Is a crypto-asset provider, in Trinidad and Tobago

Central Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Appendix II · Read the law's page

• This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank. The circular letter of February 5, 2025 is addressed to institutions licensed or holding a financial holding company permit under the Financial Institutions Act, 2008, registered under the Insurance Act, 2018, licensed under the Exchange Control Act, payment system operators and payment service providers, and e-money issuers.
• Alert the Central Bank, as soon as possible but within 24 hours of becoming aware of a cyber-incident, that a cyber-incident has occurred (Guideline Appendix II; Circular Letter CB-OIFI-399/2025).
• Complete the Cyber Incident Reporting Form and send it to cyberincident@central-bank.org.tt, copying your designated Relationship Officer, within 72 hours of the incident (Circular Letter CB-OIFI-399/2025). The Guideline states the 72-hour submission as what the company should do (Appendix II).
• Where specific details are unavailable at the initial report, indicate 'information not yet available', give best estimates and all other available details, and state when more information is expected (Guideline Appendix II).
• Provide regular updates, for example daily, as new information becomes available until the incident is contained or resolved, and a post-incident review and lessons learned report after closure (Circular Letter CB-OIFI-399/2025).

Central Bank of Trinidad and Tobago Cybersecurity Best Practices Guideline (September 2023), Parts 1 to 3 · Read the law's page

• This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank.
• Establish a cybersecurity framework proportional to your business model, complexity of operations and risks. The Guideline states this as what you should do (Part 1).
• Develop a formal risk-based cybersecurity strategy covering identification, protection, detection, response and recovery, approved by your Board and kept under at least annual review. The Guideline states this as what you should do (Part 2.A).
• Provide regular and appropriate cybersecurity training to employees and customers in an understandable way (Part 2.C).
• Conduct an annual self-assessment against the Guideline and submit the Return to the Central Bank by March 31 of the next calendar year, attaching action plans for any material deficiencies (Circular Letter CB-OIFI-2976/2023).

Virtual Assets and Virtual Asset Service Providers Act, 2025 (Act No. 12 of 2025), s. 10(3) and (4) · Read the law's page

• This binds a company that holds a certificate of acceptance as a Sandbox Participant in the Regulatory Sandbox of the Trinidad and Tobago Securities and Exchange Commission, which authorises virtual asset service providers that were operating before the Act took effect (reached by declaring that you are a crypto-asset provider).
• Notify the Commission in writing within ten days of becoming aware that a cyber-security event has occurred (section 10(3)(b)(viii)).
• Within seven business days of providing that notification, furnish the Commission with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 10(4)).