EthiopiaRequirements for Information Technology (IT) Management of Banks Directive, IT Incident Reporting
National Bank of Ethiopia Directive No. 889/2022 IT incident reporting (Requirements for Information Technology (IT) Management of Banks), arts. 3, 10
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every bank operating in Ethiopia (reached by declaring that you are a bank). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on .
- Notify the Banking Supervision Directorate of the National Bank within 2 working days of any IT incident that could have significant impact on your ability to provide services to your customers or adversely affect your reputation or financial condition, in the format of Annex-1 to the Directive (Article 10.1).
- Submit to the Banking Supervision Directorate every quarter a report on your ongoing handling of IT incidents, in the format of Annex-2 to the Directive (Article 10.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 90(7) of Banking Business Proclamation No. 1360/2024 punishes any person who contravenes or obstructs a Directive issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years; article 32(1)(e) separately lets the National Bank fine a bank as its Directive determines.
Who enforces it
Enforcement body
The National Bank of Ethiopia, which may impose fines on a bank under article 32(1)(e) of Banking Business Proclamation No. 1360/2024.
What this law does
Article 3 applies the Directive to all banks operating in Ethiopia. Article 10.1 requires a bank to notify the Banking Supervision Directorate of the National Bank, within two working days, of any IT incident that could have significant impact on its ability to provide services to its customers or adversely affect its reputation or financial condition. Article 10.2 requires a bank to submit to the Banking Supervision Directorate every quarter a report on its ongoing handling of IT incidents.
Article 13 brings the Directive into force on . Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 12.2 says a bank that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive.
The Directive recites that the National Bank of Ethiopia issued it under Article 65(2) of the Banking Business Proclamation No. 592/2008, as amended by Proclamation No. 1159/2019. Article 94(1) of Banking Business Proclamation No. 1360/2024 repeals Proclamation No. 592/2008 and the amending Proclamation No. 1159/2019. Article 93 of that Proclamation keeps existing National Bank Directives in effect, so far as they are consistent with it, until they are amended.
Article 91(2) of that Proclamation lets the National Bank issue Directives necessary for its implementation. Article 32(1) of that Proclamation applies where an examination of a bank results in a finding that it has failed to comply with the relevant laws and Directives. Article 32(1)(e) of that Proclamation lets the National Bank impose fines on the bank as determined by National Bank Directive.
Article 90(7) of that Proclamation punishes any person who contravenes or obstructs Directives issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years.
When LexLint raises it
When your app profile says your app is a bank.