LiberiaCentral Bank of Liberia Regulations Concerning Licensing and Operations of Electronic Payment (E-Payment) Services: Information Technology Systems, Security and Controls
In force since .
A sector security regimes rule binding private bodies.
- Enforcement body
- Central Bank of Liberia
- Obligation class
- Security, Governance
As of .
What it requires
- This reaches you where you are a bank or non-bank financial institution, or another entity authorized by the Central Bank of Liberia, that provides electronic payment services, including by issuing e-payment products or schemes, or where you are a third-party e-payment service provider or operator (reg. 2.0) (reached by declaring that you are a bank or a payment provider).
- Make sure the integrity and adequacy of your IT and security systems cover, at minimum, security policies and measures to safeguard the integrity, authenticity and confidentiality of data and operating systems, physical and logical access controls, backup infrastructure, a business continuity and disaster recovery plan, an effective audit function reviewing the security control environment and critical systems, an IT systems vulnerability assessment report, and a satisfactory report from an ICT certification authority on information security in accordance with the Payment Systems Act (reg. 9.0(b)).
- If you are a bank or non-bank financial institution applying to provide or enhance electronic payment services, include with your application a report from a recognized ICT certification agency confirming that corporate security policy and procedures addressing all security issues affecting the electronic payments system exist (reg. 6.0(e)).
- Ensure the security, integrity, confidentiality and availability of data and services by adopting prevailing international standards and those prescribed by the Central Bank of Liberia, and implement a cyber-security policy that conforms with international standards and any cyber-security standards the Central Bank issues (reg. 9.1(b) and (c)).
- Keep a complete audit log of all user activities on your information technology systems, and test the backup infrastructure and business continuity plan at least semi-annually (regs. 9.1(e) and 9.2(b)).
- Deploy a security appliance such as a firewall and a solution that prevents a direct connection between your back-end system and the Internet, and comply with the Payment Card Industry Data Security Standards for ATMs (regs. 10.2(b) and 25.1).
- Identify an ICT compliance officer whose responsibilities include compliance with the standards in the Regulations and your policies on ICT (reg. 17.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
The Central Bank of Liberia may impose monetary penalties of up to L$200,000.00 for a violation, alongside warning letters, directives to take corrective action, civil penalties, removal of staff, suspension of financial activities and license revocation.
- Rule
- Fixed only
- As of
- Currency
- LRD
- Fixed cap
- 200,000
What this law does
The Regulations apply to all banks and non-bank financial institutions and to any other entities duly authorized by the Central Bank and intending to provide electronic payment services. Regulation 9.0 says the integrity and adequacy of an e-payment service provider IT and security systems should at minimum cover an effective audit function over the security control environment and critical systems and an IT systems vulnerability assessment report.
Regulation 9.1 requires an e-payment service provider to implement a cyber-security policy that conforms with international standards and any other cyber-security standards the Central Bank will issue. Regulation 25.1 makes the Payment Card Industry Data Security Standards the approved standard for compliance for all ATMs in Liberia. Regulation 26.1 allows the Central Bank to impose administrative penalties of up to L$200,000.00 for a violation of the Regulations.
The Regulations take effect upon publication in the Official Gazette. The Liberia Official Gazette that publishes the Regulations is dated Wednesday, .
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.