OmanCentral Bank of Oman Open Banking Regulatory Framework, Cybersecurity and Information Security
Central Bank of Oman Open Banking Regulatory Framework, Article 5 and Annexure 3
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an Open Banking Service Provider licensed by the Central Bank of Oman, that is an account information service provider or a payment initiation service provider (reached by declaring that you are a payment provider); the Framework is effective from the date of issuance.
- Comply with Annexure 3, the Open Banking Data and Information Security Specification, to obtain the license and continue to comply with it while providing Open Banking Services (Article 5).
- Comply with the requirements in Annexure 3 to mitigate the cybersecurity risks that arise from the use of APIs for interconnectivity between your service and banks, payment service provider licensees or financial institutions (Article 6.8.3).
- Include a chief information security officer in your senior management team (Article 6.1.1).
- Put new technology deployments through security testing before go-live, adopt a defined vulnerability management process covering discovery, prioritization and remediation, and run security assessments including penetration testing periodically or whenever significant changes occur in the environment (Annexure 3, section 13.3.1(d)).
- Adopt logging practices that record successful and unsuccessful security events, keep log access to authorized individuals, and run a mechanism for log analysis to identify anomalies and detect potential security incidents (Annexure 3, section 13.3.1(e)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Oman, which may, after due process, carry out remedial action or impose penalties on a licensee that is non-compliant with applicable laws, regulations or instructions, as applicable under the National Payment Systems Law and the Banking Law.
Settledness
- As of
- Open questions
- Which requirements does the Central Bank of Oman's Cyber Security and Resilience Framework, cited in this Framework as BM 1194, add for an open banking licensee?
What this law does
The Framework is effective from the date of issuance unless otherwise specified. Article 5 requires an applicant to comply with Annexure 3, the Open Banking Data and Information Security Specification, to obtain a license, and requires the licensee to continue to comply with it while providing Open Banking Services.
Article 6.8.3 requires licensees to comply with Annexure 3 to mitigate the cybersecurity risks that arise from the use of APIs for interconnectivity between licensees and banks, payment service provider licensees or financial institutions. Annexure 3 states that new technology deployments must undergo security testing before go-live. Annexure 3 states that logging mechanisms should record both successful and unsuccessful occurrences of security events.
Article 10.1 provides that the Central Bank may, after due process, carry out remedial action or impose penalties on a non-compliant licensee as applicable under the National Payment Systems Law and the Banking Law.
When LexLint raises it
When your app profile says your app is a payment provider.