Dominican RepublicCybersecurity and Information Security Regulation, Security Program of Financial Entities and Payment System Participants
Reglamento de Seguridad Cibernética y de la Información Junta Monetaria, Segunda Resolución del 1 de noviembre de 2018 (JM 181101-02), arts. 1, 3, 31, 41, 52, 59 y 60
In force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds multiple banks, savings and credit banks, credit corporations, savings and loan associations, public financial intermediation entities, the administrators and participants of the Payment and Securities Settlement System (SIPARD), and the support and related services entities electronically connected to a financial intermediation entity or to SIPARD, a category that includes a software provider (reached by declaring that you provide financial services). Covered entities had one year from the Regulation's entry into force to adjust to it (article 62).
- Implement and maintain a general policy, or several policies, for the management of cybersecurity and information security, and make them known to your staff (article 16).
- Establish policies and procedures for the management of cybersecurity and information-security incidents, so as to identify, respond to, remediate and document them (article 31).
- Set up internal audit processes that ensure effective supervision of your cybersecurity and information security program (article 41).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia de Bancos and the Banco Central, which apply the sanctions of the Ley Monetaria y Financiera and the Reglamento de Sanciones to a financial intermediation entity, and the Banco Central may suspend a SIPARD participant that fails to comply (articles 59 and 60).
Settledness
- As of
- Open questions
- Does Decreto 685-22 or an instructivo of the Banco Central or the Superintendencia de Bancos set a time limit for reporting a cybersecurity incident by a financial entity?
What this law does
Article 1 sets the principles and general guidelines for financial intermediation entities and for the administrators and participants of the Payment and Securities Settlement System (SIPARD). Article 3 applies the Regulation to multiple banks, savings and credit banks, credit corporations, savings and loan associations, public financial intermediation entities, SIPARD administrators and SIPARD participants.
The sole paragraph of article 3 extends the Regulation to the support and related services entities linked to SIPARD by an electronic connection or an exchange of essential information. Article 16 requires the covered entities to implement and maintain a general policy or several policies for the management of cybersecurity and information security and to make them known to their staff.
Article 31 requires the covered entities to establish policies and procedures for the management of cybersecurity and information-security incidents in order to identify, respond to, remediate and document them. Article 41 requires the covered entities to establish internal audit processes to ensure effective supervision of the cybersecurity and information security program.
Article 52 creates, under the administrative dependence of the Banco Central, a Computer Security Incident Response Team for the financial sector. Article 59 provides that financial intermediation entities that infringe the Regulation are liable to the sanctions of the Ley Monetaria y Financiera and the Reglamento de Sanciones.
Article 60 allows the Banco Central to suspend temporarily the participation in SIPARD of an administrator, participant or interconnected support entity that fails to comply with the Regulation. Article 62 gives the covered entities one year from the Regulation's entry into force to adjust to it. The Junta Monetaria issued its Second Resolution of on the Regulation.
When LexLint raises it
When your app profile says your app provides financial services.