NamibiaBank of Namibia Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12), Cyber Incident Reporting
PSD-12, cyber incident reporting, paras. 11.13 to 11.15
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
- Report every successful cyberattack incident to the Bank of Namibia, with a preliminary notification within 24 hours (paragraph 11.13).
- After that notification, conduct an impact assessment of the successful cyberattack incident and report to the Bank within a month from the time the incident becomes known (paragraph 11.14).
- Make the impact report indicate at least any financial loss, data loss and availability loss (paragraph 11.15).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.
Penalty structure
An administrative penalty under section 16A(3) of the Payment System Management Act, 2003, imposed after the Bank serves a written notice to show cause and receives no satisfactory explanation within 14 days.
- Rule
- Per violation only
- As of
- Currency
- NAD
- Fixed cap
- 1,000,000
- Per violation unit
- Day
- Per violation amount
- 100,000
Over one month, NAD 1,000,000, which is the instrument's own cap: the penalty stops accruing on day 10.
Who enforces it
Enforcement body
The Bank of Namibia, which may inspect all records, data or other relevant information to ensure compliance and impose administrative penalties.
Settledness
- As of
- Open questions
- Does the 24 hour clock in paragraph 11.13 run from detection or from the incident becoming known, given that paragraph 11.13 states no starting event?
What this law does
Paragraph 6 of the Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12) applies it to all Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems, Payment Service Providers and any other entities licensed or authorised within the National Payment System.
Paragraph 11.13 of PSD-12 requires all successful cyberattack incidents to be reported to the Bank, at least within 24 hours for the preliminary notification of the cyber incident. Paragraph 11.14 of PSD-12 requires the entity, after the reporting under paragraph 11.13, to conduct an impact assessment on the successful cyberattack incident and report to the Bank within a month from the time the incident becomes known.
Paragraph 11.15 of PSD-12 requires the reporting required by paragraph 11.14 to indicate at least any financial loss, data loss and availability loss. Paragraph 15 of PSD-12 says any person that contravenes or fails to comply with any provision of it will be subjected to administrative penalties as provided for under the Act.
Section 16A(3) of the Payment System Management Act, 2003 lets the Bank of Namibia impose an administrative penalty not exceeding N$100 000 for each day of non-compliance, up to N$1 000 000 in total. Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.
When LexLint raises it
When your app profile says your app is a payment provider or is a bank.