Duty LXD-8013
Is a payment provider, in Lebanon
Banque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)since 4 lines
Banque du Liban Basic Decision No. 12725 of (Basic Circular No. 144 to Banks, also addressed to Financial Institutions), Prevention of Electronic Criminal Acts, Arts. 1-6 · Read the law's page
- Prepare policies and take preventive measures and procedures against crimes committed by electronic means, including a cybercrime risk analysis, a budget for an information-technology security policy, insurance covering electronic-crime risk, a continuously updated incident-response and business-continuity plan, a dedicated prevention team, and employee and customer awareness training.for a financial business
- Adopt at least two-factor authentication for any user accessing the system from outside the bank or financial institution, fully encrypt highly sensitive data, filter inbound email, verify the security of devices employees use outside the institution, run penetration testing, monitor network traffic, and verify data integrity.when it serves a financial business
- On learning that a customer has fallen victim to a financially-natured electronic crime, notify Lebanon's Special Investigation Commission of the relevant technical information and direct the customer to file a judicial complaint.when it serves a financial business
- Maintain a Compliance Department responsible for implementing this Decision.for a financial business
- This binds a bank or financial institution addressed by Banque du Liban's Basic Circular No. 144, in force since .
Banque du Liban Basic Decision No. 13790 on Electronic Payment Services Providers, IT Infrastructure and Information Securitysince 4 lines
Banque du Liban Basic Decision No. 13790 of (Basic Circular No. 1 to Electronic Payment Services Providers), Arts. 9, 24 and 39 · Read the law's page
- This binds an Electronic Payment Services Provider licensed by Banque du Liban, that is a non-bank institution providing e-money, local or cross-border money transfer, money collection and payment, or payment facilitator services (reached by declaring that you are a payment provider); the Decision entered into force on its issuance on .
- Comply, where applicable, with the regulatory rules on IT security and with Basic Decision No. 10227 on the business continuity plan and Basic Decision No. 12725 on cybercrime prevention (Article 24).
- To be licensed, prepare a detailed description of the IT infrastructure and information security framework at the level of the institution, its branches and its agents, covering an IT infrastructure plan, the information security measures that protect customers' funds and financial and personal data and mitigate operational, fraud and breach of trust risks, a business continuity and disaster recovery plan, and any IT outsourcing agreements (Article 9).
- If you provide the Payment Gateway service, obtain a Payment Card Industry Data Security Standard certification (Article 39(2)(b)).