MauritiusBank of Mauritius Guideline on Cyber and Technology Risk Management, Incident Reporting
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds every financial institution licensed or authorised by the Bank of Mauritius (reached by declaring that you provide financial services). The Guideline came into effect on , and paragraph 102 required full compliance by the end of June 2024.
- Report cyber and technology events and incidents to the Bank of Mauritius in the manner and format the Bank prescribes (paragraph 96).
- Share cyber and technology threat intelligence information with the Bank in the manner and format the Bank prescribes (paragraph 97).
- Submit to the Bank the findings of all audits, assessments and testing exercises, together with the remediation plan, within 90 days from the date of completion of each exercise (paragraph 95).
- Set out in your board approved response and recovery plan the details of internal and external stakeholders, including the Bank, the information to be shared and reported and the relevant timeframes, including in an emergency (paragraph 55(viii)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Section 100(4) of the Banking Act 2004 makes failing to comply with guidelines or instructions made under section 100 an offence punishable by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.
Penalty structure
Section 100(4) of the Banking Act 2004 caps the fine at 100,000 rupees and the imprisonment at 2 years for failing to comply with guidelines or instructions made under that section; the fine and the imprisonment are stated together ('and').
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Bank of Mauritius, which issues the Guideline under section 100 of the Banking Act 2004 together with section 50 of the Bank of Mauritius Act 2004 and section 17 of the National Payment Systems Act 2018.
Settledness
- As of
- Open questions
- In what manner, format and timeframe has the Bank of Mauritius prescribed that a financial institution report a cyber or technology incident under paragraph 96?
- What penalty applies to a payment service provider that fails to comply with the Guideline, given that the Guideline cites section 17 of the National Payment Systems Act 2018 as well as the Banking Act 2004 as its authority?
What this law does
The Guideline applies to all financial institutions licensed or authorised by the Bank of Mauritius. The Guideline came into effect on . Paragraph 96 of the Guideline requires financial institutions to report cyber and technology events and incidents to the Bank in such manner and format as the Bank prescribes. Paragraph 97 requires financial institutions to share cyber and technology threat intelligence information with the Bank in such manner and format as the Bank prescribes.
Paragraph 95 requires financial institutions to submit to the Bank the findings of all audits, assessments and testing exercises together with the remediation plan within 90 days from the date of completion of the respective exercise.
Paragraph 55(viii) lists, among the minimum contents of a response and recovery plan, the details of internal and external stakeholders, including the Bank, the information that has to be shared and reported together with relevant timeframes, including in case of emergency.
Section 100(4) of the Banking Act 2004 makes it an offence to fail to comply with guidelines or instructions made under that section, punishable on conviction by a fine not exceeding 100,000 rupees and imprisonment for a term not exceeding 2 years.
When LexLint raises it
When your app profile says your app provides financial services.