mopdf.com

8. Risk Management Framework(i)Formulation of a policyThe development of Internet banking widens the scope for increased interaction betweeninstitutions and their customers and opens up new avenues for cross-border bankingtransactions exposing institutions to additional risks. Many aspects of risks associatedwith Internet banking are neither fully discernible nor readily measurable.Accordingly, each institution should develop a risk management framework that iscomprehensive enough to deal with known risks and flexible enough to accommodatechanges. It should be subject to appropriate oversight by the board of directors and seniormanagement. The sophistication of the risk management processes should be appropriatefor the institution’s level of risk exposure.(ii)Role of Board of DirectorsThe board of directors shall-approve the Internet banking strategy of the institution to ensure that it isconsistent with the institution’s strategic and business plan;-approve contingency and business resumption plans that should be in placebefore an institution launches the Internet banking services .-set the level of Internet banking risk and review, approve and monitorInternet banking technology related projects that may have significantimpact on the institution;-ensure that the Internet banking systems are operated in a safe and soundmanner, including the availability of contingency and business resumptionplans;-review and approve the information security policies;-ensure that an adequate system of internal controls is established andmaintained;-ensure that qualified and competent persons at senior level are employedto identify, monitor and control Internet banking risks and that theeffectiveness of the internal control system is monitored on a regular basis;and-carry out an active oversight of the management of Internet banking risk ofthe institution by regularly receiving comprehensive written reportsidentifying material risks.In carrying out the above responsibilities, the board may engage the services of outsideexperts, as needed.5

(iii)Role of ManagementThe senior management should ensure that-the Internet banking products are consistent with the institution’s overallstrategic plans and the risks and ramifications of offering such productsover the Internet are within the institution’s risk tolerance;-necessary steps are taken to identify, monitor and control Internet bankingrisk and monitor the effectiveness of the internal control system;-the Internet banking system is designed and operated in a manner thatcomplies with all relevant laws. Senior management should also monitordevelopments and changes in consumer and banking laws, regulations andinterpretative rulings and take adequate measures to comply with them;-the overall effectiveness of the institution’s internal controls is continuallymonitored. There should be a proper system to track and report internalcontrol weaknesses for prompt corrective measures;-adequate operating policies and procedures, auditing standards, effectiverisk monitoring processes, contingency and business resumption plans areavailable;-adequate and comprehensive reports are provided to the directors fordecision making;-adequate expertise and resources are available to operate and maintaintheir Internet banking system; and-effective channels of communication are established so that the employeesare fully aware of policies and procedures affecting their duties andresponsibilities, including a clear delineation of lines of authority andresponsibilities for managing Internet banking risks.9. Security policyEach institution shall establish a written policy on the overall security of its Internetbanking system.Security RequirementsEach institution must have a security program providing for the security arrangementswhich should achieve the following objectives.-Data privacy and confidentiality.Data integrity.Authentication/identification of counterparties.Non-repudiation of Internet banking transactions.Access control/system design to prevent unauthorised access attempts.Business continuity plan.6

An institution must have the following minimum security controls. However, it is theinstitution’s responsibility to ensure that its security controls are complete in the light ofits specific circumstances. As such, it could have additional security controls.(i)Network and Data Access ControlsEach institution should apply adequate access controls to protect its network, applicationsand data from unauthorised parties.Access controls should be designed to effectively restrict unauthorised individuals fromentering sensitive data, retrieving confidential information or enabling access to banksoftware applications and operating systems.(ii)User AuthenticationEach institution should put in place tested systems to securely authenticate the identity ofInternet banking customers when customers access personal account information orengage in on-line transactions for products or services.Each institution should provide sufficient authentication for Internet banking customerswho access personal account information or engage in online transactions for products orservices.The authentication processes should be reviewed and periodically tested for effectivenessthrough penetration testing and other monitoring methods.Senior management should keep abreast of new or developing standards which may affectthe institution’s existing use of authentication devices and processes.Each institution should use a combination of access, authentication and other securitycontrols to create a secure and confidential Internet banking environment. These generallyinclude passwords, firewalls, and encryption.(iii)Transaction VerificationEach institution should implement Internet banking agreements which clearly define theprocedures for valid and authentic electronic communications between its customers anditself. The agreements should specify that the parties intend to be bound bycommunications that comply with these procedures.Each institution should maintain audit trails of all transactions to enable the verificationof specific transaction and provide evidence in the event a transaction is repudiated by itscustomers.(iv)Virus protectionSenior management should implement a detection and prevention program to minimisethe possibility of computer viruses. This program should at least include end-userpolicies, training and awareness programs, virus detection tools and enforcementprocedures.7

(v)Detection of possible intrusionsEach institution should make effective use of monitoring tools to identify vulnerabilitiesof its Internet banking system and in a real-time mode, detect possible intrusions fromexternal and internal parties. In this regard, each institution is required to conductpenetration testing and administer manual or automated intrusion detection processes.a)Penetration testingEach institution should use penetration testing to identify, isolate, and confirm possibleflaws in the design and implementation of passwords, firewalls, encryption, and othersecurity controls. The testing should be conducted by an objective, qualified, internal orexternal source prior to the introduction of Internet banking and at least once a year orwhenever substantial changes are made to the Internet banking security systems.b)Intrusion DetectionEach institution should set up strong intrusion detection devices to control network trafficon a real-time basis. The intrusion detection system must withstand outside attacks and becapable of identifying and reporting departures from normal processing. Adequate audittrail mechanisms should be in place to prevent internal fraud, and provide the means todetect unauthorised intrusion or transactions.Each institution should ensure that it has a combination of regular monitoring of networkactivity, a well-configured firewall, and regular reminders of its security policies. Theinstitution’s security policy should make it incumbent on its responsible officers to reportsecurity breaches promptly to a nominated member of senior management and to theBank of Mauritius.10. Internet banking security programEach institution shall establish a written policy on the overall security of its Internetbanking system.Each institution shall further implement an overall security program which shouldincorporate the institution’s risk management controls. The security program should setout the policies, procedures and controls to safeguard the institution’s information, defineindividual responsibilities, and describe enforcement and disciplinary actions for noncompliance.The security program should establish the necessary organisation structure andaccountability in the process of the management of risks associated with Internet banking.The need to create awareness throughout the organisation that security is an importantcultural value should also be ingrained in the security program. Every institution shouldensure that adequate training is provided to the relevant staff to keep them updated onnew security risks and methods of mitigating such risks.Senior management should carry out regular security risk assessments to track downinternal and external threats that may undermine data integrity, interfere with service orresult in the destruction of information.8

Every institution should establish specific reporting requirements for security breaches.Senior management should ensure that the security measures instituted are current andproperly implemented and comprehensive security policies and procedures are stringentlyenforced.An institution should adopt a security awareness program to give users a clearunderstanding of the procedures and controls necessary for a secure environment. Thissecurity awareness program should strengthen the institution’s security policy andprogram and may include, for example, instructions regarding password protection,Internet security procedures, user responsibilities and employee disciplinary actions.11. Contingent and Business Resumption PlansThe contingent and business resumption plans should be approved by the board ofdirectors prior to the launching of Internet banking services . They should includemeasures covering data recovery, alternate data processing capabilities, emergencystaffing and a public relations and outreach strategy to respond promptly to customer andmedia reaction to system failure and unauthorised intrusions.Each institution should evaluate and determine the importance of the businessapplications and processes and establish in order of importance business resumptiondesigned to recover the most critical functions and systems.Each institution should also establish procedures to be followed in the event itscompetitors which rely on similar technology, experience operational failure.The back-up systems should be fully maintained and tested on a regular basis to minimisethe risk of system failures and unauthorised intrusions. It is expected that security andinternal controls at the back-up locations should be as sophisticated as those at theprimary processing site.Any intrusion, attempted intrusion or suspicious activity should be immediately reportedto the nominated member of senior management for prompt corrective measure, followedby a report to the Bank of Mauritius.12. OutsourcingEach institution may outsource its Internet banking systems to resident and non-resident(i.e. located outside Mauritius) service providers and software vendors subject to the priorwritten approval of the Bank of Mauritius and the following conditions:(i)The decision taking function of an institution should remain with it and theprocess to be outsourced should not threaten its strategic flexibility and itsprocess control;(ii)The image, integrity and credibility of the institution should not beimpaired by the outsourcing arrangement;(iii)The institution should be able to manage risks associated with these newrelationships;9

(iv)Appropriate oversight program should be set up to monitor the outsourcingvendor’s controls, condition and performance; and(v)There should be adequate undertaking for regular servicing by thesupplier.Each institution should continue to remain responsible for the performance and actions ofits outsourcing vendors in relation to the services outsourced by the institution.Each institution should be aware of the privacy concerns and its obligations for any lossof control of customers’ information.Before contracting any Internet banking service, each institution should fulfil thefollowing conditions:(i)The institution should perform sufficient due diligence to satisfy itself ofthe outsourcing vendor’s expertise, experience and financial strength tofulfil the obligations;(ii)The written approval of the Board of Directors should be obtained tooutsource the Internet banking system to the service provider or softwarevendor;(iii)The ownership and control of bank records should remain with theinstitution;(iv)The institution should enter into a service agreement with the outsourcingvendor with a clause on professional ethics and conduct in performing hisduties. It should be clearly stipulated in the service agreement that itreserves the right to terminate the services of the outsourcing vendor if itfails to comply with the conditions imposed. The service agreementshould also clearly delineate the roles, responsibilities and accountabilityof each party;(v)The institution should carry out a risk assessment of such arrangementswhich should ensure that adequate back-up arrangements such asalternative service providers are available;(vi)The institution should have the ability to exercise the necessary control toproperly manage the outsourced system for providing the Internet bankingservices;(vii)The institution should put in place proper reporting and monitoringmechanisms to ensure that the integrity and quality of work conducted bythe outsourcing vendor is maintained. Regular testing and review of thework done by the outsourcing vendor must be conducted;(viii) The external and internal auditors of the institution should have the abilityto review the books of the outsourcing vendor and perform audits or obtainfrom the outsourcing vendor independent internal control audit reports.Any weaknesses highlighted during the audit must be well-documentedand promptly rectified especially where such weaknesses may affect theintegrity of the internal controls of the institution; and(ix)The details of the outsourcing arrangement should be forwarded forapproval by the Bank of Mauritius at least two weeks before entering into10

an agreement with the service provider, indicating whether all of theabovementioned requirements are satisfied.13. Advertisements and website linksAn institution will not require the prior approval of the Bank of Mauritius foradvertisements or web linking arrangements made on its website, provided that suchadvertisements do not fall within the ambit of section 38 of the Banking Act 1988. Theinstitution should, however, keep the Bank of Mauritius informed of such advertisementarrangements.(i)Advertisements by an institution on third party websitesThis guideline does not seek to restrict the advertisement and posting of financial productinformation of an institution on third party websites including those of institutionsoperating outside Mauritius. However, each institution should ensure that it has thenecessary controls in place to manage risks associated with the third-party websites.The advertisement should be monitored for completeness, accuracy and timeliness.An institution is advised to notify its customers regarding the websites that it will use toadvertise its products and services and to caution them that information contained in anyunauthorised third party websites may be incomplete, inaccurate or outdated.An institution is encouraged to adopt additional procedures to safeguard its customers’and its own interests.(ii)Website linksWhen an institution provides links to third party websites to enable customers to accessother third party services or products, the institution should analyse the risks presented bythese arrangements.In managing Compliance Risk, an institution providing hypertext links to third parties onits website should include a clear message to inform the customers that as soon as theyleave its website the privacy policy of the institution would lapse.The institution should advise customers to read its privacy policy statements and also usedisclaimers to indicate that:-A link to other websites is not an endorsement of those websites; and-the institution makes no warranties as to the accuracy informationavailable on those sites.Where the link draws information from a third party’s website into the institution’swebsite, it is important that the institution clearly states the source of such information inorder not to mislead or deceive users.11

As part of its overall management policy, an institution should adequately manage itslinking practices and enter into linking agreements where appropriate. The linkingagreement should include the use and control of user data generated by the links as wellas privacy and data protection obligations.An institution providing hypertext links to third parties on its website or advertisementfacilities to third parties should also have clear disclaimer statements informing customersthat it is not responsible for the products and services offered by third parties.14. Strategic alliances or partnershipAn institution may enter into strategic alliances with partners in relation to the provisionof Internet banking services.An institution should ensure beforehand that the proposed alliances or partnerships do notresult in any conflict of interest.The details of alliance arrangements should be forwarded for approval to Bank ofMauritius at least two weeks before entering into an agreement with partners.15. Customer Protection and Privacy Issues(i)Customer EducationEach institution should have a web page to educate customers on Internet bankingparticularly, with respect to their rights and responsibilities and the protection of theirown privacy on the Internet.Prior to the offering of Internet banking services to their customers, each institution isrequired to ensure that it has complied with the following:(ii)a)The customers have agreed to the terms and conditions for Internetbanking services;b)The customers have been informed of the risks involved in the use of theInternet banking services ;c)The customers know their rights and responsibilities and are fully awarethat they are responsible for their own actions;d)The customers have been informed that they may specify maximum limitsfor funds transfer to limit their risks;e)The customers have been advised to read the privacy policy statements ofthe institution and third parties (refer to 13(ii) “Website links”) prior toproviding any personal information to the institution or third parties; andf)The customers have been educated on their role to maintain security oftheir personal information by not sharing their IDs and passwords withanyone, by changing their passwords regularly, and by remembering tosign off.Product TransparencyEach institution should ensure that the products and services offered on the Internet arefairly and accurately disclosed. The features of the products and services, terms and12

conditions including any fees, charges, penalties and relevant interest rates should bemade transparent to the customers in plain language as far as possible. Any agreementsor contracts should be made available in a form, which can be downloaded, printed andretained by a customer.Each institution should provide advance notice to customers of variation of terms andconditions of the Internet banking services in relation to imposing or increasing charges,increasing the customer’s liability for losses or any other material changes.The terms and conditions for Internet banking services shall include the duties of theinstitution and customers, contractual arrangements for liability arising from unauthorisedor fraudulent transactions, mode of notification of changes in terms and conditions andinformation relating to the lodgement of complaints, investigation and resolutionprocedures.The contractual arrangements for liability should provide for sharing of risks between theinstitution and the customers. Customers should not be liable for loss not attributable toor not contributed by them.Each institution should only enrol customers into a new product or servic

The guideline sets out a regulatory framework for providing Internet banking services in Mauritius. It lays down the minimum standards that the institutions must observe regarding Internet banking and prescribes the requirements and the processes for obtaining the Bank of Mauritius approval for establishing Internet banking services. The