Law / 
Saint Vincent and the Grenadines
Saint Vincent and the Grenadines Eastern Caribbean Central Bank Electronic Banking Standard, Incident Reporting
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on (reached by declaring that you are a bank).
- Send all incident reports and your response to the Central Bank within 3 days of the occurrence, and report any further update on the incident to the Central Bank (paragraph 6.4).
- Implement formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of your e-banking services (paragraph 5.2.7).
- Build into your incident response plan a clear process for alerting the appropriate regulatory authorities when security breaches or disruptive incidents occur, and a process to inform the ECCB, customers, counterparties and the media in a timely and appropriate manner of material e-banking disruptions and business resumption developments (paragraph 5.11.2(d) and (g)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank, whose remedial actions specified in section 75 of the Banking Act apply to an institution found in violation of the standard.
Settledness
- As of
- Open questions
- Does the 3-day report under paragraph 6.4 of this standard and the 24-hour alert under paragraph 12.8.1 of the Technology Risk Management standard apply together to one cyber-incident?
What this law does
The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. Paragraph 6.4 of the standard requires all incident reports and the response to be sent to the Central Bank within 3 days of the occurrence. Paragraph 6.4 of the standard also requires any further update on the incident to be reported to the Central Bank.
Paragraph 5.2.7 of the standard requires formal incident response and management procedures for timely reporting and handling of suspected or actual security breaches, fraud, or service interruptions of e-banking services. Paragraph 5.11.2 of the standard requires an incident response plan to include a clear process for alerting the appropriate regulatory authorities in the event of security breaches or disruptive incidents.
The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act.
When LexLint raises it
When your app profile says your app is a bank.