SeychellesSeychelles Financial Services Authority Guidance Notes for Cyber Security Audit of Virtual Asset Service Providers
Guidance Notes for Cyber Security Audit
Guidance, not a law: the Financial Services Authority of Seychelles's reading of Seychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Cyber Security Strategy, Systems and Controls, Audit and Business Continuity. It binds nobody by itself; the law it reads does.
Guidance on a sector security regimes rule, addressed to private bodies.
- Enforcement body
- The Financial Services Authority of Seychelles, which published the Notes.
- Instrument type
- guidance published by a regulator
- Obligation class
- Security, Governance
As of .
What the regulator expects
- These Notes read regulations 4 and 5 of the Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024, which reach your organization only if it is a licensee under the Virtual Asset Service Providers Act, 2024 (reached by declaring that you are a crypto-asset provider).
- The Authority says you should have a cybersecurity audit function appropriate to the size, risks and service offerings of your licence, with clear roles and responsibilities within a cybersecurity strategy approved by your Board and periodically reviewed (para. 3.1).
- The Authority says an audit should at a minimum cover planning, Board notification, testing of controls protecting client data, private keys and transactional data and of controls protecting digital assets, incident logs, data protection measures, acceptable use, data trails and controls on third-party suppliers (para. 3.2).
- The Authority says you should submit its Annex 1 application form to have your proposed Cyber Security Auditor approved, after considering the auditor's qualifications, competence and independence from any conflict of interest (paras. 4.2 to 4.6).
- The Authority says the auditor's report should be available to the Authority when required and must be presented to your Board with the recommendations and your proposed remediation, and that the Authority may require a remediation plan with a time frame (paras. 5.1 to 5.5).
What this law does
The Financial Services Authority's Guidance Notes for Cyber Security Audit, in the version of , say that pursuant to regulation 5(3) of the Virtual Asset Service Providers (Cyber security) Regulations, 2024 licensees are required to conduct penetration testing and vulnerability assessments. The Notes say the audit of a licensee's systems is to be undertaken by a qualified independent party with no affiliation with the licensee or its directors, principal officers or shareholders.
The Notes say that, pursuant to regulation 5(4), the Authority shall approve the individual a licensee proposes as its Cyber Security Auditor. The Notes say the auditor's report must be presented to the licensee's Board along with the recommendations made by the Cyber Security Auditor.