Is a payment provider, in Liberia

Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, reg. 9.1(d) · Read the law's page

• This reaches you where you are a bank or non-bank financial institution, or another entity authorized by the Central Bank of Liberia, that provides electronic payment services, including by issuing e-payment products or schemes, or where you are a third-party e-payment service provider or operator (reg. 2.0) (reached by declaring that you are a bank or a payment provider).
• Report to the Central Bank of Liberia all computer accesses, including messages received, and all security violations, suspected or attempted, and take follow-up action promptly (reg. 9.1(d)).

Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services in Liberia, regs. 9, 10.2, 17.2 and 25.1 · Read the law's page

• This reaches you where you are a bank or non-bank financial institution, or another entity authorized by the Central Bank of Liberia, that provides electronic payment services, including by issuing e-payment products or schemes, or where you are a third-party e-payment service provider or operator (reg. 2.0) (reached by declaring that you are a bank or a payment provider).
• Make sure the integrity and adequacy of your IT and security systems cover, at minimum, security policies and measures to safeguard the integrity, authenticity and confidentiality of data and operating systems, physical and logical access controls, backup infrastructure, a business continuity and disaster recovery plan, an effective audit function reviewing the security control environment and critical systems, an IT systems vulnerability assessment report, and a satisfactory report from an ICT certification authority on information security in accordance with the Payment Systems Act (reg. 9.0(b)).
• If you are a bank or non-bank financial institution applying to provide or enhance electronic payment services, include with your application a report from a recognized ICT certification agency confirming that corporate security policy and procedures addressing all security issues affecting the electronic payments system exist (reg. 6.0(e)).
• Ensure the security, integrity, confidentiality and availability of data and services by adopting prevailing international standards and those prescribed by the Central Bank of Liberia, and implement a cyber-security policy that conforms with international standards and any cyber-security standards the Central Bank issues (reg. 9.1(b) and (c)).
• Keep a complete audit log of all user activities on your information technology systems, and test the backup infrastructure and business continuity plan at least semi-annually (regs. 9.1(e) and 9.2(b)).
• Deploy a security appliance such as a firewall and a solution that prevents a direct connection between your back-end system and the Internet, and comply with the Payment Card Industry Data Security Standards for ATMs (regs. 10.2(b) and 25.1).
• Identify an ICT compliance officer whose responsibilities include compliance with the standards in the Regulations and your policies on ICT (reg. 17.2).

Mobile Money Regulations, 2014, reg. 29 (reporting) · Read the law's page

• This reaches you where you are an authorized institution under the Mobile Money Regulations: a bank financial institution authorized to provide mobile money services, or a mobile money provider licensed by the Central Bank of Liberia (reg. 4.0) (reached by declaring that you are a bank or a payment provider).
• Promptly report to the Central Bank of Liberia any suspected or confirmed cases of fraud relating to the mobile money services, security breaches, any material service interruption or other significant issues which may affect the safety and efficiency of the services (reg. 29).
• Submit monthly reports to the Regulation and Supervision Department of the Central Bank of Liberia, not later than the 10th day of the following month, including incidents of fraud, theft or robbery and material service interruptions and major security breaches (reg. 29).

Mobile Money Regulations, 2014, regs. 12 and 29 · Read the law's page

• This reaches you where you are an authorized institution under the Mobile Money Regulations: a bank financial institution authorized to provide mobile money services, or a mobile money provider licensed by the Central Bank of Liberia (reg. 4.0) (reached by declaring that you are a bank or a payment provider).
• Use appropriate and tested technology systems, and implement appropriate security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes (reg. 12(xii) and (xiv)).
• Maintain an adequate business continuity and disaster recovery plan, and establish an effective audit function to provide periodic review of the security control environment and critical systems (reg. 12(xv) and (xvi)).
• Have your annual external auditor comment on the adequacy of information security, business continuity and disaster recovery in the annual report the auditor submits (reg. 29).