Form (1/1/7: 7)

In the name of Allah, the Most Gracious, the Most Merciful

Number: 1/10
Date: 26/2/1426 AH
Corresponding to: 20/3/2005 AD

Greetings,

Subject: Risk Management Principles for Electronic Banking

(Risk management principles for electronic banking)

In light of the fact that many licensed banks in the Kingdom are providing banking services through electronic means, and given that these services lead to an increase in the risks faced by banks, particularly strategic risks, operational risks, reputation risks, and legal risks, it is required for banks to develop and enhance their overall risk management level, specifically regarding electronic banking risks and information technology risks. In this context, the Basel Committee on Banking Supervision has issued a paper containing a general framework for managing these risks under the title "Risk Management Principles for Electronic Banking." Below are the general principles contained in the aforementioned Basel paper, issued in July 2003, noting that in addition to these principles, banks must take any additional measures they deem appropriate to ensure tight control over these risks:

First: Responsibilities of the Board of Directors and Senior Management in the Bank:

1. The Board of Directors and Senior Management are responsible for establishing an effective system for managing electronic banking risks and continuing to update and develop it, so that it includes identifying support processes and controls to be used to control these risks.

---

CENTRAL BANK OF JORDAN

2. The Board of Directors and Senior Management must continue to review key topics related to the procedures and controls used to control electronic banking risks and monitor any modifications to them.

3. The Board of Directors and Senior Management must work to establish a system for managing outsourcing relationships with multiple third parties to support the process of providing electronic banking services and continue to develop this.

Second: Security Controls:

1. The bank must use appropriate means and techniques to identify and verify the identity of customers when they use electronic banking services and within the permissions granted to each of them.

2. The bank must use means and techniques to verify electronic banking transactions, ensuring accountability and non-repudiation.

3. The bank must ensure the use of appropriate controls to ensure the segregation of duties within electronic banking activities, databases, and their standard application systems.

4. The bank must ensure the existence of an effective mechanism to control access to electronic banking systems, databases, and their standard application software according to the permissions approved for users in this regard.

5. The bank must ensure the existence of an effective mechanism that guarantees the integrity of data, information, and records of standard electronic banking transactions.

---

CENTRAL BANK OF JORDAN

6. The bank must ensure the existence of audit trails for electronic banking transactions, providing necessary protection for these records to ensure their integrity (complete and accurate).

7. The bank must use necessary controls to maintain the confidentiality of information transmitted and/or stored via electronic means, and work to activate them in proportion to the nature and sensitivity of this information.

Third: Managing Reputation and Legal Risks:

1. When providing online banking services, the bank must provide necessary information, use tight technical means, and continuously educate its customers on how to verify the bank's identity on the internet.

2. The bank must use appropriate means to ensure compliance with the legal requirements of the jurisdiction in the country where it is located, wherever applicable.

3. The bank must have the effective capability to formulate and implement plans for the continuity of electronic banking in accordance with its strategy and policies in this regard (Business continuity plans) in a manner that ensures service provision.

4. The bank must develop effective plans and procedures to deal with incidents (Incident response plans) in order to contain those problems and unexpected events and reduce their effects, including attempts at internal and external hacking of electronic banking systems.

Please accept our highest regards,

The Governor
Dr. Amieh Touqan

Form (1/1/9)
P.O. Box 37 • Amman 11118 Jordan • Phone 4630301 • Telegram Bankamkri / Amman • Fax 4638889, 4639730, 4613308