Vatican CityPayment Services Operational and Security Risk Management
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds a payment service provider: an entity carrying out financial activities on a professional basis within Vatican City State that is authorized to issue and manage means of payment (Article 1 of Regulation No. 3); the provisions apply in proportion to the provider's size and the nature, scope, complexity and riskiness of its services (Article 4 of Instruction No. 4).
- Establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks of your payment services (Article 61(1) of Regulation No. 3), as an effective operational and security risk management framework (Article 5(1) of Instruction No. 4).
- Send the Financial Information Authority the framework within 30 days of its adoption or annual update (Article 5(6)), and an updated and comprehensive assessment of your operational and security risks within 30 days of its adoption or annual update (Article 9(5)).
- Have the internal control model, including the security measures, audited by external auditors with expertise in IT security and payments (Article 6(4)).
- Carry out and document a risk assessment of your functions, processes and information assets once a year, and before any major change affecting the security of payment services (Article 9(2)).
- Establish and implement preventive security measures against the identified risks, through defence-in-depth controls covering people, processes and technology (Article 10(1) and (2)).
- Include vulnerability scans and penetration tests adequate to the level of risk in the testing of your security measures (Article 20(3)(c)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Article 69 of Regulation No. 3 provides administrative sanctions only; the provisions reviewed state no criminal penalty for a breach.
Penalty structure
Regulation No. 3, Article 69, refers a breach to the administrative sanctions of Articles 47 and 66 of Law No. XVIII, and Article 66(2)(e) sets a fine of up to 10% of the gross annual income in the preceding financial year for legal persons (up to EUR 5 million for natural persons), which must be at least double the profit made through the violation where that can be calculated, or at least EUR 1 million.
- Rule
- Turnover pct only
- As of
- Minimum
- 1,000,000
- Currency
- EUR
- Turnover percentage cap
- 10
Who enforces it
Enforcement body
The Supervisory and Financial Information Authority (ASIF, formerly the Financial Information Authority), which receives the reports and applies the administrative sanctions.
Settledness
- As of
- Open questions
- How far do the proportionality provisions of Article 4 of Instruction No. 4 relieve a small payment service provider of the framework and testing measures?
- On what day did Instruction No. 4 first bind providers, given that it enters into force on the day of its publication on the Authority's website, a day the text does not state?
What this law does
Article 1 of Regulation No. 3 applies it to entities carrying out financial activities on a professional basis within the State that are authorized for issuing and managing means of payment. Article 61(1) of Regulation No. 3 requires payment service providers to establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services they provide.
Article 61(2) of Regulation No. 3 requires payment service providers to give the Financial Information Authority, each year or at shorter intervals the Authority sets, an updated and comprehensive assessment of those risks and of the adequacy of the mitigation measures. Article 4 of Instruction No. 4 applies its provisions consistently with the principle of proportionality, taking into account the provider's size and the nature, scope, complexity and riskiness of its services.
Article 5 of Instruction No. 4 requires a payment service provider to establish an effective operational and security risk management framework. Article 5 requires the provider to communicate the framework to the Financial Information Authority within 30 days of its adoption or annual update. Article 6 requires the internal control model, including the security measures, to be audited by external auditors with expertise in IT security and payments.
Article 9 requires the provider to carry out and document a risk assessment of its functions, processes and information assets once a year, and before any major change affecting the security of payment services. Article 9 requires the provider to give the Authority its updated and comprehensive risk assessment within 30 days of its adoption or annual update.
Article 10 requires the provider to establish and implement preventive security measures against the identified operational and security risks. Article 10 requires the provider to implement a defence-in-depth approach of multi-layered controls covering people, processes and technology. Article 20 requires the provider's testing of its security measures to include vulnerability scans and penetration tests adequate to the level of risk identified with its payment services.
Article 34 of Instruction No. 4 provides that for a violation of the Instruction the Authority may apply the administrative sanctions established by Article 69 of Regulation No. 3. Article 69 of Regulation No. 3 refers to the administrative sanctions established by Articles 47 and 66 of Law No. XVIII. Article 66 of Law No. XVIII provides for a fine of up to 10% of the gross annual income in the preceding financial year for legal persons, and of at least EUR 1 million.
When LexLint raises it
When your app profile says your app is a payment provider.