MozambiqueBanco de Moçambique Aviso 6/GBM/2026, Data Centers, Cloud Contracting and Data Security for Credit Institutions and Financial Companies
Aviso n.º 6/GBM/2026, Arts. 4 a 12
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds credit institutions and financial companies (article 2); you are reached by declaring that you provide financial services. The Aviso enters into force on , and an institution already operating has up to 12 months from then to bring its data centers and service contracts into line (article 12).
- Keep primary and secondary data centers, with the primary ones located in Mozambique (article 4).
- Tell the Banco de Moçambique immediately of any circumstance that restricts or prevents the equivalence of your primary and secondary data centers, and at least 30 days ahead of any foreseeable structural change to your technology infrastructure, information systems or data centers (article 6).
- If you are a bank, microbank or electronic money institution, handle your information exclusively in private clouds (article 9).
- Throughout any contract for data-center, management or cloud services, ensure the provider guarantees the confidentiality, integrity, availability and recovery of your data, and security measures for data in transit and at rest, including encryption, multi-factor authentication, identification and correction of vulnerabilities and access controls (article 10).
- Write into each such contract, at least, the security measures for the transmission, storage and segregation of data and the Banco de Moçambique's right of audit (article 11).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Banco de Moçambique, to which institutions direct questions of interpretation (Departamento de Supervisão Prudencial) and which decides authorization requests.
Settledness
- As of
- Open questions
- Article 14 punishes non-compliance under the Lei das Instituições de Crédito e Sociedades Financeiras: which provisions of that Law set the contravention and its fine for a breach of this Aviso?
What this law does
Article 2 of Aviso n.º 6/GBM/2026 applies the Aviso to credit institutions and financial companies. Article 4 requires the institutions to have primary and secondary data centers and requires the primary ones to be located in national territory.
Article 6 requires the institutions to tell the Banco de Moçambique immediately of any circumstance that restricts or prevents the equivalence of the primary and secondary data centers, and at least 30 days ahead of any foreseeable structural change to their technology infrastructure, information systems or data centers. Article 9 requires the information of banks, microbanks and electronic money institutions to be handled exclusively in private clouds.
Article 10 requires the institutions to ensure throughout the contract that the provider guarantees confidentiality, integrity, availability and recovery of the data, and security measures for data in transit and at rest, including encryption, multi-factor authentication, identification and correction of vulnerabilities and access controls.
Article 11 requires the service contracts to provide at least for the security measures adopted for the transmission, storage and segregation of data and for a right of audit by the Banco de Moçambique. Article 12 gives institutions already operating a maximum of 12 months from the Aviso's entry into force to bring their data centers and service contracts fully into line.
Article 14 provides that non-compliance with the Aviso is a contravention punishable under the Lei das Instituições de Crédito e Sociedades Financeiras. The Aviso was published in the Boletim da República I Série n.º 166 of . Article 17 of the Aviso has it enter into force 60 days after the date of its publication.
When LexLint raises it
When your app profile says your app provides financial services.