Operational and ICT incident reporting to the Bank of Albania Albania Initial report within 4 hours of classifying an event as critical; classification no later than 24 hours after discovery
— source View →
Outsourcing risk assessment and monitoring Albania — — source View →
Notification to the BNA before contracting cloud services Angola At least 60 days before contracting; 90 days before changes
— source View →
Reporting major ICT-related incidents to the FMA Austria Initial: within 4 hours of classification and no later than 24 hours from discovery; intermediate: 72 hours after the initial report; final: within one month of the last intermediate report
— source View →
ICT third-party register and notification of critical outsourcing Austria Register submitted annually in a window announced each year; contract notifications 'in a timely manner'
— source View →
Notify the Central Bank of material outsourcing agreements Bahamas At least 10 business days before entering into or materially varying the agreement
— source View →
Prior CBB approval for material outsourcing Bahrain At least 6 weeks before committing
— source View →
Major operational or security incident reporting Benin Notice without delay; report within 72 hours
— source View →
Outsourcing of critical functions: prior notice and contract terms Benin At least 30 days' prior notice
— source View →
Notification of cloud and data-processing outsourcing to the Central Bank (financial institutions) Brazil Within 10 days after contracting; 60 days before contracting abroad without an information-exchange agreement
— source View →
Notification of cloud and data-processing outsourcing to the Central Bank (payment institutions) Brazil Within 10 days after contracting; 60 days before contracting abroad without an information-exchange agreement
— source View →
Notification of cloud and data-processing outsourcing to SUSEP Brazil Within 30 days after signing the contract
— source View →
Notify the BNB before outsourcing operational functions (payment institutions) Bulgaria Before outsourcing
— source View →
Notice before outsourcing critical functions (payment institutions) Burkina Faso At least 30 days before outsourcing
— source View →
Operational risk framework and incident notification to the Bank of Canada Canada No later than 48 hours after determining the incident is material
— source View →
Business continuity plan and IT backup for credit institutions Central African Republic — — source View →
Report significant IT outsourcing to the regulator 20 working days before signing China 20 working days before the contract is signed
— source View →
Safeguard customer reserve funds and keep core services in-house China Ongoing
— source View →
Major incident notification by payment institutions Côte d'Ivoire Without delay; detailed report within 72 hours
— source View →
Prior notice of outsourcing of critical functions Côte d'Ivoire At least 30 days before outsourcing a critical function
— source View →
Annual internal control report to the BCD Djibouti Annually by 30 April after the financial year end
— source View →
Certification entities: send an annual external security audit and submit new certificates for approval Ecuador Annually, within the first 15 days of the following year
— source View →
Cyber incident reporting to the Central Bank Eswatini Within 2 hours of verifying the incident; report by the 4th working day
— source View →
Report major ICT-related incidents to the ACPR France Within 4 hours of classification as major, and within 24 hours of detection
— source View →
NIS-2 cybersecurity risk-management measures Germany Continuous
— source View →
Major ICT incident reporting and ICT third-party register (DORA) Greece Deadlines per RTS (EU) 2025/301
— source View →
Reporting of major operational and cyber incidents to the BCEAO Guinea-Bissau Without delay; detailed report within 72 hours
— source View →
Prior notice of outsourcing of critical operational functions Guinea-Bissau At least 30 days before execution
— source View →
Environmental and social risk management system Honduras Ongoing; annual report by 31 January
— source View →
Discuss outsourcing plans with the HKMA in advance Hong Kong In advance of outsourcing or scope change
— source View →
Operational resilience framework approved and reviewed by the board Hong Kong Annual review of parameters; 1 year + up to 3 years to implement
— source View →
Cloud services: register and information to the MNB Hungary — — source View →
Keep system logs for 180 days within India India Rolling 180 days (logs); 5 years (VASP KYC and transaction records)
— source View →
Adopt a Board-approved outsourcing policy and give RBI access to outsourced records (commercial banks) India Ongoing; existing IT outsourcing agreements to comply at renewal or by 10 April 2026, whichever is earlier
— source View →
Report outsourced-provider cyber incidents and data leakage to RBI (commercial banks) India Within 6 hours of detection by the provider; immediately for data leakage
— source View →
Comply with the Cybersecurity and Cyber Resilience Framework (SEBI regulated entities) India Effective 1 January 2025 or 1 April 2025 depending on entity category
— source View →
Notice to the Central Bank before outsourcing operational functions Ireland At least 30 days before outsourcing
— source View →
Board responsibility for operational resilience Ireland — — source View →
Cyber incident and technology failure reporting (banks) Israel Phone within 2 hours; written within 8 hours of the phone report
— source View →
Prior notice of material outsourcing (banks) Israel Promptly after the senior-management decision (s. 33(a))
— source View →
Third-party, outsourcing and cloud risk management Japan — — source View →
Payment service provider outsourcing notification Kenya At least 30 days before implementation (Reg. 23(2))
— source View →
Business continuity plan Lebanon Plan within one year of the 2009 decision; simulation at least once; update on changes
— source View →
Outsourcing of IT services: due diligence, contract terms and exit arrangements Lebanon Before outsourcing; ongoing monitoring
— source View →
Safeguarding of e-money customer funds in a trust account Lesotho At all times
— source View →
Outsourcing notice and ICT security for e-money issuers Lesotho Prior notice before outsourcing
— source View →
ICT third-party (outsourcing and cloud) risk management Liechtenstein — — source View →
Documents to the CSSF after year-end (payment and e-money institutions) Luxembourg Three months after year-end for internal control documents; two weeks before the AGM for accounts
— source View →
Outsourcing notification to the CSSF (Circular 22/806) Luxembourg 3 months before; 1 month with a Luxembourg support PFS
— source View →
Notification of planned ICT third-party arrangements for critical or important functions (DORA entities) Luxembourg At least 3 months before; 1 month with a Luxembourg support PFS
— source View →
Prior consultation and notification of material outsourcing Macao Before material outsourcing; notify within 30 days of signing
— source View →
Prior approval of material outsourcing arrangements Malaysia Before entering or significantly modifying a material arrangement
— source View →
Consult Bank Negara Malaysia before first-time public cloud adoption Malaysia Before first-time public cloud adoption for critical systems
— source View →
Notice before outsourcing critical functions (payment institutions) Mali At least 30 days before execution
— source View →
Major operational incident reporting (payment institutions) Mali Without delay; detailed report within 72 hours of notification
— source View →
Prior authorisation for material outsourcing Mauritius Apply at least 15 working days before entering the agreement
— source View →
Outsourcing approval and notification by banks Moldova Prior approval for material outsourcing; notifications within 10 working days
— source View →
Delegation and outsourcing conditions for approved financial firms Monaco Ongoing
— source View →
Notify the Central Bank before outsourcing critical or important functions Montenegro No later than 60 days before the arrangement
— source View →
Authorisation or notification of outsourcing, cloud and offshore data hosting Mozambique Authorisation before moving; Bank decides within 30 days
— source View →
Cyber incident notification by banking institutions Namibia Immediately; formal submission within 24 hours of detection (paras 12.1, 12.5)
— source View →
Cyber incident notification by payment service providers Namibia Within 24 hours of a successful cyberattack (s 11.23)
— source View →
Notification and approval of material outsourcing arrangements Namibia Prior notification and authorisation at least 30 working days before signing (s 9.1)
— source View →
Prior notice to the BCEAO before outsourcing a critical operational function Niger At least 30 days before outsourcing
— source View →
Reporting of major operational incidents to the BCEAO Niger Without delay; detailed report within 72 hours
— source View →
Insurer outsourcing licence North Macedonia Licence needed before the outsourcing agreement
— source View →
Notify the CBO of outsourcing arrangements Oman Within five working days of signing
— source View →
Payment service providers: prior notification of outsourcing and registration of agents São Tomé and Príncipe Before outsourcing
— source View →
SAMA non-objection for outsourcing material functions (payment providers) Saudi Arabia Before entering the contract; notify changes
— source View →
SAMA non-objection for material outsourcing (banks) Saudi Arabia Before material outsourcing; breaches reported immediately
— source View →
Prior notice to the BCEAO before outsourcing a critical function Senegal At least 30 days before outsourcing
— source View →
Submission of outsourcing contracts to the Commission Bancaire Senegal Before signing the contract
— source View →
Business continuity plan tested annually Senegal At least once a year
— source View →
Notify the NBS before outsourcing ICT activities or using cloud services Serbia At least 30 days before contract
— source View →
Central Bank authorisation of outsourcing arrangements Seychelles Before entering the arrangement
— source View →
Outsourcing notification and cloud approval Sierra Leone Before entering the arrangement
— source View →
Technology incident reporting and recovery objectives for capital markets institutions Singapore Not later than 1 hour after discovery; root cause report within 14 days
— source View →
Prior communication to the Banco de España before outsourcing essential functions Spain At least 2 months before the provider starts the service
— source View →
Annual report of outsourcing arrangements to Bank Supervision Sri Lanka Annually by 31 January; changes immediately
— source View →
Outsourcing of significant functions: inventory, oversight and audit rights Switzerland Before signing and ongoing
— source View →
Bank internal control and audit system Taiwan Ongoing
— source View →
Outsourcing of financial institution operations Taiwan Before outsourcing; ongoing
— source View →
Prior approval for material outsourcing Tanzania Before implementation
— source View →
Prior approval for cloud computing use Tanzania Before implementation
— source View →
Outsourcing of critical operational functions by payment institutions Togo 30 days' notice before outsourcing a critical function
— source View →
Consult the NRBT before material outsourcing Tonga Before the arrangement starts
— source View →
Outsourcing: written contract and prior notice to the BCT Tunisia Prior notice to the BCT; silence for one month counts as acceptance
— source View →
Payment system operators: information security testing and audit trails Türkiye Penetration test at least annually; audit trails kept 10 years
— source View →
Payment system operators: outsourcing of IT activities Türkiye — — source View →
Security and technology-risk controls for electronic and internet banking Tuvalu — — source View →
Operational resilience: important business services and impact tolerances United Kingdom Ongoing since 31 March 2025
— source View →
Computer-security incident notification to the OCC United States As soon as possible and no later than 36 hours after determination
— source View →
Third-party relationship risk management United States Ongoing
— source View →
Obtain Reserve Bank approval to outsource payment functions or appoint agents Vanuatu Before outsourcing or appointing an agent
— source View →
Information-system safety and business continuity for credit institutions Vietnam Ongoing
— source View →
No obligations for this country.
