Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:5:p2
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 5 (pt 2/3)
Character Range: 92271–95187

providing for management oversight.
 (2) An accredited entity's fraud management capability must be appropriate and adapted to respond to fraud risks, having regard to:
 (a) the extent and nature of personal information that the entity holds;
 (b) the extent and nature of fraud risks, threats and vulnerabilities;
 (c) the potential loss or damage to one or more individuals if a digital ID fraud incident occurs;
 (d) the potential loss or damage to relying parties if a digital ID fraud incident occurs; and
 (e) the potential loss or damage to entities and individuals if a digital ID fraud incident occurs that results in a digital ID being compromised or otherwise rendered unreliable.
 (3) An accredited entity must take reasonable steps to prevent, detect and address digital ID fraud incidents, including by:
 (a) having and maintaining fraud management capability;
 (b) continuously improving its fraud management capability; and
 (c) identifying, treating and managing fraud risks.

Division 2—Fraud controls

4.25  Fraud risk assessment
 (1) An accredited entity must, for each reporting period, conduct an assessment of the fraud risks associated with its accredited services and DI data environment (fraud risk assessment).
 (2) The accredited entity must:
 (a) develop a risk matrix based on an established risk management framework or standard; and
 (b) as part of the fraud risk assessment:
 (i) assess the entity's fraud risks in accordance with the risk matrix developed in accordance with paragraph (a);
 (ii) record the results of the assessment;
 (iii) determine and record the entity's level of tolerance to fraud risks; and
 (iv) record how the entity's controls for fraud risks are applied to its accredited services and DI data environment.
 (3) If an ISP collects, uses, holds, discloses or destroys biometric information, the ISP must assess and record in its fraud risk assessment the fraud risks, mitigation strategies and any other actions the ISP will take to address risks related to biometric information.

Applicants
 (4) If subrule (1) applies to an applicant because of rule 2.3, the words 'for each reporting period' appearing in that subrule are to be ignored.

4.26  Sharing information about risks
  An accredited entity must:
 (a) consider the implications that the entity's decisions related to the management of fraud risks have for other participants of the digital ID system in which the accredited entity operates; and
 (b) share information on known fraud risks or digital ID fraud incidents with those participants as appropriate.

4.27  Fraud controller
 (1) An accredited entity must have a key position of fraud controller held by a senior officer of the entity (fraud controller).
 (2) The fraud controller must have responsibility for:
 (a) managing fraud risks; and
 (b) facilitating the entity's compliance with the fraud control requirements specified in this