Law / 
Saint Vincent and the Grenadines
Saint Vincent and the Grenadines Eastern Caribbean Central Bank Electronic Banking Standard, Security Controls
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an institution licensed under the Banking Act, 2015 of Saint Vincent and the Grenadines: the Prudential Standard for Electronic Banking applies to all institutions licensed under the Banking Act, and it came into effect on (reached by declaring that you are a bank).
- Make sure the security control infrastructure is in place to secure e-banking systems and data from internal and external threats, including appropriate authorisation, logical and physical access controls and adequate security infrastructure (paragraph 5.2.1).
- If e-banking services are outsourced, assess that the necessary controls are in place (paragraph 5.2.1).
- Implement a comprehensive security process with policies and procedures that address internal and external security threats in terms of incident prevention and the appropriate response, including physical controls, specialised security staff, logical controls with ongoing monitoring of network intrusion attempts, and ongoing review and testing of security measures (paragraph 5.2.2).
- Reinforce information security controls to preserve the confidentiality and integrity of customer data, and protect sensitive and high-risk e-banking systems with mechanisms such as encryption, firewalls, access control and data recovery plans (paragraph 5.2.4).
- Submit the security process you implement to the Central Bank (paragraph 6.4).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Central Bank, whose remedial actions specified in section 75 of the Banking Act apply to an institution found in violation of the standard.
Settledness
- As of
- Open questions
- Does the Central Bank apply the 3-day incident report in paragraph 6.4 and the 24-hour alert in the Technology Risk Management standard as two separate notices?
What this law does
The Eastern Caribbean Central Bank issued the Prudential Standard for Electronic Banking in exercise of the powers conferred on it by section 184 of the Banking Act. The standard applies to all institutions licensed under the Banking Act. The standard comes into effect on .
Paragraph 5.2.1 of the standard requires a licensed financial institution to ensure that the necessary security control infrastructure is in place to secure e-banking systems and data from both internal and external threats. Paragraph 5.2.2 of the standard requires a comprehensive security process, inclusive of policies and procedures that address possible internal and external security threats in terms of incident prevention and the appropriate response.
Paragraph 6.4 of the standard requires the security process implemented by the institution to be submitted to the Central Bank. The standard states that institutions found in violation of it are subject to remedial actions specified in section 75 of the Banking Act.
When LexLint raises it
When your app profile says your app is a bank.