EthiopiaRequirements for Information Technology (IT) Management of Microfinance Institution Directive, IT Incident Reporting
National Bank of Ethiopia Directive No. 887/2022 IT incident reporting (Requirements for Information Technology (IT) Management of Microfinance Institution), arts. 3, 10
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Enforcement body
- The National Bank of Ethiopia, which issued the Directive.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
What it requires
- This binds every microfinance institution operating in Ethiopia, a licensed deposit-taker and lender (reached by declaring that you are a bank or a lender). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on .
- Notify the Microfinance Institutions Supervision Directorate of the National Bank within 2 working days of any IT incident that could have significant impact on your ability to provide services to your customers or adversely affect your reputation or financial condition, in the format of Annex-1 to the Directive (Article 10.1).
- Submit to the Microfinance Institutions Supervision Directorate every quarter a report on your ongoing handling of IT incidents, in the format of Annex-2 to the Directive (Article 10.2).
These lines are LexLint's reading of the law's text.
What this law does
Article 3 applies the Directive to all microfinance institutions operating in Ethiopia. Article 10.1 requires a microfinance institution to notify the Microfinance Institutions Supervision Directorate of the National Bank, within two working days, of any IT incident that could have significant impact on its ability to provide services to its customers or adversely affect its reputation or financial condition.
Article 10.2 requires a microfinance institution to submit to the Microfinance Institutions Supervision Directorate every quarter a report on its ongoing handling of IT incidents. Article 2.6 defines an information technology incident as an event that jeopardizes the information system processes, storages or transmissions and disrupts the operation process of a microfinance institution. Article 13 brings the Directive into force on .
Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 12.2 says a microfinance institution that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive.
The Directive recites that the National Bank of Ethiopia issued it under Articles 14(2)(e) and 34(2) of the Microfinance Business Proclamation No. 626/2009, as amended by Proclamation No. 1164/2019.
When LexLint raises it
When your app profile says your app is a bank or is a lender.
Back to the example · Lint your app
Page updated .