BarbadosTechnology and Cyber Risk Management Guideline, Technology and Cyber Risk Management Framework of Regulated Entities
Central Bank of Barbados Technology and Cyber Risk Management Guideline (March 2026), ss. 2 to 5
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an entity licensed under the Financial Institutions Act and a payment service provider as defined under section 2 of the National Payment System Act, 2021 (reached by declaring that you provide financial services). The Guideline states its mandatory requirements with the word must and its advisory ones with may (section 2.5).
- Establish IT policies, standards and procedures to manage technology and cyber risks and safeguard information system assets in line with current industry standards (section 3.2.1).
- Establish an information security policy based on your risk assessment and mitigate the identified cyber risk threats commensurate with your risk tolerance (section 3.2.7).
- Conduct penetration testing before commissioning a new system that offers internet accessibility and open network interfaces; where that is not possible, perform it within the first six months after implementation, explained and documented (section 5.2.6).
- Establish and maintain a comprehensive testing program that covers business continuity and incident response, among others, as part of your cyber risk management framework (section 5.2.7).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 54 of the National Payment System Act, 2021 lets the Central Bank impose an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that it continues on a payment service provider that breaches a guideline or directive under that Act.
- Rule
- Fixed only
- As of
- Currency
- BBD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
The Central Bank of Barbados, which may take administrative measures against a person that breaches a guideline or directive under the National Payment System Act, 2021.
Settledness
- As of
- Open questions
- Which provision of the Financial Institutions Act attaches a sanction to a licensee's breach of a Central Bank guideline, as section 54 of the National Payment System Act, 2021 does for a payment service provider?
What this law does
The Central Bank of Barbados Technology and Cyber Risk Management Guideline, in the version of March 2026, is applicable to all entities licensed under the Financial Institutions Act and to payment service providers as defined under section 2 of the National Payment System Act, 2021. The Guideline says it contains both advisory and obligatory requirements.
The Bank says it issued the Guideline in furtherance of its responsibilities for the regulation and supervision of entities under the Financial Institutions Act and section 2 of the National Payment System Act, 2021. The Guideline says regulated entities must establish IT policies, standards and procedures to manage technology and cyber risks and safeguard information system assets in line with current industry standards.
The Guideline says all regulated entities must establish an information security policy based on the regulated entity's risk assessment. The Guideline says regulated entities must conduct penetration testing prior to the commissioning of a new system which offers internet accessibility and open network interfaces. The Guideline says regulated entities must establish and maintain a comprehensive testing program that covers both business continuity and incident response.
Section 54 of the National Payment System Act, 2021 makes a person that breaches a guideline or directive under that Act liable to an administrative measure. The administrative measures include an administrative penalty of up to $250 000 for the infringement and a fine not exceeding $25 000 for each day that the infringement continues.
Section 4 of the National Payment System Act, 2021 provides that the Central Bank shall, among other things, issue directives, instructions and guidelines for the operation of the National Payment Systems.
When LexLint raises it
When your app profile says your app provides financial services.