Provides financial services, in Mauritius

Government Notice No. 128 of 2021, made by the Financial Services Commission under section 93 of the Financial Services Act (Mauritius) · Read the law's page

• It reaches you if you provide digital and personalized advisory services through a computer program or artificial intelligence enabled algorithms with limited human intervention, which the Rules call Robotic and Artificial Intelligence Enabled Advisory Services: do not carry out those services without a Robotic and Artificial Intelligence Enabled Advisory Services licence issued by the Financial Services Commission of Mauritius, and apply for it in accordance with Part IV of the Financial Services Act (clauses 2, 3 and 4). A person already carrying out the services when the Rules began had to apply within 3 months of commencement (clause 14).
• At all times keep your principal bank account in Mauritius, an office and relevant infrastructure in Mauritius, adequate internal controls, risk management (including cyber risk management) and governance policies and procedures, a business continuity and disaster recovery plan, a board of at least three directors with one independent director resident in Mauritius, an adequate number of competent officers, and a code of conduct and ethics that binds your officers (clause 5(1)).
• Preserve the integrity and privacy of clients' information in conformity with the applicable Data Protection Laws of Mauritius, and where clients' information is stored and processed through cloud computing facilities for analytics, keep it under adequate security and access controls, accessible to you at all times and to the Commission on request (clause 5(1)(e) and (2)).
• Maintain at all times a minimum unimpaired stated capital of MUR 600,000 or its equivalent in a foreign currency, and a professional indemnity insurance policy for at least MUR 2 million or a higher amount the Commission may determine (clauses 6 and 7).
• Keep clients' funds separate from your own, in an account with a duly licensed bank (clause 8).
• Conduct due diligence on your clients under the Financial Intelligence and Anti-Money Laundering Act, the Financial Intelligence and Anti-Money Laundering Regulations 2018 or similar regulations, and the United Nations (Financial Prohibitions, Arms Embargo and Travel Ban) Sanctions Act, and make sure any investment advice given through your platform is suitable for the client after assessing the client's needs, objectives, financial situation and, to the extent relevant, risk tolerance, knowledge, experience and understanding of the risks involved (clause 9).
• Through your board, keep adequate policies, processes and controls so that your algorithms continue to perform as intended, a robust framework for designing, monitoring and testing them through periodic and random reviews, and competent officers to develop and review their methodologies even if that work is outsourced; do not outsource the key processes and management of your client-facing tools (clause 10).
• Give clients clear, fair and non-misleading information about your services, products, suitability method and risks, and disclose in writing any actual or potential conflict of interest (clause 11(1) and (2)).
• Enter into a service-level agreement with each client before providing any services, stating any exclusivity agreements and the conditions or triggers that can discontinue the service and allow human judgment to be used or to replace it; display the Commission's notice that it does not vouch for the correctness of information on your robotic or artificial intelligence interface and that clients are not protected by statutory compensation arrangements in Mauritius, in the agreement, on your website and on your platform; and obtain each client's written confirmation, before providing services, that the client understands the scope, nature, risks and limitations of the advisory services (clause 11(3) to (6)).
• Keep, in addition to the records required by section 29 of the Financial Services Act, a copy of the advice given and the output of the investment, the client information relied on to generate the advice, and details of all algorithms and software you use (clause 12).
• Submit audited financial statements for every financial year, and independent evaluation reports on your algorithms and software systems to the Commission at least once every two years from the date of your license and after any material change, seeking the Commission's prior approval before appointing the independent persons or experts (clause 13).

Bank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), Parts I to VIII and X · Read the law's page

• This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on 29 May 2023, and paragraph 102 required full compliance by the end of June 2024.
• Have your board review and approve at least annually the technology strategy, the cyber and technology risk management strategy and framework and the related policies, and appoint a senior officer as Chief Information Security Officer (paragraph 5).
• Keep a board approved business continuity plan and a board approved response and recovery plan for cyber and technology incidents (paragraphs 54 and 55).
• Have independent specialists assess the critical systems, services, infrastructures and other assets for vulnerabilities on an annual basis, and penetration test internet-facing systems and critical infrastructure after deployment or any major change and annually thereafter (paragraphs 74 and 81).
• Have the governance and the cyber and technology risk management framework audited by an external independent assessor, covering critical systems, services, infrastructures and other assets and electronic delivery channels annually and all areas within a two-year cycle for a Domestic Systemically Important Bank or a three-year cycle for any other financial institution (paragraph 67).
• Run a cyber and technology security awareness and training programme for staff, senior management and the board at least annually (paragraph 94).

Bank of Mauritius Guideline on Cyber and Technology Risk Management (BOM/BSD 780/May 2023), paras. 55(viii) and 95-97 · Read the law's page

• This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on 29 May 2023, and paragraph 102 required full compliance by the end of June 2024.
• Report cyber and technology events and incidents to the Bank of Mauritius in the manner and format the Bank prescribes (paragraph 96).
• Share cyber and technology threat intelligence information with the Bank in the manner and format the Bank prescribes (paragraph 97).
• Submit to the Bank the findings of all audits, assessments and testing exercises, together with the remediation plan, within 90 days from the date of completion of each exercise (paragraph 95).
• Set out in your board approved response and recovery plan the details of internal and external stakeholders, including the Bank, the information to be shared and reported and the relevant timeframes, including in an emergency (paragraph 55(viii)).