Eswatini

Transfers to SADC member states must be necessary and not prejudice the data subject (s. 32). Transfers to other countries need an adequate level of protection or one of the derogations in section 33(4), or authorisation by the Commission (s. 33(5)).

Section 49(1) requires a person in a listed position of authority (s. 49(2)) who knows or suspects a Part III corruption offence, or theft, fraud, extortion or forgery involving E10,000 or more, to report it to the police or a Commission investigator. Failure carries a fine of up to E5,000, up to two years' imprisonment, or both.

Section 9(2) lists the grounds for processing personal information (consent, contract, legal obligation, legitimate interests and others), section 11 requires notice to data subjects at or soon after collection, and sections 19 and 20 give rights of access, correction and deletion. A correction or deletion request must be answered within 14 days (s. 20(5)).

Section 46(1) requires controllers to notify the Commission of their processing before starting, with the details listed in section 46(2). Changes of name or address must be notified within one week and other material changes within one year (s. 46(4)).

Paragraph 13.2.1 requires accountable institutions supervised by the FSRA to freeze funds of designated persons without delay (immediately or within 24 hours), paragraph 12.3.6 requires reporting to the financial intelligence centre within 24 hours, and paragraph 13.7.1 requires quarterly reports to the FSRA. Paragraph 14.2 requires records to be kept for at least five years after the relationship ends.

Paragraph 28 of EFIC's guideline requires accountable institutions in Schedule 3 to the Act to report cash transactions of E25,000 or more (single or aggregated in a 24-hour day) not later than two working days after becoming aware of them. The guideline cites section 12 bis of the amended Act.

Section 7.5.1 of the guidelines requires a regulated institution to notify the Central Bank within two hours of verifying a successful cyber attack, followed by a report no later than the fourth working day after detection (s. 7.5.2) once the incident is contained. Section 5.3.1 also requires outsourced services to meet the same resilience standard.

Paragraph 8.6.1 requires the compliance officer to be approved by the FSRA before taking up the role, with a CV and description of duties (8.5.1(a)). The officer must be resident in Eswatini and report directly to senior management or the board (8.5.1(b), (d)); the FSRA must be told in writing of a termination within 15 days (8.5.1(c)). Institutions with five or fewer employees use their most senior employee (8.6.2).

Section 3(1) prohibits carrying on insurance business without registration, section 6 sets the application, and section 7 requires a public company with paid-up share capital of at least E2,000,000 (E400,000 for assistance-only insurers).

Section 20(1) requires the principal officer to submit audited financial statements to the Registrar within six months after the financial year ends. Section 20(6) sets a late-submission penalty of E500 plus E10 per working day.

Participants admitted to the CBE FinTech Regulatory Sandbox must send monthly interim reports and a final report, and exit under an agreed strategy. The CBE may also request data.

Paragraph 3.19 requires audited annual financial statements to be distributed to holders and submitted to the ESE within four months after the end of each financial year, and at least fifteen business days before the AGM. Paragraph 3.23 sets out the ESE's reminders and suspension process for late issuers.

Section 43(1)(b) shields a hosting provider from criminal liability for stored user content only if, on learning of specific illegal information otherwise than through a public authority's order, it promptly informs the Commission so that the Commission can assess the material and order removal if needed. Section 52 separately gives the Commission powers to regulate cybersecurity.