QU OF NT AT A FE RU

BERMUDA

DIGITAL ASSET BUSINESS (CYBER RISK) RULES 2023

BR 65 / 2023

The Bermuda Monetary Authority, in exercise of the power conferred by section

7 of the Digital Asset Business Act 2018, makes the following Rules:

Citation

1 These Rules may be cited as the Digital Asset Business (Cyber Risk) Rules 2023.

Interpretation

2 In these Rules–– “Act” means the Digital Asset Business Act 2018; “Authority” means the Bermuda Monetary Authority established under the Bermuda Monetary Authority Act 1969; “Chief information security officer” means the senior executive, by whatever title called, appointed by the licensed undertaking to oversee and implement its cyber security programme and enforce its cyber security policies.

3. Cyber risk return

(1) Class F licence holders shall annually file with the Authority a written cyber risk return whereas Class M and Class T licence holders shall file such return on the date as determined by the Authority.

(2) The cyber risk return referred to in paragraph (1) shall be in such form as the Authority may direct and shall be set out on the website of the Authority: www.bma.bm.

Declaration

4 Every cyber risk return made by a licensed undertaking under rule 3 shall be accompanied by a declaration signed by the Chief information security officer and a

DIGITAL ASSET BUSINESS (CYBER RISK) RULES 2023

senior executive or director of the licensed undertaking, declaring that to the best of their knowledge and belief, the return is accurate in all material respects.

Revocation of BR 99 / 2018

5 The Digital Asset Business (Cybersecurity) Rules 2018 are hereby revoked.

Commencement

6 These Rules shall come into operation on 1 January 2024.

Made this 23rd day of June 2023

Chairman Bermuda Monetary Authority

[Operative Date: 01 January 2024]