NZX exposes own shortcomings

New Zealand’s share market operator NZX says it failed to meet its own technology standards when a series of cyberattacks disrupted trading on its platform earlier this year.

It says its standards were also not met when high volumes of trading in March and April caused issues around clearing and settling trades.

Recommended improvements to its systems would likely come at a cost to listed companies, it said.

In a statement to the market yesterday morning, NZX said its board had commissioned and considered reviews by independent service providers into the incidents. ‘‘NZX accepts that it did not meet its own high standards in certain areas of its technology systems,’’ it said.

NZX has not made the reports public.

NZX needed to further invest in technology in 2021, particularly in the markets businesses, in order to enhance the stability and resilience of its technology, it said.

This included improving the ‘‘securities IT team’’ and cybersecurity counter-measures.

A major upgrade to its core trading system scheduled for around the end of March was well advanced, it said.

NZX chief executive Mark Peterson said it had delivered on a number of actions recommended by the reviews with others under way.

Recommendations included formalising its ‘‘technology subcommittee of the NZX board’’ and enhancing relationships and communications with its ‘‘ecosystem’’.

A range of what the NZX called ‘‘technical hygiene improvements’’ were recommended, including extending crisis management planning and bolstering NZX’s IT organisational structure with some specific specialist skill sets.

Peterson said NZX initiated its technology infrastructure modernisation programme in 2017, with $12 million invested over the fouryear period to 2020.

NZX had strengthened its Distributed Denial of Service (DDoS) defences following the cyberattacks and increased the resilience and stability of its systems, Peterson said.

NZX shared the reports with the Financial Markets Authority (FMA) and expected it would need to agree a formal action plan with the FMA in response to its findings once finalised, he said. Only then would NZX be in a position to quantify likely incremental technology costs.

‘‘NZX accepts that it did not meet its own high standards in certain areas of its technology systems.’’