Trinidad and TobagoCybersecurity Best Practices Guideline, Notification of Cybersecurity Incidents to the Central Bank
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a company licensed under the Financial Institutions Act, 2008 or registered under the Insurance Act, 2018, the Acts under which the Central Bank established the Guideline (reached by declaring that you provide financial services). The Guideline says other companies are encouraged to adopt it but are not required to report to the Central Bank. The circular letter of is addressed to institutions licensed or holding a financial holding company permit under the Financial Institutions Act, 2008, registered under the Insurance Act, 2018, licensed under the Exchange Control Act, payment system operators and payment service providers, and e-money issuers.
- Alert the Central Bank, as soon as possible but within 24 hours of becoming aware of a cyber-incident, that a cyber-incident has occurred (Guideline Appendix II; Circular Letter CB-OIFI-399/2025).
- Complete the Cyber Incident Reporting Form and send it to cyberincident@central-bank.org.tt, copying your designated Relationship Officer, within 72 hours of the incident (Circular Letter CB-OIFI-399/2025). The Guideline states the 72-hour submission as what the company should do (Appendix II).
- Where specific details are unavailable at the initial report, indicate 'information not yet available', give best estimates and all other available details, and state when more information is expected (Guideline Appendix II).
- Provide regular updates, for example daily, as new information becomes available until the incident is contained or resolved, and a post-incident review and lessons learned report after closure (Circular Letter CB-OIFI-399/2025).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank of Trinidad and Tobago, which reviews the self-attestations and independent reviews and periodically conducts risk based on-site examinations to verify compliance with the Guideline.
Settledness
- As of
- Open questions
- Does the Central Bank treat the reference in the circular letter to incidents 'deemed reportable under our regulatory framework' as the material-incident criteria in Appendix II of the Guideline?
What this law does
The Central Bank of Trinidad and Tobago's Cybersecurity Best Practices Guideline says it is established in accordance with section 10(b) of the Financial Institutions Act, 2008 and section 278(1) of the Insurance Act, 2018 in respect of companies authorized under those Acts. Appendix II of the Guideline says all companies are required to provide timely notification to the Central Bank when material incidents relating to their operations occur.
Appendix II of the Guideline says that, as soon as possible but within 24 hours of becoming aware of a cyber-incident, the company shall alert the Central Bank that a cyber-incident has occurred. Appendix II of the Guideline says the company should complete the Cyber Incident Reporting Template and submit it to the Central Bank within 72 hours of the incident.
Circular Letter CB-OIFI-399/2025 of tells regulated financial institutions of the requirement to report any cybersecurity incidents within twenty-four (24) hours of becoming aware of them. The same circular letter sets an initial notification within 24 hours of becoming aware of a cyber-incident and complete cyber incident reporting within 72 hours of the incident.
Section 12 of the Financial Institutions Act, 2008 says contravention of a guideline referred to in section 10 is not an offence but does not prevent the Central Bank or the Inspector from taking action under section 86. Section 86 of the Financial Institutions Act, 2008 lets the Inspector direct a licensee that has failed to comply with a measure imposed by the Central Bank to cease or refrain from the conduct or to perform the acts needed to remedy the situation.
When LexLint raises it
When your app profile says your app provides financial services.