HaitiBRH Circulaire 126, Information Security Rules for Financial Institutions
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds every institution financière (bank and other financial institution) that Banque de la République d'Haïti supervises under the law on banks and other financial institutions.
- Have a written information-security policy, updated annually and approved by your board of directors.NIST CSF 2.0GV.PO-01
- Maintain an information-security committee (or, for a non-bank financial institution, have your board of directors perform this function) to validate and approve the security measures your policy adopts.NIST CSF 2.0GV.RR-02
- Designate an information-security officer independent of the IT department, reporting to risk management or directly to general management, with the data and access needed to do the job.NIST CSF 2.0GV.RR-02
- Keep your security committee systematically informed of incidents capable of compromising information security and of the measures taken to address them.NIST CSF 2.0RS.CO-03
- Develop, test and maintain a risk-based contingency plan, including an offsite recovery center kept separate from your main site, and a regularly checked backup system.NIST CSF 2.0ID.IM-04NIST CSF 2.0PR.DS-11
- Have your information system's security audited at least once every three years, and attach a copy of the audit report to your annual internal-control report.NIST CSF 2.0ID.IM-01
- A failure to complete the three-year audit draws a penalty of HTG 200,000; a failure to remedy a violation BRH identifies draws HTG 100,000 per day of continuing infraction, plus HTG 2,500 per day for late payment of any fine.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.IM-01Improvements are identified from evaluations
- ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
- PR.DS-11Backups of data are created, protected, maintained, and tested
- RS.CO-03Information is shared with designated internal and external stakeholders
- CIS Controls
- 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 8.2Turning on and gathering logs from the enterprise's systems.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles 4 and 5 set only monetary penalties administered by BRH (a fixed HTG 200,000 penalty for an audit-cycle failure, an HTG 100,000 per-day penalty for unremedied violations, and an HTG 2,500 per-day late-payment surcharge); no provision reviewed here creates a criminal offense for noncompliance.
Penalty structure
Article 4's HTG 100,000-per-day penalty applies to a financial institution's continuing failure to remedy a violation BRH has identified and notified, running from the date of that notice. A separate, one-time HTG 200,000 penalty applies where the institution has failed to complete its own required security audit within the three-year cycle Article 3(t) sets. A further HTG 2,500-per-day late-payment surcharge applies where an institution without a BRH account fails to pay a fine by cheque within five business days of the payment notice.
- Rule
- Per violation only
- As of
- Currency
- HTG
- Per violation unit
- Day
- Per violation amount
- 100,000
Over one month of continuous breach, HTG 3,044,000.
Who enforces it
Enforcement body
Banque de la République d'Haïti (BRH), which may order and charge an institution for an audit after notice, require an institution to remediate identified violations, and deduct any fine directly from the institution's account at BRH.
Settledness
- As of
- Open questions
- Has BRH issued any further guidance or an updated circular refining the technical detail of the Article 3 security standards since Circulaire 126 took effect on ?
What this law does
Circulaire 126 sets the information-security rules that bind every institution financière the Banque de la République d'Haïti (BRH) supervises, pursuant to Articles 83 and 161 of the law on banks and other financial institutions. Every financial institution must have a written information-security policy, updated annually and approved by its board of directors.
Every bank must have an information-security committee that validates and approves the security measures adopted to implement that policy, a function the board of directors performs for other categories of financial institution. Every financial institution must designate an information-security officer independent of the IT department, reporting either to the risk-management function or directly to general management.
Every financial institution must ensure that its security committee is systematically informed of incidents capable of compromising information security, and of the measures taken to address them. Every financial institution must develop, test and maintain a contingency plan based on a risk analysis, to ensure the continuity of its activities in all circumstances.
Every financial institution must have its information system's security audited at least once every three years, with a copy of the audit report attached to its annual internal-control report. A financial institution that fails to have its system audited on that three-year cycle is liable to a penalty of two hundred thousand gourdes, and BRH may itself order and charge for an audit after notice.
A financial institution that fails to remedy a violation BRH identifies is liable to a further penalty of one hundred thousand gourdes per day of continuing infraction, plus an additional late-payment penalty of two thousand five hundred gourdes per day. The circular's provisions took effect .
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .