Code of Practice for Payment Card Scheme Operators

inSight

14 Dec 2006

Code of Practice for Payment Card Scheme Operators

The new Code of Practice for Payment Card Scheme Operators reflects a strong commitment to the safety and efficiency of payment card operations in Hong Kong.

Readers may recall a large-scale leak of credit card data in the US last year (the CardSystems incident). Although the incident did not occur in Hong Kong, many card holders here were affected. The incident aroused public concern about the data security of card operations. It also reminded us that we should not take the card payment services we enjoy for granted.

The HKMA does not have regulatory power over card scheme operators or the contractors involved in the card operations. Nevertheless, with the enactment of the Clearing and Settlement Systems Ordinance (CSSO) in 2004, we do have an interest in assessing whether any of the payment systems, including retail payment systems, are likely to affect monetary or financial stability or Hong Kong's status as an international financial centre, and whether to designate them under the Ordinance1. The daily average transaction volume attributable to credit and debit cards issued in Hong Kong is about $1 billion. This amount is relatively small compared with the $600 billion for the interbank payment systems. However, more than 10 million credit cards and 15 million debit cards have been issued in Hong Kong. Although retail card payment systems are not yet developed to a stage that is significant for the purpose of designation under the CSSO, the potential impact of any security incident should not be overlooked and the public concern over the CardSystems incident was well justified. We therefore felt that something should be done to safeguard public confidence in card payment systems. This is in the interest of consumers and those involved in the card payment systems, including the card scheme operators themselves.

To address this issue, the HKMA has taken the lead in working with all the major card scheme operators in Hong Kong (in alphabetical order): American Express, China UnionPay, Diners Club, EPS, JCB, JETCO, MasterCard, and Visa. These operators support our goal of promoting the safety and efficiency of credit and debit card operations in Hong Kong and fostering public confidence in the card operations, and agreed that the best way to do this was to develop a Code of Practice for the industry. This follows the successful precedent of the Code of Banking Practice for the banking sector, and is consistent with the approach we have been adopting for multi-purpose stored value cards (a Code of Practice was issued by Octopus Cards Limited in August 2005).

After comprehensive discussions, the Code, the first of its kind for the credit and debit card industry in Hong Kong, has been drawn up by the operators and endorsed by the HKMA. A large part of the Code is devoted to safety issues including operational reliability, business continuity, network security and data integrity, since these are the areas which concern the public the most. In particular, the Code sets out how the card scheme operators should monitor their contractors and the reporting mechanism if a security incident occurs. If a security breach does occur, we believe we will be in a better position to deal with it effectively and quickly. The Code also contains provisions on operational efficiency, transparency of fees and charges, and governance arrangements, all of which we believe are as important as security in fostering public confidence in payment cards. Under this self-regulatory approach, the card scheme operators will conduct annual self-assessments of their compliance with the Code, and the HKMA will monitor its overall implementation. This approach is similar to the approach adopted for the Code of Banking Practice.

With the commitment of card scheme operators, we hope the Code will provide additional comfort to credit card and debit card holders.

Raymond Li
14 December 2006

1. Section 4(1) of the Clearing and Settlement Systems Ordinance provides that the Monetary Authority may, by notice published in the Gazette, designate for the purposes of this Ordinance any clearing and settlement system "if, in the opinion of the Monetary Authority, the system is or is likely to become a clearing and settlement system whose proper functioning is material to the monetary or financial stability of Hong Kong or to the functioning of Hong Kong as an international financial centre."

Click here for previous articles in this column.

Document in Word format

Latest inSight
Last revision date : 14 December 2006