San MarinoSan Marino Central Bank Regulation on Crypto-Assets, Information System Security
Regolamento BCSM n. 2024-03 in materia di cripto-attività , articolo VII.V.13, commi 4 e 5
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a crypto-asset firm authorised by the Banca Centrale della Repubblica di San Marino, meaning a company that provides asset-referenced crypto-asset issuance services or crypto-asset services under the Regulation (reached by declaring that you are a crypto-asset provider).
- Keep the information systems secure to a high level, with documented safeguards for the physical and logical security of hardware and software including data back-up and disaster recovery procedures, for identifying who may access the systems and with what permissions, and for tracing who made each entry or change and rebuilding the history of changed data (article VII.V.13, paragraph 4).
- Dedicate a specific section of the business continuity plan to the information and accounting systems (article VII.V.13, paragraph 5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banca Centrale della Repubblica di San Marino, whose sanctioning powers are governed by article 31 of Law no. 96 of and under whose Regulation a violation is punished by the sanctions decree, Decree no. 76 of .
Settledness
- As of
- Open questions
- Does the Central Bank read the information-system security duty in article VII.V.13 as reaching a firm's outsourced information systems?
What this law does
Article VII.V.13, paragraph 4 of Regulation no. 2024-03 on crypto-assets requires the information systems of a crypto-asset firm to guarantee high levels of security, with documented safeguards for the physical and logical security of hardware and software, data back-up and disaster recovery, authorised access, and traceability of changes to data.
Article VII.V.13, paragraph 5 requires a specific section of the crypto-asset firm's business continuity plan to cover the information and accounting systems. Article I.I.1 provides that the sanctioning powers of the Central Bank are governed by article 31 of Law no. 96 of and that violations of the Regulation are punished under Decree no. 76 of .
Article VII.I.2 provides that a violation of Part VII of the Regulation, which contains article VII.V.13, is punished by the sanctions decree at its articles 7, 8, 15, 18 and 18-bis. The Regulation defines a crypto-asset firm as a company that provides exclusively asset-referenced crypto-asset issuance services, crypto-asset services, or both, besides any connected and ancillary activities the Regulation permits. The version of the Regulation read for this row is the consolidated text in force from .
When LexLint raises it
When your app profile says your app is a crypto-asset provider.