FijiReserve Bank of Fiji Prudential Supervision Policy Statement 2, Cybersecurity Incident Reporting
Prudential Supervision Policy Statement No. 2 (Reserve Bank of Fiji), para. 17
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a commercial bank, credit institution, insurance company, insurance broker, securities exchange, management company of a managed investment scheme, stock broker, the Fiji National Provident Fund, the Fiji Development Bank or a restricted foreign exchange dealer supervised by the Reserve Bank of Fiji (reached by declaring that you provide financial services); it does not reach any other business.
- Notify the Reserve Bank of Fiji within 24 hours after becoming aware of a cybersecurity incident that materially affects or has the potential to materially affect, financially or non-financially, your institution or the interests of depositors, policyholders, fund members, investors or the general public who use your services (para. 17.2).
- Report cybersecurity incidents in the format the Reserve Bank prescribes as Appendix 2 to the Policy (para. 17.1).
- Keep reporting operational risk incidents under BSPS No.16, the Reserve Bank's minimum requirements for the management of operational risk, as well: the cyber incident reporting time differs from that one, and you report both (footnote 4 to para. 17.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
The Reserve Bank may impose on a licensed financial institution that fails to comply with a directive of the Reserve Bank an initial fine not exceeding FJD 5,000 and a further fine not exceeding FJD 1,000 for each day the contravention continues (Banking Act 1995, section 15(1)(d) and (2)(a)), and may direct the institution to take a specified action by written notice (section 15(2)(b)).
- Rule
- Per violation only
- As of
- Currency
- FJD
- Fixed cap
- 5,000
- Per violation unit
- Day
- Per violation amount
- 1,000
Over one month, FJD 5,000, which is the instrument's own cap: the penalty stops accruing on day 5.
Who enforces it
Enforcement body
The Reserve Bank of Fiji, which assesses each supervised entity's compliance in the course of its supervision.
What this law does
Under paragraph 17.2 of the Reserve Bank of Fiji's Prudential Supervision Policy Statement on cybersecurity risk, PSPS 2, a supervised entity must notify the Reserve Bank within 24 hours after becoming aware of a cybersecurity incident that materially affects or has the potential to materially affect the institution or the interests of depositors, policyholders, fund members, investors or the general public who use its services.
Paragraph 17.1 requires a supervised entity to report cybersecurity incidents in the format prescribed as Appendix 2. The Policy states that its cyber incident reporting time differs from the operational risk incident reporting under BSPS No.16, and that supervised entities will continue to report both. Section 15 of the Banking Act 1995 lets the Reserve Bank sanction a licensed financial institution that fails to comply with its directives. The Policy became effective on , with full compliance required within one year of that date.
When LexLint raises it
When your app profile says your app provides financial services.