the issuer has stated publicly its intention to broaden the range of permitted usages and to apply for dtc status. although there are no candidates at present, it would be open to other non - bank issuers to go down the same route – in which case, if we received an application, we would want to be sure that the issuer was financially sound and that the card scheme itself is sound in terms of chip security and risk management policies and procedures surrounding it. when it comes to electronic banking channels, our regulatory approach is, at this stage, less specific in nature. the first step is to know what the banks are actually up to in areas such as internet banking. we therefore issued a letter to authorised institutions in 1997 saying that while banks do not need to seek formal approval from the hkma to offer their services through the internet, they should discuss with us in advance their plans to do so. this is to enable the hkma to assess whether the institution ’ s proposed internet banking system is sound and the service provided through the internet will have adequate security. note that we are not looking for absolute security. this does not exist in either the electronic or physical world of banking. however, the level of security should be “ fit for purpose ”, i. e. appropriate to the type of transactions to be conducted. the important thing is for the banks to undertake a rigorous analysis of what their security needs are in the context of the particular service that they are planning to offer. the hkma therefore expects that the security aspects of the system will have been reviewed by qualified independent experts and that the risk management systems and internal controls will be reviewed and evaluated on a regular basis e. g. by external or internal auditors. we also discuss with the banks their approach to the other types of risk described earlier, with particular focus on how the risks from the internet banking service are shared between the bank and its customers. apart from these general considerations, a number of specific issues arise in relation to internet banking. the first is how we would treat the pure internet bank, i. e. a “ virtual bank ” that delivers its services entirely over the internet. if such a bank wished to be authorised to take deposits in hong kong, it could not be allowed to exist wholly in cyberspace. it would need to have a physical establishment here, either as a locally incorporated bank or as a branch of a foreign bank. this would be necessary to provide a point of contact with the bank

will feel more comfortable with a name that they know and trust, and perhaps one whose name they see everyday in the street on signs above physical bricks and mortar. so banks with an existing brand name still have some advantage, but it is not something that can be wholly taken for granted. the banks will have to work hard to maintain and build their brand image, and to offer products which differentiate themselves from their competitors. this is a tough challenge, but it is one which the boards and senior management of banks in hong kong will have to confront. operational risk operational risk, including security risk, is of course one of the more frequently mentioned risks in connection with electronic banking. security is not a new risk. we are all familiar with the various security issues that banks are facing on a day - to - day basis, e. g. robberies, thefts of atm machines, frauds. however, banking transactions over the internet do pose new issues. a major concern about the internet is its open nature. in relation to banking on the internet, this translates into increased risk of unauthorised access to, and alteration of, information. accordingly, the fundamental objectives that internet security arrangements should try to achieve are to : • restrict access to the system to those users who are authorised ; • authenticate the identity and authority of the parties concerned to ensure the enforceability of transactions conducted through the internet ; • maintain the secrecy of information while it is in passage over the communications network ; • ensure that the data has not been modified either accidentally or fraudulently while in passage over the network ; and • prevent unauthorised access to the bank ’ s central computer system and database. the security of transactions over the internet was one of the issues that was considered by a study group on electronic banking formed by the hkma in july 1997. the results of this exercise were published as an article in our quarterly bulletin in november of the same year. based on the work of the study group, the hkma takes the view that developments in internet security technology have generally reached a point where adequate security for banking transactions is obtainable in a commercially viable manner. the use of sophisticated cryptographic techniques, firewalls and other security tools can provide security that is comparable to that offered in physical transactions. however, as with a physical transaction, the effectiveness of such measures is largely dependent on their proper implementation and the establishment of a set of comprehensive policies and procedures that are rigorously enforced. however, it should be