GrenadaGrenada Virtual Asset Business Act, 2021, Registrant's Cyber-Threat Protection Policies
Virtual Asset Business Act, 2021 (Act No. 7 of 2021), s. 11(6)(b)
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a person registered with the Grenada Authority for the Regulation of Financial Institutions (GARFIN) under the Virtual Asset Business Act, 2021 (Act No. 7 of 2021) to offer or operate virtual asset business in or from Grenada: exchange between a virtual asset and fiat currency, exchange between forms of virtual assets, transfer of a virtual asset, safekeeping or administration of a virtual asset, or participation in or provision of financial services related to an issue or sale of a virtual asset (sections 2(1), 3 and 4(1)) (reached by declaring that you are a crypto-asset provider).
- Implement and maintain policies for the virtual asset business to protect the operations of the registrant, and the personal information the registrant collects and stores, from cyber threats (section 11(6)(b)); this duty is stated separately from the policy duty on the collection, storage, use and disclosure of a client's personal information in section 11(6)(a).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 19(1)(d) makes contravening a provision of the Act for which a penalty is not provided an offence, and section 19(2) sets, on summary conviction, a fine of $10,000 and imprisonment of 2 years. Section 11(8) attaches an administrative penalty only to subsections (3) and (4) of section 11, not to subsection (6).
Who enforces it
Enforcement body
The Grenada Authority for the Regulation of Financial Institutions (GARFIN), which the Act defines as the authority.
Settledness
- As of
- Open questions
- Do the Virtual Asset Business Regulations, 2024 (S.R.O. 9 of 2024) develop the cyber-threat policy duty in section 11(6)(b) beyond the Act's own text?
What this law does
Section 11(6)(b) of the Virtual Asset Business Act, 2021 requires a registrant to implement and maintain policies for the virtual asset business to protect the operations of the registrant and personal information collected and stored by the registrant from cyber threats. An applicant for registration must include with its application written policies, rules and procedures covering, among other subjects, security access control and cyber security safeguards.
Section 19(1)(d) of the Act makes it an offence to contravene a provision of the Act for which a penalty is not provided. A person who commits an offence under the Act is liable on summary conviction to a fine of $10,000 and imprisonment of 2 years.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.