Cap. 371 Art. 19CManagement of operational and security risks.

(1) Without prejudice to the application of Chapter II of the DORA Regulation, credit institutions shall establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks, relating to the payment services they provide. As part of that framework, credit institutions shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

(2) Credit institutions shall provide to the Central Bank on an annual basis or at shorter intervals, as may be determined by the competent authority in co-operation with the Central Bank, an updated and comprehensive assessment of the operational and security risks relating to the payment services they provide and on the adequacy of the mitigation measures and control mechanisms implemented in response to those risks.

(3) The competent authority shall co-operate with the Central Bank in the assessment and processing of documents referred to in sub-article (2).

(4) The competent authority may issue, amend or revoke Banking Rules as may be required in order to better implement the provisions of this article.