SeychellesSeychelles Virtual Asset Service Providers (Cyber Security Requirements) Regulations, 2024: Cyber Security Strategy, Systems and Controls, Audit and Business Continuity
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This reaches your organization only if it is a licensee under the Virtual Asset Service Providers Act, 2024 (Act 12 of 2024): the Regulations apply to all licensees (reg. 3) (reached by declaring that you are a crypto-asset provider).
- Have in place a cyber security strategy for establishing and maintaining systems and controls that manage the cyber security and operational risks arising from failures in your processes and systems, including systems and processes with or from third-party suppliers, agents and intermediaries, with the resources to manage cyber security risks, to identify, respond to and prevent a cyber security event, and to limit the damage (reg. 4(1) to (3)).
- Implement controls to prevent system and process failures and to identify and rectify them promptly; keep monitoring that detects cyber incidents quickly and periodically evaluates your systems and controls; keep senior management oversight with defined roles and accountability, maintain documentation of your internal processes and systems, and train all staff in cyber security periodically (reg. 4(4), (6), (7) and (8)).
- Review the cyber security strategy and policy regularly and at least annually, and after a cyber security event or a weakness specific to your operation, and submit the results of the review and any remedial actions needed to your board of directors as soon as practicable and no later than one month after the board approved the review (reg. 4(9) and (10)).
- Maintain systems and controls that have regard to confidentiality (safe storage and transmission of data, firewalls and entry restrictions), accessibility for authorized persons, integrity of information, maintenance of systems including code version control and updates, and procedures for updates to technological infrastructure including forks, and ensure they protect the processing and security of your information through established security standards (reg. 5(1) and (2)).
- Run penetration testing and vulnerability assessment of your systems twice in the first year of licensing and at least once a year afterwards, and keep audit trail systems that allow complete and accurate reconstruction of all financial transactions, protect the audit trail data and hardware from alteration or tampering, and log system events including access, alterations and cyber security events (reg. 5(3)).
- When the Authority requires it, and subject to its approval, appoint a qualified independent party to audit your systems and controls and give the Authority a written opinion that your program and controls are suitably designed and operating effectively; state in the appointing resolution whether the auditor is qualified and independent (reg. 5(4) and (5)).
- Implement appropriate and effective arrangements to maintain the continuity of your operations, assess the likelihood and impact of a cyber security risk to that continuity, and apply commensurate measures to minimize its occurrence (reg. 6).
- Have the fit and proper person responsible for information security prepare a cyber security report covering the availability, functionality and integrity of your electronic systems, any cyber risk from your virtual asset services, and the cyber security program implemented with proposals to redress inadequacies (reg. 8(1)).
- Keep a formalized business continuity plan approved by your board of directors that addresses continuity, communication and regular testing, outlines resources, recovery priorities and communication arrangements; review and test it at least every two years and give the Authority the plan or the test results on request within the time it indicates (reg. 11).
These lines are LexLint's reading of the law's text, as of . Also read by: Seychelles Financial Services Authority Guidance Notes for Cyber Security Audit of Virtual Asset Service Providers (guidance from the Financial Services Authority of Seychelles, issued ); the Financial Services Authority of Seychelles (guidance, recorded ).
If you get it wrong
Penalty structure
The highest administrative penalty is SCR4,000,000 for a contravention of regulation 4, plus SCR50,000 for each day or part of a day, not exceeding twenty days, that it continues.
- Rule
- Fixed only
- As of
- Currency
- SCR
- Fixed cap
- 4,000,000
Who enforces it
Enforcement body
The Authority named in the Regulations, which takes the enforcement action it deems necessary under the Act and may impose the administrative penalties stated in regulations 4, 5, 8 and 11.
Settledness
- As of
- Guidance link
- https://fsaseychelles.sc/component/edocman/guidance-notes-for-cybersecurity-audit/download?Itemid=0
- Guidance body
- the Financial Services Authority of Seychelles
- Open questions
- Does section 22(2) of the Virtual Asset Service Providers Act, 2024 fix the date by which the cyber security report in regulation 8 must reach the Authority?
What this law does
Regulation 3 applies the Regulations to all licensees under the Act. Regulation 4(1) requires a licensee to have in place a cyber security strategy for the establishment and maintenance of appropriate systems and controls for managing cyber security and operational risks. Regulation 4(9) requires a licensee to review its cyber security strategy and policy regularly, and at least annually.
Regulation 4(11) lets the Authority impose an administrative penalty of SCR4,000,000 and an additional SCR50,000 for each day or part of each day, not exceeding twenty days, for which a contravention of regulation 4 continues. Regulation 5(3)(a) requires penetration testing and vulnerability assessment of a licensee's systems on a bi-annual basis during the first year of licensing and at least once a year for subsequent years.
Regulation 5(4) requires a licensee, subject to the approval of the Authority, to appoint a qualified independent party to audit its systems and control as and when the Authority requires. Regulation 5(6) lets the Authority impose an administrative penalty of SCR2,000,000 and an additional SCR50,000 for each day or part of each day, not exceeding thirty days, for a contravention of regulation 5(3) or 5(4).
Regulation 6 requires a licensee to implement appropriate and effective arrangements to maintain the continuity of its operations. Regulation 8(1) requires a cyber security report, prepared by the fit and proper person responsible for information security, for the purpose of section 22(2) of the Act. Regulation 8(2) lets the Authority impose an administrative penalty of SCR 500,000 for a contravention of regulation 8.
Regulation 11(1) requires a licensee to have in place a formalized business continuity plan, as approved by its board of directors. Regulation 11(3) requires a licensee to review and test its business continuity plan at least every two years. Regulation 11(5) lets the Authority impose an administrative penalty of SCR 500,000 and an additional SCR50,000 for each day or part of each day, not exceeding thirty days, for a contravention of regulation 11.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- Seychelles Financial Services Authority Guidance Notes for Cyber Security Audit of Virtual Asset Service Providers, the Financial Services Authority of Seychelles
When LexLint raises it
When your app profile says your app is a crypto-asset provider.