UgandaNational Payment Systems Regulations, 2021, Electronic Money Issuer Incident Notification
National Payment Systems Regulations, 2021 (S.I. No. 18 of 2021), reg. 22(4)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://archive.gazettes.africa/archive/ug/2021/ug-government-gazette-statutory-instruments-supplement-dated-2021-03-05-no-9.pdfIn force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- This binds an electronic money issuer licensed by the Bank of Uganda under the National Payment Systems Act, 2020 (reached by declaring that you are a payment or e-money provider).
- Notify the Bank of Uganda in writing no later than twenty-four hours from the occurrence of suspected or confirmed fraud relating to the electronic money service, security breaches, material service interruption or other significant issues that may affect the safety and efficiency of the electronic money service (regulation 22(4)(a)).
- Notify the Bank of Uganda in writing within the same twenty-four hours of any loss of confidential data (regulation 22(4)(b)).
- Notify the Bank of Uganda in writing within the same twenty-four hours of any other occurrence from which the Bank may request information (regulation 22(4)(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Regulation 22(8) sets a civil penalty of two hundred currency points per day of default for a licensee that without reasonable cause fails to comply with regulation 22, and Schedule 1 values a currency point at twenty thousand shillings, so 4,000,000 shillings for each day.
- Rule
- Fixed only
- As of
- Currency
- UGX
- Fixed cap
- 4,000,000
Who enforces it
Enforcement body
The Bank of Uganda, the central bank, which oversees payment systems under the National Payment Systems Act, 2020.
What this law does
Regulation 22(4) requires an electronic money issuer to notify the Bank of Uganda in writing no later than twenty-four hours from the occurrence of suspected or confirmed fraud relating to the electronic money service, security breaches, material service interruption or other significant issues that may affect its safety and efficiency. The same paragraph requires notice within the same period of a loss of confidential data.
Regulation 22(8) makes a licensee that fails to comply with regulation 22 without reasonable cause liable to a civil penalty of two hundred currency points per day of default.
When LexLint raises it
When your app profile says your app is a payment provider.