Provides financial services, in Namibia

Credit Bureau Regulations, 2014 (Government Notice 103 of 2014, Government Gazette 5518), regs. 3, 17, 20, 21, 23, 24, 28 and 30 · Read the law's page

• If you receive or investigate credit applications, credit agreements or payment histories, compile data from them and issue reports on individuals or businesses, register with the Bank of Namibia as a credit bureau before you offer the service, and do not also act as a credit provider or debt collection agency.
• Keep the consumer information you receive confidential, and release it to subscribers only as the data subject concerned has explicitly authorised in writing, subject to the other provisions of the regulation and any other law.
• Do not hold in your database or include in a credit report any information on a data subject's race, colour, ethnic origin, sex, religion or social or economic status.
• Do not sell, lease or transfer your credit performance information, apart from selling credit reports, except to another credit bureau with the approval of the Bank of Namibia; aggregated information may be sold only if the personal information of data subjects is not disclosed.
• Maintain rigorous standards of security and reliability, and protect data against loss, corruption, destruction, misuse, undue access or disclosure.
• Give a natural person who requests it a free copy of his or her credit report once every 12 months, inform the person of the right to challenge the information, and on a challenge endorse the report, ask the information provider for credible evidence within seven working days, and within 20 working days either give the person the evidence or remove the information and all record of it.
• Submit periodic returns and statistics to the Bank of Namibia in the format and frequency it determines, and furnish any record the Bank requests during an inspection.

BID-30 (2017), incident reporting, para. 17.1 · Read the law's page

• This binds a banking institution authorised by the Bank of Namibia to conduct banking business in Namibia, and the banking group to which it belongs (reached by declaring that you are a bank). The paragraphs on governance and the programme are worded "should", and the incident reporting paragraph is worded "is required".
• Report all material information security related incidents to the Bank of Namibia immediately as and when each happens (paragraph 17.1).
• Communicate with internal and external parties to ensure a coordinated response to an incident, and determine the type of information to be reported and when (paragraph 17.1).

BID-30 (2017), information security programme, paras. 8 to 18 · Read the law's page

• This binds a banking institution authorised by the Bank of Namibia to conduct banking business in Namibia, and the banking group to which it belongs (reached by declaring that you are a bank). The paragraphs on governance and the programme are worded "should", and the incident reporting paragraph is worded "is required".
• Have your board of directors ensure that an information security policy and program is established and implemented to comply with the Determination (paragraph 8).
• Establish, implement and maintain an information security policy approved by the board, and a documented information security program that states how you identify your information security risks, set your objectives and risk tolerance, and manage those risks (paragraphs 10.1 and 11.1).
• Extend your information security practices to third parties through service level agreements (paragraph 12.2).
• Implement a methodology for vulnerability assessments and penetration testing, and run the tests regularly and whenever systems are updated or deployed (paragraph 18.4).
• Engage independent auditors or specialists to evaluate your security and monitoring systems every three years or when significant changes are made to the systems (paragraph 17.5).

PSD-12, cyber incident reporting, paras. 11.13 to 11.15 · Read the law's page

• This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
• Report every successful cyberattack incident to the Bank of Namibia, with a preliminary notification within 24 hours (paragraph 11.13).
• After that notification, conduct an impact assessment of the successful cyberattack incident and report to the Bank within a month from the time the incident becomes known (paragraph 11.14).
• Make the impact report indicate at least any financial loss, data loss and availability loss (paragraph 11.15).

PSD-12, cybersecurity standards, paras. 9 to 13 · Read the law's page

• This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
• Have your board establish and approve a Framework for information security, cybersecurity and operational resilience, and set risk tolerances aligned with the key risk indicators in paragraph 13 (paragraphs 9.1 and 9.3).
• Identify and classify your business functions and supporting processes and perform a risk assessment at least once every year, and include one penetration test every three years for critical systems in your threat intelligence processes (paragraphs 11.1 and 11.3).
• Encrypt, tokenize or mask data transmitted across open and public networks in line with best practice standards (paragraph 12.1).
• Meet the key risk indicators and tolerance levels in paragraph 13, including recovery time and recovery point objectives for critical systems, and test your response, resumption and recovery plans (paragraph 13).

BID-30 (2026), incident reporting, paras. 12.1 to 12.5 · Read the law's page

• This Determination takes effect six months after its publication in the Gazette on 19 June 2026 (paragraph 14); until then the Determination of 2017 applies. It binds a banking institution or microfinance banking institution authorised by the Bank of Namibia to conduct banking business or microfinance banking business in Namibia (reached by declaring that you are a bank).
• Report to the Director of the Banking Supervision Department at the Bank of Namibia, by telephone or in writing, immediately upon becoming aware of material information relating to an information or cyber security incident, and send regular updates until the incident is contained (paragraph 12.1).
• Submit information about the incident on the form the Bank issues within 24 hours after detecting it, or by the next working day where the incident occurred on a weekend or public holiday (paragraph 12.5).
• Treat an incident as material when it meets one or more of the higher impact level criteria or three or more of the lower impact level criteria in Table 1 and Annexure A (paragraphs 12.3 and 12.4).
• Assess each incident against the transactions affected, users affected, service downtime, economic impact, escalation, other institutions affected and reputational impact, and put the outcome in the incident reporting form (paragraph 12.6).

BID-30 (2026), information security framework, paras. 7 to 11 · Read the law's page

• This Determination takes effect six months after its publication in the Gazette on 19 June 2026 (paragraph 14); until then the Determination of 2017 applies. It binds a banking institution or microfinance banking institution authorised by the Bank of Namibia to conduct banking business or microfinance banking business in Namibia (reached by declaring that you are a bank).
• Have your board establish and maintain effective governance over your information and cybersecurity frameworks, and have a comprehensive information security framework in place that covers governance, identification, protection, detection, response and recovery (paragraphs 7.1 and 7.3.1).
• Document all suspected and actual material information and cyber incidents and give the Bank a preliminary report within 24 hours, followed by a detailed post-incident analysis (paragraph 7.2(h)).
• Perform penetration testing on critical systems at least annually, and run vulnerability assessments regularly and remediate what they find (paragraphs 10.5 and 10.6).
• Maintain and test data backup and restoration procedures regularly or at least quarterly, and test your incident response and recovery plan with simulation tests at least twice a year (paragraphs 11.3 and 11.4).
• Extend the framework to third parties you enter material outsourcing arrangements with, and require them to uphold information security controls commensurate with your risk profile (paragraph 7.3.1(d)).