Provides financial services, in the Seychelles

National Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), reg. 13 · Read the law's page

• This reaches you where you are an electronic money issuer, meaning a person licensed as a payment service provider or approved by the Central Bank of Seychelles to issue electronic money (reg. 2) (reached by declaring that you are a payment provider).
• Maintain valid third-party certification from a reputable certification authority or body on your compliance status with ISO standards at all times, and appropriate, robust and tested technology systems (reg. 13(2)(a) and (b)).
• Maintain appropriate and robust security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes, and an adequate and robust business continuity and disaster recovery plan (reg. 13(2)(c) and (d)).
• Maintain an effective audit function to provide periodic review of the security control environment and critical systems (reg. 13(2)(e)).
• Ensure your systems are capable of maintaining a complete audit log of all user activities, to facilitate detection of errors, fraud and tampering incidents (reg. 13(3)).
• Deploy and adopt systems proportionate to the nature and complexity of your design, architecture and platform, accompanied by procedural safeguards to detect and protect against fraud and hacking (reg. 13(4)).
• Comply with the Regulations within six months of their coming into force if you were already operating before then (reg. 20).

National Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), regs. 18 and 19 (reporting) · Read the law's page

• This reaches you where you are an electronic money issuer, meaning a person licensed as a payment service provider or approved by the Central Bank of Seychelles to issue electronic money (reg. 2) (reached by declaring that you are a payment provider).
• Report to the Central Bank of Seychelles any suspected fraud relating to the electronic money service, any security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service (reg. 19(4)).
• Notify the Central Bank of Seychelles in writing, with details, of any loss of confidential data (reg. 18(1)(f)).
• Submit a monthly statistical report to the Central Bank of Seychelles by the 15th of every month that includes the total number of incidents of fraud, theft and robbery and the total number of service interruptions, system downtime and security breaches, with the source of discovery, nature of incident, reasons and value of maximum exposure (reg. 17(a) and the Schedule).

Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, reg. 7 · Read the law's page

• This reaches your organization only if it is a licensee under the Virtual Asset Service Providers Act, 2024 (Act 12 of 2024): the Regulations apply to all licensees (reg. 3) (reached by declaring that you are a crypto-asset provider).
• Notify the Authority within 24 hours of any attempt, where you discover a cyber security risk as a result of a cyber security event, meaning any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse your electronic systems or the information on them (reg. 7(1)).
• For a successful attempt, provide the Authority a report within 5 working days on whether the event affects or has affected the services or network and information systems that support your critical or important functions, the services you are authorized to provide, and whether it is or was malicious and unauthorized access to your network and information systems (reg. 7(2)).
• Include in that report the remedial actions to mitigate cyber security risk and prevent future cyber security events (reg. 7(3)).

Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, regs. 4-6, 8-9 and 11 · Read the law's page

• This reaches your organization only if it is a licensee under the Virtual Asset Service Providers Act, 2024 (Act 12 of 2024): the Regulations apply to all licensees (reg. 3) (reached by declaring that you are a crypto-asset provider).
• Have in place a cyber security strategy for establishing and maintaining systems and controls that manage the cyber security and operational risks arising from failures in your processes and systems, including systems and processes with or from third-party suppliers, agents and intermediaries, with the resources to manage cyber security risks, to identify, respond to and prevent a cyber security event, and to limit the damage (reg. 4(1) to (3)).
• Implement controls to prevent system and process failures and to identify and rectify them promptly; keep monitoring that detects cyber incidents quickly and periodically evaluates your systems and controls; keep senior management oversight with defined roles and accountability, maintain documentation of your internal processes and systems, and train all staff in cyber security periodically (reg. 4(4), (6), (7) and (8)).
• Review the cyber security strategy and policy regularly and at least annually, and after a cyber security event or a weakness specific to your operation, and submit the results of the review and any remedial actions needed to your board of directors and to the Authority as soon as practicable and no later than one month after the board approved the review (reg. 4(9) and (10)).
• Maintain systems and controls that have regard to confidentiality (safe storage and transmission of data, firewalls and entry restrictions), accessibility for authorized persons, integrity of information, maintenance of systems including code version control and updates, and procedures for updates to technological infrastructure including forks, and ensure they protect the processing and security of your information through established security standards (reg. 5(1) and (2)).
• Run penetration testing and vulnerability assessment of your systems twice in the first year of licensing and at least once a year afterwards, and keep audit trail systems that allow complete and accurate reconstruction of all financial transactions, protect the audit trail data and hardware from alteration or tampering, and log system events including access, alterations and cyber security events (reg. 5(3)).
• When the Authority requires it, and subject to its approval, appoint a qualified independent party to audit your systems and controls and give the Authority a written opinion that your program and controls are suitably designed and operating effectively; state in the appointing resolution whether the auditor is qualified and independent (reg. 5(4) and (5)).
• Implement appropriate and effective arrangements to maintain the continuity of your operations, assess the likelihood and impact of a cyber security risk to that continuity, and apply commensurate measures to minimize its occurrence (reg. 6).
• Have the fit and proper person responsible for information security prepare a cyber security report covering the availability, functionality and integrity of your electronic systems, any cyber risk from your virtual asset services, and the cyber security program implemented with proposals to redress inadequacies (reg. 8(1)).
• Keep a formalized business continuity plan approved by your board of directors that addresses continuity, communication and regular testing, outlines resources, recovery priorities and communication arrangements; review and test it at least every two years and give the Authority the plan or the test results on request within the time it indicates (reg. 11).