Saint Kitts and NevisSaint Kitts and Nevis Eastern Caribbean Central Bank Electronic Banking Standard, Incident Reporting
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an institution licensed under the Banking Act of Saint Kitts and Nevis: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on (reached by declaring that you are a bank).
- Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
- Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services (paragraph 5.2.7).
- Build into your incident response plan a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and a process to inform the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of one hundred thousand dollars and a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Central Bank, which may subject a licensed financial institution that violates a prudential standard issued by the Central Bank to the remedial actions specified in section 75 of the Banking Act.
Settledness
- As of
- Open questions
- Does the 3-day report under paragraph 6.4 of this standard and the 24-hour alert under paragraph 12.8.1 of the Technology Risk Management standard apply together to one cyber-incident?
What this law does
The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. Paragraph 6.4 of the standard requires all incident reports and the response to be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the standard also requires any further update on the incident to be reported to the Central Bank.
Paragraph 5.2.7 of the standard requires formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of e-banking services. Paragraph 5.11.2 of the standard requires an incident response plan to include a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents.
The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act. Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2).
Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management. Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.