SeychellesSeychelles National Payment System (Electronic Money) Regulations, 2022: Reporting of Security Breaches and Loss of Confidential Data
In force.
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting, Security
As of .
What it requires
- This reaches you where you are an electronic money issuer, meaning a person licensed as a payment service provider or approved by the Central Bank of Seychelles to issue electronic money (reg. 2) (reached by declaring that you are a payment provider).
- Report to the Central Bank of Seychelles any suspected fraud relating to the electronic money service, any security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service (reg. 19(4)).
- Notify the Central Bank of Seychelles in writing, with details, of any loss of confidential data (reg. 18(1)(f)).
- Submit a monthly statistical report to the Central Bank of Seychelles by the 15th of every month that includes the total number of incidents of fraud, theft and robbery and the total number of service interruptions, system downtime and security breaches, with the source of discovery, nature of incident, reasons and value of maximum exposure (reg. 17(a) and the Schedule).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Central Bank of Seychelles
Settledness
- As of
- Open questions
- Does the 30-calendar-day advance period in regulation 18(2) apply to a notification of the loss of confidential data under regulation 18(1)(f)?
What this law does
Regulation 19 requires an electronic money issuer to report to the Central Bank any suspected fraud, any security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service. Regulation 18 requires an electronic money issuer to notify the Central Bank, and give details in writing, of any loss of confidential data.
The Schedule to the Regulations requires the statistical report to state the total number of service interruptions, system downtime and security breaches.
When LexLint raises it
When your app profile says your app is a payment provider.