Provides financial services, in Vatican City

Instruction No. 4 on major incident notification, Title III (arts. 25 to 33), with Regulation No. 3, art. 62 · Read the law's page

• This binds the same payment service providers as the risk-management provisions of Regulation No. 3 and Instruction No. 4: an entity authorized to issue and manage means of payment within Vatican City State.
• Notify the Financial Information Authority of a major operational or security incident (Article 62(1) of Regulation No. 3); an incident is major if one or more criteria have a higher impact level or three or more have a lower impact level (Article 25 of Instruction No. 4).
• Send the initial report within 4 hours of the moment the potential major incident was first detected, or as soon as the reporting channels are available again (Article 30(2)).
• Send intermediate reports whenever there is a relevant status update, each stating the date of the next update, which may not go beyond 3 business days (Article 31).
• Send the final report within 2 weeks after the activity is deemed back to normal (Article 32(2)).
• Where the incident has or may have an impact on the financial interests of your payment service users, inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects (Article 62(1) of Regulation No. 3), and give the Authority a copy of the information provided to users as soon as it is available (Article 29(3) of Instruction No. 4).

Instruction No. 4 on operational and security risk measures, Title II (arts. 4 to 24), with Regulation No. 3, art. 61 · Read the law's page

• This binds a payment service provider: an entity carrying out financial activities on a professional basis within Vatican City State that is authorized to issue and manage means of payment (Article 1 of Regulation No. 3); the provisions apply in proportion to the provider's size and the nature, scope, complexity and riskiness of its services (Article 4 of Instruction No. 4).
• Establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks of your payment services (Article 61(1) of Regulation No. 3), as an effective operational and security risk management framework (Article 5(1) of Instruction No. 4).
• Send the Financial Information Authority the framework within 30 days of its adoption or annual update (Article 5(6)), and an updated and comprehensive assessment of your operational and security risks within 30 days of its adoption or annual update (Article 9(5)).
• Have the internal control model, including the security measures, audited by external auditors with expertise in IT security and payments (Article 6(4)).
• Carry out and document a risk assessment of your functions, processes and information assets once a year, and before any major change affecting the security of payment services (Article 9(2)).
• Establish and implement preventive security measures against the identified risks, through defence-in-depth controls covering people, processes and technology (Article 10(1) and (2)).
• Include vulnerability scans and penetration tests adequate to the level of risk in the testing of your security measures (Article 20(3)(c)).