GuyanaBank of Guyana Supervision Guideline No. 15, Technology Risk Management
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://bankofguyana.org.gy/bog3/images/Publications/supervisionguidelines/Supervision%20Guideline%20No.15%20-%20Technology%20Risk%20Managem…In force.
A sector security regimes rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds licensed financial institutions (LFIs) under the Financial Institutions Act 1995, to the extent that is commensurate with each institution's size, risk profile and business model (paragraphs 6 and 7), and is reached by declaring that you provide financial services.
- Explain any deviation from the Guideline in a separate document made promptly available to the Bank (paragraph 8).
- Have your Board comprehensively understand the potential risks that technology presents to the institution (paragraph 17).
- Establish a technology risk management framework to manage technology risks (paragraph 24), able to identify the information system assets that need protection and the direct and indirect IT threats (paragraph 25).
- Implement an appropriate access controls policy for the identification, authentication and authorization of internal and external users, covering logical and physical access (paragraph 76).
- Ensure that the scope, frequency and intensity of technology audits are commensurate with the complexity, sophistication and criticality of technology systems and applications (paragraph 102).
- Notify the Bank before conducting e-banking or any other internet services for the first time, or before introducing new technology or enhancements for them, with the risk, security and independent external assurance information paragraphs 108 to 110 list (paragraph 107).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Guyana, which may issue specific directives to an institution that has failed to comply with the Guideline and impose any or all of the corrective actions under the Financial Institutions Act 1995.
Settledness
- As of
- Open questions
- Does the Guideline's description of its approach as general guidance in paragraph 9 qualify the duties it states in terms of must, given the sanction in paragraph 116?
- Does the Bank require a licensed financial institution to report a security incident to it, and on what clock, given that the Guideline names a reporting template in Appendix 3 but states no deadline?
What this law does
Paragraph 6 of the Guideline applies it, as appropriate, to all licensed financial institutions. Paragraph 9 of the Guideline describes the supervisory approach as not a prescriptive and comprehensive approach for all technology risks. Paragraph 25 of the Guideline requires an institution's technology risk management framework to be able to identify the information system assets that need protection and the direct and indirect IT threats.
Paragraph 76 of the Guideline requires a financial institution to implement an appropriate access controls policy for the identification, authentication and authorization of internal and external users. Paragraph 102 of the Guideline requires a financial institution to ensure that the scope, frequency and intensity of technology audits are commensurate with the complexity, sophistication and criticality of its technology systems and applications.
Paragraph 107 of the Guideline requires a licensed financial institution to notify the Bank before conducting e-banking or any other internet services, including introducing new technology relating to them. Paragraph 116 of the Guideline provides that, where an institution has failed to comply, the Bank may issue specific directives to it and impose any or all of the corrective actions under the Financial Institutions Act.
Footnote 10 of the Guideline states that the incident management reporting template in Appendix 3 can also be used to report incidents to the Bank.
When LexLint raises it
When your app profile says your app provides financial services.