UruguaySuperintendencia de Servicios Financieros Communication on Technology, Systems and Information Security Events
Resolución RR-SSF-2021-353 de la Superintendencia de Servicios Financieros Comunicación de eventos vinculados a Tecnología, Sistemas y Seguridad de la Información
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds financial intermediation institutions and larger credit-administering companies (empresas administradoras de créditos de mayores activos) supervised by the Superintendencia de Servicios Financieros of the Banco Central del Uruguay (reached by declaring that you provide financial services).
- Report to the Superintendencia every event that could affect services or clients and that, by its impact, affects the operational or reputational risk of the institution or the financial system, whether it occurs on your premises or at an outsourced service provider.
- Report as a minimum any event that warrants a communication to clients, to the Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento (AGESIC) or to any other national entity or authority, that applies your business continuity or disaster recovery plan in whole or in part, that interrupts or affects a customer service channel for 30 minutes or more, that affects services to 10% or more of clients, or that exposes sensitive information and personal data of 5% or more of clients.
- Communicate an emerging event as soon as possible after learning of it, even if not all information is available, and complete it in later reports; communicate a scheduled event at least 24 hours before it starts.
- Where the event warrants a communication to clients, AGESIC or another authority, report to the Superintendencia at least at the same time as those communications.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendencia de Servicios Financieros of the Banco Central del Uruguay, which may apply observations, warnings and fines of up to 10% of the basic net worth of banks to supervised entities that breach general norms or particular instructions issued to them.
Settledness
- As of
- Open questions
- Is the resolution a general norm or a particular instruction for the purposes of the sanctions in literal L of article 38 of Ley 16.696?
What this law does
Resolución RR-SSF-2021-353 tells financial intermediation institutions and larger credit-administering companies that they must present information on every event that could affect services or clients and that, by its impact, affects operational or reputational risk.
The resolution requires those entities to report as a minimum events that meet its thresholds, including an interruption of a customer channel of 30 minutes or more and exposure of sensitive information and personal data of 5% or more of clients. The resolution requires an emerging event to be communicated as soon as possible after it becomes known and a scheduled event at least 24 hours before it starts. The resolution applies to events detected on or after .
The resolution rests on literal H of article 38 of Ley 16.696 and on articles 490 and 582.1 of the Recopilación de Normas de Regulación y Control del Sistema Financiero. Literal L of article 38 of Ley 16.696 empowers the Superintendencia to apply observations, warnings and fines of up to 10% of the basic net worth of banks to supervised entities that breach the general norms or particular instructions issued to them.
When LexLint raises it
When your app profile says your app provides financial services.