QatarQatar Central Bank Technology Risks Regulation for Banks, cyber security requirements
Qatar Central Bank Technology Risks Regulation for Banks (January 2018), Sections 1 to 9
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a bank licensed in Qatar and regulated by the Qatar Central Bank (QCB); a bank that declares it is a bank is reached (Section II).
- Have the board and senior management oversee technology risks, and establish IT policies, standards and procedures to manage them (Section 1.2.1).
- Have the information systems (infrastructure, people and processes) audited at least once every year, or whenever a change may affect their security (Section 3.1.3).
- Submit a compliance report to QCB on an annual basis at a minimum, and obtain QCB's prior approval before entering into an outsourcing agreement (Sections 7.1.1 and 9.10.1.2).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Article 216 sets up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and also up to 100,000 riyals daily for every continuous violation.
- Rule
- Per violation only
- As of
- Currency
- QAR
- Per violation unit
- Violation
- Per violation amount
- 10,000,000
Who enforces it
Enforcement body
The Qatar Central Bank, which may impose a financial penalty on a financial institution for a violation of the Qatar Central Bank Law or of the regulations, decisions or instructions issued in implementation of it (Law No. 13 of 2012, Article 216).
What this law does
The Technology Risks Regulation is addressed to banks in Qatar, which it says are required to comply with its requirements. A bank's board and senior management must oversee its technology risks. A bank must have its information systems audited at least once every year, or whenever a change may affect their security. A bank must submit a compliance report to QCB on an annual basis at a minimum. A bank must obtain QCB's prior approval before entering into an outsourcing agreement.
QCB's published sanctions part for banks provides that penalties are imposed for any violation of the instructions on Modern Technology and Electronic Banking Services Risks, the circular whose requirements this Regulation says it has enhanced.
Article 216 of the Qatar Central Bank Law (Law No. 13 of 2012) lets the Qatar Central Bank impose a financial penalty of up to 10,000,000 riyals for every violation of the Law or of the regulations, decisions or instructions issued in implementation of it, and up to 100,000 riyals a day for a continuing violation.
The Qatar Central Bank's enforcement guidance lists a breach of the Law or its implementing resolutions or instructions among the grounds on which a licence can be canceled or suspended under Article 90 of the Law.
When LexLint raises it
When your app profile says your app is a bank.