TunisiaBanque Centrale de Tunisie Circular on Payment Institutions, Security Device, Annual Audit and Tests
Circulaire BCT n° 2018-16, Arts. 9-10
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.bct.gov.tn/bct/siteprod/documents/Cir_2018_16_fr.pdfIn force.
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds payment institutions, the specialized financial institutions the Banque Centrale de Tunisie authorizes under article 20 of Loi n° 2016-48 to provide payment services; you are reached by declaring that you are a payment provider.
- Operate an operations security device that gives full traceability of payment operations and prevents intrusion and fraud through organizational measures and prevention tools (article 9).
- Keep an adequate device for managing liquidity risk, operational risks and cyber risk, and a business continuity plan that is formalized and tested (article 9).
- Submit your information systems to a computer-security audit every year, and give the Banque Centrale de Tunisie a copy of the audit report (article 10).
- Test the security state of your information systems and your capacity to face attacks on them, taking care that the tests do not risk operational disruption (article 10).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Banque Centrale de Tunisie, whose governor may impose on a payment institution that breaches its governance rules the sanctions of article 170 of Loi n° 2016-48: a warning, or a fine that may not exceed 15% of the minimum capital of the category of financial institution concerned.
Settledness
- As of
- Open questions
- Has the Banque Centrale de Tunisie replaced this circular with a later circular on payment institutions, and from what date?
What this law does
Article 9 of the circular requires payment institutions to have an operations security device that gives full traceability of payment operations and prevents the risk of intrusion and fraud through organizational measures and prevention tools. Article 9 also requires payment institutions to have an adequate device for managing liquidity risk, operational risks and cyber risk, and a business continuity plan that is formalized and tested.
Article 10 requires payment institutions to submit their information systems to an annual computer-security audit and to give the Banque Centrale de Tunisie a copy of the audit report. Article 10 requires them to run tests that analyze the security state of their information systems and their capacity to face attacks targeting those systems, without risking operational disruption.
Article 1 of the circular states that it fixes the conditions of application of articles 20 and 21 of Loi n° 2016-48 on banks and financial institutions. Article 20 of Loi n° 2016-48 has the Banque Centrale de Tunisie define by circular the governance rules specific to payment institutions and fix the conditions of application of that article.
Article 169 of the Law lets the governor of the Banque Centrale de Tunisie sanction a financial institution for failing to respect the governance and internal-control standards in the Law and in the regulatory provisions the Banque Centrale de Tunisie issues. Article 170 of the Law lets the governor give a warning or impose a fine that may not exceed 15% of the minimum capital of the category of financial institution concerned.
Title II of the circular, headed on governance rules, begins at Article 5. Title III of the circular, on the opening and operation of payment accounts, begins at Article 14. Article 40 of the circular has its provisions enter into force from the date of its publication.
When LexLint raises it
When your app profile says your app is a payment provider.