Vatican CityPayment Services Major Incident Notification
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds the same payment service providers as the risk-management provisions of Regulation No. 3 and Instruction No. 4: an entity authorized to issue and manage means of payment within Vatican City State.
- Notify the Financial Information Authority of a major operational or security incident (Article 62(1) of Regulation No. 3); an incident is major if one or more criteria have a higher impact level or three or more have a lower impact level (Article 25 of Instruction No. 4).
- Send the initial report within 4 hours of the moment the potential major incident was first detected, or as soon as the reporting channels are available again (Article 30(2)).
- Send intermediate reports whenever there is a relevant status update, each stating the date of the next update, which may not go beyond 3 business days (Article 31).
- Send the final report within 2 weeks after the activity is deemed back to normal (Article 32(2)).
- Where the incident has or may have an impact on the financial interests of your payment service users, inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects (Article 62(1) of Regulation No. 3), and give the Authority a copy of the information provided to users as soon as it is available (Article 29(3) of Instruction No. 4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 69 of Regulation No. 3 provides administrative sanctions only; the provisions reviewed state no criminal penalty for a breach.
Penalty structure
Regulation No. 3, Article 69, refers a breach to the administrative sanctions of Articles 47 and 66 of Law No. XVIII, and Article 66(2)(e) sets a fine of up to 10% of the gross annual income in the preceding financial year for legal persons (up to EUR 5 million for natural persons), which must be at least double the profit made through the violation where that can be calculated, or at least EUR 1 million.
- Rule
- Turnover pct only
- As of
- Minimum
- 1,000,000
- Currency
- EUR
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The Supervisory and Financial Information Authority (ASIF, formerly the Financial Information Authority), which receives the reports and applies the administrative sanctions.
Settledness
- As of
- Open questions
- On what day did Instruction No. 4 first bind providers, given that it enters into force on the day of its publication on the Authority's website, a day the text does not state?
What this law does
Article 62(1) of Regulation No. 3 requires payment service providers to notify the Financial Information Authority of a major operational or security incident. Article 62(1) requires the provider, where the incident has or may have an impact on the financial interests of its payment service users, to inform them without undue delay of the incident and of the measures they can take to mitigate its adverse effects.
Article 25 of Instruction No. 4 classifies an incident as major if one or more criteria have a higher impact level or three or more criteria have a lower impact level. Article 30 requires an initial report to the Authority within 4 hours of the moment a potential major incident was first detected. Article 31 requires each intermediate report to state the date for the next update, which may not go beyond 3 business days.
Article 32 requires the final report within a maximum of 2 weeks after the activity is deemed back to normal. Article 29 requires the provider to give the Authority a copy of the information provided to its users as soon as it is available. Article 34 of Instruction No. 4 provides that for a violation of the Instruction the Authority may apply the administrative sanctions established by Article 69 of Regulation No. 3.
Article 69 of Regulation No. 3 refers to the administrative sanctions established by Articles 47 and 66 of Law No. XVIII. Article 66 of Law No. XVIII provides for a fine of up to 10% of the gross annual income in the preceding financial year for legal persons, and of at least EUR 1 million.
When LexLint raises it
When your app profile says your app is a payment provider.