Sri LankaTechnology Risk Management and Resilience for Licensed Banks
Banking Act Directions No. 16 of 2021 (Regulatory Framework on Technology Risk Management and Resilience for Licensed Banks) Directions 1 to 8 and Schedule I
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds every licensed commercial bank and licensed specialised bank, including its operations conducted through agents and third-party service providers (reached by declaring that you are a bank).
- Establish an Information Security Committee as the apex management level body responsible for information security and technology resilience (Schedule I, 4.1.1).
- Appoint a Chief Information Security Officer as the executive officer responsible for the bank’s information security (Schedule I, 4.2.1).
- If you are a licensed commercial bank, a licensed specialised bank that is a domestic systemically important bank, or another licensed specialised bank offering electronic delivery channels other than automated teller machines, implement a Security Operations Center that is operational on a 24 x 7 basis (Schedule I, 5.6.1 and 5.6.4).
- Keep an up to date incident response plan approved by your Board of Directors, detailing procedures for incident escalation, remediation, recovery, and communication with internal and external stakeholders (Schedule I, 5.7.1).
- Test incident response and recovery capabilities at least annually (Schedule I, 5.7.2).
- Subject critical information systems to penetration tests by independent external experts at least annually, and other qualifying information systems and customer data repositories at least once in every two years (Schedule I, 5.8.3(ii)).
- Keep disaster recovery arrangements for critical information systems that meet a recovery time objective of less than 4 hours if you are a domestic systemically important bank, or less than 6 hours if you are not, and a recovery point objective of zero or near zero (Schedule I, 6.3.1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 80(1)(b) of the Banking Act makes it an offence for a director, manager, officer or employee of a licensed bank to fail to comply with a direction issued by the Monetary Board under that Act.
Who enforces it
Enforcement body
The Monetary Board of the Central Bank of Sri Lanka, which may issue directions to licensed commercial banks regarding the manner in which any aspect of their business is conducted.
Settledness
- As of
- Open questions
- What do Banking Act Directions No. 05 of 2023, listed as amendments to these Directions, change in the framework described here?
What this law does
Banking Act Directions No. 16 of 2021 apply to all licensed banks, including operations conducted through agents and third-party service providers. Banking Act Directions No. 16 of 2021 are dated . The Monetary Board of the Central Bank of Sri Lanka is empowered to issue Directions to all licensed commercial banks regarding the manner in which any aspect of their business is conducted.
The Monetary Board is empowered to give Directions to licensed specialised banks regarding the manner in which any aspect of their business is conducted. The framework in Schedule I requires a licensed bank to establish an Information Security Committee as the apex management level body responsible for information security and technology resilience.
The framework requires a licensed bank to appoint a Chief Information Security Officer as the executive officer responsible for its information security. The framework requires a Security Operations Center to be operational on a 24 x 7 basis. The framework requires a licensed bank to have an up to date incident response plan approved by its Board of Directors, detailing procedures for incident escalation, remediation, recovery, and communication with internal and external stakeholders.
The framework requires critical information systems to be subjected to penetration tests at least annually. The framework requires a recovery time objective of less than 4 hours for the critical information systems of a domestic systemically important bank and less than 6 hours for those of any other licensed bank. The general deadline for requirements without an extended deadline is 31.12.2022.
Banking Act Directions No. 05 of 2023, dated 08.12.2023, are listed as amendments to Banking Act Directions No. 16 of 2021. Section 80 of the Banking Act makes it an offence for a director, manager, officer or employee of a licensed bank to fail to comply with a direction issued by the Monetary Board under the Act.
When LexLint raises it
When your app profile says your app is a bank.