Cyber and Operational Resilience: Escalating Enforcement Actions

Overview

Regulatory enforcement for cyber and operational resilience failures is active and multi-jurisdictional, targeting both financial and non-financial technology firms. The Hong Kong Monetary Authority (HKMA) reprimanded ePaylinks Technology Co., Limited and ordered it to pay a pecuniary penalty of HKD 1,000,000 for contraventions of the Payment Systems and Stored Value Facilities Ordinance.

In the UK, the Financial Conduct Authority (FCA) imposed a cancellation on Toza Payment Technology Limited for failures in its payment service activities and regulatory obligations. In the US, the Securities and Exchange Commission (SEC) brought settled charges against Equiniti Trust Company LLC for failing to protect client funds against cyber intrusions. The SEC also charged Intercontinental Exchange, Inc. and nine affiliates, including the New York Stock Exchange, for failing to timely inform the Commission of a cyber intrusion, as required by Regulation SCI.

Separately, a FINRA Order Accepting an Offer of Settlement involved Jeffrey Alan Stanley in a case concerning the 'banking-as-a-service' business model. These actions demonstrate a consistent regulatory focus on operational integrity and disclosure across payment systems, securities markets, and fintech platforms.

Key Enforcement Actions

Recent enforcement actions highlight regulatory focus on cyber intrusion reporting, client fund protection, payment systems compliance, and financial reporting failures.

The Hong Kong Monetary Authority (HKMA) reprimanded ePaylinks Technology Co., Limited and ordered it to pay a pecuniary penalty of HKD 1,000,000 for contraventions of the Payment Systems and Stored Value Facilities Ordinance.

In the United States, the Securities and Exchange Commission (SEC) pursued actions concerning cyber intrusion reporting and client fund protection. The SEC charged Intercontinental Exchange and nine affiliates, including the New York Stock Exchange, for failing to inform the Commission of a cyber intrusion. In a separate action, the SEC charged Equiniti Trust Co for failing to protect client funds against cyber intrusions.

Multiple penalties relate to persistent financial reporting failures. The German Federal Financial Supervisory Authority (BaFin) documented several fines against ZhongDe Waste Technology AG. The Federal Office of Justice imposed a disciplinary fine of EUR 750,000 on ZhongDe Waste Technology AG in February 2022. A further fine of EUR 1,000,000 was imposed on ZhongDe Waste Technology AG in April 2024. Additional fines of EUR 50,000 were imposed on ZhongDe Waste Technology AG in November 2023. Another fine of EUR 50,000 was imposed on ZhongDe Waste Technology AG in May 2026. A further fine of EUR 50,000 was imposed on ZhongDe Waste Technology AG in May 2026.

These actions demonstrate a pattern of non-compliance with securities and financial reporting obligations over several years. The penalties against ZhongDe Waste Technology AG illustrate a sustained regulatory response to these failures. The HKMA action against ePaylinks Technology Co., Limited underscores the importance of compliance with payment systems regulations. The SEC's charges against Intercontinental Exchange and its affiliates highlight the critical need for timely cyber intrusion reporting. The case involving Equiniti Trust Co further emphasises the regulatory expectation for robust client fund protection against cyber threats.

Analysis

The enforcement data reveals distinct patterns in regulatory action. A clear trajectory of escalating penalties is evident in the case of ZhongDe Waste Technology AG. BaFin, acting through the Federal Office of Justice, imposed a series of disciplinary fines on the firm: EUR 50,000 in October 2022, EUR 750,000 in February 2022, a further EUR 50,000 in November 2023, and a final fine of EUR 1,000,000 in April 2024. This progression demonstrates a regulatory response that intensifies with repeated or unresolved compliance failures concerning securities reporting obligations.

Simultaneously, regulators are applying enforcement frameworks to novel business structures. FINRA's action against Jeffrey Alan Stanley specifically addresses the 'banking-as-a-service' model, where fintech companies provide online banking to end users. The settlement order indicates that established regulatory expectations for oversight and control are being enforced within these emerging operational frameworks, treating them as extensions of traditional financial services.

Furthermore, actions extend beyond monetary penalties to address core operational duties. The SEC's settled charges against Equiniti Trust Company LLC, formerly American Stock Transfer & Trust Company, centre on the firm's failure to protect client funds from cyber intrusions. This case underscores that the duty to safeguard assets is a fundamental obligation, with enforcement triggered by a breach of that duty, irrespective of whether a specific monetary penalty is publicly quantified in the settlement. The pattern connects disclosure failures, escalating fines for persistent issues, and the application of core protective duties to new and traditional business models alike.

Regulatory Implications

The enforcement actions demonstrate a clear regulatory focus on operational resilience, extending supervisory reach beyond traditional financial institutions to their technology and service partners. The Hong Kong Monetary Authority's action against ePaylinks Technology Co., Limited, resulting in a HKD 1,000,000 penalty, directly targets a payment service provider under specific financial legislation.

This scope is mirrored by the UK Financial Conduct Authority's cancellation of Toza Payment Technology Limited's permissions for failures in its payment service activities. Similarly, the SEC's action against Equiniti Trust Co for failing to protect client funds from cyber intrusions highlights that critical market infrastructure providers, like transfer agents, are held to stringent safeguarding standards.

The regulatory net also captures IT and fintech service models. The SEC charged DXC Technology Co for misleading non-GAAP disclosures, while a FINRA settlement involving Jeffrey Alan Stanley concerned the 'banking-as-a-service' model. These cases show that the provision of technological or operational support to the financial sector does not insulate firms from enforcement for core governance, disclosure, or control failures.

Collectively, these actions signal that regulators view the operational integrity of the entire financial services ecosystem as a foundational supervisory concern, applying enforcement tools to a broad range of entities within the value chain.

Key Takeaways

* The Hong Kong Monetary Authority (HKMA) reprimanded ePaylinks Technology Co., Limited.
* The HKMA ordered ePaylinks Technology Co., Limited to pay a penalty of HKD 1,000,000.
* The Federal Office of Justice imposed a disciplinary fine of EUR 1,000,000 on ZhongDe Waste Technology AG.
* The SEC charged Equiniti Trust Co with failing to protect client funds against cyber intrusions.
* The SEC charged Intercontinental Exchange and nine affiliates, including the New York Stock Exchange, for failing to timely inform the SEC of a cyber intrusion.
* These actions demonstrate a consistent regulatory focus on operational integrity and disclosure.

About the Data

This analysis uses 30 topic-filtered actions linked to official regulatory sources across 10 regulators: HKMA, BaFin, CSSF, SEBI, FSMA, SEC, OSC, FCA, FINRA, OCC. The records cover 2021-12-20 to 2026-05-22. 8 records contain a monetary penalty verified against the evidence contract. Monetary values retain their source currency; GBP-normalised values are reserved for explicitly labelled aggregate charts. Other records may describe cancellations, prohibitions, investigations, orders or sanctions whose monetary value is not verified. The selection supports this article's analysis but is not a complete catalogue of every action in the period.