Saint LuciaSaint Lucia Virtual Asset Business Act, 2022, Licensee's Cyber-Threat Protection Policies
Virtual Asset Business Act, 2022 (No. 24 of 2022), s. 12(7)(b)
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a person licensed by the Financial Services Regulatory Authority under the Virtual Asset Business Act, 2022 (No. 24 of 2022) to offer or operate a virtual asset business in or from Saint Lucia: an exchange between a virtual asset and fiat currency, an exchange between forms of virtual assets, a transfer of a virtual asset, the safekeeping or administering of a virtual asset, or participating in or providing financial services related to the issue or sale of a virtual asset (sections 2(1), 3 and 4(1)) (reached by declaring that you are a crypto-asset provider).
- Implement and maintain policies for the virtual asset business to protect the operations of the licensee, and the personal information the licensee collects and stores, from cyber threats (section 12(7)(b)); this duty is stated separately from the policy duty to comply with the Data Protection Act in section 12(7)(a).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 19 sets, on summary conviction, a fine not exceeding ten thousand dollars and imprisonment for a term not exceeding two years for contravening a provision of the Act for which a penalty is not specified. Section 12(4) attaches a penalty of five thousand dollars only to subsections (2) and (3) of section 12, not to subsection (7).
Who enforces it
Enforcement body
The Financial Services Regulatory Authority, which the Act defines as the Authority.
Settledness
- As of
- Open questions
- Do the Virtual Asset Business Regulations, No. 37 of 2025 develop the cyber-threat policy duty in section 12(7)(b) beyond the Act's own text, and does the Virtual Asset Business (Amendment) Act, No. 1 of 2025 change it?
What this law does
Section 12(7)(b) of the Virtual Asset Business Act, 2022 requires a licensee to implement and maintain policies for the virtual asset business to protect the operations of the licensee and personal information collected and stored by the licensee from cyber threats. An applicant for a licence must include with its application written policies, rules and procedures covering, among other subjects, security access control and cyber security safeguards.
A person who contravenes a provision of the Act for which a penalty is not specified is liable on summary conviction to a fine not exceeding ten thousand dollars and imprisonment for a term not exceeding two years.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.