BarbadosTechnology and Cyber Risk Management Guideline, Technology and Cyber Risk Management Framework of Financial Institutions
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a financial institution regulated by the Financial Services Commission (reached by declaring that you provide financial services). The Guideline states most of its requirements as what an institution should do, and the extent to which it is implemented should be proportional to the level of risk and complexity of the services offered.
- Have senior management establish the technology and cyber risk management framework and strategy, and manage technology and cyber risks based on that framework and strategy (Governance).
- Carry out penetration testing after a vulnerability assessment has been conducted, to obtain an in-depth evaluation of your technology and cyber security defenses. The Guideline states this as what you should do (Technology and Cyber Risk Penetration Testing).
- Revise your cybersecurity program annually where it has identified areas, systems or processes that require material improvement, document the identification and the remedial efforts, and keep that documentation available for inspection by the Commission (section 10(B)(3)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to comply with a directive of the Commission, which may be given to ensure compliance with the guidelines, is an offence under section 9(4) of the Financial Services Commission Act, 2010 punishable on summary conviction by a fine of $20 000 or imprisonment for a term of 1 year or both.
Penalty structure
Section 9(4) of the Financial Services Commission Act, 2010 sets this fine, or imprisonment for a term of 1 year or both, for a person who fails to comply with a directive given under section 8(1)(a), with a further fine of $2 500 for each day of non-compliance where a time period is specified. The Guideline itself carries no penalty.
- Rule
- Fixed only
- As of
- Currency
- BBD
- Fixed cap
- 20,000
Who enforces it
Enforcement body
The Financial Services Commission, which may give a financial institution directives to ensure compliance with the guidelines.
Settledness
- As of
- Open questions
- Does the Commission treat the 'should' in section 10 of the Guideline as a requirement, given that its Information Circular of April 2025 says financial institutions are required to notify it of all reportable cyber incidents?
What this law does
The Financial Services Commission's Technology and Cyber Risk Management Guideline says it was issued on pursuant to section 53 of the Financial Services Commission Act, 2010. The Guideline applies to all financial institutions the Commission regulates. The Guideline says it is effective . The Guideline says senior management is required to establish the technology and cyber risk management framework and strategy.
The Guideline says a financial institution should carry out penetration testing after a vulnerability assessment has been conducted. The Guideline says documentation of the areas of a cybersecurity program needing improvement must be available for inspection by the Commission. Section 53 of the Financial Services Commission Act, 2010 lets the Commission issue guidelines after consultation with financial institutions.
Section 8 of the Act lets the Commission give directives to ensure compliance with the guidelines. Section 9 of the Act makes a person to whom a directive is given liable on summary conviction to a fine of $20 000 or to imprisonment for a term of 1 year or to both for failing to comply with it. Section 25 of the Act lets the Commission revoke a licence or cancel a registration where a financial institution has committed a serious breach of the guidelines.
When LexLint raises it
When your app profile says your app provides financial services.