Provides financial services, in Oman

Central Bank of Oman Open Banking Regulatory Framework, Article 5 and Annexure 3 · Read the law's page

• This binds an Open Banking Service Provider licensed by the Central Bank of Oman, that is an account information service provider or a payment initiation service provider (reached by declaring that you are a payment provider); the Framework is effective from the date of issuance.
• Comply with Annexure 3, the Open Banking Data and Information Security Specification, to obtain the license and continue to comply with it while providing Open Banking Services (Article 5).
• Comply with the requirements in Annexure 3 to mitigate the cybersecurity risks that arise from the use of APIs for interconnectivity between your service and banks, payment service provider licensees or financial institutions (Article 6.8.3).
• Include a chief information security officer in your senior management team (Article 6.1.1).
• Put new technology deployments through security testing before go-live, adopt a defined vulnerability management process covering discovery, prioritization and remediation, and run security assessments including penetration testing periodically or whenever significant changes occur in the environment (Annexure 3, section 13.3.1(d)).
• Adopt logging practices that record successful and unsuccessful security events, keep log access to authorized individuals, and run a mechanism for log analysis to identify anomalies and detect potential security incidents (Annexure 3, section 13.3.1(e)).

Central Bank of Oman Open Banking Regulatory Framework, Article 6.6.3 and Annexure 3 section 13.3.1(f) · Read the law's page

• This binds an Open Banking Service Provider licensed by the Central Bank of Oman, that is an account information service provider or a payment initiation service provider (reached by declaring that you are a payment provider); the Framework is effective from the date of issuance.
• Notify the Central Bank of Oman of major operational or security incidents that have or could have a significantly negative impact on the financial interests of customers, banks, payment service provider licensees or financial institutions, or on the licensee itself (Article 6.6.3(c)(ii)).
• Notify the Central Bank of Oman of incidents where there is knowledge or suspicion of fraud committed or intended against customers or the licensee itself, whether by internal or external parties (Article 6.6.3(c)(i)).
• Promptly report to the relevant authorities any security breach resulting in the inadvertent or unlawful loss, alteration, unauthorized disclosure or access to data, or any incident related to cybersecurity such as malware, ransomware or denial-of-service attacks, after assessing its impact as high, medium or low, and adhere to the appropriate reporting timelines (Annexure 3, section 13.3.1(f)).
• Document incident response procedures with roles, responsibilities, lines of escalation and communication protocols, and conduct cyber incident drills or simulations annually (Annexure 3, section 13.3.1(f)).