San MarinoSan Marino Central Bank Regulation on Investment Services and Activities, Information System Security
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds an investment firm authorised by the Banca Centrale della Repubblica di San Marino under the Regulation on investment services and activities (reached by declaring that you are a securities firm).
- Keep the information systems secure to a high level, with documented safeguards for the physical and logical security of hardware and software including data back-up and disaster recovery procedures, for identifying who may access the systems and with what permissions, and for tracing who made each entry or change and rebuilding the history of changed data (article VII.VI.13, paragraph 4).
- Dedicate a specific section of the business continuity plan to the information and accounting systems (article VII.VI.13, paragraph 5).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banca Centrale della Repubblica di San Marino, whose sanctioning powers are governed by article 31 of Law no. 96 of and under whose Regulation a violation is punished by the sanctions decree, Decree no. 76 of .
Settledness
- As of
- Open questions
- Does the Central Bank read the information-system security duty in article VII.VI.13 as reaching a firm's outsourced information systems?
What this law does
Article VII.VI.13, paragraph 4 of Regulation no. 2024-05 on investment services and activities requires the information systems of an investment firm to guarantee high levels of security, with documented safeguards for the physical and logical security of hardware and software, data back-up and disaster recovery, authorised access, and traceability of changes to data.
Article VII.VI.13, paragraph 5 requires a specific section of the investment firm's business continuity plan to cover the information and accounting systems. Article I.I.1 provides that the sanctioning powers of the Central Bank are governed by article 31 of Law no. 96 of and that violations of the Regulation are punished under Decree no. 76 of .
Article VII.I.2 provides that a violation of Part VII of the Regulation, which contains article VII.VI.13, is punished by the sanctions decree at its articles 7, 8, 15, 18 and 18-bis. The Regulation defines an investment firm by reference to article 1 of the LISF. The version of the Regulation read for this row is the consolidated text in force from .
When LexLint raises it
When your app profile says your app is a securities firm.