BarbadosTechnology and Cyber Risk Management Guideline, Reporting of Cyber Incidents to the Financial Services Commission
Financial Services Commission Technology and Cyber Risk Management Guideline (December 2024), s. 10
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a financial institution regulated by the Financial Services Commission (reached by declaring that you provide financial services). The Guideline states most of its requirements as what an institution should do, and the extent to which it is implemented should be proportional to the level of risk and complexity of the services offered.
- Inform the Commission within four hours after an incident is classified, classifying it within the first twenty-four hours of its detection. The Guideline states this as what you should do (section 10(B)(1)).
- Submit the initial report within four hours from the moment the incident is classified as high or critical, and within twenty-four hours for an incident classified as low or medium (Instructions for the completion of the Cyber Incident Reporting Forms, section 5.2).
- If the incident has not been resolved 5 days after the initial report, populate and submit the Intermediate Report Form, and later deliver the final report, based on an independent assessment, within twenty working days after business is deemed back to normal. The Instructions state the final report as what you should do (sections 5.3 and 5.4).
- Notify the Commission of all reportable cyber incidents and also report unsuccessful attempts of any cyber incidents (Information Circular, Reporting Cyber Incidents, April 2025).
- Keep customers informed of any major incident or data breach where their data has potentially been compromised. The Guideline states this as what you should do (section 10(B)(4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to comply with a directive of the Commission, which may be given to ensure compliance with the guidelines, is an offence under section 9(4) of the Financial Services Commission Act, 2010 punishable on summary conviction by a fine of $20 000 or imprisonment for a term of 1 year or both.
Penalty structure
Section 9(4) of the Financial Services Commission Act, 2010 sets this fine, or imprisonment for a term of 1 year or both, for a person who fails to comply with a directive given under section 8(1)(a), with a further fine of $2 500 for each day of non-compliance where a time period is specified. The Guideline itself carries no penalty.
- Rule
- Fixed only
- As of
- Currency
- BBD
- Fixed cap
- 20,000
Who enforces it
Enforcement body
The Financial Services Commission, which may give a financial institution directives to ensure compliance with the guidelines.
Settledness
- As of
- Open questions
- Does the Commission treat the 'should' in section 10 of the Guideline as a requirement, given that its Information Circular of April 2025 says financial institutions are required to notify it of all reportable cyber incidents?
What this law does
The Financial Services Commission's Technology and Cyber Risk Management Guideline says it was issued on pursuant to section 53 of the Financial Services Commission Act, 2010. The Guideline applies to all financial institutions the Commission regulates. The Guideline says it is effective .
Section 10 of the Guideline says financial institutions should inform the Commission within four hours after an incident is classified, and that an incident should be classified within the first twenty-four hours of its detection.
The Commission's instructions for completing the cyber incident reporting forms say the initial report should be submitted within four hours from the moment the incident has been classified as high or critical and within twenty-four hours for incidents classified as low or medium. The instructions say that if the incident has not been resolved 5 days after the submission of the Initial Report the financial institution is required to populate the Intermediate Report Form.
The instructions say financial institutions should deliver the final report to the Commission within twenty working days after business is deemed back to normal. The Commission's Information Circular of April 2025 says financial institutions are required to notify the Commission of all reportable cyber incidents and also to report unsuccessful attempts of any cyber incidents.
The Guideline says failure to report incidents to the Commission may result in increased supervisory oversight, including enhanced monitoring, watch-listing or staging of the financial institution under the Commission's ladder of intervention. Section 53 of the Financial Services Commission Act, 2010 lets the Commission issue guidelines after consultation with financial institutions. Section 8 of the Act lets the Commission give directives to ensure compliance with the guidelines.
Section 9 of the Act makes a person to whom a directive is given liable on summary conviction to a fine of $20 000 or to imprisonment for a term of 1 year or to both for failing to comply with it. Section 25 of the Act lets the Commission revoke a licence or cancel a registration where a financial institution has committed a serious breach of the guidelines.
When LexLint raises it
When your app profile says your app provides financial services.