Papua New GuineaBank of Papua New Guinea Directive on Electronic Fund Transfers 02/2019, Technology and Information Security Standards
Directive on Electronic Fund Transfers 02/2019 (Bank of Papua New Guinea), s. 4
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.bankpng.gov.pg/sites/default/files/2024-09/Directive-on-Electronic-Funds-Transfer.pdfIn force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a payment service provider offering electronic fund transfers by any means in Papua New Guinea, including through ATM and POS terminals, internet and telephone channels, mobile phones, cards and e-money (reached by declaring that you are a payment provider); it does not reach a business that offers no payment service.
- Ensure the technology you use to supply payment service facilities for electronic transfers is safe and secure and ensures confidentiality, integrity, authenticity and non-repudiation of the payment related information (s. 4(1)).
- Update and implement an information security policy that adequately addresses the security requirements of the relevant delivery channels, and use methods consistent with industry best practices to authenticate user identity (s. 4(3) and (4)).
- Implement a robust security risk management framework to actively identify, assess, reduce and monitor security risk, so that sensitive information stays confidential in transmission and storage, information stays accurate, reliable and complete, users and agents are authenticated and their functions authorized, online transactions are monitored to detect fraud and act on it promptly, and risk controls cover every point of interaction with customers (s. 4(6)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 30(1) of the National Payments System Act 2013 makes a contravention of directions made under the Act an offence, and section 30(2) sets a fine not exceeding K500,000 or imprisonment not exceeding five years, or both, where no specific penalty is provided.
Penalty structure
Under the National Payments System Act 2013, section 30, a contravention of directions made under the Act where no specific penalty is provided carries a fine of up to K500,000, or imprisonment of up to five years, or both, with a further default penalty of up to K5,000 for each day a continuing offence persists.
- Rule
- Per violation only
- As of
- Currency
- PGK
- Fixed cap
- 500,000
- Per violation unit
- Day
- Per violation amount
- 5,000
Over one month of continuous breach, PGK 152,200.
Who enforces it
Enforcement body
The Bank of Papua New Guinea, as the Central Bank, which may prosecute a person who commits an offence against the National Payments System Act 2013.
What this law does
The Bank of Papua New Guinea's Directive on Electronic Fund Transfers 02/2019 states that it is issued in accordance with the National Payments System Act 2013 and that the Directive legalises its enforcement. Section 4(1) of the Directive requires the technology used for supplying payment service facilities for electronic transfers to be safe and secure and to ensure confidentiality, integrity, authenticity and non-repudiation of the payment related information.
Section 4(3) of the Directive requires payment service providers to update and implement the information security policy to address the security requirements of the relevant delivery channels. Section 4(6) of the Directive requires payment service providers to implement a robust security risk management framework to actively identify, assess, reduce and monitor security risk.
Section 34 of the National Payments System Act 2013 lets the Central Bank issue orders, directions or guidelines to implement the Act. Section 30 of the National Payments System Act 2013 makes a contravention of the Act or of directions made under it an offence, with a fine of up to K500,000 or imprisonment of up to five years, or both, where no specific penalty is provided.
When LexLint raises it
When your app profile says your app is a payment provider.