Retail Payment Activities Regulations — 5
Framework 5 (1) The risk management and incident response framework required under subsection 17(1) of the Act must be in writing and must (a) set out the following among its objectives: (i) ensuring that the payment service provider is able to perform retail payment activities without reduction, deterioration or breakdown, including by ensuring the availability of the systems, data and information involved in the performance of those activities, and (ii) preserving the integrity and confidentiality of those activities, systems, data and information; (b) set out clearly defined and measurable reliability targets for the ability to perform the retail payment activities and for the availability of the systems, data and information referred to in subparagraph (a)(i), as well as indicators for assessing whether each of the objectives referred to in paragraph (a) is met; (c) identify the human and financial resources that are required to implement and maintain the framework, including, with respect to human resources, their skills and training, as well as the measures that the payment service provider must take to ensure timely and reliable access to those resources, whether from internal or external sources; (d) allocate specific roles and responsibilities in respect of the implementation and maintenance of the framework — both in the normal course of business and when detecting, responding to and recovering from incidents — including, unless the payment service provider is an individual, (i) responsibility for challenging and overseeing the exercise of each of those roles and responsibilities, and (ii) to a senior officer, responsibility for overseeing the payment service provider’s compliance with sections 6 to 10 of these Regulations and subsection 17(1), section 18 and subsection 19(3) of the Act and for overseeing material decisions that relate to the payment service provider’s identification and mitigation of, and response to, operational risks and incidents; (e) identify the assets — including systems, data and information — and business processes that are associated with the payment service provider’s performance of retail payment activities and classify them according to their sensitivity and their criticality to the performance of those activities; (f) identify, and describe the potential causes of, the payment service provider’s operational risks, including those relating to (i) business continuity and resilience, (ii) cybersecurity, (iii) fraud, (iv) information and data management, (v) information technology, (vi) human resources, (vii) process design and implementation, (viii) product design and implementation, (ix) change management, (x) physical security of persons and assets, and (xi) third parties; (g) describe the systems, policies, procedures, processes, controls and any other means that the payment service provider must have in place to mitigate its operational risks and protect the assets and business processes referred to in paragraph (e); (h) describe the systems, policies, procedures, processes, controls and any other means that the payment service provider must have in place to ensure the continuous monitoring of the following for the purpose of promptly detecting incidents, anomalous events that could indicate emerging operational risks and lapses in the implementation of the framework: (i) the payment service provider’s retail payment activities, (ii) the systems, data and information involved in the performance of those activities, and (iii) the systems, policies, procedures, processes, controls and other means referred to in paragraph (g); (i) set out a plan for responding to — including recovering from — incidents, including those involving or detected by an agent or mandatary or a third-party service provider, that (i) contains clearly defined policies, processes and procedures for implementing the plan and for escalating the response to an incident, taking into account the incident response procedu