Securities and Exchange Commission (SEC) has given capital market operators three days to submit their cybersecurity risk assessment reports as part of efforts to strengthen the financial sector’s resilience against cyber threats and emerging digital risks.
The commission, in a circular dated November 2, 2026, directed all capital market operators to complete the cybersecurity assessment form on its electronic portal on or before November 5, 2026.
The directive requires affected operators to ensure that their submissions reflect their current cybersecurity risk profiles, providing the information needed to assess the level of cyber risks facing the financial sector.
In the circular, the Commission stated that the exercise was necessary to facilitate an effective assessment of cybersecurity risks across the financial sector.
The exercise is part of broader initiatives by the financial sector, through the Inter-Agency Cybersecurity Technical Working Group of the Financial Services Regulation Coordinating Committee (FSRCC), to strengthen cybersecurity risk management and resilience across the industry.
According to the commission, the initiatives include developing a strategic cybersecurity risk management framework for the financial sector and conducting a sector-wide cybersecurity risk assessment to identify threats, vulnerabilities and emerging risks.
The programme also seeks to develop and promote appropriate cybersecurity frameworks, standards and guidelines to help financial sector institutions manage risks associated with cyber threats.
The commission said the initiatives would also strengthen coordination and response mechanisms for significant cyber incidents affecting the financial sector.
The directive comes amid the growing importance of digital systems in financial services, including securities trading, investment transactions and the management of investors’ information.