Saint LuciaSaint Lucia ECCB Electronic Banking Standard, Incident Reports to the Central Bank Within Three Days
ECCB Electronic Banking Standard incident reports (Banking Prudential Standard No. 3 of 2022, Prudential Standard for Electronic Banking), paras. 5.2.7, 5.11.2 and 6.4, with Banking Act, No. 3 of 2015, ss. 75, 80 and 184
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says licensed financial institutions must apply it based on the scope and level of sophistication of their e-banking operations and functions.
- Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
- Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services, and identify and notify the affected customers (paragraph 5.2.7).
- Report to the Central Bank the incidents you deem significant, meaning those that may compromise your operations or pose a threat to financial stability; the Standard says these should be reported (paragraph 5.2.7).
- Have a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and for informing the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act, No. 3 of 2015 makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of $100,000 and a further penalty for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Eastern Caribbean Central Bank, which issued the Standard in exercise of the powers conferred on it by section 184 of the Banking Act.
Settledness
- As of
- Open questions
- Where one incident falls under both the Technology Risk Management Standard (alert within 24 hours, report within 48 hours) and the Electronic Banking Standard (report within 3 days), which clock does the Central Bank apply?
What this law does
Banking Prudential Standard No. 3 of 2022, the Prudential Standard for Electronic Banking, is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. Banking Prudential Standard No. 3 of 2022 came into effect on . Banking Prudential Standard No. 3 of 2022 applies to all institutions licensed under the Banking Act.
Paragraph 6.4 of the ECCB Electronic Banking Standard says that all incident reports and response shall be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the ECCB Electronic Banking Standard adds that any further update on the incident shall also be reported to the Central Bank.
Paragraph 5.2.7 of the ECCB Electronic Banking Standard says that an institution must implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of its e-banking services. Paragraph 5.2.7 of the ECCB Electronic Banking Standard also says that significant incidents should be reported to the Central Bank.
Paragraph 5.11.2 of the ECCB Electronic Banking Standard says that an institution must develop a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents. Institutions found in violation of the ECCB Electronic Banking Standard are subject to the remedial actions specified in section 75 of the Banking Act.
Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.