GrenadaGrenada ECCB Electronic Banking Standard, Security Controls for E-Banking Systems and Data
ECCB Electronic Banking Standard security controls (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.1 to 5.2.8 and 6.4, with Banking Act, No. 20 of 2015, ss. 75, 80 and 184
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every institution licensed under the Banking Act, No. 20 of 2015 of Grenada, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says licensed financial institutions must apply it based on the scope and level of sophistication of their e-banking operations and functions.
- Put in place the security control infrastructure needed to secure your e-banking systems and data from internal and external threats, including authorisation, logical and physical access controls (paragraph 5.2.1).
- Implement a comprehensive security process with policies and procedures for incident prevention and response, covering physical controls, specialised staff to maintain security policies, logical controls and monitoring of network intrusion attempts, and ongoing review and testing of security measures and controls (paragraph 5.2.2).
- Reinforce information security controls to preserve the confidentiality and integrity of customer data, classify e-banking data and systems by sensitivity, and use mechanisms such as encryption, firewalls, access control and data recovery plans to protect all sensitive and high-risk e-banking systems (paragraph 5.2.4).
- Employ appropriate systems to reduce external threats to e-banking systems, including virus-scanning software at critical entry points, intrusion detection software and other security assessment tools, and penetration testing of internal and external networks (paragraph 5.2.8).
- Submit the security process you have implemented to the Central Bank (paragraph 6.4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act, No. 20 of 2015 makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of one hundred thousand dollars and a further penalty for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Eastern Caribbean Central Bank, which issued the Standard in exercise of the powers conferred on it by section 184 of the Banking Act.
Settledness
- As of
- Open questions
- The Standard says it must be read in conjunction with the Technology Risk Management Standard; where the two state different controls for the same system, which control does the Central Bank apply?
What this law does
Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on . Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.
Paragraph 5.2.1 of the ECCB Electronic Banking Standard says that a licensed financial institution must ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the ECCB Electronic Banking Standard says that an institution must ensure that a comprehensive security process is implemented, with policies and procedures that address internal and external security threats.
Paragraph 5.2.4 of the ECCB Electronic Banking Standard says that an institution must reinforce information security controls to preserve the confidentiality and integrity of customer data. Paragraph 5.2.8 of the ECCB Electronic Banking Standard says that appropriate systems must be employed to reduce external threats to e-banking systems, including penetration testing of internal and external networks.
Paragraph 6.4 of the ECCB Electronic Banking Standard says that the security process an institution has implemented shall be submitted to the Central Bank. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.
Section 80 of the Banking Act, No. 20 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80 of the Banking Act, No. 20 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of one hundred thousand dollars, with a further penalty for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.