Provides financial services, in Saint Lucia

Virtual Asset Business Act, 2022 (No. 24 of 2022), s. 12(7)(b) · Read the law's page

• This binds a person licensed by the Financial Services Regulatory Authority under the Virtual Asset Business Act, 2022 (No. 24 of 2022) to offer or operate a virtual asset business in or from Saint Lucia: an exchange between a virtual asset and fiat currency, an exchange between forms of virtual assets, a transfer of a virtual asset, the safekeeping or administering of a virtual asset, or participating in or providing financial services related to the issue or sale of a virtual asset (sections 2(1), 3 and 4(1)) (reached by declaring that you are a crypto-asset provider).
• Implement and maintain policies for the virtual asset business to protect the operations of the licensee, and the personal information the licensee collects and stores, from cyber threats (section 12(7)(b)); this duty is stated separately from the policy duty to comply with the Data Protection Act in section 12(7)(a).

ECCB Technology Risk Management Standard, Roles and Responsibilities and Information Security User Group (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 · Read the law's page

• This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says it should be applied by all regulated licensed financial institutions, and their financial groups and conglomerates, unless information technology is not a significant function or alternative measures of equal effect have been taken.
• Explain any deviation from the Standard in a separate document, and make that document promptly available to the ECCB when it asks (Scope of Application, paragraph (c)).
• Have your board ensure the development of a robust cyber-risk management framework, with effective internal controls and risk management practices aimed at continuous security, reliability, resilience and recoverability (Board of Directors, item a).
• Have your senior management implement the board approved cyber security strategies, policies and framework, and develop and implement a cybersecurity incident response plan that details the steps to be taken in the event of a security breach (Senior Management, items a and e).
• Run a training program on IT security policies and procedures that is conducted and updated at least annually and reaches all employees, including senior management (Senior Management, item h).
• Establish an Information Security User Group (ISUG) that shares strategic, operational and tactical cybersecurity information and intelligence among the banking community on an automated platform (paragraph 12.7.3).

ECCB Technology Risk Management Standard, paras. 12.8.1 to 12.8.5 and Senior Management items f and g (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 · Read the law's page

• This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says it should be applied by all regulated licensed financial institutions, and their financial groups and conglomerates, unless information technology is not a significant function or alternative measures of equal effect have been taken.
• Alert the ECCB and your Information Security User Group within 24 hours of becoming aware of a cyber-incident (paragraph 12.8.1).
• Complete the Appendix I cyber-incident report and submit it to the ECCB within 48 hours of the incident; the Standard says you should do so, and Appendix I instructs you to submit the form within 48 hours of a suspected or confirmed cyber-incident (paragraph 12.8.1 and Appendix I).
• Provide updates on the incident to the ECCB at the frequency the ECCB determines, until the ECCB deems the incident resolved (paragraph 12.8.4).
• After the cyber-incident is resolved, conduct a post-incident review and submit it to the ECCB; the review should at a minimum include lessons learnt and a plan of action to address identified deficiencies and IT controls (paragraph 12.8.5).
• Notify directly each customer whose account was potentially or actually compromised within seventy-two (72) hours of the discovery of the incident, and notify the general public about the incident after notifying the ECCB (Senior Management, items f and g).

ECCB Electronic Banking Standard, incident reports (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.7, 5.11.2 and 6.4, with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 · Read the law's page

• This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says licensed financial institutions must apply it based on the scope and level of sophistication of their e-banking operations and functions.
• Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
• Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services, and identify and notify the affected customers (paragraph 5.2.7).
• Report to the Central Bank the incidents you deem significant, meaning those that may compromise your operations or pose a threat to financial stability; the Standard says these should be reported (paragraph 5.2.7).
• Have a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and for informing the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).

ECCB Electronic Banking Standard, security controls (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.1 to 5.2.8 and 6.4, with Banking Act, No. 3 of 2015, ss. 75, 80 and 184 · Read the law's page

• This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says licensed financial institutions must apply it based on the scope and level of sophistication of their e-banking operations and functions.
• Put in place the security control infrastructure needed to secure your e-banking systems and data from internal and external threats, including authorisation, logical and physical access controls (paragraph 5.2.1).
• Implement a comprehensive security process with policies and procedures for incident prevention and response, covering physical controls, specialised staff to maintain security policies, logical controls and monitoring of network intrusion attempts, and ongoing review and testing of security measures and controls (paragraph 5.2.2).
• Reinforce information security controls to preserve the confidentiality and integrity of customer data, classify e-banking data and systems by sensitivity, and use mechanisms such as encryption, firewalls, access control and data recovery plans to protect all sensitive and high-risk e-banking systems (paragraph 5.2.4).
• Employ appropriate systems to reduce external threats to e-banking systems, including virus-scanning software at critical entry points, intrusion detection software and other security assessment tools, and penetration testing of internal and external networks (paragraph 5.2.8).
• Submit the security process you have implemented to the Central Bank (paragraph 6.4).