Saint LuciaSaint Lucia ECCB Technology Risk Management Standard, Cyber-Risk Governance and Security Duties of Licensed Financial Institutions
ECCB Technology Risk Management Standard Roles and Responsibilities and Information Security User Group (Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015), with Banking Act, No. 3 of 2015, ss. 75, 80 and 184
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every institution licensed under the Banking Act, No. 3 of 2015 of Saint Lucia, that is, a licensed financial institution supervised by the Eastern Caribbean Central Bank (reached by declaring that you are a bank). The Standard says it should be applied by all regulated licensed financial institutions, and their financial groups and conglomerates, unless information technology is not a significant function or alternative measures of equal effect have been taken.
- Explain any deviation from the Standard in a separate document, and make that document promptly available to the ECCB when it asks (Scope of Application, paragraph (c)).
- Have your board ensure the development of a robust cyber-risk management framework, with effective internal controls and risk management practices aimed at continuous security, reliability, resilience and recoverability (Board of Directors, item a).
- Have your senior management implement the board approved cyber security strategies, policies and framework, and develop and implement a cybersecurity incident response plan that details the steps to be taken in the event of a security breach (Senior Management, items a and e).
- Run a training program on IT security policies and procedures that is conducted and updated at least annually and reaches all employees, including senior management (Senior Management, item h).
- Establish an Information Security User Group (ISUG) that shares strategic, operational and tactical cybersecurity information and intelligence among the banking community on an automated platform (paragraph 12.7.3).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80 of the Banking Act, No. 3 of 2015 makes a licensed financial institution's failure to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80 an offence, punishable on summary conviction by a fine of $100,000 and a further penalty for each day a continuing offence continues after conviction.
Who enforces it
Enforcement body
The Eastern Caribbean Central Bank, which issued the Standard in exercise of the powers conferred on it by section 184 of the Banking Act.
Settledness
- As of
- Open questions
- The Standard's own footnote cites the Banking Act of Anguilla as the empowering provision; is a separate issuance for Saint Lucia needed before it binds institutions licensed under the Banking Act, No. 3 of 2015?
What this law does
The Prudential Standard on Technology Risk Management for Institutions Licensed Under the Banking Act, 2015 is issued by the Eastern Caribbean Central Bank in exercise of the powers conferred by section 184 of the Banking Act. The ECCB Technology Risk Management Standard came into effect on .
The ECCB Technology Risk Management Standard says it should be applied by all regulated licensed financial institutions unless information technology is not a significant function or alternative measures of equal effect have been taken. The ECCB Technology Risk Management Standard requires any deviation from it to be explained in a separate document that is made promptly available to the ECCB on request.
Under the ECCB Technology Risk Management Standard, the roles and responsibilities of the board of directors shall include ensuring the development of a robust cyber-risk management framework. Under the ECCB Technology Risk Management Standard, the roles and responsibilities of senior management shall include developing and implementing a cybersecurity incident response plan.
The ECCB Technology Risk Management Standard requires licensed financial institutions to establish an Information Security User Group. Section 75 of the Banking Act, No. 3 of 2015 lets the Central Bank take remedial action against a licensed financial institution that violates a prudential standard issued by the Central Bank.
Section 80 of the Banking Act, No. 3 of 2015 makes it an offence for a licensed financial institution to fail to comply with a requirement or prohibition imposed on it under the Part of the Act that contains section 80.
Under section 80 of the Banking Act, No. 3 of 2015, a licensed financial institution convicted of the offence of failing to comply with a requirement imposed under the Part of the Act that contains section 80 is liable to a fine of $100,000, with a further penalty for each day a continuing offence continues after conviction.
When LexLint raises it
When your app profile says your app is a bank.