, and FinTech firms)

GeneralAbstract

30

Technology
Implementation

Specific

Abstractness ofmatters agreed uponSpecializedIV. Supplemental consideration of risk-management measureswhen using cloud services
Supplemental consideration centered on use of critical information systems

1. Perspectives of supplemental consideration
It would be beneficial to consider in a supplemental manner the Report of the Council ofExperts on the Usage of Cloud Computing by Financial Institutions (“Cloud Council”
hereinafter), and the Security Guidelines for cloud services formulated in supplemental
revision 8 to the Security Guidelines based on that report (“Cloud Guidelines” hereinafter),from the following perspectives.
(1) Reflecting conditions after formulation of the Cloud Guidelines
After formulation of the Cloud Guidelines, together with advancing use of Cloud computing
at Financial Institutions43, Financial Institutions’ FinTech efforts have rapidly increased in
activity. Since cloud services often are used under such conditions in FinTech operations, it isexpected that use of cloud service would increase further in the future. At the same time,through the Outsourcing Council’s activities such as clarification of the meaning of criticalinformation systems, deliberation on the risk-based approach proposed by the Cloud Council
has intensified. In light of such conditions following formulation of the Cloud Guidelines, it isanticipated that in some cases Cloud Guidelines will be applied to critical information
systems (e.g., block chains and AI as FinTech use cases), and in order further to increase theefficacy of Cloud Guidelines, it would be beneficial to carry out supplemental considerationof matter such as whether there are any points on which Cloud Guidelines should be madeclearer. It also would be beneficial to identify the properties specific to cloud services in orderto make clear the perspectives of risk-management measures that should be supplemented44.
(2) Trends among other developed countries
Since formulation of guidelines on use of cloud services advanced in other developed
countries around the same time the Cloud Council met, it would be beneficial to refer to suchguidelines and other materials (References, Reference 8).
While the guidelines of other developed countries share many points of commonality withJapan’s Cloud Guidelines, some examples of their distinctive features are provided below.
 Financial Institutions must have effective access to data related to outsourced operations.
As used here, data includes not only Financial Institutions’ data, customer data, andtransaction-history data but also data related to systems and procedures 45, and it is thoughtthat it would not be appropriate to narrow the scope of subject data. In addition, whilebased on this way of thinking the business facilities subject to such access are interpreted
broadly to include headquarters and administrative centers, it is conceivable that in some43

In FY2013, immediately before the launching of the Cloud Council, 26.7% of Banking and Related Financial Institutions used the Cloud.
In contrast, in FY2015 this percentage had increased to 36.4%. (See References, Reference 7)
44
Identification of properties specific to cloud services is beneficial for differentiating in the future which Cloud Guidelines are applicable tooutsourcing in general and which are specific to the Cloud. For details, see Footnote 31 to the FISC Report of the Council of Experts on
Outsourcing in Financial Institutions.
45
For example, procedures for investigating staff identity and system audit traceability also are included.

31

cases access to data centers would not necessarily be required. Furthermore, with regard tojurisdiction contracts with Cloud service providers are de facto subject to the jurisdictionof domestic law. This is intended to increase the efficacy of data access. These can beunderstood as explicit requirements focused on access to data needed for control purposesin light of the fact that in use of cloud services the degree of controls implemented by
Financial Institutions in general tends to be low.
 The purpose of establishment of requirements is identified as “to identify appropriately andencourage management of operational risks involved in use by Financial Institutions of
outsourcees,” and based on this, there is a need to “ensure that operational risk to Financial
Institutions does not increase.” Most requirements are centered on matters related togeneral control methods such as risk management and supervision and do not touch on thecontent of controls related to equipment and other technologies. While clearly identifying
the basic concept that the level of controls should be identical regardless of whether or notoutsourcing is employed (i.e., that the effects of security measures should be identical), it isunderstood that if these are understood sufficiently then the various individual technicalrisk-mitigation measures that may be taken in light of factors such as the properties andsizes of Financial Institutions should be entrusted primarily to the Financial Institutions
themselves.
In light of the above matters, properties specific to cloud services will be discussed in detailfirst, and then supplemental consideration will be conducted centered on cases in which cloudservices are used in critical information systems.

2. Properties specific to cloud services
The Cloud Council determined that it would be appropriate to treat cloud services as a form ofoutsourcing. As used here, outsourcing is a term used to refer to the source from which IT
system resources are procured. Thus it would be appropriate here to summarize the nature ofcloud services, a form of outsourcing, from the perspective of procurement of IT system
resources.
At the time at which the Security Guidelines first were formulated, methods of procuring IT
system resources were not as diverse as they are today. In general, resources such as buildings,
power supplies, air-conditioning, and water-cooling equipment, as well as the staff required indevelopment of business software applications and operation of information systems,
basically were arranged by Financial Institutions themselves, while procurement from outside
suppliers was limited more or less to hardware such as host computers and tape storage
equipment, basic software such as operating systems and database systems, and somedevelopment and operation staff46.
Later, for purposes including to reduce costs and put advanced technologies to use,
outsourcing, thorough procurement from outside suppliers of resources related to operation of
information systems, gradually advanced, and as a result today more than 90% of Financial
Institutions employ outsourcing for accounting backbone systems. At the same time, thismeans that Financial Institutions need to shift the focus of their controls from internal toexternal subjects, while also maintaining the effects of security measures at the same level as

46

For this reason, since the internal organizations of Financial Institutions are the main subject of controls under security measures, of the 113
guidelines in the first edition of the Security Guidelines two concerned outsourcing.

32when procuring such resources on their own, even as the focus of controls shifts in this way.
This had led to the need to implement additional security measures47.
Cloud services appeared amid these changes in methods of procuring IT system resources andin the focus of controls. Since in procurement of IT system resources cloud services enables
more flexible procurement in accordance with user needs than does traditional outsourcing48,
it is anticipated that use of cloud services will advance further as Financial Institutions
incorporate FinTech across a wide range of areas.
At the same time, it is anticipated that the status of cloud services as being subject to controls
would increase more and more at Financial Institutions, and in light of the state of cloudservices in recent years their specific natures will be summarized below, together with making
clear the perspectives on which supplemental consideration is needed.
(1) Anonymous joint use
While cloud services involve the nature of joint use in which multiple businesses entrust
services to the same Cloud service provider, this is anonymous joint use in that nocommunication takes place among users.
For this reason, the main role in decision-making on security measures in cloud services isplayed not by individual users but by the Cloud service providers. For example, there is atendency to take a passive approach toward audit requests or improvement requests fromindividual users, and this could lead to a refusal to grant access to data centers as needed forauditing purposes, due to security concerns. Accordingly, there is an inherent possibility that
controls by Financial Institutions might not function fully at Cloud service providers, and as aresult risk evaluation and risk mitigation measures might not be able to be implemented
appropriately.
While for general information systems it would be sufficient to choose Cloud service
providers appropriately with consideration for such possibilities and for Financial Institutions
to make decisions on the degree of controls in accordance with the risks involved, for criticalinformation systems the social impact of an incident could be massive, and particularly in an
emergency Financial Institutions need to demonstrate fully their control capabilities withregard to Cloud service providers, to the same degree as in traditional outsourcing of criticalinformation systems49. While in considering controls it is conceivable that risk-management
measures could be considered based on the control perspective employed at shared systemcenters50, which involve a similar nature of joint use, it also must be noted that cloud services
differ from shared system centers, to which specific outsourcees entrust operations
47

The most recent supplemented and revised Version 8 of the Security Guidelines includes nine additional guidelines on outsourcing(including five on cloud services). It is thought that in future revisions to the Security Guidelines it will be necessary to reflectappropriately, for example in the structure of the Security Guidelines, the fact that the focal point of controls is shifting from an internal toan external one.
48
Conceivable characteristics of flexible procurement include economical costs, immediacy of procurement, simplicity of procurement
procedures, and efficiency of system management. Economical costs refer to the ability to enjoy economies of scale in the form of
relatively lower costs since the scale of information processing is so large. Immediacy of procurement refers to the relative shortness of theperiod from the decision to use a service to the time it enters service. Simplicity of procurement procedures refers to cases such as theability to configure system usage conditions easily on the Internet. Efficiency of system management refers to, for example, the lack of aneed for individual management of hardware. It also has been pointed out regarding these characteristics of security measures that theamount of investment in security is higher than for Financial Institutions (some Cloud service providers invest billions of yen per year insecurity) and the high degree of service continuity since information processing covers a wide area.
49
While the Cloud Guidelines mention the option of use of third-party auditing as an effective and efficient means of monitoring during
operation, intended to demonstrate control capabilities during normal times, the May 2016 FISC System Audit Guidelines (Additions to
Revision 3 (“Audit Guidelines” hereinafter) provide specific recommendations on methods of joint auditing using third-party auditors, as
key points of cloud service auditing including the processes thereof and points to consider.
50
A shared system center is a center to which multiple Financial Institutions jointly entrust tasks such as operation of critical information
systems. It is similar to cloud services in that multiple users enjoy the benefits of security measures.

33

comprehensively, in that Cloud service providers may be entrusted with partial operations,such as information systems’ hardware or basic software.
For the above reasons, in supplemental consideration related to critical information systems
decisions are made on the scope of controls and their content based on an understanding of
the demarcation of responsibilities with Cloud service providers while referring to therisk-management measures applicable to shared system centers51 with regard to this nature ofjoint use52. It also would be appropriate to clarify risk-management measures to make up forthe decrease in controls accompanying the nature of anonymity53.
(2) Broad range of information processing
Since users of cloud services are broad ranging, business facilities including those where
information is processed may cover a broad geographical range that includes multiple
countries. This differs from traditional outsourcing in which the bulk of business facilities
tends to be located domestically, and users may want, for example, to know in advance thelocation of the facility where they can access the data they need to effect recovery andinvestigate the cause in the event of an incident. Also, to ensure that recovery, investigation of
causes, and subsequent measures to prevent reoccurrence can be conducted effectively, theywould like it to be stated clearly in the contract who is the auditing authority for the businessfacility where they can access such data, or that the laws and regulations of their own country
apply to that business facility.
While in the case of general information systems it is sufficient for Financial Institutions to
respond to incidents individually, deciding themselves on the degree of controls in accordancewith risks, since in the case of critical information systems the social impact of an incident
could be massive Financial Institutions also need to consider risk-management measures fromthe perspective of the business facilities at which data can be accessed.
For the above reasons, in supplemental consideration related to critical information systems it
would be appropriate to clarify risk-management measures related to the business facilities
where it is possible to access the data needed for control purposes, including recovery fromincidents and investigating their causes54.
(3) Technical advancement
Cloud services are undergoing remarkable technological advances, particularly in the areas ofsoftware such as virtualization technology that makes it possible for multiple users to use
resources efficiently and technologies to conceal data better so that it cannot be accessed orused by other than the authorized users. For this reason, in some cases it is possible to achieve
51

The FISC Report of the Council of Experts on Outsourcing in Financial Institutions addresses the issue of timeliness in responding to an
emergency in particular as a form of risk management at a shared system center. While since in cloud services there is no communication
among users, in a sense this means that the issue of achieving a shared understanding among users does not arise. However, since Cloud
service providers consider the impact on all users as a whole, it might take some time for them to respond to emergencies. Accordingly, theissue of timeliness in responding to an emergency concerns use of cloud services as well, and for this reason the “IT governance specific toshared system centers (risk management measures)” proposed in the FISC Report of the Council of Experts on Outsourcing in Financial
Institutions should be referred to.
52
The Security Guidelines (Operation 109) identify as one basic matter that should be considered when concluding contracts with Cloud
service providers “arrangements regrading demarcation of management and divisions of responsibilities with Cloud service providers(including cases when serves are entrusted to multiple Cloud service providers).”
53
Auditing is one way to improve control capabilities. Regarding auditing, the Cloud Guidelines state, “System auditing and monitoring are
required.” On auditing authority, they state that “clearly stating the right to implement on-site auditing etc.” is “recommended.”
54
Under the Cloud Guidelines, it is anticipated that data for which the location should be confirmed would be Financial Institutions’ data. For
this reason, the location needs to be ascertained from the perspective of business continuity. Also, regarding jurisdiction, the guidelines
state, “There is a need to give sufficient consideration to . . . which country’s laws would apply in the event of a dispute.”34

effects equal to those of physical security measures such as those achieved through equipment
and hardware using software technology alone55, and in other cases more effective software
technology itself is appearing, redrawing the existing technological map. Accordingly, it
might not necessarily be appropriate to identify technical security measures such as
equipment guidelines and technical guidelines uniformly in advance.
In light of such conditions, under existing the Security Guidelines ways of thinking aboutmutual handling of operation guidelines, equipment guidelines, and technical guidelines are
not necessarily identified clearly. For this reason, current conditions involve uncertainties
when equipment guidelines and technical guidelines, which are highly susceptible to theeffects of technological changes, are used exactly as defined without reflecting the conditionsof technological changes as evaluation items in (for example) objective evaluation whenchoosing a Cloud service provider56. As a result, when viewed from the perspective of theresults of security measures overall, there is a risk that controls formally could be extended toareas in which Financial Institutions should not implement controls individually, leading toexcessive security measures.
In addition, although in light of the advanced nature of technologies employed auditors needto have full knowledge of the details of technologies employed in cloud services, if the IT
staff and IT system auditing staff available to Financial Institutions internally are limited, thenthere is a risk that audits will not necessarily be effective.
While for general information systems if handling of Security Guidelines is defined clearlythen it is sufficient for Financial Institutions to make risk-based decisions accordingly, in thecase of critical information systems Financial Institutions need to employ consideration fromthe perspective of securing efficacy while assuming that auditing will be conducted.
In light of the above matters, it would be appropriate for additional consideration to clarify thehandling of Security Guidelines of a technical nature, such as equipment guidelines andtechnical guidelines, and to clarify risk-management measures related to human resources,
such as auditing, for critical information systems57.

3. Thinking on controls for outsourcees handling critical information
systems
In light of the specific nature of cloud services, it would be beneficial for additional
consideration of risk-management measures to make clear the way of thinking on controls foroutsourcees handling critical information systems.
First of all, “critical information systems” refers to information systems involving serious
externalities or those handing sensitive information (including personal information that must55

For example, from the perspective of the principle of equivalency, if the effects of the security measures can be increased through means
such as data encryption and distribution of data across multiple data centers, then the physical security measures conducted in a single data
center might not need to be as strong as usual.
56
For example, the equipment guidelines include Equipment 47: “Measures must be taken to prevent damage due to rodents. While this does
exist as a risk, among the data centers used by Cloud service providers there are cases in which this risk is not high enough to require
explicit confirmation by Financial Institutions. For this reason, whether or not to apply this guideline should be determined throughconsideration of the actual situation of the Cloud service provider. Also, the technical guidelines include Technical 28, 29: “Measures must
be taken to prevent leakage of data.” This guideline states, “Encryption is recommended,” providing an example of technical measures.
However, since such technology is advancing rapidly from day to day, if the example provided in the technical guidelines were to be stuck
to in a formal manner, then there is a risk of a failure to evaluate properly superior technologies adopted by Cloud service providers.
57
To increase the efficacy of auditing, the Cloud Guidelines state, “It is acceptable to substitute auditing by a third party in cases such as
when it would not be effective for an outsourcer Financial Institution to conduct an on-site audit” and “It is effective to verify the content
of results of auditing already undergone by the Cloud service provider and conduct spot verification of the Cloud service providers
concerning chiefly problems and matters on which the audit results were inadequate.”35

be given special consideration58). In the event of a large-scale system failure involving one of
the former systems, the impact would not be limited to internal matters such as customers but
also could affect the financial infrastructure or stable economic management, while a case ofleakage of sensitive personal information involving one of the latter systems could lead tocredit instability that could develop into a situation that could impact the survival of Financial
Institutions themselves. Since responsibility for responding to incidents in information
systems with such a social and public nature rests primarily with the Financial Institutions,because it derives from the nature of financial operations, even when using outsourcing such
responsibility is not borne by the outsourcees, who handle only technical aspects. Accordingly,
in the event of an incident the Financial Institutions are responsible for minimizing its impact
as well as effecting swift recovery of the information systems and ensuring business
continuity, and they need to make adequate arrangements in advance to implement the same
degree of controls for outsourcees as they would for internal systems.
To enable effective controls in the event of such incidents, it is necessary both to monitor the
status of operation of IT systems on an everyday basis in normal times for reasons including
to ensure that no irregularities will be overlooked and to check periodically on the state ofinternal controls on the part of outsourcees, encouraging them to resolve any issues that could
affect responses in the event of an incident.
The points above also apply to cloud services, as a form of outsourcing, and when Financial
Institutions use cloud services as critical information systems, in light of the demarcation of
responsibilities of Cloud service providers they need to implement effective controls while
keeping in mind the positioning of Cloud services in business continuity59.

4. Supplemental consideration of risk-management measures
In light of the above matters, the following supplemental proposals are offered concerning
risk-management measures for implementing effective controls when using cloud services.
(1) Ascertaining Cloud facilities subject to controls
When using cloud services for critical information systems, during selection of Cloud service
providers Financial Institutions must ascertain the business facilities subject to effective
controls60 (“Cloud facilities subject to controls” hereinafter), such as information processing
As used here, sensitive information refers to such information as stipulated in the Financial Service Agency’s Guidelines on Protection of
Personal Information in the Financial Sector. This includes personal information for which consideration is required under the amended
Personal Information Protection Act. (Article 5, Paragraph 1 of the Guidelines [enacted May 30, 2017] identifies as sensitive information“personal information requiring consideration pursuant to Article 2, Paragraph 3 of the Act as well as information concerning labor union
membership, family status, legal domicile, health, and sexual lifestyle.” Article 2, Paragraph 3 of the amended Personal Information
Protection Act states, “Personal information requiring consideration refers to personal information identified in laws, regulations, etc.
requiring particular consideration in handling to avoid inappropriate discrimination or bias against the individual, such as his or her
ethnicity, creed, social status, medical history, criminal record, or status as a victim of crime.”)59
While Financial Institutions need first of all to ensure business continuity in an emergency, keeping the effect of the emergency to aminimum, this does not mean that all Financial Institutions need to apply uniform risk-management measures to Cloud service providers.
For example, if the business continuity plan includes use of a standby system in an emergency without waiting for recovery of the cloudservice, then clearly the risk-management measures for Cloud service providers would differ from those in a case in which the business
continuity plan assumes recovery of cloud services. Also, as pointed out in the FISC Report of the Council of Experts on Outsourcing in
Financial Institutions, if as a result of fractionalization of outsourced operations the risk of operations outsourced to Cloud service
providers can be judged to be sufficiently low, then risk-management measures may differ. Accordingly, for critical information systems
Financial Institutions should decide on specific risk-management measures in light of the positioning of the cloud service and how it isused.
60
While Cloud facilities subject to controls may include the head offices, sales offices, data centers, operation centers, and a variety of otherfacilities of Cloud service providers, in fact these may be specified by Financial Institutions individually in accordance with matters suchas the content of cloud services used and the state of internal controls of Cloud service providers. Accordingly, it is not absolutely
necessary to include data centers in Cloud facilities subject to controls.
58

36

facilities where data necessary for control purposes (“necessary data” hereinafter) can beaccessed.
Also, Cloud facilities subject to controls need to be located in regions (countries, states, etc.)
where controls effectively are feasible.
(2) Clear description of auditing authority etc.
When using cloud services for critical information systems, Financial Institutions must makeclear in contracts concluded with Cloud service providers or through other means the rightsthat they require (e.g., auditing authority) in order to implement effective controls over the
Cloud facilities subject to controls, to secure such rights.
(3) Implementing audits
In auditing Cloud service providers, in light of the advanced nature of the technologies
involved it is recommended that Financial Institutions use guaranteed audit reports fromauditors entrusted by the Cloud service providers themselves. Also, in such a case it isrecommended that reports be used that verify consistency with the Security Guidelines, sothat controls function fully and effectively61.
When using cloud services for critical information systems, Financial Institutions must
implement periodic auditing to ensure that effective controls function fully and effectively.
(4) Assignment of auditors and other monitoring staff
When using cloud services for critical information systems, Financial Institutions’ top
management must assign human resources who possess the capabilities needed effectively to
implement auditing and other monitoring of the Cloud service providers, based on anunderstanding of the advanced nature of the technologies employed in cloud services. In
addition, if it is not easy to train such human resources inside the Financial Institutions, use of
specialized third-party auditors and similar parties is recommended.
(5) Points to note when implementing objective evaluation
While the Cloud Guidelines state that Financial Institutions “need to conduct evaluation basedon information related to the qualities and business execution capabilities of Cloud service
providers and on matters such as the states of the Cloud service providers’ internal controls
and risk management” when selecting Cloud service providers, it must be noted that this does
not necessarily mean that the evaluation items used when implementing objective evaluationmust include the equipment guidelines or technical guidelines of the Security Guidelines.

61

In addition, it is conceivable that Cloud service providers could provide services such as audit tracing to users via the Internet or othermethods as means of effective and efficient auditing.

37

V. Ideal form of security measures for open APIs based oncollective consideration
1. Control-related issues in open APIs
Since an open API is one means of realizing Type III, Financial Institutions publishing APIs
apply mutatis mutandis outsourcing guidelines and implement controls for FinTech firms
connecting via these APIs through the methods of objective evaluation andmonitoring62.(Rules on mutatis mutandis application of outsourcing guidelines)
Accordingly, if in the future regulators, industry organizations, and others were to develop an
open API environment, then API-based connections between Financial Institutions and
FinTech firms would increase in number, and as a result FinTech firms would be subject tocontrols by multiple Financial Institutions.
If in doing so it were to be the case that multiple Financial Institutions would formally
implement individual controls, then there would be a concern that the burden of responding tothese would be excessive for FinTech firms, and this could be detrimental to innovation.
Since originally the controls implemented by Financial Institutions are conducted inaccordance with the Security Guidelines etc., it is conceivable that the methods and content ofcontrols would involve commonalities among Financial Institutions in numerous areas. If
parties involved in API connections were to study these commonalities in controls jointly andimplement related efforts with the goal of lessening the burden on FinTech firms, thenFinancial Institutions would be able to enjoy the benefits of innovation.

2. Ideal form of security measures in open APIs
Controls can be divided into their content—e.g., data preservation, confirmation of identity,
service availability, and failure management—and their methods—e.g., objective evaluation,
conclusion of contracts, and monitoring. Each of these involves numerous points ofcommonality among Financial Institutions.
First of all, in general Financial Institutions decide on the content of controls as independent
items added to the rules agreed upon by society, such as the Security Guidelines andvoluntary guidelines of industry organizations. Accordingly, it is conceivable that at first
Financial Institutions and FinTech firms would come together to consider and build consensus
on the content of controls—that is, items on Checklists used for objective evaluation—at theentry stage of considering use, based on socially agreed-upon rules related to open APIs63. If
agreement has been reached in advance on the parts in common of the Checklist, then it will
be possible to reflect these in the contract, monitoring and auditing items, etc. as the content
of controls conducted later, when concluding the contract and during operation. This would
result in lessening the burden of reaching consensus individually between Financial
Institutions and FinTech firms on security measures.
Next, with regard to the methods of controls, traditionally it has been common practice at
Financial Institutions to implement control methods such as monitoring jointly. Controls have
The Bank API Report states, “Before connecting with the APIs of other businesses there is a need to review the suitability of such APIs
from security and other perspectives,” and “The security suitability of API connections needs to be checked periodically or as needed.”
63
The Bank API Report states, “To lessen the burden of review on companies connected to multiple banks through APIs, it is expected thatthe bank will prepare an API connection checklist (tentative name) for use in reviewing the suitability of API connections.” For this reason,
the API Connection Checklist (Tentative Name) Working Group was established with FISC serving as its secretariat, and it handles tasks
including consideration of commonalities in the content of controls. See References, Reference 9 for details.
62

38

been made more efficient through multiple Financial Institutions reaching agreement andhaving a selected lead Banking and Related Financial Institution (or a third-party auditor
entrusted by the Banking and Related Financial Institutions) implement controls as theirrepresentative, sharing the results. Accordingly, under an open API too it would be possible
for Financial Institutions to implement controls jointly of parties connected to using acommon API. For example, use by other Financial Institutions of the results of objective
evaluation, contracts concluded, and audit results of such a lead Banking and Related
Financial Institution64 would lessen the burden on FinTech firms compared to dealing witheach Financial Institution individually.
As seen above, it is possible when Financial Institutions conduct controls as a group inaccordance with content agreed upon in advance among related parties to lessen the burden
further if FinTech firms are able to respond to controls as a group.
As regulators, industry organizations, and others make progress on environmental
improvements, a movement can be seen toward the establishment of groups of businesses
participating in open APIs, as an effort toward forming groups of FinTech firms65. If such agroup of businesses has been established, then it would be possible both to formulate
voluntary guidelines on security measures based on the content of controls agreed upon inadvance among related parties and to provide guidance and recommendations to members asnecessary based on the results of verification of the state of compliance of individual
members with such voluntary guidelines, for example through auditing by internal auditors(including third-party auditors entrusted by such groups of businesses)66.
As seen above, if efforts based on collective consideration are expected to advance at FinTech
firms, then it would be expected that groups of Financial Institutions would begin consultation
with groups of FinTech firms concerning security measures, and both sides would cooperate
in advancing efforts aimed at minimizing the burdens on related parties while securing overall
security67.

The Bank API Report states, “Prior review may refer to the results of prior review by other banks in order to standardize the level of such
review and lessen the burden on companies connected to multiple banks through APIs, with the bank taking responsibility for entrustingsuch review to another bank.” It also states, “Monitoring may refer to the results of monitoring by other banks in order to standardize thelevel of such monitoring and lessen the burden on companies connected to multiple banks through APIs, with the bank taking
responsibility for entrusting such monitoring to another bank.” Regarding joint auditing methods, refer to the “Key points of joint system
audits” and “Key points of cloud service audits” in the audit guidelines.
65
On March 3, 2017, the FinTech Association of Japan released a document titled “Toward a certified e-settlement agency businessassociation,” calling for “Preparation by multiple businesses for . . . establishment of a certified e-settlement agency business associationas called for in the proposed amended Banking Act” and noting, “The new association plans to consider improved APIs for Financial
Institutions in addition to providing the operations stipulated for such an association in the amended Banking Act, such as establishment of
the necessary rules and handling complaints.”
66
For example, the act on partial revisions to the Banking Act (passed May 26, 2017) included under Article 52-61-20, as duties of an
association of certified e-settlement agency businesses “establishment of rules as necessary to ensure the propriety of e-settlement andother businesses conducted by members and the appropriate handling and security of information handled” and “guiding and advising
members and other activities intended to ensure compliance with rules.”67
For example, if a FinTech business association were to verify members’ state of compliance with voluntary guidelines as part of its
guidance and advising of members, then even though the party conducting this task would differ from that of verification by an associationof Financial Institutions of FinTech businesses during objective evaluation and monitoring, effectively there are likely to be many areas ofoverlap, and so a joint implementation scheme might be considered in order to minimize the burden on related parties.
64

39

VI. Thinking on future revisions to the Security Guidelines etc.
After those of the Council, FISC will receive recommendations from the Outsourcing Council
and the FinTech Council and proceed with revisions to the Security Guidelines and otherguidelines. In doing so, it is expected that such revisions will be based on the content of thereports from both councils, including that outlined below, and that an understanding centeredon thinking on security measures will be attained among a diverse range of parties related tosecurity measures in financial information systems.

1. Adoption of the basic principles of security measures
Basic principles based on a risk-based approach shall be adopted as the thinking on security
measures.

2. Clarification of the Security Guidelines(1) Clarification of the subjects of the Security Guidelines
Financial information systems subject to application of the Security Guidelines shall bedefined clearly as information systems used in the financial operations conducted by Financial
Institutions, and the relationship between other information systems and the Security
Guidelines shall be made clear.
(2) Clarification of the definitions and positioning of the high Security Guidelines andminimum necessary Security Guidelines
The high Security Guidelines shall be defined and their subjects identified clearly as
information systems involving serious externalities and information systems containing
sensitive information. In addition, minimum necessary Security Guidelines shall be defined
and the fact made clear that they should be established within the scope of the objective of
reducing uncertainty in security measures.
(3) Clarification of the positioning of technical guidelines
It shall be made clear that under conditions characterized by rapid technological progress,
technical guidelines and other guidelines should be handled in different ways. It shall be madeclear that the former should not be applied literally to all information systems but rather that
Financial Institutions should determine whether or not to apply them based on the latest
technological trends and other factors, while taking into consideration the high Security
Guidelines and minimum necessary Security Guidelines.

3. Enhancement of external control guidelines(1) Reflecting shifts in the focus of controls
Financial Institutions’ dependency on outsourcing is increasing in backbone accounting
systems and other areas. Based on the fact of this shift of the focus of controls from internal to40external resources, control guidelines applicable to external parties under the Security
Guidelines shall be made clear.
(2) Consolidation of control guidelines in light of diverse forms
Guidelines and related matters shall be consolidated in accordance with the ideal forms ofcontrols based on the diverse forms of related matters such as shared system centers, cloudservices, and FinTech and in accordance with the nature of each.

41

Conclusions
In addressing the theme of FinTech, the Council began its consideration by first making clear
the form taken by FinTech. This resulted in recommendations unlike those made elsewhere in
the world, through classifying FinTech by type based on the perspective of controls by
Financial Institutions. This has made it possible to identify the issues logically andappropriately, and to draw out effective and practical countermeasures for them.
In addition, even though FinTech is a broad-ranging theme, this report was prepared over ashort period of just nine months, through a total of six meetings, in order to keep pace withthe movements of Financial Institutions, industry organizations, regulators, and other relatedparties. This was possible in large part thanks to the sufficient groundwork that had been laid
for collective consideration by parties related to financial information systems in Japanthrough the process of the FISC’s maintenance of the Security Guidelines for more than 30
years. That is, when considering FinTech in Japan there was no need to gather related parties
together anew and deliberate on new guidelines, since it was sufficient to consider, through anexisting system for collective consideration, additional issues arising when applying existing
the Security Guidelines to FinTech. This groundwork laid by the FISC will enable efficiently
and flexibly addressing various issues related to financial information systems that may arisein the future—not just FinTech—in ways in which Japan can either lead the world or keep
pace with other countries.
At the same time, the Council’s consideration builds on the groundwork of therecommendations of the Outsourcing Council. For example, while the Outsourcing Council
added maximizing enterprise value to ensuring system security as part of the thinking behind
the Security Guidelines, the Council, by focusing on enjoyment of the benefits of innovation
through FinTech initiatives, proposes practical methods for maximizing enterprise value inthe form of principles and rules. In addition, while the Outsourcing Council proposed
application of the Security Guidelines from a risk-based approach, the Council deepens thisfurther to consider the fundamental issues of what should be subject to the Security
Guidelines to begin with and how FISC should address matters not subject to application of
the Security Guidelines, expressing its opinion based on such consideration. Furthermore,since the Outsourcing Council made clear the meaning of “critical information systems,” theCouncil considered cases in which cloud services are used as critical information systems,
shining light on a subject not necessarily addressed sufficiently in previous consideration by
the Cloud Council, and thus serving to supplement the content of its recommendations.
Through the process of such consideration, the Council has reviewed the history ofprocurement of IT system resources and, building on this, both made clear the historicalsignificance of cloud services to Financial Institutions and offered advanced opinions unlike
any seen before in the world, by making clear the distinctive properties of cloud services thatdiffer from those of traditional information systems.
In this way, as a result of deliberation of uniform depth through both councils on outsourcing
and FinTech, it has been possible to offer broad-ranging and mutually consistent opinionsfrom individual risk-management measures to the fundamental principles of thinking on the
Security Guidelines as well as the ideal form the FISC should take.
This final report is the fruit of passionate and diligent deliberation on the part of the Chair
Iwahara, Assistant Chair Fuchizaki, and other members of both councils, including experts
and representatives of Financial Institutions, FinTech firms, IT solution providers, and Cloud
service providers, as well as the observers from government agencies and the central bank.

42

In the future, revisions to the Security Guidelines will be advanced through a permanent
specialized committee on security measures organized by the FISC, based on the content of
the recommendations of both councils. In doing so, plans call for employing discussions fromperspectives that will be easy for those involved in the field in financial information systems
to understand and use, while not deviating from the fundamental principles of therecommendations of the Council of Experts. In addition, since they will reflect thefundamental and broad-ranging recommendations of both councils, plans call for
implementing the most thoroughgoing, large-scale reforms to the Security Guidelines since
their first edition was formulated in 1985.
It is expected that through these revisions, the thinking on new security measures to serve incentral roles in the coming age, as recommended by both councils of experts, will be reflected
appropriately in the Security Guidelines, and that as a result Financial Institutions will be able
to aim to maximize their enterprise value while also ensuring the security of their IT systems
even as they respond appropriately to future environmental changes.

43

List of Members and Observers of the Council of Experts on FinTech in Financial
Institutions(As of June 21, 2017)(Honorifics omitted)
Chair

Shinsaku Iwahara

Professor of Law, Waseda Law School

Assistant
Chair

Masahiro Fuchizaki

Representative Director, President & CEO, the Japan
Research Institute, Limited

Members Kiyoshi Yasutomi

Professor emeritus, Keio University
Visiting Professor of Law School and director,
Legal Education Center,Kyoto Sangyo University
Attorney (Atsumi & Sakai)

Jiro Kokuryo

Vice President/Professor of Faculty of Policy
Management, Keio University

Hiroshi Kamiyama

Attorney-at-law, Partner, Hibiya Park Law Offices

Hideaki Tanaka

Head of Information Tehcnology Risk Management
Department, IT & Systems Planning Division,
Mizuho Financial Group, Inc.
(through fourth meeting)

Kohtaro Mochida

General Manager, IT & Planning Dept., System Risk
Planning Dept.,
Sumitomo Mitsui Banking Corporation(starting with fifth meeting)

Mitsuru Yamada

General Manager, IT Systems Division,
The Nanto Bank, Ltd.

Norifumi Yoshimoto

General Manager, FinTech Business Planning Dept.,
SBI Sumishin Net Bank, Ltd.

Hironori Sanada

General Manager In Charge of Information Systems
Dept., Sumitomo Life Insurance Co.

Toshitsugu Hisai

Associate Director, IT Planning Dept.,
Tokio Marine & Nichido Fire Insurance Co., Ltd.
(through fourth meeting)Koji Kuroyama

General Manager, IT Planning Dept.,
Tokio Marine & Nichido Fire Insurance Co., Ltd.
(starting with fifth meeting)Motohiro Uemura

Deputy Managing Director CIO Office(Executive Director),
Nomura Holdings, Inc.

Mark Makdad

Director,
Fintech Association of Japan

Toshio Taki

Director and Executive Officer,
Head of the Money Forward Fintech Research Institute44

Observers

Hironobu Todoroki

Head of Corporate Management,General Counsel,
Liquid Inc.

Takashi Murakami

Senior Specialist, Business Development Group,
Planning Department, Fourth Financial Sector,
NTT DATA Corporation

Toshiya Cho

Senior Vice president, Financial Innovation Center,
Business Planning Unit, Hitachi, Ltd., Financial
Information Systems Sales Management Division

Daichi Iwata

Senior Manager, FinTech Business Development
Office, Corporate Business Developent Division,
NEC Corporation

Akihiro Umegai

AWS Security Assurance,AWS Security Assurance Lead - Japan/APAC,
Amazon Web Services Japan K.K.

Kappei Uchida

General Manager, Financial Industry, Cloud & Solution
Business Division, Microsoft Japan Co., Ltd.
(through second meeting)Kunihisa Hirahara

Senior Industry Marketing Development Manager,
Financial Service Industry, Industry Sales Group 1,
Microsoft Japan Co., Ltd.
(starting with third meeting)Yasuyuki Ogyu

Director, Deloitte Tohmatsu Consulting LLC

Junichi Kanda

Director, Credit System Office, Planning and
Coordination Bureau, Financial Services Agency

Sayuri Katayose

Head of Information Technology Monitoring team,Inspection Coordination Division,Inspection Bureau,
Financial Services Agency

Daisuke Nakai

Director, Deputy Head of Computer System Risk andBusiness Continuity Group, Examination Planning
Division, Financial System and Bank Examination
Department, Bank of Japan

Akihiko Morota

Director, Cybersecurity Division, List of officials ofCommerce and Information Policy Bureau,
Ministry of Economy, Trade and Industry

Kazuaki Omori

Counselor for Cybersecurity Strategy,
Global ICT Strategy Bureau,
Ministry of Internal Affairs and Communications

45

(Secretariat of the Center for Financial Industry Information Systems)
President

Tatsuo Watanabe

Executive Director

Norikazu Takahashi

Planning Div.

General Manager

Jutaro Kobayashi

Planning Div.

Deputy General Manager

Akira Fujinaga

Planning Div.

Lead Researcher

Hideki Osawa(starting with second meeting)Research Div.

General Manager

Yasushi Nakayama

Security&Audit/
Research Div.

General Manager

Toshinobu Nishimura(through fourth meeting)

Security&Audit/
Research Div.

General Manager

Masaaki Wada
(starting with fifth meeting)General Affairs Div.

General Manager

Kouichiro Mizuno

General Affairs Div.

Special Managing Researcher

Makoto Koriyama

 Secretariat staff
Akihiro Shibata, Fuminori Nakahodo (through fourth meeting), Kazuma Okamoto (throughfirst meeting), Satoshi Miura, Tian Hao

Reference: Council schedule
First meeting: October 5, 2016; second meeting: December 1, 2016; third meeting: February 2,
2017; fourth meeting: March 23, 2017; fifth meeting: May 15, 2017; sixth meeting: June 13,
2017

46

VII. References

47

Reference 1. FinTech-related trends among Banking and Related
Financial Institutions
1. Trends among domestic Financial Institutions
Since 2015, domestic Financial Institutions, centered on major commercial banks and regionalbanks, have issued increasing numbers of press releases in which “FinTech” appears as a
keyword. Their main content is outlined below.
January 2015: Major commercial bank holds FinTech competition
July 2015:
Increasing number of press releases from regional banks(e.g., establishment of sections to promote FinTech)
January 2016: Major commercial banks and regional banks begin feasibility studies on
new technologies
Regional bank enters into an alliance with a FinTech firm
July 2016:
Major commercial bank begins feasibility study on domestic remittances
using block chain technology

Numbers of press releases from domestic Financial Institutions concerning FinTech(Number)
40
35

Major commercial banks
Regional banks

30
25

Tier-II regional banks
Other banks ('net banks)

20
15
10
5
0
Jan.-March April-June July-Sept. Oct.-Dec. Jan.-March April-June July-Sept.
2015
2015
2015
2015
2016
2016
2016
Source: Prepared by FISC based on press releases from Financial Institutions48

2. Sample definitions of FinTech from regulators and others
Japan Revitalization Strategy 2016 (June 2, 2016 Cabinet decision)
In recent years, progress has been made toward fusing finance and IT, under the name
FinTech, and this is bringing about transformations in the financial business andmarkets.
Financial System Council, “Report of the Working Group on Advances in Settlement
Operations etc.”(December 22, 2015)
FinTech is a word made by combining finance with technology. It refers mainly toinnovative financial services using IT. In particular, there have been active moves
toward provision of financial services not provided by traditional banks by IT startups
using IT technology, chiefly overseas.
Ministry of Economy, Trade and Industry, “About the Industry/Finance/IT ResearchGroup (FinTech Research Group)”First Release (October 6, 2015)
Recent years have seen the appearance of startup ventures providing innovative
financial services using IT, known as FinTech, and around the world a movement isapparent toward companies from businesses other than traditional financial businesses,
such as retailers, offering new financial services.
Bank of Japan, “Settlement Systems Report” (March 2016)
FinTech is a word formed by combining finance with technology. It has rapidly started
to attract attention in recent years. While the definition of FinTech is not necessarily
clear, and in many cases its meaning may vary among speakers, in general it often
refers to new types of financial services incorporating new technologies such as
information and communication technologies, or to the movement toward proactively
providing such financial services.

49

3. Trends among Japanese regulators and others(1) Amendments to the Banking Act etc.
The Banking Act and other laws were amended in May 2016, making it possible for Financial
Institutions (or financial groups) to invest in “companies operating in businesses that
contribute, or are expected to contribute, to advancing the banking business or increasing
convenience to users” as subsidiaries, subject to individual approval by regulators. As a result,cases of Financial Institutions (or financial groups) making FinTech firms into subsidiaries inparticipating in FinTech businesses are expected to appear in the future.
(2) The report of the Financial System Working Group and amendments to the Banking Act
etc.
The Financial System Council’s Financial System Working Group began meeting on July 28,
2016 to discuss the ideal forms of regulations targeting intermediaries. It issued a report on its
deliberations on December 27, 2016. That report included recommendations for a systemic
framework for business handling e-commerce settlement and other activities, to encourage
open innovation. Based on this report and other factors, an act on partial amendment of the
Banking Act and other acts was promulgated on March 6, 2017 and passed on May 26 of thesame year.
(3) JBA initiatives
On August 4, 2016 the JBA held the first meetings of its Open API Research Group and its
Research Group on Feasibility of Block-chain Technologies and Related Issues to consider
matters relate dot promotion of financial innovations through FinTech based on the results ofsurveys of individual banks. Each of these groups issued a report in March 2017. (FISC also
participated in both research groups and the Council.)
The JBA survey included the following comment on FISC: “Guidelines such as FISC
Security Guidelines on Computer Systems for Banking and Related Financial Institutions canbe expected both to encourage standardization of security measures and to reduce study timeand cost requirements, by identifying the security measures and other steps that banks shouldtake.”(4) The Financial System Council’s report on advances in settlement operations etc.
The Financial System Council has reported the following matters concerning issues related to
information security and other subjects in the interim report of its Study Group on Advancesin Settlement Operations etc. (issued April 2015)68 and its Report of the Working Group on
Advances in Settlement Operations etc. (issued December 2015)69.

68
69

http://www.fsa.go.jp/singi/singi_kinyu/tosin/20150428-1.html
http://www.fsa.go.jp/singi/singi_kinyu/tosin/20151222-2.html

50Interim report of the Study Group on Advances in Settlement Operations etc.
Chapter 4: Security of Settlement Systems and Information Security;
2. Information Security(2) Future topics
Through now, information security in banking has been addressed basically throughreducing the risk of intrusions by limiting external connections mainly to parties
within the financial industry and having service providers bear responsibility fordamages in the event of a problem.
On the other hand, against a backdrop of developments including advances in IT,
settlement interfaces are expanding to outside of banks, as seen in the examples ofservices such as ’net banking and mobile remittances, and at the same time
unbundling is underway in banking services centered on settlement. Under suchconditions, increasingly diverse players are becoming involved in settlement
information processes.
Under such conditions, there are concerns that the traditional methods of having
service providers bear responsibility for information security measures and achieving
information security by blocking out external networks might not enable sufficientmeasures.
In light of these facts, in the future it will be important to implement information
security measures compatible with adoption of open networks. For this reason, it isthought that for now there is a need to proceed with consideration of matters such as
the following.
 While efforts have been implemented with regard to banks’ net banking and similar
services such as establishment of supervisory guidelines and FISC Security
Guidelines, when diverse players are involved in the settlement information process
it is important to improve information security among such diverse players, not justbanks alone. From this point of view, measures to establish rules and information
security guidelines on which such diverse players can base their measures, and tosecure their efficacy, are important.
 To carry out effective information security measures for open networks, it isessential to implement measures under which banks, other diverse players, andusers each bear certain responsibilities. For this reason, it is expected that
responsibilities and damages in the event of a problem will be divided and, as
necessary, certain reasonable rules will be formed.
 To raise the level of security across open networks as a whole, including outside of
Financial Institutions, information security measures on the part of users of services
as well—not just service providers—are important. From this perspective, it isimportant to implement measures to promote information security efforts by abroad range of related parties, including increasing user literacy, while also giving
consideration to convenience.

51

Report of the Working Group on Advances in Settlement Operations etc.
Chapter 6: Continual Efforts to Advance Settlement
There is a need to shift toward steady activities to advance settlement operations etc., in
accordance with the courses of action discussed above. At the same time, in light of thepossibilities of changes and advances in settlement environments and settlement
services, there is a need to implement continuous strategic initiatives based on the basic
courses of action discussed in this Report.
For this reason, together with following up on the state of progress on efforts towardadvancement of settlement, there is a need to identify issues and actions continually andshift toward implementation of these through public-private partnership, while reflecting
international trends, the state of innovation related to advancement of settlement, andother considerations. It is expected that the Financial Service Agency will implement
efforts toward development of structures for these purposes. Also, in doing so it isimportant to take care to respond appropriately to the issues of stability of the settlement
system and information security.

52

4. Trends in other developed countries(1) United States
At the end of March 2016, the U.S. Office of the Comptroller of the Currency (OCC)
published and requested opinions on the document Supporting Responsible Innovation in theFederal Banking System: An OCC Perspective70.
Noting that national banks have driven innovation for more than 150 years, this document
describes the expectation that they will continue to serve as a source of national strength bydemonstrating their advantages in financial innovation, even as FinTech leads to a breakdownof traditional ways of doing business in the banking industry.

• Innovation has been a hallmark of the national banking system since its founding in
1863 by President Lincoln. That innovative spirit has been especially evident in recent
decades as national banks and federal savings associations have led the way indeveloping and adapting products, services, and technology to meet the changing needsof their customers.
• While banks continue to innovate, rapid and dramatic advances in financial technology(fintech) are beginning to disrupt the way traditional banks do business. As theprudential regulator of the federal banking system, we want national banks and federalsavings associations to thrive in this environment and to continue fulfilling their vitalrole of providing financial services to consumers, businesses, and their communities.
For this purpose, the OCC identifies eight principles for preparing a regulatory framework to
support responsible innovation among federally authorized Financial Institutions.
1. Support responsible innovation.
2. Foster an internal culture receptive to responsible innovation.
3. Leverage agency experience and expertise.
4. Encourage responsible innovation that provides fair access to financial services andfair treatment of consumers.
5. Further safe and sound operations through effective risk management.
6. Encourage banks of all sizes to integrate responsible innovation into their strategicplanning.
7. Promote ongoing dialogue through formal outreach.
8. Collaborate with other regulators.
It also recommends a relationship of mutual collaboration between national banks and
FinTech firms, utilizing the advantages of each.

• By employing their respective advantages, banks and nonbank innovators can benefit
from collaboration. Through strategic and prudent collaboration, banks can gain
access to new technologies, and nonbank innovators can gain access to funding sources
and large customer bases.
Furthermore, effective risk management is identified as a necessary condition.
70

https://www.occ.treas.gov/news-issuances/news-releases/2016/nr-occ-2016-39.html

53• Innovation is not free from risk, but when managed appropriately, risk should not
impede progress. Indeed, effective risk management is essential to responsible
innovation. Banks and regulators must strike the right balance between risk andinnovation.
• As we learned in the financial crisis, not all innovation is positive. . . . The OCC will
support innovation that is consistent with safety and soundness, compliant withapplicable laws and regulations, and protective of consumers’ rights.
Later, in December 2016, the OCC announced a proposal to grant special-purpose nationalbank licenses to some FinTech firms71.
(2) United Kingdom
The British Financial Conduct Authority (FCA) launched Project Innovate in October 2014,
intended to promote more effective competition in financial services through fostering
autonomous innovation. As part of these efforts, implementation plans for a “regulatory
sandbox” under which innovative ideas can be tested with real-world users were released in
December 2015.
At the same time, as requested by Her Majesty's Treasury an Open Banking Working Groupwas established in September 2015, beginning studies toward promotion of open standards forAPIs used in Britain’s banking industry. As a result of such studies, on February 8, 2016 theOpen Banking Standard72 was announced. This report includes a detailed framework for
promoting the Open Banking Standard in the U.K., intended to enable the nation to secure a
position of international leadership in this field and remain an economic and industrial
powerhouse in the new century.

• Leadership in this area will set UK banking apart. It will also set precedents across
many sectors: a strong data infrastructure will be as important to the UK’s economy
today as roads have been to our success in the industrial economy for over a century.
(Underlining added by FISC.)

71
72

https://www.occ.treas.gov/news-issuances/news-releases/2016/nr-occ-2016-152.html
https://theodi.org/open-banking-standard

54

Reference 2. Procedures for application of the Security Guidelines

No

Information systems for e-commercetransactions
FinTech operations provided by businesses
other than Financial Institutions or similarorganizations for users of their own services,
etc.

Yes

Information systems used to handle financial operations, andfor which the Financial Institution or other organization isliableHigh Security Guidelines
Guidelines using terms such as“must” or “necessary”

Risk-based approach employedYes

Are they critical information systems?

Are they computer systems of Banking and Related Financial
Institutions subject to the Security Guidelines?

Information systems handling FinTech
operations

Not subject to Security Guidelines

No

Fully RBA

Security measures may beestablished independently

Simplified RBA

Information systems involving critical externalities
Information systems storing sensitive information(Information systems to which it would be appropriate toapply high Security Guidelines)

55

Minimum necessary
Security Guidelines
Guidelines using terms such as“acceptable”

Reference 3. Thinking on types of FinTech operations
1. Types of FinTech operations subject to consideration
Based on the guidelines for determining information systems subject to the Security
Guidelines and the business forms in which Financial Institutions would not necessarily
occupy positions of leadership, the FinTech operations subject to consideration by theCouncil can be grouped into the following three types.
Types of FinTech operations that should be subject to the Security Guidelines

Type I corresponds to the basic type in which outsourcing is addressed under the existing
Security Guidelines. Type II is a type used in consideration of responsibilities under security
measures when Financial Institutions make FinTech firms subsidiaries under the above May
2016 amendments to the Banking Act and other acts, since responsibilities for subsidiaries
arise in addition to those under security measures73. Type III is a type in which, unlike underType I and Type II, Financial Institutions’ responsibilities under security measures is partial.
2. Basic patterns of related parties when implementing security measures in FinTech
operations
In looking at the tripartite relationship in FinTech operations, it would be beneficial to refer tothe thinking on the basic pattern of a bipartite relationship. In a bipartite relationship, one
party may consist of a single or multiple businesses. The singular case is one pattern. The
73

In the amendments to the Banking Act and other acts in May 2016, the functions that should be performed by a holding company wereclarified in order to enhance business administration in financial groups. Also, Shinsaku Iwahara, Group Governance in Financial Holding
Companies: Interactions between the Banking Act and the Companies Act (3) notes, “Many financial holding companies . . . haveconcluded business administration contracts with subsidiaries calling for them to provide advice and guidance on business administration.”56

multiple cases may involve either multiple Financial Institutions or multiple IT solution
providers.
In the former case, subject patterns in which distinctive properties are considered to arise in
security measures are those of shared system centers and cloud services. The former makes it
possible to improve the efficiency of security measures and other resources, with the results
enjoyed by multiple Financial Institutions (joint nature), while the issue remains of someuncertainty with regard to whether or not the same degree of swift and smoothdecision-making can be achieved as in the case of a single Financial Institution (issue oftimeliness). While the latter does have a joint nature and does not require mutual agreement
among the outsourcers since they are independent of each other (anonymity), it requires
specific care under security measures with regard to control methods such as ascertaining
where data are stored.
In the latter case, if there are multiple outsourcees of Financial Institutions then controls arefeasible directly. For this reason, no distinctive properties arise, and there is no difference
from the singular case. If there are multiple stages of indirect outsourcees due tosubcontracting, then it would be more difficult for Financial Institutions to implement
controls on subcontractors, and for this reason such a pattern will involve some distinctive
properties. (See the Report of the Council of Experts on Outsourcing in Financial Institutions
for more details.)
The above points are summarized below.
Basic types of bipartite relationships
SingularFI

Multiple Financial Institutions

IT

FI

FI

IT

FI
・
・
・

Multiple IT solution providers

Shared System
Center, Cloud

IT

IT

・・・

IT

・・・

・
・

Subcontracting・

FI: Financial Institution; FT: FinTech firm; IT: IT solution provider (including Cloud solution provider) : Outsourcing responsibility

In light of the above, types are considered with regard to a tripartite relationship. However,there is no need to consider patterns for bipartite relationships among the three parties. This isbecause naturally information systems are required when Financial Institutions implement
FinTech operations with FinTech firms, and it is considered common practice that Financial
Institutions and FinTech firms would provide external resources for development andoperation of the information systems needed for this purpose. That is, they would outsourcethese to IT solution providers. (Particularly with regard to FinTech firms that have only justbegun operations, it is said to be common practice to entrust such resources to Cloud service
providers among IT solution providers74.)

74

According to the Bank of Japan’s supplement to its Financial System Report, “New possibilities of financial services arising form IT
advances, and cybersecurity” (March 2016), one point on which FinTech differs from the financial services provided by Financial
Institutions through now is the fact that “proactive use of external resources and services such as cloud services and open-source software
shortens preparatory periods and serves as a strength enabling dynamic service provision.” In addition, the FISC Cloud Council Reportnotes that the Cloud offers benefits including scalability and flexibility suited to a small start, the speed of adoption of new technology, anda high affinity to mobile devices and social medial resulting in increased convenience and functionality.

57

Accordingly, it can be considered sufficient to consider singular and multiple relations among
the three partiers of Financial Institutions, FinTech firms, and IT solution providers 75. First ofall, if any one of the three parties is singular, then since the Financial Institutions always willbe the outsourcers, it would seem appropriate to consider the following three types inaccordance with the combinations of the other two parties.

Conceivable types when the three parties are singular
ExamplesFI

FT

FI provides to its customers, as its own service, aservice that the FT subcontracts to the IT, etc.

IT

(a)

FI

IT

FI adds to some financial services for its customers
provided using the IT a new service from the FT, etc.

FT
(b)

FI

IT

FI receives software and services from the FT,
operated by an IT chosen by the FI, etc.

FT(c)

FI: Financial Institution; FT: FinTech firm; IT: IT solution provider (including Cloud solution providers)

: Outsourcing responsibility

The next subject to be addressed is whether or not there is a basic pattern that should be
employed when any of the three parties under the above patterns consist of more than one
business. First of all, if there are multiple IT solution providers then under the assumption thatthe thinking of the basic bipartite relationship will be employed there would seem to be noneed to envision a new pattern. That is, if there are multiple IT solution providers, who serveas outsourcees to Financial Institutions, then no unique properties would arise because
Financial Institutions can implement controls directly. On the other hand, with regard to acase of subcontracting to multiple IT solution providers through IT solution providers or
FinTech firms, since the Outsourcing Council already has completed comprehensive
consideration of types that have their own distinctive properties, there would seem to be noneed for individual consideration in the Council.
Next, if there are multiple FinTech firms involved, then since it is conceivable based on afocus on the business properties of FinTech firms that Financial Institutions or solution
providers could decide on individual business roles for multiple FinTech firms, no distinctive
properties such as a joint nature will arise. Also, when focusing on the technical properties of
FinTech firms, no difference arises when there are multiple IT solution providers.
Accordingly, even if there are multiple FinTech firms there would seem to be no need forindividual consideration.
75

If the business and technical properties of a FinTech firm can be separated, then theoretically it should be possible to break down into thebipartite relationship. However, since the internal conditions of FinTech firms are diverse it is thought to be difficult to separate theseproperties clearly.

58

Lastly, when multiple Financial Institutions are involved, it would appear that no distinctive
properties would apply other than the joint nature already sorted out through the thinking on
the basic patterns in a bipartite relationship.
For the above reasons, no separate consideration is thought to be necessary when any of thethree parties consists of multiple businesses.
3. Patterns of FinTech operations by type
The patterns of FinTech operations by type on which this consideration should be based arepresented below as a summary of the above points.
Patterns of FinTech operations by type of related party implementing security measures
Type IFI

FTType II

IT

FI

FT

Type III

a

FI

IT

FT

a′

FI

IT

b

FI

IT

FT
b′

FI

FT

FI

IT

IT

FT
c

c′

FI: Financial Institution; FT: FinTech firm; IT: IT solution provider (including Cloud solution provider)→: Full responsibility for security measures: Partial responsibility for security measures: Responsibility for subsidiaries

59

FT

IT

a″

Reference 4. Overview of existing Security Guidelines (related to outsourcing)
Management
phase

No.

1

2

3
a. Whenconsidering
use

Theme

Strength ofcontrols

Security
Guidelines
section no. etc.

RequiredOperation 87
1.
2.

RequiredOperation 108
1.
2.

RequiredOperation 87-1
1.

RequiredOperation 108
1.

Required

Outsourcing
Council ofExperts
IV.4.(1)RequiredOperation 87-1
2.

RequiredOperation 108
3.

recommended

Operation 108
3.

Clarification of purpose
and scope of outsourcing

Clarification of selection
procedures

Objective evaluation

4

Prior conclusion ofNDA

5(If theoutsourced
operations are
not of highimportance)
Objective
evaluation
based ondisclosed
information,
judgments,
performance,etc.

6Prior ascertaining of
migration tasks forcontract suspension
or termination

Acceptable

Operation 108
3.

recommended

Operation 108
3.(11)

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions
subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When using outsourcing, the objectives, scope, etc.
must be made clear in advance.

-

-

-

When selecting outsourcees, the selection
procedures must be made clear.
(This includes establishing in advance the conditions
for selection of subcontractors.)

-

-

-

Outsourcees must be evaluated objectively.
Only outsourcees capable of realizing the outsourced
operations may be selected, based on considerationof the required risk-management levels. In doing so,
it is required that evaluation be conducted based on
evaluating matters such as the properties andbusiness execution capabilities of the outsourcees
and the states of their internal controls and risk
management.

There is a duty to provide
to Financial Institutions
the information needed
for Financial Institutions
to implement objective
evaluation.

There is a duty toevaluate Financial
Institutions’subcontractors
objectively.

There is a duty to provide
to primary outsourcees
the information needed
for primary outsourcees
to implement objective
evaluation.

In conducting such evaluation, it is recommended toconclude a nondisclosure agreement in advance asneeded.

---When there is a possibility that the outsourced
operations might be judged to be not of highimportance based on sufficient consideration of theirproperties in Banking and Related Financial
Institutions, it must be possible to make objective
evaluations based on matters such as public
information and industry evaluations and businessperformance.

-

When it has been
determined that theoutsourced operations
are not of highimportance to Banking
and Related Financial
Institutions, it must be
possible to makeobjective evaluations
based on matters such as
public information andindustry evaluations andbusiness performance ofFinancial Institutions’subcontractors.

-

It is recommended to ascertain system migration
work involved in suspension or termination of theoutsourcing contract (methods of extracting data to
be migrated and content of actual migration work)
prior to starting to use a service.

-

-

-

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

60

Management
phase

No.

Theme

Strength ofcontrols

Required

Security
Guidelines
section no. etc.

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When processing operations that require a highdegree of availability or processing, collecting, orstoring highly confidential customer information, it isrequired to ascertain the region (country, state, etc.)
in which the cloud service is located, to an extent thatmakes it possible to identify what laws andregulations apply.

When processing
operations that require ahigh degree of availability
or processing, collecting,or storing highly
confidential customer
information, there is aduty to provide to
Financial Institutions
information on the region(country, state, etc.) in
which the cloud service islocated, to an extent thatmakes it possible toidentify what laws andregulations apply.

When processing
operations that require ahigh degree of availability
or processing, collecting,or storing highly
confidential customer
information, there is aduty to ascertain theregion (country, state,etc.) in which the cloudservice is located, to an
extent that makes it
possible to identify whatlaws and regulations
apply.

When processing
operations that require ahigh degree of availability
or processing, collecting,or storing highly
confidential customer
information, there is aduty to provide to primaryoutsourcees informationon the region (country,
state, etc.) in which thecloud service is located,
to an extent that makes it
possible to identify whatlaws and regulations
apply.

For systems that require extremely high levels ofavailability or reliability, such as accounting
backbone systems, it is required to ascertain detailed
location information in order to ascertain theconditions of data-center locations and other matters.

For systems that require
extremely high levels ofavailability or reliability,
such as accounting
backbone systems, there
is a duty to provide to
Banking and Related
Financial Institutions
detailed location
information so that they
can ascertain theconditions of data-center
locations and othermatters.

For systems that require
extremely high levels ofavailability or reliability,
such as accounting
backbone systems, there
is a duty to ascertain
detailed location
information in order toascertain the conditionsof data-center locations
and other matters.

For systems that require
extremely high levels ofavailability or reliability,
such as accounting
backbone systems, there
is a duty to provide toprimary outsourcees
detailed location
information so that they
can ascertain theconditions of data-center
locations and othermatters.

It is required to ascertain specific locations in casessuch as when admission to a data center is neededin response to an incident or when conducting an
on-site audit.

There is a duty to provide
to Financial Institutions
specific location
information in cases suchas when they require
entry to a data-center in
response to an incident orwhen conducting an
on-site audit.

There is a duty toascertain specificlocations in cases suchas when entry to a datacenter is needed in
response to an incident orwhen conducting an
on-site audit.

There is a duty to provide
to primary outsourcees
specific location
information in cases suchas when they require
entry to a data-center in
response to an incident orwhen conducting an
on-site audit.

When Banking and Related Financial Institutions
may determine, based on sufficient consideration of
the properties of the operations, that the outsourced
operations are not of high importance, it isacceptable to omit the ascertaining of information on
the locations of data.

-

When Banking andRelated Financial
Institutions may determine,based on sufficientconsideration of theproperties of theoperations, that theoutsourced operations are
not of high importance, it isacceptable to omit theascertaining of informationon the locations of data.

-

If the applicable law for disputes with outsourcees isforeign law or the court with jurisdiction is a foreign
court, risk evaluation must be conducted whenselecting outsourcees.

-

-

-

Operation 108
4.

Ascertaining
locations of data
RequiredDuties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 108
4.

7
a. Whenconsidering
use

Required(If theoutsourced
operations are
not of highimportance)
Requirement toascertain
locations ofdata

8

Risks to beevaluated in
anticipation of
possible disputes
overseas

Operation 108
4.

Acceptable

Operation 108
4.

RequiredOperation 108
5.

61

Management
phase

No.

Theme

9

Approval by person
responsible of selectionof service provider

a. Whenconsidering
use
10

11

(When adopting software
packages)
Development of anevaluation structure andclarification of theoperation andmanagement structures

Concluding contracts
including security
measuresb. Whenconcluding
the contract

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

The approval of the responsible person must be
obtained ultimately for decisions on outsourcees.

-

-

-

Refer to Operations 72, Operations 73 concerning
adoption of applications, services, etc. owned byoutsourcees.

When adopting software
packages, there is a duty
to provide to Financial
Institutions theinformation needed fortheir evaluation of the
packages and similartasks.

When adopting software
packages, there is a duty
to establish structures forevaluation of matterssuch as the efficacy,reliability, and productivityof the packages. Therealso is a duty to makeclear the structures for
package operation andmanagement.

When adopting software
packages, there is a duty
to provide to primaryoutsourcees theinformation needed fortheir evaluation of the
packages and similartasks.

To ensure that outsourced operations are performed
securely, contracts must be concluded withoutsourcees concerning nondisclosure, secure
operation, etc.

To ensure that operations
outsourced by Financial
Institutions are performed
securely, there is a duty
to conclude contracts withFinancial Institutions
concerning
nondisclosure, secure
operation, etc.

To ensure that
outsourced operations
are performed securely,
there is a duty toconclude contracts withFinancial Institutions’subcontractors
concerning
nondisclosure, secure
operation, etc.

To ensure that operations
outsourced by primaryoutsourcees are
performed securely, there
is a duty to conclude
contracts with primaryoutsourcees concerning
nondisclosure, secure
operation, etc.

It must be stated clearly in the contract that Cloud
service providers shall provide the necessary
information based on consultation between Financial
Institutions and Cloud service providers.

There is a duty to stateclearly in the contract withFinancial Institutions
provisions regarding
provision of theinformation needed by
Financial Institutions.

There is a duty to stateclearly in the contract that
Financial Institutions’subcontractors shallprovide the necessary
information based on
consultation withFinancial Institutions’subcontractors.

There is a duty to stateclearly in the contract withprimary outsourcees
provisions regarding
provision of theinformation needed byprimary outsourcees.

If the information subject to a request for disclosure isof a highly confidential nature, it must be provided
after first concluding a nondisclosure agreement
between both parties.

If the information subject
to a request for disclosure
is of a highly confidential
nature, there is a duty toprovide it only after firstconcluding a
nondisclosure agreement
between both parties(Financial Institutions andprimary outsourcees).

If the information subject
to a request for disclosure
is of a highly confidential
nature, there is a duty toprovide it only after firstconcluding a
nondisclosure agreement
between both parties(primary outsourcees andFinancial Institutions’subcontractors).

If the information subject
to a request for disclosure
is of a highly confidential
nature, there is a duty toprovide it only after firstconcluding a
nondisclosure agreement
between both parties(primary outsourcees andFinancial Institutions’subcontractors).

Security
Guidelines
section no. etc.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

RequiredOperation 87-1
3.

RequiredOperation 108
6.

RequiredOperation 87-1
4.

Refer to Operations 72, Operations 73 as necessary
when adopting software packages.
Recommended

Operation 108
7.

RequiredOperation 88
1.

RequiredOperation 109
1.

Required(Note 2)

12

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Strength ofcontrols

Operation 109
1.(9)Disclosure of
information frombusinesses

Required(Note 2)

Operation 109
1.(9)

62

Management
phase

No.

Theme

Disclosure of
information frombusinesses

Strength ofcontrols

Required(Note 2)

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

It must be stated in the contract or SLA that in theevent that a risk event has occurred, or when it has
been determined for example that the risk of
information leakage through various documents has
increased or that the state of internal controls by the
Cloud service provider has worsened, thennotwithstanding the standard assumptions of
information disclosure in normal times when arequest for disclosure has been received from the
Financial Institution the subject information must be
disclosed.

There is a duty to state in
the contract or SLA with
the Financial Institutionthat in the event that arisk event has occurred,or when it has been
determined for example
that the risk of information
leakage through various
documents has increasedor that the state ofinternal controls by the
Financial Institutions’subcontractors has
worsened, thennotwithstanding thestandard assumptions of
information disclosure innormal times when arequest for disclosure has
been received from the
Financial Institution thesubject information must
be disclosed.

There is a duty to state in thecontract or SLA with the
Financial Institutions’subcontractors that in theevent that a risk event has
occurred, or when it has been
determined for example thatthe risk of information leakage
through various documents
has increased or that thestate of internal controls by
the Financial Institutions’subcontractors has
worsened, thennotwithstanding the standard
assumptions of information
disclosure in normal times
when a request for disclosure
has been received from the
Financial Institutions’subcontractors the subject
information must be
disclosed.

There is a duty to state in
the contract or SLA withthe primary outsourcees
that in the event that arisk event has occurred,or when it has been
determined for example
that the risk of information
leakage through various
documents has increasedor that the state ofinternal controls by the
Financial Institutions’subcontractors has
worsened, thennotwithstanding thestandard assumptions of
information disclosure innormal times when arequest for disclosure has
been received from theprimary outsourcees the
subject information must
be disclosed.

When Banking and Related Financial Institutions
have determined, through sufficient consideration of
the priorities of the operations, that the outsourced
operations are not of high importance, it isacceptable not to issue detailed and strict demands
to outsourcees for information such as matters
directly related to risk management.

-

WhenBanking and Related
Financial Institutions havedetermined that theoutsourced operations are notof high importance, it isacceptable not to issuedetailed and strict demands toFinancial Institutions’subcontractors for informationsuch as matters directly
related to risk management.

-

-

-

-

Operation 109
1.(10)

To ensure swift responses in cases such as failures,the relationships of responsibility between outsourcer
Financial Institutions and outsourcees must be madeclear, based on the management capabilities of theoutsourcer Financial Institutions, and businesses
serving as centralized contact points and incoordinating roles among outsourcees must be
decided on in advance.
If the outsourcer Financial Institutions can fulfill thisrole, appointing a business to handle coordination on
the outsourcees’ side is not required.

-

-

-

Operation 109
1.(10)

When, based on sufficient consideration of theproperties of the business,Banking and Related
Financial Institutions may determine that theoutsourced operations are not of high importance,and results of risk analysis show that the scope of the
impact of a failure would be limited or that the impact
can be mitigated even if recovery is delayed, it isacceptable not to appoint a business to handle thecoordination role.

Security
Guidelines
section no. etc.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
1.(9)

12

(If theoutsourced
operations are
not of highimportance)
Detailed andstrict disclosureof information
frombusinesses

b. Whenconcluding
the contract(When outsourcing tomultiple businesses)
Prior decision on abusiness to coordinate
among multiple
businesses

Acceptable

Required(Note 2)

Operation 109
1.(9)

13
(If the outsourced
operations are not ofhigh importance)
Requirement todecide on a businessto coordinate among
multiple businesses

Acceptable

63

Management
phase

No.

Theme

Strength ofcontrols

Requiredb. Whenconcluding
the contract

14

Security
Guidelines
section no. etc.

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

It is required to conclude a contract withconsideration for the right to audit security measuresin accordance with the type and scope of outsourced
operations (e.g., the right to audit outsourcees or theright to have outside specialized agencies conduct
auditing).

There is a duty toconclude a contract withFinancial Institutions withconsideration for the rightto audit security
measures in accordancewith the type and scopeof operations outsourced
by Financial Institutions(e.g., the right to audit
outsourcees or the rightto have outside
specialized agencies
conduct auditing).

There is a duty toconclude a contract withFinancial Institutions’subcontractors withconsideration for the rightto audit security
measures in accordancewith the type and scopeof outsourced operations(e.g., the right to audit
Financial Institutions’subcontractors or theright to have outside
specialized agencies
conduct auditing).

There is a duty toconclude a contract withprimary outsourcees withconsideration for the rightto audit security
measures in accordancewith the type and scopeof operations outsourced
by primary outsourcees(e.g., the right to audit
outsourcees or the rightto have outside
specialized agencies
conduct auditing).

When concluding an outsourcing contract with theoutsourcee in outsourcing of critical information
systems, the authority of Banking and Related
Financial Institutions to audit subcontractors must be
stated clearly, to ensure a system for checking on
subcontractors.

When concluding an
outsourcing contract withFinancial Institutions in
acceptance ofoutsourcing of criticalinformation systems, theauthority of Banking andRelated Financial
Institutions to audit
subcontractors must be
stated clearly, to ensure asystem for checking on
Financial Institutions’subcontractors.

When concluding an
outsourcing contract withFinancial Institutions’subcontractors in
outsourcing of criticalinformation systems to
Financial Institutions’subcontractors, theauthority of Banking andRelated Financial
Institutions to audit
subcontractors must be
stated clearly, to ensure asystem for checking on
Financial Institutions’subcontractors.

When concluding an
outsourcing contract withprimary outsourcees in
acceptance ofoutsourcing of criticalinformation systems, theauthority of Banking andRelated Financial
Institutions to audit
subcontractors must be
stated clearly, to ensure asystem for checking on
Financial Institutions’subcontractors.

It is possible to entrust auditing to an appropriate
auditor instead of conducting it oneself.

-

It is possible to entrust
auditing to an appropriate
auditor instead of
conducting it oneself.

-

When outsourcing information systems other thancritical information systems, it is acceptable not tostate clearly the auditing authority of Banking andRelated Financial Institutions vis-a-vis
subcontractors when concluding a contract with anoutsourcee.

-

When Financial
Institutions outsource
information systems otherthan critical information
systems and do not stateclearly their auditing
authority vis-a-vis
Financial Institutions’subcontractors, it isacceptable not to stateclearly the auditing
authority of Banking andRelated Financial
Institutions vis-a-vis
subcontractors whenconcluding a contract witha Financial Institutions’subcontractor.

-

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 88
4.(15)

Required

Outsourcing
Council ofExperts
IV 4.(2)Acceptable

Outsourcing
Council ofExperts IV 4.(2)Clear statement ofauthority to audit
outsourcees

Acceptable

Outsourcing
Council ofExperts IV 4.(2)64Management
phase

No.

14

15

Theme

Clear statement ofauthority to audit
outsourcees

Clear statement of rightto conduct on-site
auditing etc.

Strength ofcontrols

Acceptable

Required(Note 2)

Security
Guidelines
section no. etc.

17

Clear statement of
substitute measuresinstead of on-site
auditing etc.

Clear statement of rightto conduct on-site
auditing etc.

Required(Note 2)Required(Note 2)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

Even when outsourcing critical information systems,
the above simplified procedures may be used if theoutsourced operations are subdivided among
subcontractors and the relevant subcontracted
operations can be determined to involve sufficiently
low risk levels.

-

When Financial
Institutions outsource
critical information
systems and employ
simplified procedures
because subcontracted
operations have been
determined to involve
sufficiently low risk levels,
the above simplified
procedures may be used
if the relevant
subcontracted operations
can be determined to
involve sufficiently low
risk levels.

-

The outsourcing contract must state clearly the rightof outsourcer Banking and Related Financial
Institutions to conduct on-site auditing and similar
activities.

There is a duty to stateclearly in outsourcing
contracts with Financial
Institutions that Banking
and Related Financial
Institutions have the rightto conduct on-site
auditing and similar
activities.

There is a duty to stateclearly in outsourcing
contracts with Financial
Institutions’subcontractors thatprimary outsourcees havethe right to conduct
on-site auditing andsimilar activities vis-a-vis
subcontractors.

There is a duty to stateclearly in outsourcing
contracts with primaryoutsourcees the right toconduct on-site auditing
and similar activities
vis-a-vis primaryoutsourcees and others.

Instead of conducting direct on-site inspections,client Financial Institutions may substitute verification
by independent third parties who possess the skills
for on-site inspections and other tasks during normal
times.

Instead of conducting
direct on-site inspections,
Banking and Related
Financial Institutions may
substitute verification by
independent third parties
who possess the skills foron-site inspections andother tasks during normal
times.

There is a duty to enableprimary outsourcees tosubstitute verification by
independent third parties
who possess the skills foron-site inspections andother tasks during normal
times for direct on-site
inspections of Financial
Institutions’subcontractors.

Instead of conducting
direct on-site inspections,primary outsourcees andothers may substituteverification by
independent third parties
who possess the skills foron-site inspections andother tasks during normal
times.

In cases such as when a serious vulnerability related
to Cloud technologies has been identified, when an
incident has arisen in another customer-related
domain at the Cloud service provider, or when an
incident has arisen at another business, it must be
possible to conduct extraordinary third-party audits toconfirm the impact on client Financial Institutions.

There is a duty to enable
extraordinary third-party
audits to confirm theimpact on Banking andRelated Financial
Institutions in cases suchas when a serious
vulnerability related to
Cloud technologies has
been identified, when an
incident has arisen inanother customer-related
domain at the Financial
Institutions’subcontractor, or when
an incident has arisen atanother business.

There is a duty to enable
extraordinary third-party
audits to confirm theimpact on Banking andRelated Financial
Institutions in cases suchas when a serious
vulnerability related to
Cloud technologies has
been identified, when an
incident has arisen inanother customer-related
domain at the Financial
Institutions’subcontractor, or when
an incident has arisen atanother business.

There is a duty to enable
extraordinary third-party
audits to confirm theimpact on primaryoutsourcees and others incases such as when aserious vulnerability
related to Cloudtechnologies has been
identified, when an
incident has arisen inanother customer-related
domain at the company,or when an incident hasarisen at anotherbusiness.

Outsourcing
Council ofExperts IV 4.(2)Operation 109
1.(12)

b. Whenconcluding
the contract

16

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
1.(12)

Operation 109
1.(12)

65

Management
phase

No.

17

18

Theme

(When on-site
auditing etc. islimited)Sharedunderstanding ofconditions forexercise of right toon-site auditing etc.

Clear statement
regarding costs ofaccepting on-site
auditing etc.

Strength ofcontrols

Acceptable

Required(Note 2)

Security
Guidelines
section no. etc.

Operation 109
1.(12)

Operation 109
1.(12)

b. Whenconcluding
the contract

19

20

Clear statement ofauthority to audit
subcontractors

Clear statement on
handing of mattersidentified in on-site
auditing etc.

Required(Note 2)Required(Note 2)

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

Conditions for exercise of the right to conduct on-site
auditing and similar activities are documented asnecessary and both outsourcer Financial Institutions
and Cloud service providers may have a sharedunderstanding of the matter when conducting on-site
auditing or similar activities only if it is not possible touse third-party auditing instead of such activities, or if
it has been determined that such third-party auditing
could not be relied upon.

-

Conditions for exercise of theright to conduct on-site
auditing and similar activities
are documented asnecessary and both primaryoutsourcees and Financial
Institutions’ subcontractors
may have a sharedunderstanding of the matter
when conducting on-site
auditing or similar activities
only if it is not possible to use
third-party auditing instead ofsuch activities, or if it has
been determined by the
Financial Institutions thatsuch third-party auditing
could not be relied upon.

-

Both parties must consult in advance on whether theoutsourcer Financial Institutions or Cloud service
providers would bear the costs of acceptance by the
Cloud service providers of on-site inspections.

There is a duty for bothparties to consult inadvance on whether the
Financial Institutions or
primary outsourcees
would bear the costs ofacceptance by the
primary outsourcees of
on-site inspections.

There is a duty for bothparties to consult in advanceon whether the primaryoutsourcees or Financial
Institutions’ subcontractors
would bear the costs ofacceptance by the Financial
Institutions’ subcontractors of
on-site inspections.

There is a duty for bothparties to consult in advanceon whether the primaryoutsourcees or Financial
Institutions’ subcontractors
would bear the costs ofacceptance by the Financial
Institutions’ subcontractors of
on-site inspections.

It must be stated clearly in the contract between theoutsourcer Financial Institution and the Cloud service
provider that the Financial Institution has the right toconduct on-site auditing of subcontractors when theoperations subcontracted are important ones.

There is a duty for the
Financial Institution tostate clearly in thecontract between the
Financial Institution andthe primary outsourceethat the Financial
Institution has the right toconduct on-site auditingof Financial Institutions’subcontractors and othersubcontractors when theoperations subcontracted
are important ones.

There is a duty for the
Financial Institution tostate clearly in thecontract between the
primary outsourcee andthe Financial Institutions’subcontractors that the
Financial Institution has
the right to conduct
on-site auditing of
Financial Institutions’subcontractors and othersubcontractors when theoperations subcontracted
are important ones.

There is a duty for the
Financial Institution tostate clearly in thecontract between the
primary outsourcee andthe Financial Institutions’subcontractors that the
Financial Institution has
the right to conduct
on-site auditing of
Financial Institutions’subcontractors and othersubcontractors when theoperations subcontracted
are important ones.

It must be stated clearly in the contract that for
matters identified in on-site auditing and similar
activities a reasonable deadline for response,
including correction, shall be established throughconsultation between the outsourcer Financial
Institution and the Cloud service provider andresponses shall be completed by that deadline.

There is a duty to stateclearly in the contract thatfor matters identified in
on-site auditing andsimilar activities areasonable deadline forresponse, including
correction, shall beestablished throughconsultation between the
Financial Institution andthe primary outsourcee
and responses shall becompleted by that
deadline.

There is a duty to stateclearly in the contract thatfor matters identified in
on-site auditing andsimilar activities areasonable deadline forresponse, including
correction, shall beestablished throughconsultation between the
primary outsourcee andFinancial Institutions’subcontractors andresponses shall becompleted by that
deadline.

There is a duty to stateclearly in the contract thatfor matters identified in
on-site auditing andsimilar activities areasonable deadline forresponse, including
correction, shall beestablished throughconsultation between the
primary outsourcee andFinancial Institutions’subcontractors andresponses shall becompleted by that
deadline.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
1.(12)

Operation 109
1.(12)

66

Management
phase

No.

Theme

Strength ofcontrols

Required(Note 2)

21

Clear statement
concerning inspections
etc. by financial
regulators

Required(Note 2)

Security
Guidelines
section no. etc.

22

Clear statement
concerning on-site
investigation upon an
incident

Required(Note 2)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

To facilitate smooth on-site inspections by regulatorsand similar activities, outsourcees’ duty to cooperate
in on-site inspections by regulators and similar
activities must be stated clearly in contracts between
outsourcer Financial Institutions and outsourcees.

To facilitate smooth
on-site inspections byregulators and similar
activities, there is a duty
to state primaryoutsourcees’ duty tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
Financial Institutions andprimary outsourcees.

To facilitate smooth
on-site inspections byregulators and similar
activities, there is a duty
to state Financial
Institutions’subcontractors’ duty tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

To facilitate smooth
on-site inspections byregulators and similar
activities, there is a duty
to state primaryoutsourcees’ duty tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

The duty of subcontractors (including
sub-subcontractors) to cooperate in on-site
inspections by regulators and similar activities must
be stated clearly in contracts between Financial
Institutions and lead subcontractors as well.

There is a duty to stateclearly the duty of
subcontractors (including
sub-subcontractors) tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
Financial Institutions andprimary outsourcees.

There is a duty to stateclearly the duty of
subcontractors (including
sub-subcontractors) tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

There is a duty to stateclearly the duty of
subcontractors (including
sub-subcontractors) tocooperate in on-site
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

Provisions must be stated clearly in the contract
regarding prompt rectification of any matters pointed
out in inspections by regulators and similar activities.

There is a duty to stateclearly provisions
regarding prompt
rectification of any
matters pointed out in
inspections by regulatorsand similar activities incontracts between
Financial Institutions andprimary outsourcees.

There is a duty to stateclearly provisions
regarding prompt
rectification of any
matters pointed out in
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

There is a duty to stateclearly provisions
regarding prompt
rectification of any
matters pointed out in
inspections by regulatorsand similar activities incontracts between
primary outsourcees andFinancial Institutions’subcontractors.

It must state clearly in the contract that if a Financial
Institution has determined that the Cloud service
provider has failed to submit information or that there
are problems with the speed of such provision in acase such as when an incident such as leakage of
information has arisen or there are concerns thatsuch an incident has arisen, or if there are doubts
about the comprehensiveness of the information
submitted, the client Financial Institution itself or asecurity vendor or data forensics vendor specified by
the Financial Institution may conduct an on-site
investigation.

There is a duty to state clearlyin the contract that if the
Financial Institution has
determined that the Financial
Institutions’ subcontractor has
failed to submit information orthat there are problems withthe speed of such provision ina case such as when an
incident such as leakage of
information has arisen or
there are concerns that suchan incident has arisen, or if
there are doubts about thecomprehensiveness of theinformation submitted, theFinancial Institution itself or asecurity vendor or data
forensics vendor specified by
the Financial Institution may
conduct an on-site
investigation.

There is a duty to state clearlyin the contract that if the
primary outsourcee has
determined that the Financial
Institutions’ subcontractor has
failed to submit information orthat there are problems withthe speed of such provision ina case such as when an
incident such as leakage of
information has arisen or
there are concerns that suchan incident has arisen, or if
there are doubts about thecomprehensiveness of theinformation submitted, theprimary outsourcee itself or asecurity vendor or data
forensics vendor specified by
the primary outsourcee may
conduct an on-site
investigation.

There is a duty to state clearlyin the contract that if the
primary outsourcee has
determined that the Financial
Institutions’ subcontractor has
failed to submit information orthat there are problems withthe speed of such provision ina case such as when an
incident such as leakage of
information has arisen or
there are concerns that suchan incident has arisen, or if
there are doubts about thecomprehensiveness of theinformation submitted, theprimary outsourcee itself or asecurity vendor or data
forensics vendor specified by
the primary outsourcee may
conduct an on-site
investigation.

Operation 109
1.(13)

Operation 109
1.(13)

b. Whenconcluding
the contract
Required(Note 2)

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
1.(13)

Operation 109
1.(14)

67

Management
phase

No.

Theme

Strength ofcontrols

Required(Note 2)

22

Security
Guidelines
section no. etc.

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

Agreement must be reached when concluding thecontract on the scope of evidence subject tocollection during investigation and the bearing ofcosts as required for purposes of development of
extraction tools and verification.

There is a duty to reachagreement with Financial
Institutions whenconcluding the contract
on the scope of evidence
subject to collection
during investigation andthe bearing of costs as
required for purposes ofdevelopment of extraction
tools and verification.

There is a duty to reachagreement with Financial
Institutions’subcontractors whenconcluding the contract
on the scope of evidence
subject to collection
during investigation andthe bearing of costs as
required for purposes ofdevelopment of extraction
tools and verification.

There is a duty to reachagreement with primaryoutsourcees whenconcluding the contract
on the scope of evidence
subject to collection
during investigation andthe bearing of costs as
required for purposes ofdevelopment of extraction
tools and verification.

The contract must state clearly that whenmanagement instability has arisen on the part of a
Cloud service provider, then as necessary the client
Financial Institution itself or a specialized vendor
designated by it is permitted to enter the facilities of
the Cloud service provider to preserve customer data
and related works or deliverables.

There is a duty to stateclearly in the contract thatwhen management
instability has arisen on
the part of a Financial
Institutions’subcontractor, then asnecessary it will
cooperate in the client
Financial Institution itself
or a specialized vendor
designated by it entering
the facilities of the
Financial Institutions’subcontractor to preserve
customer data andrelated works ordeliverables.

There is a duty to stateclearly in the contract thatwhen management
instability has arisen on
the part of a Financial
Institutions’subcontractor, then asnecessary the primaryoutsourcee itself or a
specialized vendor
designated by it ispermitted to enter thefacilities of the Financial
Institutions’ subcontractor
to preserve customer
data and related works ordeliverables.

There is a duty to stateclearly in the contract thatwhen management
instability has arisen on
the part of the company
itself, then as necessary it
will cooperate in the
primary outsourcee itself
or a specialized vendor
designated by it entering
company facilities topreserve customer data
and related works ordeliverables.

It must be stated clearly that if the staff responding to
failures at Financial Institutions do not have sufficient
local language abilities then support in Japanese or acontact point for responding to failures at a Japanesesubsidiary of the outsourcee shall be established.

There is a duty to provide
information to Financial
Institutions on provisionof support in Japanese or
establishment of acontact point for
responding to failures at aJapanese subsidiary of
the primary outsourcee if
the staff responding to
failures at Financial
Institutions do not havesufficient local language
abilities.

It must be made clear that
support will be provided inJapanese or a contact
point established for
responding to failures at aJapanese subsidiary of
the Financial Institutions’subcontractor if the staff
responding to failures atprimary outsourcees do
not have sufficient local
language abilities.

There is a duty to provide
information to primaryoutsourcees on provisionof support in Japanese or
establishment of acontact point for
responding to failures at aJapanese subsidiary of
the primary outsourcee if
the staff responding to
failures at Financial
Institutions do not havesufficient local language
abilities.

Since it is anticipated that in the event of an incident
such as a failure or information leakage, tasks
conducted to identify leaked or damaged data andidentify causes could become increasingly complex,
measures must be prepared for securing traceability.

There is a duty to prepare
measures for securing
traceability as requested
by Financial Institutions in
the event of an incident
such as a failure or
information leakage.

There is a duty for
Financial Institutions’subcontractors to takemeasures for securing
traceability at them asrequested by Financial
Institutions in the event of
an incident such as a
failure or information
leakage.

There is a duty to prepare
measures for securing
traceability as requested
by primary outsourcees inthe event of an incident
such as a failure or
information leakage.

Operation 109
1.(14)

Clear statement
concerning on-site
investigation upon an
incident

Required(Note 2)

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
1.(14)

b. Whenconcluding
the contract

23

24(When storing data
overseas)
Clear statement
concerning
Japanese-language
support and setting up a
failure contact point

Preparing to secure
traceability

Required(Note 2)Required(Note 2)

Operation 109
1.(16)

Operation 109
1.(17)

68

Management
phase

No.

Theme

Clear statement
concerning prior review
of subcontractors

25(When outsourcing
an information
system other than acritical information
system)Substitution for priorreview of
subcontractors

b. Whenconcluding
the contract(If the outsourced
operations are not ofhigh importance)
Omission of priorreview of
subcontractors

26

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

To ascertain the state of outsourcing and eliminate
the involvement of inappropriate subcontractors,
when subcontracting outsourced operations
appropriate prior review of the subcontractors must
be conducted.
When outsourcing particularly important operations
such as those involving accounting systems or
systems containing highly confidential customer
data, Banking and Related Financial Institutions must
conduct the prior review themselves.

So that Financial
Institutions can ascertain
the state of outsourcing
and eliminate theinvolvement of
inappropriate
subcontractors, there is aduty for Financial
Institutions’subcontractors to
respond to appropriate
prior review when
Financial Institutions
subcontract outsourced
operations.

So that Financial
Institutions can ascertain
the state of outsourcing
and eliminate theinvolvement of
inappropriate
subcontractors, there is aduty for primaryoutsourcees to conduct
appropriate prior review
of subcontractors whensubcontracting to
Financial Institutions’subcontractors.

So that Financial
Institutions can ascertain
the state of outsourcing
and eliminate theinvolvement of
inappropriate
subcontractors, there is aduty to respond to
appropriate prior review
of Financial Institutions’subcontractors conductedby primary outsourcees
when Financial
Institutions subcontract
outsourced operations.

-

-

-

Outsourcing
Council ofExperts
IV 4.(1)When outsourcing an information system other thana critical information system, if a process of review
and management by outsourcees of subcontractors
is considered to be at least as effective as that of
Banking and Related Financial Institutions, then it isacceptable to replace prior review of individual
subcontractors with confirmation of the results ofverification of the appropriateness of the state ofdevelopment and operation of outsourcees’ review
and management processes by Banking and Related
Financial Institutions in advance.

-

-

-

Acceptable

Operation 109
1.(11)

If Banking and Related Financial Institutions havedetermined that outsourced operations are not highly
important based on sufficient consideration of theirproperties, then risk-management measures such asprior review and everyday monitoring of
subcontractors by client Financial Institutions may be
simplified.

Recommended

Operation 88
5.

It is recommended to reach agreement on service
levels through conclusion of an SLA and confirmationof SLO.

Recommended

Operation 109
2.

There is a duty to reachagreement with Financial
Institutions on service
levels through conclusionof an SLA andconfirmation of SLO.

There is a duty to reachagreement with Financial
Institutions’subcontractors on service
levels through conclusionof an SLA andconfirmation of SLO.

There is a duty to reachagreement with primaryoutsourcees on service
levels through conclusionof an SLA andconfirmation of SLO.

Strength ofcontrols

Security
Guidelines
section no. etc.

Required(Note 2)

Operation 109
1.(11)

Required

Outsourcing
Council ofExperts
IV 4.(1)

Acceptable

SLA

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

69

Management
phase

No.

26

Theme

(If the outsourced
operations are not ofhigh importance)
Omission of
concluding an SLA

Strength ofcontrols

Acceptable

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

If Banking and Related Financial Institutions have,based on sufficient consideration of the properties ofthe operations, determined that the outsourced
operations are not highly important, it is acceptable
to conclude only a standard SLA provided by the
Cloud service provider or to omit conclusion of an
SLA through concluding only a general contract.

-

If Banking and Related
Financial Institutions havedetermined that theoutsourced operations
are not highly importantand have concluded only
a standard SLA provided
by the Financial
Institutions’subcontractors or omitted
conclusion of an SLA
through concluding only ageneral contract, then it isacceptable to conclude
only a standard SLA
provided by the Financial
Institutions’subcontractors or to omit
conclusion of an SLA
through concluding only ageneral contract.

-

-

-

-

Operation 109
4.

To enable continuity of operations even when it
would be difficult to continue the contract with the
Cloud service provider due to violation of the SLA ora change in policy by the Cloud service provider orthe Financial Institution, it is recommended to takesteps in advance to enable migration to substitutecloud services or general outsourcing or migration toan on-premises environment.

-

-

-

Operation 109
4.

If Banking and Related Financial Institutions could,
based on sufficient consideration of the properties ofthe operations, determine that the outsourced
operations are not highly important, then it isacceptable to make preparations in advance for
migration to other outsourcees instead of assuming
the cooperation of the current outsourcees.

Security
Guidelines
section no. etc.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 109
3.

b. Whenconcluding
the contract

Prior preparations for
migration to substituteservices etc.

Recommended

27(If the outsourced
operations are not ofhigh importance)
System migrationplans not assuming
the cooperation ofoutsourcees

Acceptable

Outsourcing of development may be subject to the minimum necessary Security Guidelines (Note 3).
c.
Development

70Management
phase

No.

Theme

Measures to prevent
leakage whenoutsourcing data
management

Encryption of datacollected/transmitted

d. During
operation

Strength ofcontrols

Required

Required

Security
Guidelines
section no. etc.

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When entrusting data management to outsourcees,
measures must be taken to prevent leakage.

When entrusted with data
management from
Financial Institutions,
there is a duty to takemeasures to prevent
leakage as requested by
the Financial Institutions.

When entrusting data
management to Financial
Institutions’subcontractors, there is aduty for the Financial
Institutions’subcontractors to takemeasures to prevent
leakage as requested by
the Financial Institutions.

When entrusted with data
management fromprimary outsourcees,
there is a duty to takemeasures to prevent
leakage as requested by
the primary outsourcees.

Data-management measures such as encryption
must be taken for data that include highly confidential
information such as personal data.
To ascertain the risk of unauthorized access to data
for which encryption is not possible due to thelimitations of specifications (i.e., data processed asplain text), it is required to ascertain encryption
specifications and determine whether or not they
conform to the company’s own risk-management
policies.

There is a duty to takedata-management
measures such as
encryption for data that
include highly confidential
information such as
personal data.
There also is a duty toprovide Financial
Institutions withinformation related toencryption specifications
so that they candetermine whether or notthey conform torisk-management
policies.

There is a duty for Financial
Institutions’ subcontractors totake data-management
measures such as encryption
for data that include highly
confidential information suchas personal data.
To ascertain the risk ofunauthorized access to data
for which encryption is notpossible due to the limitationsof specifications (i.e., dataprocessed as plain text),
there is a duty to ascertain
encryption specifications anddetermine whether or not they
conform to the company’s
own risk-management
policies.

There is a duty to takedata-management
measures such as
encryption for data that
include highly confidential
information such as
personal data.
There also is a duty toprovide primaryoutsourcees withinformation related toencryption specifications
so that they candetermine whether or notthey conform torisk-management
policies.

When entrusting Cloud service providers withmanagement of encryption keys, it is required toascertain sufficiently an overview of the management
measures employed and determine whether they
conform to the company’s own risk-management
policies.

When entrusting
Financial Institutions’subcontractors withmanagement ofencryption keys, there isa duty to provide
Financial Institutions withinformation related toencryption specifications
so that they can ascertain
sufficiently an overview ofthe management
measures employed anddetermine whether or notthey conform to theirrisk-management
policies.

When entrusting
Financial Institutions’subcontractors withmanagement ofencryption keys, there isa duty to ascertain
sufficiently an overview ofthe management
measures employed anddetermine whether they
conform to the company’s
own risk-management
policies.

When entrusting
Financial Institutions’subcontractors withmanagement ofencryption keys, there isa duty to provide primaryoutsourcees withinformation related toencryption specifications
so that they can ascertain
sufficiently an overview ofthe management
measures employed anddetermine whether or notthey conform to theirrisk-management
policies.

It is acceptable to employ token technology that
renders data in the Cloud environment essentiallymeaningless by replacing it with random numbers,
with the original data and token maintained on the
Financial Institutions’ side.
However, when employing tokens as a management
method, suitable management measures such as
token mapping are required on the part of the
Financial Institution.

-

-

-

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 110
1.

Operation 110
1.(1)

28

Checking propriety
of managers ofencryption keys

Substitute measuresinstead of encryption

Required

RequiredOperation 110
1.(2)Operation 110
1.(3)

71

Management
phase

No.

Theme

Data deletion upon
failure or replacement ofstorage devices

Strength ofcontrols

Required

Security
Guidelines
section no. etc.

Operation 110
2.

29
Substitute measuresinstead of acertificate of datadeletion upon failureor replacement ofstorage devices

d. During
operation(When not handling
important data)
Requirement fordata deletion or
destruction

30

Everyday monitoring ofoutsourced operations

Acceptable

Operation 110
2.

Acceptable

Operation 110
2.

RequiredOperation 89
1.
2.
3.

RequiredOperation 90
1.
2.
3.

RequiredOperation 112
1.
2.

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When replacing devices or components due tocauses such as failure of an outsourcee’s storage
device, it is required to employ sufficientmanagement, including data deletion, for suchstorage devices since there is a possibility that theirdevices or components could still contain highly
confidential data concerning Banking and Related
Financial Institutions or their customers.

When replacing devices
or components due tocauses such as failure ofa primary outsourcee’s
storage device, there is aduty to employ sufficientmanagement, including
data deletion, for suchstorage devices asrequested by the
Financial Institution.

When replacing devices
or components due tocauses such as failure ofa Financial Institutions’subcontractor’s storage
device, there is a duty for
Financial Institutions’subcontractors to employ
sufficient management,
including data deletion,
for such storage devices
as requested by the
Financial Institution.

When replacing devices
or components due tocauses such as failure ofa Financial Institutions’subcontractor’s storage
device, there is a duty toemploy sufficientmanagement, including
data deletion, for suchstorage devices asrequested by the primaryoutsourcee.

The contract may stipulate that verification of theefficacy of the data deletion and destruction process
through a request for provision of information madeto the Cloud service providers, auditing, or similar
method may substitute for the issue and obtaining ofa certificate of deletion in the event of damage orreplacement of storage devices.

-

The contract may
stipulate that verificationof the efficacy of the datadeletion and destruction
process through arequest for provision of
information made to the
Financial Institutions’subcontractors, auditing,or similar method may
substitute for the issue
and obtaining of acertificate of deletion in
the event of damage orreplacement of storage
devices.

-

When outsourcees do not handle important data,
they may not need to be required to delete or destroy
data when replacing storage devices etc.

-

-

-

From the perspective of smooth and appropriate
management of outsourcing operations, it is requiredthat the scope of outsourcees’ operations and their
responsibilities and rules that outsourcees’ staff must
follow be made clear and monitored on an everyday
basis.

There is a duty toundergo everyday
monitoring by Financial
Institutions.

From the perspective ofsmooth and appropriate
management ofoutsourcing operations,
there is a duty to ensurethat the scope of
Financial Institutions’subcontractors’
operations and their
responsibilities and rulesthat subcontractors’’ staff
must follow be madeclear and monitored onan everyday basis.

There is a duty toundergo everyday
monitoring by primaryoutsourcees.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

72

Management
phase

No.

Theme

Preparation of a system
auditing structure

On-site auditingd. During
operation

Strength ofcontrols

Required

Required

Security
Guidelines
section no. etc.

Operation 91
1.
2.
3.
4.
5.
6.

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

To ensure the efficacy, efficiency, reliability,
compliance, and security of operation, development,changes, etc. regarding computer systems related tooutsourcing, it is required that a system beestablished under which independent auditors
conduct general auditing and evaluation of thecomputer systems and report the results of suchauditing to top management.

There is a duty toundergo general auditingand evaluation ofcomputer systems
conducted by anindependent auditor
regarding matters suchas operation,
development, andchanges regarding
computer systems related
to the outsourced
operations.

There is a duty toundergo general auditingand evaluation ofcomputer systems
conducted by anindependent auditor toensure the efficacy,
efficiency, reliability,
compliance, and securityof operation,
development, changes,
etc. regarding computer
systems related tooutsourcing.

There is a duty toundergo general auditingand evaluation ofcomputer systems
conducted by anindependent auditor
regarding matters suchas operation,
development, andchanges regarding
computer systems related
to the outsourced
operations.

When a request for provision of information alone is
not sufficient for verifying the appropriateness ofoutsourced operations, it is required to check mattersthrough means such as on-site auditing andmonitoring of Cloud service providers’ offices, data
centers, etc.

When a request forprovision of information
alone is not sufficient forverifying theappropriateness ofoutsourced operations,
there is a duty to undergo
checking of mattersthrough means such as
on-site auditing andmonitoring by Financial
Institutions of thecompany’s own offices,
data centers, etc.

When a request forprovision of information
alone is not sufficient forverifying theappropriateness ofoutsourced operations,
there is a duty to check
matters through means
such as on-site auditing
and monitoring of
Financial Institutions’subcontractors’ offices,
data centers, etc.

When a request forprovision of information
alone is not sufficient forverifying theappropriateness ofoutsourced operations,
there is a duty to undergo
checking of mattersthrough means such as
on-site auditing andmonitoring of thecompany’s own offices,
data centers, etc.

In cases such as when on-site monitoring ofoutsourcees would not be effective, it may bereplaced by third-party auditing.

-

In cases such as whenon-site monitoring of
Financial Institutions’subcontractors would not
be effective, it may bereplaced by third-party
auditing.

-

It is required to choose an audit firm with no external
appearances that would lead to suspicions of aconflict of interest with Cloud service providers froman independent, third-party point of view.

As requested by Financial
Institutions, there is aduty to choose an audit
firm with no external
appearances that would
lead to suspicions of aconflict of interest withFinancial Institutions froman independent,
third-party point of view.

As requested by Financial
Institutions, there is aduty for Financial
Institutions’subcontractors to choose
an audit firm with noexternal appearancesthat would lead tosuspicions of a conflict ofinterest with Financial
Institutions’subcontractors from an
independent, third-party
point of view.

As requested by primaryoutsourcees, there is aduty to choose an audit
firm with no external
appearances that would
lead to suspicions of aconflict of interest withprimary outsourcees froman independent,
third-party point of view.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 112
2.

31

Acceptable

Operation 112
3.

Third-party auditing

Required

Outsourcing
Council ofExperts
Footnote 40(Note 4)73

Management
phased. During
operation

No.

31

Theme

(If the outsourced
operations are not ofhigh importance)
Management
measures based on
cost-benefit analysis

Measures fornondisclosure, privacy,
and fraud prevention
upon termination of thecontract

Types of datadeletion methodse.
Termination

Strength ofcontrols

Acceptable

Required

Required

Security
Guidelines
section no. etc.

Substitutemeasuresinstead ofcertificate ofdeletionrecommended

Acceptable

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When the importance of outsourced operations is notvery high, means such as third-party certification may
be used instead of on-site auditing based on a
cost-benefits perspective.

-

When Banking andRelated Financial
Institutions havedetermined that theimportance of outsourced
operations is not very
high, means such as
third-party certification ofoperations outsourced to
Financial Institutions’subcontractors may be
used instead of on-site
auditing based on a
cost-benefits perspective.

-

Upon the end of the outsourcing contract, it isrequired to take measures to protect confidential
information, protect privacy, and prevent
improprieties, in order to prevent leakage of data.

Upon the end of theoutsourcing contract,
there is a duty to takemeasures to protect
confidential information,
protect privacy, andprevent improprieties asrequested by Financial
Institutions.

Upon the end of theoutsourcing contract,
there is a duty for
Financial Institutions’subcontractors to takemeasures to protect
confidential information,
protect privacy, andprevent improprieties asrequested by Financial
Institutions.

Upon the end of theoutsourcing contract,
there is a duty to takemeasures to protect
confidential information,
protect privacy, andprevent improprieties asrequested by primaryoutsourcees.

Conceivable means of data deletion are physicaldeletion and logical deletion.
Physical deletion is recommended in cases of future
hardware upgrades and removal.
Note: Use of logical deletion only also is acceptable.

There is a duty to conduct
logical deletion of data as
requested by Financial
Institutions.

There is a duty for
Financial Institutions’subcontractors to conduct
logical deletion of data as
requested by Financial
Institutions.

There is a duty to conduct
logical deletion of data as
requested by primaryoutsourcees.

It is recommended to obtain a certificate of deletion
when outsourcees delete data.

There is a duty to submit
a certificate of deletion to
the Financial Institution
when deleting data.

There is a duty to obtain acertificate of deletion
when Financial
Institutions’subcontractors delete
data.

There is a duty to submit
a certificate of deletion to
the primary outsourcee
when deleting data.

Instead of requiring the issue and obtaining of acertificate of deletion, the contract may stipulate that
outsourcees delete data, including logical deletion,and have the appropriateness of the deletion processverified through means such as auditing by anindependent third party.

-

Instead of requiring theissue and obtaining of acertificate of deletion, thecontract may stipulatethat Financial Institutions’subcontractors delete
data, including logicaldeletion, and have theappropriateness of thedeletion process verified
through means such as
auditing by anindependent third party.

-

Operation 112
4.

Operation 111
1.

Operation 111
2.

32
Receipt of certificate
of deletion

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Operation 111
3.

Operation 111
3.

74

Management
phase

e.
Termination

No.

Theme

32

(Outsourcingthat does not
involve
handling ofconfidential
information)
Simplification ofdata deletion
process etc.

Strength ofcontrols

Acceptable

Requiredf. Upon an
incident

33(Important systems)
Emergency responses
including subcontractors

Required

Required

Implementation of risk
management(Note 5)

Security
Guidelines
section no. etc.

Operation 111
4.

Duties borne as Financial
Institutions’ primaryoutsourcees(Duties B-1)

Duties borne by Financial
Institutions’subcontractors(Duties B-2)

Duties borne as Financial
Institutions’subcontractors(Duties C)

When entrusting to outsourcees operations that do
not involve handling of confidential information suchas customer data, it is conceivable that the datadeletion process upon the end of the contract could
be simplified or unnecessary, and a certificate ofdeletion might be unnecessary as well.

-

-

-

When outsourcing critical information systems,
formulation of a CP including outsourcees or
subcontractors is required.

When entrusted by a
Financial Institution with acritical information
system, there is a duty toformulate the company’s
own CP so that it includes
Financial Institutions andFinancial Institutions’subcontractors.

When outsourcing criticalinformation systems to a
Financial Institution’s
subcontractor, there is aduty to formulate the
Financial Institution’s
subcontractor’s CP sothat it includes the
Financial Institution andthe Financial Institution’s
primary outsourcees.

When entrusted by aprimary outsourcee with acritical information
system, there is a duty toformulate the company’s
own CP so that it includes
Financial Institutions andprimary outsourcees.

When outsourcees and others prepare CPs
individually, their content must be fully consistent andcomplementary with that of the CPs of individual
Banking and Related Financial Institutions.

When Banking andRelated Financial
Institutions prepare CPs
individually, there is aduty for their content tobe fully consistent andcomplementary with thatof the company’s own
CP.

When Financial
Institutions’subcontractors and otherorganizations prepare
CPs individually, there isa duty for their content tobe fully consistent andcomplementary with thatof the CP of each primaryoutsourcee.

When primaryoutsourcees and otherorganizations prepare
CPs individually, there isa duty for their content tobe fully consistent andcomplementary with thatof the company’s own
CP.

During normal times, Banking and Related Financial
Institutions must conduct periodic drills jointly withoutsourcees and subcontractors, based on the CPs
concluded with outsourcees and others.

During normal times,
there is a duty to conductperiodic drills jointly with
Banking and Related
Financial Institutions’subcontractors, based on
the CPs concluded with
Banking and Related
Financial Institutions.

During normal times,
there is a duty toparticipate in periodic
drills conducted jointlywith Financial Institutions
and Financial Institutions’subcontractors, based on
the CPs concluded withFinancial Institutions’subcontractors andothers.

During normal times,
there is a duty to conductperiodic drills jointly withFinancial Institutions andprimary outsourcees,
based on the CPs
concluded with primaryoutsourcees and others.

Duties of Financial Institutions when using
outsourcing(Duties A) (Note 1)

Outsourcing
Council ofExperts
IV 4.(3)Outsourcing
Council ofExperts
IV 4.(3)Outsourcing
Council ofExperts
IV 4.(3)Operation 90-1

75

(Note 1) Duties of Financial Institutions when using outsourcing (Duties A)
Applicable content reproduced from FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions (Ver. 8), Security Guidelines on Computer
Systems for Banking and Related Financial Institutions(Ver. 8, supplemented and revised), and the Report of the Council of Experts on Outsourcing in Financial Institutions(Note 2) p. 22, Security Guidelines on Computer Systems for Banking and Related Financial Institutions (Ver. 8, supplemented and revised)
Items for which it is noted as “Required” to state matters clearly in contracts in the Cloud Report are ones that can be considered related to outsourcing in on-premises and shared systemcenter forms. For this reason, in this table these are indicated as “Recommended.”(Note 3) p. 43, Report of the Council of Experts on Outsourcing in Financial Institutions
Outsourcing of development of important information systems (including not only that conducted during development but also that conducted during consideration of use, whenconcluding the contract, and upon termination) may be subject to the minimum necessary Security Guidelines stipulated within the extent of the purposes of reducing uncertainty of
security measures.
(Note 4) Footnote 40, Report of the Council of Experts on Outsourcing in Financial Institutions
The FISC System Audit Guidelines for Banking and Related Financial Institutions(Rv. 3, supplemented) states under Part 1; Chapter III; 5. Key Points of Auditing Cloud Services; (1)Consideration of Joint Auditing of Cloud Service Providers Using Third-Party Auditing that in selection of an auditor, “As a Financial Institution bearing responsibilities to its customers,
there is a need to select an auditor that from the view of a third party would not appear to involve any concerns of conflict of interest with the cloud service provider. For this reason, theoutsourcer Financial Institution needs to select for joint auditing an auditor not involved in the account auditing of the cloud service provider. Also, if selecting an auditor that is involved in
SOC2 or IT7 guarantees for the cloud service provider, there is a need to select auditing staff not involved in SOC2 or IT7 guarantees for the cloud service provider.
(Note 5) Footnote 12, FinTech Council Report
For cases in which the Financial Institution does not play a leading role, under Operation 90-1 the Security Guidelines include guidelines on service use that differ from those on
outsourcing. These guidelines state, “As with management of outsourcing, in many cases it is difficult or inefficient for a Financial Institution to select a service provider from multiple
options and conduct risk management itself,” indicating that the degree of responsibility borne by Financial Institutions in security measures should be understood to be more limited thanin the case of general outsourcing. However, these guidelines apply to systems and networks linking Financial Institutions and not to the customer services considered herein.

76

Reference 5. Thinking on the principle of equivalency
The principle of equivalency refers to the concept of ensuring that the effects of security
measures for information systems handling financial operations are equivalent regardless ofwhich related parties are involved in such security measures. This principle is explained
below, while touching on the relationship between the principle of equivalency andredistribution rules and perusing the processes from risk evaluation through decision on andimplementation of security measures.
1. Processes through implementation of security measures in accordance with thebasic principles thereof(1) Risk evaluation and decision-making by top management
First of all, goals to be achieved by security measures and individual security measures
themselves are derived based on IT governance in accordance with the basic principles of
security measures.

Security
measures
Security
measuresAccepted

Follow-up

Mutual adjustment

Expected results of security
measures

Goals of security measures

ReducedSecurity
measures

Information system risks

Allocation ofmanagement resources
Comparison andbalancing of
security measuresand follow-up
measures

Coordination withnew development

Coordination withmanagement
resources as awholemeasures

Financial Institutions ascertain the properties of risks through risk evaluation of information
systems. Top management decides on the degrees to which to reduce risks or to which totolerate risks76 in accordance with the risks of information systems. They also decide on thegoals to be achieved by security measures as means of reducing risks. Decisions are made on
the goals to be achieved by security measures and individual security measures themselves inaccordance with the properties of the related risks, while referring to the Security Guidelines.
Top management makes decisions on allocation of resources to security measures with thegoal of maximizing. enterprise value though measures taken such as adjustment of allocationof management resources as a whole. In doing so, the goals to be achieved are mutually
adjusted while comparing and balancing the costs of security measures taken to reduce risks
and the subsequent costs that might arise if not implementing the security measures. Next,
76

Aside from reduction and tolerance, other options include transfer, through insuring against damages in the event a risk occurs, andavoidance, by not using information systems for which such management responsibilities would arise.

77

adjustments are made with other areas to which resources could be allocated, such as
investment in new development, within the information systems budget. Lastly, allocation ofmanagement resources as a whole is adjusted, above and beyond the information systems
budget.
(2) Allocation of duties related to security measures and achievement of related results

Goals of security
measures

Reduction

Security
measureOutsourceesITsolutionproviders

Security
measureIT systems

Security
measure

IT riskmanagement
etc.

Financial
Institutions

Effects of security
measures

Next, the duties related to security measures derived are allocated among related parties andsecurity measures are implemented.

After top management has made decisions on the goals to be achieved by security measuresand allocation of management resources, security measures are implemented undermanagement by multiple related parties (e.g., IT risk-management sections, IT sections, andoutsourcees). In implementing these, roles (duties) are identified (allocated) among relatedparties in accordance with individual security measures.
In general, duties related to security measures are allocated to the two parties of outsourcees
responsible for the technical aspects of security measures and Financial Institutions. Financial
Institutions select outsourcees who already possess the ability to carry out security measuresand ultimately bear the costs of performance of this duty by outsourcees, as outsourcing costs.
The aim is to achieve the results of security measures and reduce system risk to an acceptable
degree as decided by top management.
2. Allocation of duties related to security measures in FinTech operations and theprinciple of equivalency
In FinTech operations in which FinTech firms take part as parties related to security measures,
there is a need for efforts to reduce risks to the same degree as when financial-related services
are conducted by the two parties of Financial Institutions and IT solution providers. This isreferred to as the “principle of equivalency.”
However, when FinTech firms also are involved, if the duties traditionally expected of IT
solution providers are demanded of FinTech firms instead, then only FinTech firms capable ofperforming the same duties as IT solution providers would be chosen.

78

FinTechfirms
Financial
Institutions
Principle ofequivalency

Effects of security
measures

Goals of security
measures

ReductionITsolutionprovidersITsolutionproviders

Financial
Institutions

Expected distributionof duties

Bearable duties

Results ofredistributionITsolutionprovidersITsolutionproviders
FinTechITsolutionproviders
FinTechFinTech
firms

firms

firms

Financial
Institutions

RedistributionEvaluation

Financial
Institutions

Financial
Institutions

Effects of
security measures

However, in the case of FinTech there is a need to consider the perspective of enjoying thebenefits of innovation, and for this reason rules are needed on redistribution of duties.

Principle ofequivalency

Specifically, redistribution of duties is a measure intended to balance enjoyment of thebenefits of innovation with ensuring system security (principle of equivalency) in a case inwhich the results of evaluation during selection show that FinTech firms lack full ability to
execute security measures. In the example above, Financial Institutions would bear some ofthe duties of FinTech firms.
An extreme example of such redistribution would be a case in which a FinTech firm would
bear no duties at all. However, since under the principle of making businesses involved inprovision of financial-related services subject to such duties it would not be appropriate forsuch a party to implement no security measures at all, there is a minimal level of duties that
FinTech firms must bear as responsible business, and these duties cannot be redistributed.
Also, redistribution of duties and the principle of equivalency are concepts that can apply bothto cases in which Financial Institutions play a leading role in financial-related services (i.e.,
FinTech firms serve as outsourcees) and cases in which FinTech firms play a leading role (i.e.,
outsourcing applies mutatis mutandis to FinTech firms).
While such redistribution of duties is one option that Financial Institutions traditionally areable to employ at their discretion, by proactively describing it clearly in the Security
Guidelines it is expected that relations with FinTech firms will advance and innovation will
be encouraged.

79

Reference 6. Prospectusonestablishment
oftheFinancial
Mechanization Foundation (tentative name) (excerpted)
September 1984
PurposeAutomation of financial systems has been advancing rapidly in recent years, and it is expectedthat in the future this will have major and complex effects on management of Financial
Institutions, on relations between the financial industry and other industries, and, as a result,on credit discipline in Japan.
In particular, in light of the facts that the financial system involves funds settlement functions
necessarily used in the activities of various economic sectors and development of
third-generation online systems connecting Financial Institutions with non-Financial
Institution third parties is advancing rapidly, it is conceivable that there will be a need toresolve quickly and steadily the various issues that may arise with regard to automation offinancial systems in general, including those related to ensuring security, in order to facilitate
the smooth advancement of financial automation systems.
Since such issues involve a wide range of industries, in consideration of related matters it canbe considered essential to obtain the cooperation of related parties including Financial
Institutions, insurers, securities companies, hardware and software makers,
telecommunications carriers, central bank and regulators. That is, it would appear to benecessary both to advance various measures to ensure security through consolidation ofknowledge, experience, information, and other resources based on sufficient communication
among such related parties and to advance appropriate planning, proposal, development,
implementation, and other activities.
In light of this point of view, in order to address the various issues related to financial
automation systems in an efficient and flexible way, it would seem to be appropriate to form aprivately funded independent, neutral institution with the participation of the above relatedparties, to effect environmental improvements to demonstrate the vitality of the private sector.
The cooperation of related parties is requested, based on their support of the purpose
described above.
Activities(1) Planning, investigation, and research concerning financial transactions, legal matters,
investment, burdens on beneficiaries, international relations, and other matters withregard to financial automation systems(2) Ascertaining and disclosing the state of failures and criminal activities related tofinancial automation systems, and promoting security measures through means
including formulation of security guidelines(3) Implementing investigation and research on joint projects related to financial
automation systems, facilitation and intermediation related to financial automation
systems, system audits, and training, seminars, and public-relations activities, among
other activities(Underlining added by FISC.)

80

Reference 7. Cloud usage
As of FY2015, about one-half of Banking and Related Financial Institutions either currently
used the Cloud or were considering doing so. These numbers are increasing from year to year,
without showing a bias toward any specific systems.
Trends in Cloud use
50.0%
45.0%
9.0%

40.0%

9.2%

35.0%
10.5%

30.0%

13.0%

25.0%

In use（total）

12.4%

12.9%
15.3%
12.0%

20.0%

Use planned/underconsideration
In use (private)

6.0%
4.8%

7.9%

15.0%
4.0%
20.9%

10.0%
5.0%

17.4%

16.7%

16.5%
13.0%

10.7%

In use (community)
In use (public)

0.0%
FY2010 FY2011 FY2012 FY2013 FY2014 FY2015

In use (total)

Cloud usage environments
Institutions

500
450
400

96
86

350
73

300

89

Email systems

95

250

81

Sales support systems
88

200

54

Internal information-sharing
systems
Scheduling systems

35

39

Backbone systems

69

74

FY2014FY2015

80
77

150
43

100
50

49
35
49

Other systems

0
FY2013

Source: Results of FISC survey of Financial Institutions

81

Reference 8. Trends among overseas regulators regarding use of cloudservices
In recent years, progress has been made on formulation of guidelines on use of cloud services
by Financial Institutions not only in Japan but in other developed countries as well.
In the United States, in July 2012 the Federal Financial Institutions Examination Council(FFIEC) released “IT Handbook: Outsourcing Booklet: Outsourced Cloud Computing” 77. In
addition, it appears that new studies are underway in the U.S. in light of growing use of public
Cloud services.
In the United Kingdom, in July 2016 the Financial Conduct Authority (FCA) issued the“Guidance for firms outsourcing to the ‘cloud’ and other third-party IT services”78.
Below, the thinking of overseas regulators concerning security measures when using cloudservices is described with a focus mainly on the U.S. and the U.K., based on the above
published documents along with an interview conducted by the FISC with the Office of theComptroller of the Currency (OCC).
1. Basic thinking on risk management in cloud services
Even when Financial Institutions outsource operations to Cloud service providers, they needto implement controls similar to those in place when conducting such operations in-house andto carry out controls and risk management to ensure that risks do not increase compared toin-house operations.
“(Even if the institution engages in cloud computing,) outsourced relationships should be
subject to the same risk management . . . that would be expected if the Financial Institution
were conducting the activities in-house.” (U.S.)“A firm should . . . as part of the due diligence exercise, ensure that in entering into an
outsource agreement, it does not worsen the firms operational risk.” (U.K.)
2. Thinking on controls
With regard to controls, the focus is on control methods corresponding to individual
management phases, such as objective evaluation when considering use, the content ofcontracts concluded, and monitoring during operation.
“Matters that are important first of all when using a public Cloud are due diligence whenconcluding a contract and the content of the contract itself. Furthermore, monitoring after
concluding the contract also is important. For example, monitoring of the service levelagreement is an effective form of monitoring, since it makes it possible to identify any
problems with a Cloud service provider in advance.” (U.S.)
At the same time, the content of technical controls is entrusted to the Financial Institutions,and thus the Financial Institutions need to understand technology sufficiently and use it
appropriately.
77
78

http://ithandbook.ffiec.gov/media/153119/06-28-12_-_external_cloud_computing_-_public_statement.pdf
https://www.fca.org.uk/publication/finalised-guidance/fg16-5.pdf

82

“A basic principle of supervision is that Financial Institutions choose which technologies
to use. Regulators do not issue instructions on such choices. Similar degrees of internal
controls and management are required no matter which technologies are used.” (U.S.)“With regard to security measures, regulators do not issue instructions concerning
individual technologies, such as requiring use of encryption or firewalls. This is because
technologies can change. It is enough if effective and valid security measures are
implemented. For example, an encryption tool provided by a Cloud service provider might
be used. In such a case, if staff of the Cloud service provider have keys to decrypt the data,then there is a risk that they could view the information they contain. At the same time,machines require maintenance, and it is understandable that the Cloud service provider’sstaff may need to possess such keys. Accordingly, in such a case it would be acceptable if
the Financial Institution took measures to ascertain who on the staff of the Cloud service
provider possesses such keys, and for what purposes. With regard to firewalls andintrusion detection systems as well, Financial Institutions need to understand theirstructures and test them to ensure that they operate properly.” (U.S.)
3. Thinking on auditing authority
In their contracts with Cloud service providers, Financial Institutions need to makearrangements to ensure that effective controls can be implemented.
“A firm should . . . know whether its contract with the service provider is governed by thelaw and subject to the jurisdiction of the United Kingdom. If it is not, it should still ensure
effective access to data and business premises for the firm, auditor and relevant regulator.”(U.K.)In the U.S., except in cases as stipulated in the law governing handling of personallyidentifying information (the Gramm-Leach-Bliley Act), there is no enforceable requirement todefine auditing authority vis-a-vis Cloud service providers clearly in the contract. It can besurmised that this reflects the background factor of the fact that in the U.S., under the Bank
Service Company Act, regulators can audit directly IT solution providers to which bankoperations are outsourced.
“Banks should have auditing authority over Cloud IT solution providers, and this pointshould be stipulated in the contract. However, this is a best practice and is not enforced onbanks by regulators. Legally, banks are free to determine what to stipulate in theircontracts.” (U.S.)“IT solution providers to which numerous banks outsource accounting systems are subject
to joint inspection by the Office of the Comptroller of the Currency (OCC), the Federal
Deposit Insurance Corporation (FDIC), the Federal Reserve Board (FRB), and others,
and reports on such inspection are provided to the Financial Institutions using the IT
solution providers.” (U.S.)
In addition, the efficacy of guarantee audit reports prepared by auditors as requested by Cloud
service providers themselves is regarded highly.

83

“Major Cloud service providers undergo auditing by independent auditors and submit totheir customers guaranteed audit reports in accordance with the standards of theAmerican Institute of Certified Public Accountants. Since for practical purposes this issufficient in terms including its scope, there is no need for Financial Institutions to conduct
additional auditing after receiving such a report. As a practical matter it is unlikely that amajor Cloud service provider with thousands of customers would be able to undergo
individual auditing by each of its customers. However, it is recommended to provide in thecontract for additional auditing if this report is inadequate.” (U.S.)
4. Thinking on locations of data storage
There are no regulations that require domestic storage of data. Wherever data are stored, theyneed effectively to be accessible to Financial Institutions and regulators. For this reason, thelocations of data storage need to be ascertained.
“Specific regulatory requirements for some firms . . . require effective access to data
related to the outsourced activities for regulated firms, their auditors, regulators andrelevant competent authorities. The term ‘data’ has a wide meaning. It includes but is not
limited to firm, personal customer and transactional data, but also system and process
data: for example Human Resource vetting procedures or system audit trails and logs. A
firm should . . . ensure that data are not stored in jurisdictions that may inhibit effective
access to data for UK regulators.” (U.K.)“While there is no regulatory requirement for domestic storage of data in the United States,
the data must be acceptable when needed to the same extent as they would be if they werestored in the U.S.” (U.S.)“When using a public Cloud service as well, the geographical scope of data storage mustbe established and the bank must be able to monitor them. Regulators will inspect whether
the bank monitors whether or not data are transferred to places where they should not be.”(U.S.)
5. Thinking on advanced nature of technology
While Financial Institutions choose from a diverse range of Cloud services the forms best
suited to their own needs, they need to understand the boundaries of their own responsibility
in accordance with the form chosen and to control risks appropriately. They also need torecognize the possibility of new risks arising and to understand their content in advance andtake measures as necessary. One anticipated new risk is that of the mutual effects on systemsof anonymous users.
“Among public Cloud services, PaaS and IaaS services involve higher risks borne by
Financial Institutions than do SaaS services. It is important that Financial Institutions
understand this. Also, migration to the Cloud of systems with more of a core nature results
in increased risks. However, regulators feel that the level and understanding of major IT
solution providers are high, and in many cases Financial Institutions actually learn from
IT solution providers.” (U.S.)“While it would be preferable for Financial Institutions’ data to be stored in a fixed form,
if they were stored together with that of a gaming company, for example, then the level ofrisk might increase accordingly. For example, there is a need for verification of whether or84

not a Financial Institution would be affected by hacking of another user on the same
hardware even if the Financial Institution itself were not hacked.” (U.S.)“A firm should . . . consider how data will be segregated (if using a public cloud).” (U.K.)
6. Thinking on business continuity planning
Business continuity planning needs to be discussed and documented with outsourcees inadvance, and its efficacy needs to be verified periodically through drills.
“Data redundancy needs to be covered in the contract in advance. Also, when covering
redundancy in the contract it is necessary to understand how it is achieved in practicalterms and to test whether or not it truly functions as anticipated.” (U.S.)“A firm should have in place appropriate arrangements to ensure that it can continue tofunction . . . in the event of an unforeseen interruption of the outsourced services. (A firm)should: document its strategy for maintaining continuity of its operations, including
recovery from an event, and its plans for . . . regularly testing the adequacy andeffectiveness of this strategy.” (U.K.)7. Other matters“Managing a cloud computing service provider may require additional controls if theservicer is unfamiliar with the financial industry and the Financial Institution’s legal andregulatory requirements for safeguarding customer information and other sensitive data.
Additionally, the use of such a servicer may present risks that the institution is unable orunwilling to mitigate.” (U.S.)In Japan, Cloud service providers are provided with opportunities to deepen theirunderstanding of the financial business through means including joining FISC andparticipation in meetings such as those of the Council of Experts.

85Reference 9. Collective consideration of the checklist used in API
connection
The document Report of Review Committee on Open APIs : Promoting Open Innovation(Interim Summary [Draft]) published by the JBA states, “To lessen the burden of responding
to review on the part of firms connected with multiple banks through APIs, agencies related to
information security are expected to establish API Connection Checklists (tentative name)consisting of the items that need to be confirmed and those already confirmed independently,
for use when banks review the suitability of other parties connecting via API.”In response to this statement, in February 2017 the API Connection Checklist Working Group(“Checklist WG” hereinafter) was established, with FISC serving as its secretariat. Its
activities include consideration of the content of controls carried out in the entry management
phase—that is, the common portions of the checklist used in objective evaluation of parties
connecting via APIs (“Checklist” hereinafter).
Since an open API is one method of realizing Type III in the FinTech Council, considerationof the Checklist needs to be advanced in consistency with the content of opinions offeredconcerning Type III in the FinTech Council. That is, there is a need for consideration
conscious of the interrelations among groups studying FinTech-related security measureswhile reflecting the “Rules on mutatis mutandis application of outsourcing guidelines” and“minimum necessary Security Guidelines.”79
Also, from the perspective of lessening the burden on FinTech firms, it is recommended that asocially normative Checklist be established, and for this purpose it is recommended that
related parties involved in API connection—Financial Institutions, FinTech firms, and IT
solution providers—take part in the process of considering the Checklist, with the aim ofbuilding consensus.
In establishing the Checklist, the above collective consideration shall be conducted, and when
deliverables have been brought together as a result, such deliverables shall be handled as partof the content of opinions offered by the FinTech Council. In addition, even in a case such as
when environmental changes have arisen it is expected that the above collective consideration
would be conducted and the content of deliverables would be reviewed, implemented, andmanaged continually.
It is expected that related parties involved in API connection would use such deliverables as
effective materials in accordance with the actual states of Financial Institutions, aiming bothto secure overall security and to carry out innovation.

79

The minimum necessary Security Guidelines will be established as guidelines to which businesses involved in provision offinancial-related services, including those connecting via APIs, should refer. Until they are established, it is recommended to refer inconsideration of related matters at least to the basic components of abilities to execute security measures (Footnote 26).

86

Reference 10. Topics addressed by the Council and countermeasuresagainst them
TopicsSubject to application of Security Guidelines (topics in application)
Type I

Type II

Type III

Sometimes lacking
in balance withFinTech firms’
ability to
implement
standards.

Sometimes it may
be a burden to
FinTech firms to
respond to
Financial
Institutions’businessmanagement andoutsourcee
management.

Security standards need to be
applicable flexibly to a wide
range of types.

Open API
Lessening the burden
on FinTech firms of
responding to controls

Not subject toapplication
There areexpectations for
implementationof appropriate
security measuresin a seamless,inseparable
manner for thefinancial-related
services known
as FinTech ingeneral.

Counter
measures

Redistribution
rules

Supplemental
consideration ofType II(II3,P17)(II6,P21)

Rules on mutatis
Ideal forms of
mutandissecurity measuresapplication of
based on groupoutsourcing
consideration
guidelines(II4,P19)

Principles
applicable tobusinesses
involved infinancial-related
service provision(V,P38)Separable systems (II7,P23)
Supplemental consideration of risk-management measures when using
Cloud services (IV,P31)
Principle of cooperation (II5,P20)

Principle of equivalency (II1,P10 & Reference 5)

87(III3,P28)