BarbadosTechnology and Cyber Risk Management Guideline, Classification and Reporting of Major Incidents to the Central Bank
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an entity licensed under the Financial Institutions Act and a payment service provider as defined under section 2 of the National Payment System Act, 2021 (reached by declaring that you provide financial services). The Guideline states its mandatory requirements with the word must and its advisory ones with may (section 2.5).
- Classify an incident within the first twenty-four hours of its detection; an incident is major if it meets the criteria in the Classification Matrix in the M-CIRT instructions (section 6.6.8).
- Complete the stage 1 section of the Initial report template and submit it to the Central Bank within four hours after an incident is classified as major (section 6.6.8).
- Contact the Central Bank promptly, pending the report template, where a matter is classified as major within twenty-four hours or where a matter reaches the media or social platforms (section 6.6.9).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 54 of the National Payment System Act, 2021 lets the Central Bank impose an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that it continues on a payment service provider that breaches a guideline or directive under that Act.
- Rule
- Fixed only
- As of
- Currency
- BBD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
The Central Bank of Barbados, which may take administrative measures against a person that breaches a guideline or directive under the National Payment System Act, 2021.
Settledness
- As of
- Open questions
- Which provision of the Financial Institutions Act attaches a sanction to a licensee's breach of a Central Bank guideline, as section 54 of the National Payment System Act, 2021 does for a payment service provider?
What this law does
The Central Bank of Barbados Technology and Cyber Risk Management Guideline, in the version of March 2026, is applicable to all entities licensed under the Financial Institutions Act and to payment service providers as defined under section 2 of the National Payment System Act, 2021. The Guideline says it contains both advisory and obligatory requirements.
The Bank says it issued the Guideline in furtherance of its responsibilities for the regulation and supervision of entities under the Financial Institutions Act and section 2 of the National Payment System Act, 2021. The Guideline says an incident must be classified within the first twenty-four (24) hours of its detection.
The Guideline says regulated entities must complete the stage 1 section of the Initial report template and submit it to the Bank within four (4) hours after an incident is classified as major. The Guideline says the Bank must be contacted promptly pending the report template where a matter is classified as major within twenty-four hours or reaches the media or social platforms.
Section 54 of the National Payment System Act, 2021 makes a person that breaches a guideline or directive under that Act liable to an administrative measure. The administrative measures include an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that the infringement continues.
Section 4 of the National Payment System Act, 2021 provides that the Central Bank shall, among other things, issue directives, instructions and guidelines for the operation of the National Payment Systems.
When LexLint raises it
When your app profile says your app provides financial services.