LebanonBanque du Liban Basic Decision No. 13790 on Electronic Payment Services Providers, IT Infrastructure and Information Security
Banque du Liban Basic Decision No. 13790 of (Basic Circular No. 1 to Electronic Payment Services Providers) Arts. 9, 24 and 39
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds an Electronic Payment Services Provider licensed by Banque du Liban, that is a non-bank institution providing e-money, local or cross-border money transfer, money collection and payment, or payment facilitator services (reached by declaring that you are a payment provider); the Decision entered into force on its issuance on .
- Comply, where applicable, with the regulatory rules on IT security and with Basic Decision No. 10227 on the business continuity plan and Basic Decision No. 12725 on cybercrime prevention (Article 24).
- To be licensed, prepare a detailed description of the IT infrastructure and information security framework at the level of the institution, its branches and its agents, covering an IT infrastructure plan, the information security measures that protect customers' funds and financial and personal data and mitigate operational, fraud and breach of trust risks, a business continuity and disaster recovery plan, and any IT outsourcing agreements (Article 9).
- If you provide the Payment Gateway service, obtain a Payment Card Industry Data Security Standard certification (Article 39(2)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Article 42 provides that a violation of the Basic Decision constitutes an offense under Article 770 of the Penal Code and that Banque du Liban may prosecute an infringing institution before the competent judicial authority.
Penalty structure
Article 40 lets the Central Council impose a fine not exceeding 1,500,000,000 Lebanese pounds for each violation of the Decision and of the relevant statements it imposes.
- Rule
- Per violation only
- As of
- Currency
- LBP
- Per violation unit
- Violation
- Per violation amount
- 1,500,000,000
Who enforces it
Enforcement body
Banque du Liban, whose Central Council may impose the fines in Article 40 and which may refer an infringing institution to the Higher Banking Commission to impose the administrative sanctions in Article 41.
Settledness
- As of
- Open questions
- Does Basic Decision No. 13790 impose any duty to report a cyber incident to Banque du Liban beyond the cybercrime prevention rules it incorporates in Article 24?
What this law does
Article 2 requires any institution intending to provide a covered service to obtain a prior approval from Banque du Liban to be licensed as an Electronic Payment Services Provider in one or more of five categories of services. Article 24 requires the licensed institution to comply with the regulatory rules on IT security and with Basic Decision 12725 on cybercrime prevention.
Article 9 requires the institution to prepare a detailed description of its IT infrastructure and information security framework, including information security measures protecting customers' funds and financial and personal data. Article 39 requires an institution providing the Payment Gateway service to obtain a Payment Card Industry Data Security Standard certification. Article 40 lets the Central Council impose a fine of up to 1,500,000,000 Lebanese pounds for each violation of the Decision.
Article 41 lets Banque du Liban refer a violating institution to the Higher Banking Commission, which may impose a warning, limits on its activities, a ban on its managers and license revocation. Article 46 provides that the Decision enters into force upon its issuance.
When LexLint raises it
When your app profile says your app is a payment provider.