MadagascarBanking Act: Cybersecurity Duties of Credit Institutions
Loi n°2020-011 sur la loi bancaire, art. 164
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://www.assemblee-nationale.mg/wp-content/uploads/2020/09/Loi-n%C2%B02020-011_loi-bancaire.pdfIn force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a credit institution (établissement de crédit): a legal person that habitually performs one or more of the banking services in Articles 5 to 13 of the Banking Act in Madagascar (Article 2), reached by declaring that you are a bank.
- Comply with the cybersecurity regulation in force, including the rules the CSBF issues by instruction for preventing, managing and mitigating information-technology risk across the banking system (Article 164).
- Define a cybersecurity policy and strategy, and put in place the means needed to prevent, manage and mitigate cyber-risks, with a rapid, effective and proportionate framework for response and control (Article 164).
- Delimit the cybersecurity roles of the board of directors, the general management and the internal control body, and adopt ethics rules for those roles that their members can understand (Article 164).
- Prepare and keep up to date a crisis management plan that your board of directors and the CSBF approve (Article 164).
- Make the security rules for your computer and telecommunications networks conform to the standards issued by the national cybersecurity entity (Article 164).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commission de Supervision Bancaire et Financière (CSBF), which imposes disciplinary and pecuniary sanctions on a banking service provider that breaches the Act or its subsequent texts.
Settledness
- As of
- Open questions
- Which CSBF instruction currently sets the information-technology risk rules that Article 164 directs the CSBF to issue?
- Which body is the national entity in charge of cybersecurity whose standards Article 164 makes binding on credit institutions' network security rules?
What this law does
Article 164 requires credit institutions to comply with the cybersecurity regulation in force. Article 164 has the Commission de Supervision Bancaire et Financière (CSBF) ensure that each credit institution defines a cybersecurity policy and strategy, sets up the means to prevent, manage and mitigate cyber-risks, delimits the cybersecurity roles of its board, general management and internal control body, and keeps a crisis management plan that its board and the CSBF approve.
Article 61 lets the CSBF impose pecuniary sanctions in addition to or instead of its disciplinary sanctions, with the amount set by decree of the Minister of Finance.
When LexLint raises it
When your app profile says your app is a bank.