Trinidad and TobagoVirtual Assets and Virtual Asset Service Providers Act, Notice of a Cyber-Security Event by a Sandbox Participant
Virtual Assets and Virtual Asset Service Providers Act, 2025 (Act No. 12 of 2025), s. 10(3) and (4)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds a company that holds a certificate of acceptance as a Sandbox Participant in the Regulatory Sandbox of the Trinidad and Tobago Securities and Exchange Commission, which authorises virtual asset service providers that were operating before the Act took effect (reached by declaring that you are a crypto-asset provider).
- Notify the Commission in writing within ten days of becoming aware that a cyber-security event has occurred (section 10(3)(b)(viii)).
- Within seven business days of providing that notification, furnish the Commission with a written report setting out the particulars of the situation and the mitigating measures you will undertake (section 10(4)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Trinidad and Tobago Securities and Exchange Commission, which administers the Regulatory Sandbox and may issue warning letters, compliance directions, suspensions and terminations and impose administrative fines for failure to comply with conditions of participation or with obligations under any written law.
Settledness
- As of
- Open questions
- What counts as a cyber-security event for the ten-day notice in section 10(3)(b)(viii), which the Act does not define?
What this law does
The Virtual Assets and Virtual Asset Service Providers Act, 2025 establishes a Regulatory Sandbox into which virtual asset service providers that were operating before the Act's commencement may be authorised to conduct certain virtual asset activities under certain conditions. The Act defines a Sandbox Participant as a company that has been issued and holds a valid certificate of acceptance under the Act.
Section 10(3) of the Act requires a Sandbox Participant to notify the Commission in writing within ten days of becoming aware that a cyber-security event has occurred. Section 10(4) of the Act requires the Sandbox Participant to furnish the Commission with a written report setting out the particulars of the situation within seven business days of providing the notification.
Section 5(3) of the Act lets the Commission issue warning letters, compliance directions, suspensions and terminations and impose administrative fines for failure to comply with conditions attached to participation in the Regulatory Sandbox. The Trinidad and Tobago Securities and Exchange Commission states that the Act was assented to on and took effect upon assent.
When LexLint raises it
When your app profile says your app is a crypto-asset provider.