Provides financial services, in Papua New Guinea

Cybersecurity Bill 2026 (Papua New Guinea consultation draft), Part IV, ss. 31 to 34, 36, 37 and 39 · Read the law's page

• This is a bill in public consultation (the fourth draft, opened for comment on 6 August 2026) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind a CII operator, meaning a person or entity that owns, manages or controls a facility, system or service the Minister designates as critical information infrastructure by notice in the National Gazette (s. 31(1)); banking and financial systems, telecommunications networks, energy and power systems, transportation systems, water and sanitation systems, public health and hospital systems, government information and communications systems, extractive industry operational technology systems and educational institutions are taken to be designated unless the Minister specifies otherwise (s. 31(3)) (reached by declaring that you operate an essential service, provide financial services, provide telecom services or handle health records).
• Implement the minimum cybersecurity controls the Authority prescribes, appoint a Cybersecurity Officer for each CII facility or system and notify the Authority of the appointment within 30 days (ss. 32(a) and (b) and 33).
• Conduct a comprehensive cybersecurity risk assessment of each designated CII facility or system at least once in each calendar year, and submit a summary to the Authority within 30 days of its completion (s. 34).
• Submit to compliance audits by the Authority, which may enter and inspect your premises, inspect and copy your records and systems, and require you or any employee to answer questions and produce documents (s. 36).
• Do not procure or deploy ICT products or services in a CII facility or system unless you are satisfied that they meet the prescribed cybersecurity requirements (s. 37(1)).
• Comply with any minimum cybersecurity standard the Authority issues by notice in the National Gazette for designated CII operators (s. 32, Cybersecurity standards, subsection (3)).

Cybersecurity Bill 2026 (Papua New Guinea consultation draft), Part V, ss. 40 and 41 · Read the law's page

• This is a bill in public consultation (the fourth draft, opened for comment on 6 August 2026) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind a financial institution, meaning a bank, insurance company, savings and loan society, micro-finance institution, payment service provider or other entity licensed by the Bank of Papua New Guinea to conduct financial services (s. 3(1)(v)); all computer systems and networks it operates are taken to be designated critical information infrastructure (s. 40(1)) (reached by declaring that you provide financial services).
• Implement the minimum cybersecurity controls the Authority prescribes for financial institutions in consultation with the Bank of Papua New Guinea (s. 41(a)).
• Maintain an incident response plan specifically addressing financial cybercrime, conduct regular penetration testing of your systems, and train staff in cybersecurity awareness and fraud prevention (s. 41(c) to (e)).
• Meet the obligations the draft puts on a CII operator in Part IV as well, because Part V applies in addition to them (s. 40(2)).

Cybersecurity Bill 2026 (Papua New Guinea consultation draft), s. 111 · Read the law's page

• This is a bill in public consultation (the fourth draft, opened for comment on 6 August 2026) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind any person or entity that manages a computer system, whether public or private and of any size, not only a CII operator or a financial institution.
• Notify the Authority in the prescribed manner when a computer system you manage suffers a cybersecurity incident, meaning any breach, compromise or disruption affecting the confidentiality, integrity or availability of the system or its data, or an attempted breach that poses a significant risk to the system (ss. 3(1)(o) and 111(1)).
• Make the notification within 24 hours if you are a CII operator or a financial institution, and within 72 hours if you are any other entity (s. 111(1)).
• Include in the notification the information the Authority prescribes (s. 111(2)).

Cybersecurity Bill 2026 (Papua New Guinea consultation draft), ss. 35 and 41(b) · Read the law's page

• This is a bill in public consultation (the fourth draft, opened for comment on 6 August 2026) and binds no one unless Parliament passes it and it is certified; the lines below describe what it would require if passed as drafted. It would bind the same CII operators and financial institutions as the draft's critical information infrastructure and financial systems provisions (ss. 31, 35 and 40) (reached by declaring that you operate an essential service, provide financial services, provide telecom services or handle health records).
• Notify the Authority within 24 hours of becoming aware of a cybersecurity incident affecting a designated CII facility or system, stating what happened, when it was discovered, which facility or system is affected, its likely impact and the measures taken or proposed to mitigate it (s. 35(1) and (2)).
• Provide a full incident report to the Authority within 7 days of the incident (s. 35(3)).
• If you are a financial institution, report a cybersecurity incident affecting your systems to both the Authority and the Bank of Papua New Guinea within 24 hours of detection (s. 41(b)).

Directive on Electronic Fund Transfers 02/2019 (Bank of Papua New Guinea), s. 4 · Read the law's page

• This binds a payment service provider offering electronic fund transfers by any means in Papua New Guinea, including through ATM and POS terminals, internet and telephone channels, mobile phones, cards and e-money (reached by declaring that you are a payment provider); it does not reach a business that offers no payment service.
• Ensure the technology you use to supply payment service facilities for electronic transfers is safe and secure and ensures confidentiality, integrity, authenticity and non-repudiation of the payment related information (s. 4(1)).
• Update and implement an information security policy that adequately addresses the security requirements of the relevant delivery channels, and use methods consistent with industry best practices to authenticate user identity (s. 4(3) and (4)).
• Implement a robust security risk management framework to actively identify, assess, reduce and monitor security risk, so that sensitive information stays confidential in transmission and storage, information stays accurate, reliable and complete, users and agents are authenticated and their functions authorized, online transactions are monitored to detect fraud and act on it promptly, and risk controls cover every point of interaction with customers (s. 4(6)).