YemenLaw No. 40 of 2006 on Electronic Payment Systems and Financial and Banking Operations, Secure-Services and Banking-Confidentiality Duty
In force since .
A sector security regimes rule binding private bodies.
What it requires
- This binds a financial institution licensed to deal in financial transfers that practices electronic funds transfer in Yemen under Law No. 40 of 2006.
- Comply with the Central Bank of Yemen's Bank Law, Banks Law, and the related regulations and instructions issued for electronic funds transfer operations.NIST CSF 2.0GV.OC-03
- Take the measures necessary to provide secure services to customers and preserve banking confidentiality when conducting an electronic funds transfer.NIST CSF 2.0PR.DS-02
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
Article 27 of Law No. 40 of 2006 Regarding Electronic Payment Systems and Financial and Banking Operations binds every financial institution practicing electronic funds transfer under the Law to two duties: comply with the Bank Law, the Banks Law, and the related laws, regulations, and instructions issued under them, and take the measures necessary to provide secure services to customers and preserve banking confidentiality.
The Law defines a financial institution as any body authorized to deal in financial transfers under the laws in force, a class that reaches a payments or funds-transfer platform operating as, or through, a licensed Yemeni financial institution.
Article 30 separately empowers the Central Bank of Yemen to issue the instructions needed to organize electronic funds transfer business, including approving electronic payment methods and the disclosure of information banks and financial institutions must provide; Article 44 further directs the Bank's Governor to establish payment-system infrastructure, organize authentication-certificate issuance with confidentiality safeguards for an electronic-signature code, and set technical specifications for devices and machines used in financial and banking technology, but no implementing regulation issued under either article was located, so no specific technical standard is described here.
No provision of this Law's Chapter Eight (Articles 37 to 41) names a penalty for a breach of Article 27 itself; that chapter's penalties instead attach to authentication-certificate fraud and a licensed authentication provider's own violations, and are this jurisdiction's scraping-topic computer-misuse and fraud findings rather than a security-topic one.
When LexLint raises it
When your app profile says your app is a bank or is a payment provider.
Back to the example · Lint your app
Page updated .