LebanonBanque du Liban Basic Circular No. 144 (Prevention of Electronic Criminal Acts)
Banque du Liban Basic Decision No. 12725 of (Basic Circular No. 144 to Banks, also addressed to Financial Institutions) Prevention of Electronic Criminal Acts, Arts. 1-6
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: http://www.bdl.gov.lb/circulars/download/651/arIn force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds a bank or financial institution addressed by Banque du Liban's Basic Circular No. 144, in force since .
- Prepare policies and take preventive measures and procedures against crimes committed by electronic means, including a cybercrime risk analysis, a budget for an information-technology security policy, insurance covering electronic-crime risk, a continuously updated incident-response and business-continuity plan, a dedicated prevention team, and employee and customer awareness training.NIST CSF 2.0GV.PO-01
- Adopt at least two-factor authentication for any user accessing the system from outside the bank or financial institution, fully encrypt highly sensitive data, filter inbound email, verify the security of devices employees use outside the institution, run penetration testing, monitor network traffic, and verify data integrity.NIST CSF 2.0PR.AA-03NIST CSF 2.0PR.DS-01NIST CSF 2.0DE.CM-01
- On learning that a customer has fallen victim to a financially-natured electronic crime, notify Lebanon's Special Investigation Commission of the relevant technical information and direct the customer to file a judicial complaint.NIST CSF 2.0RS.CO-02
- Maintain a Compliance Department responsible for implementing this Decision.NIST CSF 2.0GV.RR-02
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- PR.AA-03Users, services, and hardware are authenticated
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- DE.CM-01Networks and network services are monitored to find potentially adverse events
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Articles One through Six set no fine or criminal penalty of their own for a bank or financial institution's noncompliance; separate criminal exposure for the underlying electronic crime itself runs through Law No. 81/2018's own cybercrime chapter, recorded under Lebanon's scraping topic rather than here.
Who enforces it
Enforcement body
Banque du Liban, through the Compliance Department each bank or financial institution must maintain under Article Four; Lebanon's Special Investigation Commission additionally receives incident-specific technical information under Article Three.
Settledness
- As of
- Open questions
- Banque du Liban's own website returns a Cloudflare bot challenge to an automated reader and the most recent Basic and Intermediate Circular index reachable through the Internet Archive dates to : has BDL issued a later circular amending or superseding Basic Circular No. 144 since then?
What this law does
Banque du Liban (BDL), Lebanon's central bank, issued Basic Decision No. 12725 dated on the prevention of electronic criminal acts. BDL published the Decision as Basic Circular No. 144 to banks, also addressed to financial institutions. The Decision took effect immediately upon its issuance.
Article One requires every bank and financial institution to prepare policies and take preventive measures and procedures against crimes committed by electronic means, covering at minimum a defined list of general policies and technical measures.
Those general policies include analyzing potential cybercrime risk and continuously following developments in information-security technology, budgeting for an information-technology security policy, arranging insurance against electronic-crime risk, maintaining a continuously updated incident-response and business-continuity plan, forming a dedicated prevention team, sharing threat information with relevant parties inside and outside the institution, training employees and customers, monitoring employees with privileged system access, and vetting any external party entrusted with tasks touching the institution's electronic systems.
The required technical measures include adopting a technology that relies on at least two factors to verify the identity of a user accessing the system from outside the bank or financial institution, fully encrypting highly sensitive data, strictly filtering inbound email, verifying the security of any device an employee uses outside the institution, monitoring network traffic for unusual behavior, and verifying data integrity to detect and trace unlawful tampering.
They also include penetration testing to detect any potential vulnerability in the network. Upon learning that a customer has fallen victim to a financially-natured electronic crime, the bank or financial institution must notify Lebanon's Special Investigation Commission of technical information related to the incident. A dedicated Compliance Department established at each bank and financial institution implements the Decision.
The Decision sets no fixed fine or criminal penalty of its own, and Banque du Liban's own circular index shows no later Basic or Intermediate Circular amending or superseding it through the most recent reachable listing.
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .