Saint LuciaSaint Lucia ECCB Technology Risk Management Standard, Cyber-Incident Alert, Report and Customer Notice
ECCB Technology Risk Management Standard paras. 12.8.1 to 12.8.5 and Senior Management items f and g (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Reporting
As of .
What it requires
- This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says it should be applied by all regulated licensed financial institutions, and their financial groups and conglomerates, unless information technology is not a significant function or alternative measures of equal effect have been taken.
- Alert the ECCB and your Information Security User Group within 24 hours of becoming aware of a cyber-incident (paragraph 12.8.1).
- Complete the Appendix I cyber-incident report and submit it to the ECCB within 48 hours of the incident; the Standard says you should do so, and Appendix I instructs you to submit the form within 48 hours of a suspected or confirmed cyber-incident (paragraph 12.8.1 and Appendix I).
- Provide updates on the incident to the ECCB at the frequency the ECCB determines, until the ECCB deems the incident resolved (paragraph 12.8.4).
- After the cyber-incident is resolved, conduct a post-incident review and submit it to the ECCB; the review should at a minimum include lessons learnt and a plan of action to address identified deficiencies and IT controls (paragraph 12.8.5).
- Notify directly each customer whose account was potentially or actually compromised within seventy-two (72) hours of the discovery of the incident, and notify the general public about the incident after notifying the ECCB (Senior Management, items f and g).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act, No. 3 of 2015 makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of $100,000 and a further penalty for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Eastern Caribbean Central Bank, which issued the Standard in exercise of the powers conferred on it by section 184 of the Banking Act.
Settledness
- As of
- Open questions
- Where one incident falls under both the Technology Risk Management Standard (alert within 24 hours, report within 48 hours) and the Electronic Banking Standard (report within 3 days), which clock does the Central Bank apply?
- The Standard's own footnote cites the Banking Act of Anguilla as the empowering provision; is a separate issuance for Saint Lucia needed before it binds institutions licensed under the Banking Act, No. 3 of 2015?
What this law does
The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on .
Paragraph 12.8.1 of the ECCB Technology Risk Management Standard says that within 24 hours of becoming aware of a cyber-incident a licensed financial institution shall alert the ECCB and its Information Security User Group. Paragraph 12.8.1 of the ECCB Technology Risk Management Standard also says that the compromised institution should complete the incident report in Appendix I and submit it to the ECCB within 48 hours of the incident.
Paragraph 12.8.4 of the ECCB Technology Risk Management Standard says that an institution shall provide an update on the incident to the ECCB at a frequency determined by the ECCB. Paragraph 12.8.5 of the ECCB Technology Risk Management Standard says that after the cyber-incident is resolved an institution shall conduct a post-incident review and submit it to the ECCB.
Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include notifying directly, within seventy-two hours of the discovery of the incident, the customers whose accounts were potentially or actually compromised. Section 75 of the Banking Act, No. 3 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.
Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.