PSD-12 read plainly: what the cybersecurity determination asks of payment providers

Who it covers

The determination was signed by the Governor on 12 December 2022 and published in Government Gazette 7984 on 21 December 2022 as General Notice 737. Paragraph 16 sets the effective date at 1 July 2023. The Bank issued it under section 14 of the Payment System Management Act, 2003, as amended.

Paragraph 2 says the determination applies to all persons within the National Payment System. Paragraph 6 lists who is meant: financial market infrastructures, designated non-bank financial institutions, participants of those infrastructures, retail payment systems such as electronic funds transfers, cards and electronic money, payment service providers, other licensed or authorised entities, and participants in the Bank’s FinTech Regulatory Framework. A business which only accepts payments is outside the list. A firm admitted to the Bank’s sandbox is inside it.

The board owns it

Paragraph 9 puts responsibility for information security, cybersecurity and operational resilience on the board. The board must approve a framework, set risk tolerances, and be told the risk profile at least four times a year. It must keep the people who run security separate from itself, and the security officers must have reporting access to the board. The board must also take part in industry efforts to respond to and recover from cyberattacks.

Paragraph 10 sets out the framework itself. It must state objectives and tolerances, cover identification, protection, detection, response and recovery, assign roles for emergencies and crises, cover people, process and technology, and be tested through independent compliance programmes and audits.

The technical duties

Identification starts with an annual risk assessment of business functions, or one after a significant change (11.1), and a classification of those functions by criticality (11.2). Threat intelligence is required, including one penetration test every three years for critical systems (11.3).

Protection means controls in line with best practice (11.4) and third-party agreements which safeguard data and operational resilience objectives (11.5). Detection means continuous monitoring, including monitoring of all payments for fraudulent or suspicious activity (11.6). Paragraph 12 adds two firm rules. Data sent across open and public networks must be encrypted, tokenised or masked (12.1). Two-factor authentication is required before every payment transaction on a payment instrument, website or mobile application (12.2).

The clocks and the tolerances

When a successful cyberattack or a fraudulent payment from one is detected, the entity must investigate nature, extent and damage (11.7) and contain it while recovery starts (11.8). It must report to the Bank within 24 hours as a preliminary notification (11.13). Within a month of the incident becoming known it must report an impact assessment stating financial loss, data loss and availability loss in minutes (11.14, 11.15).

Recovery rules follow. Payment systems must be designed and tested to resume critical operations within 2 hours of a disruption, with judgement exercised so risks do not escalate and settlement completes by the end of the business day (11.9, 11.10). Response, resumption and recovery plans must be tested at least twice a year for critical systems (11.11). Paragraph 13 sets four tolerances: 99.9 percent uptime of critical systems, a recovery time objective of 2 hours, a recovery point objective of 5 minutes, and two successful tests in a year.

Paragraph 14 allows the Bank to inspect records and data, and paragraph 15 applies the administrative penalties of the Act to any contravention. The amounts are now checked against the instruments themselves. Section 40(1) of the Payment System Management Act, 2023 makes a person who fails to comply with a determination, directive, guideline, standard, circular, specification, order or notice issued by the Bank liable to an administrative penalty not exceeding N$100,000 for every day of contravention. An aggrieved person appeals to the High Court, and the Bank must not enforce the penalty until the appeal ends (section 40(3) and (4)). The penalties determination, PSD-8 of 1 June 2017, adds process: a notice of delay in compliance, 14 business days to make written representations, payment within 30 business days of a final notice, and, under paragraph 9.3, a total cap of N$1,000,000 for each case of non-compliance. PSD-8 was made under the 2003 Act, and section 40(1) of the 2023 Act states a daily maximum with no total, so a reader should ask the Bank whether the per-case cap still applies.

Definitions which carry weight

Paragraph 3 of the determination defines the terms on which its duties turn. Critical operations are activities or services whose loss would affect the continued operation of the National Payment System, its customers or the wider financial system. Critical systems are the systems required for the efficient and effective operation of the system at two levels: financial market infrastructures, and interoperable retail payment systems such as cards, electronic funds transfers and electronic money, plus any payment activity the Bank authorises or designates. Availability loss means all events which stop planned production for an appreciable amount of time, measured in minutes.

Several definitions are worth reading closely. A successful attack is the gaining of access by threat actors who try to gain unauthorised access, steal data or damage computing systems. The test for the 24 hour report is therefore access gained, not an attempt repelled. A tolerance level is the level of risk a board or the Bank is prepared to accept, and the determination gives two examples: two hours of uptime or availability. Encryption, tokenisation and masking each have a definition, which matters because paragraph 12.1 lets an entity choose among the three for data on open networks.

The Bank’s stated position in paragraph 7 is blunt. Digital transformation and the rise of digital payments increase the risk of cyberattacks, which pose a significant threat to financial stability, and the Bank states it understands cyberattacks will happen. The determination therefore asks institutions to implement and manage controls proactively and to plan their response. A reader expecting a promise of prevention will not find one. The standard asks for preparation, detection, and a rehearsed response.

Outsourcing, collaboration and the supply chain

Two paragraphs reach beyond the entity’s own walls. Paragraph 11.5 requires agreements with third parties, covering relevant outsourcing arrangements and critical information technology service providers, to include provisions which safeguard the entity’s information and data and its operational resilience objectives. A payment provider which relies on a cloud host, a messaging provider or a card processor must therefore carry its own obligations into its contracts. A signed standard form from a supplier is unlikely to be enough.

Paragraph 9.5 asks the board to ensure participation in industry-wide collaborative efforts to respond to and recover from cyberattacks across the financial system, and paragraph 11.12 requires consultation and coordination with relevant internal and external stakeholders when response, resumption and recovery plans are made. The thinking is systemic. The Bank’s position paragraph says, if operational resilience is not managed, financial market infrastructures and other key stakeholders become sources of financial shocks and a channel through which shocks spread. A provider’s plan must therefore name the other parties who depend on it and are depended on in turn.

Common misreadings

Three misreadings recur. The first treats the 2 hour figure as a promise of full service. Paragraph 11.9 requires a capability to resume critical operations within 2 hours, and paragraph 11.10 adds a counterweight: judgement must be exercised so risks do not escalate, taking into account the completion of settlement by the end of each business day. Resumption is a capability to be designed and tested, and the judgement matters as much as the clock.

The second treats the 24 hour report as a full account. Paragraph 11.13 asks for a preliminary notification of a successful attack within 24 hours, and the fuller impact assessment follows within a month of the incident becoming known. A short, accurate notice sent on time is the aim, and an entity should send it before the cause is understood.

The third treats the determination as a technology specification. It names almost no products or settings. Its demands are about governance, evidence and outcomes: boards told four times a year, plans tested twice a year, a penetration test every three years for critical systems, and independent assessment of whether the framework is adequate and followed (paragraph 10.6). A provider shows compliance by producing the records, not by describing the tools.

What this means for organisations in Namibia

A payment provider should treat paragraphs 11.13 to 11.15 as a drill, not a policy. Write the 24 hour notice and the one month impact report as templates before an incident, with fields for financial loss, data loss and minutes of availability loss.

A fintech preparing for the Bank’s sandbox should read PSD-12 as part of its entry pack, because paragraph 6 names its participants. A firm outside the payment system gains a ready benchmark: boards told four times a year, restore tests twice a year, and a 2 hour recovery target are reasonable aims for any small provider.