Is a bank, in Mozambique

Aviso n.º 10/GBM/2021, de 22 de Dezembro (Regulamento do Número Único de Identificação Bancária), arts. 14 and 15 · Read the law's page

• If you are a credit institution or financial company, give an individual or a legal entity that asks for it clarification of the elements that led to the assignment of their Número Único de Identificação Bancária, immediately unless the matter makes that impossible.
• Update the data on which a client's Número Único de Identificação Bancária was assigned within five working days of the request, and ask the Banco de Moçambique for the corresponding updates within two working days.

Aviso n.º 12/GBM/2024, de 30 de Dezembro (Regulamento da Central de Registo de Crédito), arts. 16, 17, 18 and 19 · Read the law's page

• If you are a participating entity where a beneficiary or prospective beneficiary of credit holds or held credit, answer a request for clarification, updating or rectification of what the Central de Registo de Crédito holds about them in writing within ten days, and make the updates or rectifications needed; the period may be extended where a third entity must act, but tell the beneficiary in good time why the decision is not taken within it.
• When the credit responsibility behind a registry entry is extinguished, report the fact and, on the beneficiary's request, issue a letter or declaration of discharge; if you fail to, you answer for the costs the beneficiary incurs as a result.
• Let a beneficiary of credit who applied for, contracted, guaranteed or endorsed a credit with you request access to the information about them in the registry.

Aviso n.º 12/GBM/2024, de 30 de Dezembro (Regulamento da Central de Registo de Crédito), arts. 2, 4, 11, 13, 14, 15, 20 and 23 · Read the law's page

• If you grant credit or carry on activities directly related to credit and are under the supervision or monitoring of the Banco de Moçambique, send the Central de Registo de Crédito accurate, complete and timely information on your credit operations, within twenty-four hours of the disbursement, the creation or renewal of the limit, the constitution of the guarantee or the operation that creates the responsibility.
• Obtain the express consent of the person concerned before you consult the Central de Registo de Crédito.
• Treat the credit operations reported to the registry as secret and do not use them for purposes other than those the Regulation sets; do not pass information obtained from the registry on to third parties, except to the beneficiaries or prospective beneficiaries of credit.
• Keep all the information you sent to the registry for ten years from the extinction of the credit.

Lei n.º 13/2026, arts. 57 a 66 · Read the law's page

• Notify a cybersecurity incident with a significant impact (a substantial impact, if you are an intermediary provider, a data-centre operator, or a cloud-computing-platform operator), judged by the number of users affected, duration, geographic spread, service disruption, and economic or social impact, within a deadline the National Cybersecurity Authority sets rather than the Law itself: to your sectoral CSIRT and the National CSIRT or, if you are an intermediary digital-service provider, a data-centre operator, or a cloud-computing-platform operator, to the National Cybersecurity Authority. File a monthly report on your response and resolution.
• If you operate a data centre or a cloud-computing platform, also notify your own subscribers promptly of an incident, including a data leak, that affects or may affect their content, and notify the National CSIRT of any incident or data leak you know of (in good time for a data centre, immediately for a cloud platform).
• If you operate a data centre or a cloud-computing platform, also adopt internal rules and policies for business continuity, disaster recovery, and risk management, and give your subscribers a summary of them (articles 63(1)(d) and 64(1)(d)).
• If you disclose a security vulnerability in good faith, including by giving at least 90 calendar days' notice before publishing it, the Law shields you from liability for having done so.
• It reaches you whether you are a Public Administration body, a private-sector business of any kind, or one of the named critical-infrastructure, essential-service, digital-service, data-centre, or cloud-platform categories.

Aviso n.º 6/GBM/2026, Arts. 4 a 12 · Read the law's page

• This binds credit institutions and financial companies (article 2); you are reached by declaring that you provide financial services. An institution already operating has up to 12 months from the Aviso's entry into force to bring its data centers and service contracts into line (article 12).
• Keep primary and secondary data centers, with the primary ones located in Mozambique (article 4).
• Tell the Banco de Moçambique immediately of any circumstance that restricts or prevents the equivalence of your primary and secondary data centers, and at least 30 days ahead of any foreseeable structural change to your technology infrastructure, information systems or data centers (article 6).
• If you are a bank, microbank or electronic money institution, handle your information exclusively in private clouds (article 9).
• Throughout any contract for data-center, management or cloud services, ensure the provider guarantees the confidentiality, integrity, availability and recovery of your data, and security measures for data in transit and at rest, including encryption, multi-factor authentication, identification and correction of vulnerabilities and access controls (article 10).
• Write into each such contract, at least, the security measures for the transmission, storage and segregation of data and the Banco de Moçambique's right of audit (article 11).