OmanCentral Bank of Oman Open Banking Regulatory Framework, Notification of Security Incidents
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an Open Banking Service Provider licensed by the Central Bank of Oman, that is an account information service provider or a payment initiation service provider (reached by declaring that you are a payment provider); the Framework is effective from the date of issuance.
- Notify the Central Bank of Oman of major operational or security incidents that have or could have a significantly negative impact on the financial interests of customers, banks, payment service provider licensees or financial institutions, or on the licensee itself (Article 6.6.3(c)(ii)).
- Notify the Central Bank of Oman of incidents where there is knowledge or suspicion of fraud committed or intended against customers or the licensee itself, whether by internal or external parties (Article 6.6.3(c)(i)).
- Promptly report to the relevant authorities any security breach resulting in the inadvertent or unlawful loss, alteration, unauthorized disclosure or access to data, or any incident related to cybersecurity such as malware, ransomware or denial-of-service attacks, after assessing its impact as high, medium or low, and adhere to the appropriate reporting timelines (Annexure 3, section 13.3.1(f)).
- Document incident response procedures with roles, responsibilities, lines of escalation and communication protocols, and conduct cyber incident drills or simulations annually (Annexure 3, section 13.3.1(f)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Oman, which may, after due process, carry out remedial action or impose penalties on a licensee that is non-compliant with applicable laws, regulations or instructions, as applicable under the National Payment Systems Law and the Banking Law.
Settledness
- As of
- Open questions
- Which reporting timelines apply to a high, medium or low impact security incident under Annexure 3, section 13.3.1(f)?
What this law does
The Framework is effective from the date of issuance unless otherwise specified. Article 6.6.3(c)(ii) requires a licensee to notify the Central Bank of major operational or security incidents that have or could have a significantly negative impact on the financial interests of customers, banks, payment service provider licensees or financial institutions, or the licensee itself.
Article 6.6.3(c)(i) requires a licensee to notify the Central Bank of incidents where there is knowledge or suspicion of fraud committed or intended against customers or the licensee itself. Annexure 3 states that any security breach resulting in loss, alteration, unauthorized disclosure or access to data, or any cybersecurity incident such as malware, ransomware or denial-of-service attacks, must be promptly reported to the relevant authorities.
Article 10.1 provides that the Central Bank may, after due process, carry out remedial action or impose penalties on a non-compliant licensee as applicable under the National Payment Systems Law and the Banking Law.
When LexLint raises it
When your app profile says your app is a payment provider.