Provides financial services, in Fiji

Prudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), para. 17 · Read the law's page

• This binds a commercial bank, credit institution, insurance company, insurance broker, securities exchange, management company of a managed investment scheme, stock broker, the Fiji National Provident Fund, the Fiji Development Bank or a restricted foreign exchange dealer supervised by the Reserve Bank of Fiji (reached by declaring that you provide financial services); it does not reach any other business.
• Notify the Reserve Bank of Fiji within 24 hours after becoming aware of a cybersecurity incident that materially affects or has the potential to materially affect, financially or non-financially, your institution or the interests of depositors, policyholders, fund members, investors or the general public who use your services (para. 17.2).
• Report cybersecurity incidents in the format the Reserve Bank prescribes as Appendix 2 to the Policy (para. 17.1).
• Keep reporting operational risk incidents under BSPS No.16, the Reserve Bank's minimum requirements for the management of operational risk, as well: the cyber incident reporting time differs from that one, and you report both (footnote 4 to para. 17.2).

Prudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), paras. 4 to 16 · Read the law's page

• This binds a commercial bank, credit institution, insurance company, insurance broker, securities exchange, management company of a managed investment scheme, stock broker, the Fiji National Provident Fund, the Fiji Development Bank or a restricted foreign exchange dealer supervised by the Reserve Bank of Fiji (reached by declaring that you provide financial services); it does not reach any other business.
• Establish and maintain a documented cybersecurity risk management framework that is part of your enterprise risk management framework, is approved by your board and is regularly reviewed (paras. 4.1 and 4.2.1).
• Have in place a cybersecurity policy commensurate with your exposures to vulnerabilities and threats, covering cybersecurity risk identification, measurement, monitoring and control (para. 4.4.1).
• Establish a designated cybersecurity risk management function headed by a Chief Information Security Officer or an equivalent senior officer (para. 4.2.3).
• Establish, document and implement policies and procedures to control access to your information assets (para. 7.1.1), and obtain information about technical vulnerabilities of your information systems in a timely fashion, evaluate your exposure to them and implement appropriate measures (para. 10.6.1).
• Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals at a minimum for high risk systems and processes, and before such systems are introduced (para. 15.3(a)).
• Develop and implement a third-party relationship policy that mandates cybersecurity controls to address the risk posed by third-party access to your information assets (para. 13.2).
• Have a cybersecurity incident management process governed by a documented policy and procedures (para. 14.1).
• Give the Reserve Bank a copy of your cybersecurity policy and all relevant policies and procedures within 12 months of the Policy's implementation, and a copy of any major revision within 30 days after your board approves it (para. 18.1). Full compliance was required within one year of the Policy's effective date of 31 March 2023 (para. 19.1).

Fair Reporting of Credit Act 2016, ss. 3, 4, 13, 14, 20 and 22 · Read the law's page

• Do not establish, operate or conduct business as a credit reporting agency in Fiji unless the Reserve Bank of Fiji has licensed you.
• If you are a credit reporting agency, comply with the regulations and rules made under the Act, the Reserve Bank's directions and the code of conduct it issues.
• If you are a credit reporting agency, retain positive credit information for 2 years after the credit is repaid, and negative information for 2 years after the credit is regularised or the arrears paid.
• If you are a credit reporting agency, give a person a copy of the credit information you hold on them, correct it on request, and let the person challenge its accuracy.
• If you are a credit reporting agency, submit to the Reserve Bank an annual compliance report certified by an independent auditor, covering the accuracy of the information, complaints and the adequacy of your data-confidentiality procedures.
• Do not receive credit information unless you are registered with the Reserve Bank as a credit report recipient, and do not provide credit information unless you are registered as a credit information provider; a utility provider must register as both.