TongaPrudential Banking Standard No. 15, Cybersecurity incident reporting by banks
Prudential Banking Standard No. 15 - 2021, Cybersecurity, paras. 105-106
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a bank licensed under the Banking Act 2020 (paragraph 108), and is reached by declaring that you are a bank.
- Notify the National Reserve Bank of Tonga as soon as possible and not later than sixty minutes after becoming aware of an information security incident that materially affects, or has the potential to materially affect, the institution or the interests of depositors, financially or non-financially (paragraph 106).
- Report all cybersecurity incidents to the National Reserve Bank of Tonga each quarter, in the format of Form QCR in Appendix I (paragraph 105).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The National Reserve Bank of Tonga, which may issue written warnings, enter into a written agreement with a bank's board on a programme of remedial action, and issue written orders to cease and desist from an infraction, where a bank contravenes a prudential banking standard (section 39 of the Banking Act 2020).
Settledness
- As of
- Open questions
- Does the National Reserve Bank of Tonga apply the measures in section 39 of the Banking Act 2020 to a bank that notifies an information security incident after sixty minutes?
What this law does
Paragraph 105 of Prudential Banking Standard No. 15 requires a bank to provide quarterly reporting on all cybersecurity incidents in the format prescribed in Appendix I. Paragraph 106 of Prudential Banking Standard No. 15 requires a bank to notify the National Reserve Bank of Tonga as soon as possible but not later than sixty minutes after becoming aware of an information security incident that materially affects or has the potential to materially affect the institution or the interests of depositors.
Paragraph 107 of Prudential Banking Standard No. 15 provides that non-compliance with it is subject to corrective actions as provided under section 39 of the Banking Act 2020. Section 39(1)(a) of the Banking Act 2020 allows the Reserve Bank to impose the measures in that section where a bank contravenes a prudential banking standard.
When LexLint raises it
When your app profile says your app is a bank.