Reserve Bank of Fiji Prudential Supervision Policy Statement No. 2: Minimum Requirements for the Management of Cybersecurity Risk

What it is

Prudential Supervision Policy Statement No. 2, Minimum Requirements for the Management of Cybersecurity Risk by Supervised Entities, was issued by the Reserve Bank of Fiji on 3 March 2023. It is made under the Banking Act 1995, the Insurance Act 1998, the Reserve Bank of Fiji Act, the capital markets regulations, the Exchange Control Act and the Fiji National Provident Fund Act 2011. It took effect on 31 March 2023, with full compliance required within one year.

PSPS 2 does not mention artificial intelligence. It matters for AI because it sets binding rules for the information assets, systems and third parties of Fiji’s financial institutions, and AI systems are among them. A bank’s AI chatbot, an insurer’s claims model or an AI service that reads customer files all sit inside its scope.

Who it applies to

Licensed commercial banks, credit institutions, insurance companies, insurance brokers, the securities exchange, management companies of managed investment schemes, stock brokers, the Fiji National Provident Fund, the Fiji Development Bank and restricted foreign exchange dealers. Branches of foreign-incorporated entities are covered as well.

What it requires

Board and framework. The board is ultimately responsible for cybersecurity. Each entity needs a comprehensive, board-approved cybersecurity risk management framework, with roles and reporting lines, a documented risk tolerance, a cybersecurity strategy and regular review of the framework’s effectiveness, including audit.

Information assets and controls. Entities must identify and inventory all information, information processing and communication assets, assign an owner to each, classify them under a board-approved scheme, and apply controls over access, operations, communications, cryptography, system development and change, and security testing. AI systems, the data they use and the accounts they act through belong in that inventory and under those controls.

Third parties. Third-party services must not weaken the cybersecurity control environment or the assurance over it. Entities need a third-party relationship policy covering due diligence on a provider’s viability, reliability and financial position, time-limited access, and management of changes to services. Service level agreements must include cybersecurity provisions, and contracts must reserve the right of the entity and the Reserve Bank to review the provider’s relevant activities, systems and sites, including on site. For AI, that reaches model and platform providers that process an entity’s data.

Incidents. Entities need a documented incident management process. They must notify the Reserve Bank within 24 hours of becoming aware of a cybersecurity incident that materially affects, or could materially affect, the institution or its customers, and report cybersecurity incidents quarterly in the prescribed form. Operational risk incidents continue to be reported under BSPS No. 16.

Oversight. Entities had to give the Reserve Bank their cybersecurity policies within 12 months of implementation, and must send revised policies within 30 days of board approval of major changes. The Reserve Bank assesses compliance in supervision and can apply sanctions.

For an entity using AI, the practical questions follow from the policy. Is every AI system and AI vendor on the information asset inventory? Has each AI provider been through third-party due diligence, with the contract rights PSPS 2 requires? Are AI systems security tested, including against attacks specific to AI? And would an AI failure or data exposure reach the 24-hour notification process?

Key dates

• 3 March 2023. Policy issued.
• 31 March 2023. Policy took effect.
• 31 March 2024. End of the one-year period for full compliance.

How it relates to other frameworks

PSPS 2 sits alongside the Reserve Bank’s other supervision policies, including BSPS No. 16 on operational risk, ISPS No. 8 on insurers’ risk management frameworks and PSPS No. 3 on culture and conduct risk. Outside the financial sector, the main legal protection for personal information in Fiji is section 24 of the Constitution, and the National Digital Strategy commits Fiji to a National AI Framework.

Where regulators in the region have written AI-specific expectations for financial institutions, such as the MAS AI Risk Management Guidelines in Singapore, they build on the same base of inventory, third-party management and incident response. ISO/IEC 42001 gives Fijian institutions a structure for extending their cybersecurity framework to AI.

A note on this page

This is Aicura’s reading of PSPS 2. It is not legal or prudential advice and it is not the policy itself. Read the policy published by the Reserve Bank of Fiji, and raise questions about how it applies to your AI systems with your supervisor.