Is a payment provider, in the Seychelles

National Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), reg. 13 · Read the law's page

• This reaches you where you are an electronic money issuer, meaning a person licensed as a payment service provider or approved by the Central Bank of Seychelles to issue electronic money (reg. 2) (reached by declaring that you are a payment provider).
• Maintain valid third-party certification from a reputable certification authority or body on your compliance status with ISO standards at all times, and appropriate, robust and tested technology systems (reg. 13(2)(a) and (b)).
• Maintain appropriate and robust security policies and measures intended to safeguard the integrity, authenticity and confidentiality of data and operating processes, and an adequate and robust business continuity and disaster recovery plan (reg. 13(2)(c) and (d)).
• Maintain an effective audit function to provide periodic review of the security control environment and critical systems (reg. 13(2)(e)).
• Ensure your systems are capable of maintaining a complete audit log of all user activities, to facilitate detection of errors, fraud and tampering incidents (reg. 13(3)).
• Deploy and adopt systems proportionate to the nature and complexity of your design, architecture and platform, accompanied by procedural safeguards to detect and protect against fraud and hacking (reg. 13(4)).
• Comply with the Regulations within six months of their coming into force if you were already operating before then (reg. 20).

National Payment System (Electronic Money) Regulations, 2022 (S.I. 128 of 2022), regs. 18 and 19 (reporting) · Read the law's page

• This reaches you where you are an electronic money issuer, meaning a person licensed as a payment service provider or approved by the Central Bank of Seychelles to issue electronic money (reg. 2) (reached by declaring that you are a payment provider).
• Report to the Central Bank of Seychelles any suspected fraud relating to the electronic money service, any security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service (reg. 19(4)).
• Notify the Central Bank of Seychelles in writing, with details, of any loss of confidential data (reg. 18(1)(f)).
• Submit a monthly statistical report to the Central Bank of Seychelles by the 15th of every month that includes the total number of incidents of fraud, theft and robbery and the total number of service interruptions, system downtime and security breaches, with the source of discovery, nature of incident, reasons and value of maximum exposure (reg. 17(a) and the Schedule).