Cap. 376 Art. 11AManagement of operational and security risks.

(1) Without prejudice to the application of Chapter II of the DORA Regulation, payment institutions, electronic money institutions and account information service providers shall establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the payment services they provide. As part of that framework, payment institutions, electronic money institutions and account information service providers, shall establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents.

(2) Payment institutions, electronic money institutions and account information service providers shall provide to the Central Bank, on an annual basis or at shorter intervals as may be determined by the competent authority in co-operation with the Central Bank, an updated and comprehensive assessment of the operational and security risks relating to the payment services they provide, and on the adequacy of the mitigation measures and control mechanisms implemented in response to those risks.

(3) The competent authority shall co-operate with the Central Bank in the assessment and processing of documents referred to in sub-article (2).

(4) The competent authority may issue, amend or revoke Financial Institutions Rules as may be required in order to better implement the provisions of this article.