TuvaluBanking Commission Act, security of banks' computer access and Internet banking platforms
Banking Commission Act (Act 3 of 2011, Cap. 38.02), ss. 38(4) and 39(2)-(3)
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a bank, a person engaged in the business of accepting deposits in Tuvalu and using the funds to make extensions of credit or investments, including a branch of a bank organised in another jurisdiction, and is reached by declaring that you are a bank.
- Maintain adequate security for your Internet or proprietary platforms if you give customers computer access, including adequate systems for customer authentication and for physical and logical protection against unauthorised external access by individual penetration attempts, computer viruses, denial of service and other forms of electronic access (section 38(4)).
- Have adequate systems to identify, monitor and control transactional risk from your use of technology if you operate as an Internet bank (section 39(2)).
- Have adequate security for your Internet platforms if you operate as an Internet bank, including adequate systems for customer authentication and for physical and logical protection against unauthorised external access by individual penetration attempts, computer viruses, denial of service and other forms of electronic access (section 39(3)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Banking Commission, which must take specified actions against a bank guilty of an infringement of the Act, including written warnings, a written agreement with the board on a programme of remedial action, cease and desist orders and civil penalties of one hundred to one thousand dollars per day (section 37(2)).
Settledness
- As of
- Open questions
- Which day did the Act come into operation, given that the Revised Edition prints as the commencement while its endnote to section 2 cites Government Notice 27 of 2015?
What this law does
Section 38(4) of the Banking Commission Act provides that banks providing computer access must maintain adequate security for their Internet or proprietary platforms, including adequate systems for customer authentication and for physical and logical protection against unauthorised external access by individual penetration attempts, computer viruses, denial of service and other forms of electronic access.
Section 39(2) of the Banking Commission Act provides that Internet banks must have adequate systems to identify, monitor and control transactional risk from the bank's use of technology. Section 39(3) of the Banking Commission Act provides that Internet banks must have adequate security for their Internet platforms, including adequate systems for customer authentication and for physical and logical protection against unauthorised external access.
Section 39(1) of the Banking Commission Act defines Internet banks as banks that provide services to customers through delivery channels, including the Internet, automated teller machines and telephone, and by mail, but not at physical offices.
Section 37(2) of the Banking Commission Act requires the Commission to take specified actions or impose specified penalties on a bank it determines to be guilty of an infringement consisting of the violation of a provision of the Act or of any regulation or order of the Commission.
Section 37(2)(a) to (d) of the Banking Commission Act lists written warnings, a written agreement with the board of directors providing for a program of remedial action, written orders to cease and desist, and civil penalties of one hundred dollars to one thousand dollars per day for each day that the infraction continues.
When LexLint raises it
When your app profile says your app is a bank.