Saint Kitts and NevisSaint Kitts and Nevis Eastern Caribbean Central Bank Technology Risk Management Standard, Cyber-Risk Governance
Technology Risk Standard cyber governance, Prudential Standard on Technology Risk Management, paras. 5.2.4 and Board and Senior Management roles
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an institution licensed under the Banking Act of Saint Kitts and Nevis: the Prudential Standard on Technology Risk Management says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates unless IT is not a significant function or equally effective alternative measures have been taken, and it came into effect on (reached by declaring that you are a bank).
- Have your Board keep ultimate responsibility for effective oversight of all IT and cybersecurity risks, systems and processes, and approve the technology policies, standards and procedures that govern the management of technology risks and safeguard information system assets (Information Technology Governance and Board roles).
- Have Senior Management implement the Board-approved cyber security strategies, policies and framework, which the standard lists among Senior Management's responsibilities (Senior Management roles, item a).
- If you rely heavily on IT systems for daily operations, you should establish a cybersecurity policy based on your risk assessment that mitigates the identified cyber risk threats in line with your risk appetite (paragraph 5.2.4).
- Explain any deviation from the standard in a separate document and make it promptly available to the ECCB on request (Scope of Application, item c).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of one hundred thousand dollars and a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Central Bank, which may subject a licensed financial institution that violates a prudential standard issued by the Central Bank to the remedial actions specified in section 75 of the Banking Act.
Settledness
- As of
- Open questions
- Which of the paragraphs of the standard worded as 'should' does the Central Bank treat as a breach of a prudential standard?
What this law does
The Eastern Caribbean Central Bank issued the Prudential Standard on Technology Risk Management in exercise of the powers conferred on it by section 184 of the Banking Act, 2015. The standard comes into effect on . The standard says it should be applied by all regulated licensed financial institutions, Financial Groups and Conglomerates, unless IT is not a significant function or alternative measures of equal effect have been taken.
The standard says the Board of an institution is ultimately responsible for effective oversight of all IT and cybersecurity risks, systems and processes. The standard says that any deviation from it must be explained in a separate document, to be made promptly available to the ECCB on request. The standard says an institution that relies heavily on its IT systems for daily operations should establish a cybersecurity policy based on its risk assessment.
Section 75(1)(c) of the Banking Act of Saint Kitts and Nevis provides that a licensed financial institution that violates any prudential standard issued by the Central Bank may be subject to the remedial actions specified in section 75(2). Section 75(2) of the Act lets the Central Bank issue a written warning, conclude a written agreement providing for a program of remedial action, issue an order, or issue directions to the management.
Section 80 of the Banking Act of Saint Kitts and Nevis makes it an offence for a licensed financial institution to fail to comply with any requirement or contravene any prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80(a), a licensed financial institution convicted of that offence is liable on summary conviction to a fine of one hundred thousand dollars, with a further penalty of ten thousand dollars for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.