EthiopiaRequirements for Information Technology (IT) Management of Banks Directive, IT Risk Management and Security Programme
National Bank of Ethiopia Directive No. 889/2022 IT risk management and security programme (Requirements for Information Technology (IT) Management of Banks), arts. 3, 6 to 9
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every bank operating in Ethiopia (reached by declaring that you are a bank). Its provisions other than Articles 5 and 6.7 have applied since , one year after the Directive entered into force on .
- Put in place and implement an IT risk management program aligned with your risk management program, and take into account the cyber security risk management requirements the Information Network Security Agency provides (Articles 6.1 and 6.3).
- Conduct an IT risk assessment every quarter, present the report to your board of directors, send it to the Banking Supervision Directorate of the National Bank within 30 calendar days after the end of the quarter, and keep an IT risk register that you update quarterly (Articles 6.4 to 6.6).
- Develop and implement IT risk management strategies, plans, policies, procedures and standards covering at least physical access and network security, business continuity, disaster recovery, incident response, hardware, software and network maintenance, database and backup management and access, IT change and patch management, vendor and third-party service provider management, customer data privacy, password, data transfer, user access, antivirus and firewall security, and risk in system development, integration and acquisition, and revise them from your periodic risk assessment findings (Articles 7.1 to 7.3).
- Prepare an annual IT security awareness plan and provide the awareness program to relevant employees, including the board and senior management (Articles 8.1 and 8.2).
- Maintain an IT audit function within internal audit that audits at least quarterly, includes at least an annual cyber threat test or other IT audit activities the Information Network Security Agency provides, and reports its findings to the board audit committee with a copy to the Banking Supervision Directorate of the National Bank (Articles 9.1, 9.4 and 9.5).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 90(7) of Banking Business Proclamation No. 1360/2024 punishes any person who contravenes or obstructs a Directive issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years; article 32(1)(e) separately lets the National Bank fine a bank as its Directive determines.
Who enforces it
Enforcement body
The National Bank of Ethiopia, which may impose fines on a bank under article 32(1)(e) of Banking Business Proclamation No. 1360/2024.
What this law does
Article 3 applies the Directive to all banks operating in Ethiopia. Article 6.1 requires a bank to put in place and implement an IT risk management program aligned with its risk management program. Article 6.3 requires it to take into account the cyber security risk management requirements provided by the Information Network Security Agency. Article 6.4 requires a bank to conduct a quarterly IT risk assessment and present the report to its board of directors.
Article 6.5 requires the report to reach the Banking Supervision Directorate of the National Bank within 30 calendar days after the end of each quarter. Article 6.6 requires a bank to maintain an IT risk register and update it quarterly. Article 7.2 requires its IT risk management policies to cover an incident response plan, hardware, software and network maintenance, database and backup management and access, and IT change and patch management.
Article 7.2 also requires them to cover password, data transfer security, user right access, antivirus and firewall security. Article 8.1 requires a bank to prepare an annual IT security awareness plan. Article 9.1 requires a bank to establish an IT audit function within its internal audit function. Article 9.5 requires IT audit at least quarterly, with the findings reported to the board audit committee. Article 13 brings the Directive into force on .
Article 11.2 makes every provision except Article 5 and sub-article 6.7 effective after the elapse of one year from that date. Article 12.2 says a bank that violates provisions other than those of Article 5 and sub-article 6.7 shall be penalized as per the relevant National Bank directive. The Directive recites that the National Bank of Ethiopia issued it under Article 65(2) of the Banking Business Proclamation No. 592/2008, as amended by Proclamation No. 1159/2019.
Article 94(1) of Banking Business Proclamation No. 1360/2024 repeals Proclamation No. 592/2008 and the amending Proclamation No. 1159/2019. Article 93 of that Proclamation keeps existing National Bank Directives in effect, so far as they are consistent with it, until they are amended. Article 91(2) of that Proclamation lets the National Bank issue Directives necessary for its implementation.
Article 32(1) of that Proclamation applies where an examination of a bank results in a finding that it has failed to comply with the relevant laws and Directives. Article 32(1)(e) of that Proclamation lets the National Bank impose fines on the bank as determined by National Bank Directive. Article 90(7) of that Proclamation punishes any person who contravenes or obstructs Directives issued to implement it with a fine up to Birr 50,000 and imprisonment up to 3 years.
When LexLint raises it
When your app profile says your app is a bank.