Provides financial services, in Tonga

Prudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 1-3, 99-103 and 107 · Read the law's page

• This binds a bank licensed under the Banking Act 2020 (paragraph 108), and is reached by declaring that you are a bank.
• Keep a framework for cybersecurity risk management that is an integral part of your enterprise risk management framework, document it, have the Board approve it and review it regularly (paragraphs 1 and 2).
• Maintain a designated cybersecurity risk management function with independent reporting lines, headed by a Chief Information Security Officer or an equivalent senior officer (paragraph 3).
• Develop and document an enterprise wide cybersecurity risk strategy approved by the Board (paragraph 5).
• Have in place a cybersecurity policy framework commensurate with your exposures to vulnerabilities and threats, covering policies and procedures for cybersecurity risk identification, measurement, monitoring and control (paragraph 8).
• Have a cybersecurity incident management process governed by documented policy and procedures, with the objective of restoring normal service as quickly as possible (paragraphs 99 and 100).
• Conduct security audits and tests, including vulnerability scans and penetration tests, at regular intervals for high risk systems and processes and before such systems are put in production (paragraph 103).

Prudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 105-106 · Read the law's page

• This binds a bank licensed under the Banking Act 2020 (paragraph 108), and is reached by declaring that you are a bank.
• Notify the National Reserve Bank of Tonga as soon as possible and not later than sixty minutes after becoming aware of an information security incident that materially affects, or has the potential to materially affect, the institution or the interests of depositors, financially or non-financially (paragraph 106).
• Report all cybersecurity incidents to the National Reserve Bank of Tonga each quarter, in the format of Form QCR in Appendix I (paragraph 105).

Act 14 of 2025, s. 15 · Read the law's page

• It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette.
• Within 24 hours of becoming aware of it, report to the Computer Emergency Response Team (CERT) a cybersecurity incident relating to the information systems of your designated critical infrastructure, an incident relating to any information system interconnected with or communicating with those systems, or any other cybersecurity incident or occurrence the Minister CPR has designated as requiring notification.
• File that report in the form the Minister CPR prescribes.

Act 14 of 2025, ss. 11-14, 16-17 · Read the law's page

• It reaches you only once the Minister responsible for cybersecurity policy and regulation (Minister CPR) has designated your physical, electronic or virtual infrastructure assets, systems or networks as critical infrastructure under section 11 and published that designation in the Government Gazette; grounds for designation include infrastructure necessary for electronic communications, banking or other financial services, electrical energy, public transportation, other public utilities, or public safety and public health including emergency services.
• Once designated, register with the Minister CPR, notify the Minister CPR of any change in your legal ownership or in the person or entity operating the infrastructure, and conduct and submit periodic cybersecurity self-assessments to the Ministry CPR in the form and manner it prescribes.
• Comply with any minimum standards the Minister CPR issues for critical infrastructure, submit to the Minister CPR's periodic and ad hoc audits and inspections of your compliance, and comply with any order the Minister CPR makes to take remedial, protective or preventative action following an audit, an assessment, or a reported incident.
• Develop, maintain and implement policies, practices and procedures to detect, share information about, mitigate and respond to cybersecurity threats and incidents, communicate them to your staff, and keep records evidencing your compliance available to the Minister CPR on request.

National Reserve Bank of Tonga Act [Cap 16.12], s. 59A (credit information systems) · Read the law's page

• If you hold information collected and maintained in a credit information system that collects and disseminates credit information among financial institutions, use it only to improve the quality of bank credit and in the National Reserve Bank of Tonga's supervision of financial institutions (s. 59A(2)).
• The National Reserve Bank of Tonga may regulate, license, register and supervise such credit information systems (s. 59A(1)).