TunisiaBanque Centrale de Tunisie Circular on Payment Institutions, Notification of Cyber Attacks and Intrusions
Circulaire BCT n° 2018-16, Art. 10
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.bct.gov.tn/bct/siteprod/documents/Cir_2018_16_fr.pdfIn force.
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds payment institutions, the specialized financial institutions the Banque Centrale de Tunisie authorizes under article 20 of Loi n° 2016-48 to provide payment services; you are reached by declaring that you are a payment provider.
- Inform the Banque Centrale de Tunisie and the national cybersecurity agency immediately of any attack, intrusion or other disturbance likely to impede the operation of your information systems (article 10); the circular names the Agence Nationale de la Sécurité Informatique, which the Agence Nationale de la Cybersécurité has replaced.
- Comply with the measures that agency sets to end the disturbance (article 10).
- Tell the Banque Centrale de Tunisie, without delay, which measures you have taken (article 10).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Banque Centrale de Tunisie, whose governor may impose on a payment institution that breaches its governance rules the sanctions of article 170 of Loi n° 2016-48: a warning, or a fine that may not exceed 15% of the minimum capital of the category of financial institution concerned.
Settledness
- As of
- Open questions
- The circular requires notification immediately and states no hour limit: has the Banque Centrale de Tunisie set one by a later instruction?
- Has the Banque Centrale de Tunisie replaced this circular with a later circular on payment institutions, and from what date?
What this law does
Article 10 requires payment institutions to inform the Banque Centrale de Tunisie and the Agence Nationale de la Sécurité Informatique immediately of any attacks, intrusions and other disturbances likely to impede the operation of their information systems. Article 10 then requires them to comply with the measures the agency sets to end those disturbances, and requires that the Banque Centrale de Tunisie be informed without delay of the measures taken.
Article 27 of Décret-loi n° 2023-17 provides that the Agence Nationale de la Cybersécurité replaces the Agence nationale de sécurité informatique and takes over its property, rights and obligations. Article 1 of the circular states that it fixes the conditions of application of articles 20 and 21 of Loi n° 2016-48 on banks and financial institutions.
Article 20 of Loi n° 2016-48 has the Banque Centrale de Tunisie define by circular the governance rules specific to payment institutions and fix the conditions of application of that article. Article 169 of the Law lets the governor of the Banque Centrale de Tunisie sanction a financial institution for failing to respect the governance and internal-control standards in the Law and in the regulatory provisions the Banque Centrale de Tunisie issues.
Article 170 of the Law lets the governor give a warning or impose a fine that may not exceed 15% of the minimum capital of the category of financial institution concerned. Title II of the circular, headed on governance rules, begins at Article 5. Title III of the circular, on the opening and operation of payment accounts, begins at Article 14. Article 40 of the circular has its provisions enter into force from the date of its publication.
When LexLint raises it
When your app profile says your app is a payment provider.