BermudaBermuda Digital Asset Business Act 2018: Senior Representative's Notice and Report of a Cyber Reporting Event
Digital Asset Business Act 2018, s. 20
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Enforcement body
- The Bermuda Monetary Authority, the Authority under the Digital Asset Business Act 2018.
- Obligation class
- Reporting, Security
As of .
What it requires
- This reaches your organization only if it is a licensed undertaking under the Digital Asset Business Act 2018, which must appoint a senior representative approved by the Authority (s. 19); the duty in section 20 is placed on that senior representative (reached by declaring that you are a crypto-asset provider).
- Have your senior representative notify the Bermuda Monetary Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that a cyber reporting event involving your undertaking has occurred (s. 20(1) and (3)).
- Have your senior representative furnish the Authority, within 14 days of that notification, with a written report setting out all the particulars of the case that are available to him (s. 20(2)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
The cap applies for each failure to comply with a requirement imposed under the Act; the Authority does not impose it where the person took all reasonable steps and exercised all due diligence.
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 10,000,000
What this law does
Section 20(1) requires a senior representative to notify the Authority forthwith, in such manner as it may direct, on its coming to his knowledge, or his having reason to believe, that an event to which section 20 applies has occurred. Section 20 requires the senior representative, within 14 days of that notification, to furnish the Authority with a written report setting out all the particulars of the case that are available to him.
Section 20 includes a cyber reporting event in a list of events with a material change to the business of the licensed undertaking. Section 2 of the Act defines a cyber reporting event as any act that results in unauthorized access to, disruption, or misuse of the electronic systems or information stored on such systems of a licensed undertaking, in the circumstances the definition lists.
Section 19 requires every licensed undertaking to appoint a senior representative who is a person approved by the Authority. Section 39 of the Act makes a person who fails to comply with a requirement imposed by or under the Act liable to a civil penalty not exceeding $10,000,000 for each failure. The Digital Asset Business Amendment Act 2023 repealed and replaced the definition of cyber reporting event with effect from .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.