The SEC's New Cybersecurity Disclosure Rules – New Requirements For Foreign Private Issuers

On 26 July 2023, the US Securities and Exchange Commission (the "SEC") adopted rules requiring registrants to disclose material cybersecurity incidents and certain information regarding their cybersecurity risk management, strategy, and governance. Under the final rules, foreign private issuers ("FPIs") will be required to furnish on Form 6-K information on material cybersecurity incidents that they disclose or otherwise publicize in a foreign jurisdiction, to any stock exchange, or to security holders. They will also be required in their annual report on Form 20-F to (i) describe the board of directors' oversight of risks from cybersecurity threats and (ii) describe management's role in assessing and managing material risks from cybersecurity threats. The SEC stated in the adopting release that "FPIs' cybersecurity incidents and risks are not any less important to investors' capital allocation than those of domestic registrants".