QatarQatar Central Bank Technology Risk Instructions for Financial Services Operators, incident management and notification
Qatar Central Bank Technology Risk Instructions for Financial Services Operators (2022), Section 1.4
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an exchange house, investment company, finance house or relevant broker operating in Qatar and regulated by the Qatar Central Bank (QCB); a firm that declares it is a payment provider, a lender or a securities firm is reached (Introduction and Scope).
- Develop and maintain an information security incident management policy and plan with various levels of escalation and response (Section 1.4.1).
- Notify QCB and the National Cyber Security Agency immediately, based on the severity of the incident, and notify the Ministry of Interior in the case of a cybercrime (Section 1.4.5).
- Exercise and simulate incident response plans periodically for critical business processes and key risks (Section 1.4.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 216 sets up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and also up to 100,000 riyals daily for every continuous violation.
- Rule
- Per violation only
- As of
- Currency
- QAR
- Per violation unit
- Violation
- Per violation amount
- 10,000,000
Who enforces it
Enforcement body
The Qatar Central Bank, which may impose a financial penalty on a financial institution for a violation of the Qatar Central Bank Law or of the regulations, decisions or instructions issued in implementation of it (Law No. 13 of 2012, Article 216).
What this law does
The Technology Risk Instructions apply to all Financial Service Operators, meaning exchange houses, investment companies, finance houses and their relevant brokers operating in Qatar and regulated by the Qatar Central Bank. A Financial Service Operator must develop and maintain an information security incident management policy and plan with various levels of escalation and response.
A Financial Service Operator must communicate all incidents internally according to the escalation plan, ensuring QCB and NCSA are notified immediately based on the severity of the incident, and must notify the Ministry of Interior in the case of a cybercrime. A Financial Service Operator must ensure periodic exercising and simulation of its incident response plans relevant to critical business processes and key risks.
Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.
The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.
When LexLint raises it
When your app profile says your app is a payment provider, is a lender or is a securities firm.