NamibiaBank of Namibia Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12), Cybersecurity Standards
PSD-12, cybersecurity standards, paras. 9 to 13
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds the payment system operators, participants and payment service providers within Namibia's National Payment System: Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems such as electronic funds transfers, payment cards and electronic money, Payment Service Providers and any other entity licensed or authorised within the National Payment System (reached by declaring that you are a payment provider or a bank).
- Have your board establish and approve a Framework for information security, cybersecurity and operational resilience, and set risk tolerances aligned with the key risk indicators in paragraph 13 (paragraphs 9.1 and 9.3).
- Identify and classify your business functions and supporting processes and perform a risk assessment at least once every year, and include one penetration test every three years for critical systems in your threat intelligence processes (paragraphs 11.1 and 11.3).
- Encrypt, tokenize or mask data transmitted across open and public networks in line with best practice standards (paragraph 12.1).
- Meet the key risk indicators and tolerance levels in paragraph 13, including recovery time and recovery point objectives for critical systems, and test your response, resumption and recovery plans (paragraph 13).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.
Penalty structure
An administrative penalty under section 16A(3) of the Payment System Management Act, 2003, imposed after the Bank serves a written notice to show cause and receives no satisfactory explanation within 14 days.
- Rule
- Per violation only
- As of
- Currency
- NAD
- Fixed cap
- 1,000,000
- Per violation unit
- Day
- Per violation amount
- 100,000
Over one month, NAD 1,000,000, which is the instrument's own cap: the penalty stops accruing on day 10.
Who enforces it
Enforcement body
The Bank of Namibia, which may inspect all records, data or other relevant information to ensure compliance and impose administrative penalties.
Settledness
- As of
- Open questions
- Which of the Determination's operational resilience and cybersecurity standards apply to a bank that only participates in a payment system the Bank of Namibia oversees?
What this law does
Paragraph 6 of the Determination of the Operational and Cybersecurity Standards within the National Payment System (PSD-12) applies it to all Financial Market Infrastructures, Designated Non-Bank Financial Institutions, participants of Financial Market Infrastructures, Retail Payment Systems, Payment Service Providers and any other entities licensed or authorised within the National Payment System.
Paragraph 9.1 of PSD-12 makes the boards of the entities it applies to responsible for information security, cybersecurity and operational resilience, and requires them to establish and approve a Framework. Paragraph 11.1 of PSD-12 requires an identification of business functions and supporting processes and a risk assessment at least once every year, or when a significant change affects them.
Paragraph 12.1 of PSD-12 requires encryption, tokenization or masking of the transmission of data across open and public networks in line with best practice standards. Paragraph 16 of PSD-12 says it becomes effective on . Paragraph 15 of PSD-12 says any person that contravenes or fails to comply with any provision of it will be subjected to administrative penalties as provided for under the Act.
Section 16A(3) of the Payment System Management Act, 2003 lets the Bank of Namibia impose an administrative penalty not exceeding N$100 000 for each day of non-compliance, up to N$1 000 000 in total. Section 14(2) of the Payment System Management Act, 2003 makes contravening a determination made under section 14(1) an offence.
When LexLint raises it
When your app profile says your app is a payment provider or is a bank.