EswatiniMinimum Standards for Electronic Payment Schemes: Security Controls, Business Continuity and Incident Response Planning
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a financial institution or non-financial institution, including a payment system operator or payment service provider, that has introduced or intends to introduce an electronic payment scheme or product, and is required to adhere to the Minimum Standards (paragraph 1.4; reached by declaring that you are a bank or a payment provider).
- Put in place appropriate security control processes for the scheme that address authentication, non-repudiation, data and transaction integrity, segregation of duties, authorization controls, and maintenance of audit trails and confidentiality of key financial institution information (paragraph 9.2).
- Have the board and senior management review and approve the key aspects of the security control process, including authorization privileges, logical and physical access controls and adequate infrastructure security (paragraph 9.1.7).
- Have effective capacity, business continuity and contingency planning processes to help ensure the availability of the electronic payment scheme and its services (paragraph 11.3).
- Develop appropriate incident response plans to manage, contain and minimize problems arising from unexpected events, including internal and external attacks, that may hamper the provision of electronic payment systems and services (paragraph 11.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Eswatini, which under paragraph 5.1 attaches penalties and sanctions as it determines to a failure to comply with the Minimum Standards.
Settledness
- As of
- Open questions
- Does the National Payment System Act, 2023 change the status of the 2010 Minimum Standards for Electronic Payment Schemes?
What this law does
Paragraph 1.4 of the Minimum Standards for Electronic Payment Schemes says that all financial institutions and non-financial institutions, including payment system operators and payment service providers, that have introduced or intend to introduce electronic payment schemes or products are required to adhere to them.
Paragraph 9.2 says the management of an electronic payment scheme service provider is responsible for ensuring that appropriate security control processes are in place for the scheme. Paragraph 11.4 says the institution shall at minimum ensure that it has developed appropriate incident response plans. Paragraph 5.1 says that failure to comply with the Minimum Standards shall attract penalties and sanctions as determined by the Bank.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.