Guinea-BissauBCEAO Electronic Money Instruction: Security and Continuity Requirements of Issuers
Instruction n°008-05-2015 de la BCEAO sur la monnaie électronique, art. 7
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an electronic money issuer in the member states of the West African Monetary Union (UMOA): a bank, a payment financial institution, a decentralised financial system or an electronic money institution that issues electronic money (Articles 2 and 3), reached by declaring that you are a bank or a payment provider.
- Make every electronic money issuing solution meet requirements for high availability of the platform, integrity of messages, confidentiality of information, authenticity of transactions and non-repudiation of transactions (Article 7).
- Put in place a proven arrangement for the continuity of your operations and a risk management strategy that defines the policy, practices and procedures for the risks inherent in the system (Article 7).
- Keep an audit trail that traces each operation from the payment order to its settlement, and keep that traceability for ten years from the date of the operation (Article 7).
- Have your compliance with these requirements attested by a qualified, approved and experienced external body at least once every three years, with the audit extended to your technical partner operator where there is one (Article 7).
- When you outsource your technical arrangement, make sure the technical provider meets these requirements, keep the means to control its activity, send the BCEAO a copy of the agreement with the provider, and remain responsible for the outsourced arrangement's compliance (Article 7).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banque Centrale des Etats de l'Afrique de l'Ouest (BCEAO), which sanctions a breach of the instruction by an electronic money institution.
Settledness
- As of
- Open questions
- Does Article 7 reach a bank, payment financial institution or decentralised financial system only for the electronic money it issues, since Article 3 applies the instruction to those institutions alongside electronic money institutions?
What this law does
Article 7 requires every electronic money issuing solution to meet requirements for high availability of the platform, integrity of messages, confidentiality of information, authenticity of transactions and non-repudiation of transactions. Article 7 requires the issuer to have its compliance with those requirements attested by an external audit at least once every three years.
Article 40 lets the BCEAO sanction a breach of the instruction by an electronic money institution with a warning, a suspension or prohibition of operations, other limits on activity or withdrawal of the licence, and a pecuniary sanction of at most twenty-five percent of the minimum share capital required.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.