Circular Letter – Cybersecurity Best Practices Guideline for Financial Institutions Annual Self-Assessments

…/2 Eric Williams Plaza, Independence Square, Port of Spain, Trinidad and Tobago Postal Address: P.O. Box 1250 Telephone: (868) 621-CBTT (2288), 235-CBTT (2288) Fax: (868) 612-6396 E-Mail Address: info@central-bank.org.tt Website: www.central-bank.org.tt February 11, 2025 CIRCULAR LETTER TO: Commercial Banks, Non-Bank Financial Institutions and Payment System Operators Licensed under the Financial Institutions Act, 2008 Financial Holding Companies Issued a Permit under the FIA Insurance Companies and Insurance Brokers Registered under the Insurance Act, 2018 Bureaux de Change Licensed under the Exchange Control Act Chap 79:50 Payment Service Providers Registered under the Central Bank Act, Chap 79:02 E-Money Issuers Registered under the E-Money Issuer Order, 2020 (as amended) REF: CB-OIFI-450/2025 CYBERSECURITY BEST PRACTICES GUIDELINE FOR FINANCIAL INSTITUTIONS ANNUAL SELF-ASSESSMENTS The Central Bank of Trinidad and Tobago (“Central Bank”) refers to the Cybersecurity Best Practices Guideline (“Guideline”) issued on September 15, 2023 and reminds all regulated financial institutions of the requirement to submit the Self-Assessment Return on an annual basis and by March 31st of each calendar year. Accordingly, the Central Bank requires the submission of the following reports to ensure compliance:

1. Self-Assessment Return (“Return”): Financial institutions must complete, sign and submit the Return via electronic mail by March 31, 2025 to cyberguides@central-bank.org.tt and copied to the Relationship Officer. The Return is available on the Central Bank’s website at: https://www.central￾bank.org.tt/core-functions/supervision/cybersecurity.
2. Action Plan: Financial institutions are required to submit a comprehensive action plan to address identified deficiencies. This plan must outline the steps to address the identified gaps and should be submitted along with the Return. The action plan presented for 2025 should also provide updates on the status of planned actions submitted in the 2024 self-assessment if not previously submitted.
3. Independent Review Reports: In accordance with section 1, under “Supervision and Enforcement,” of the Guideline, financial institutions are reminded of the requirement to submit reports of independent reviews referred to in section 2.A. of the Guideline.

Circular Letter to Commercial Banks, Non-Bank Financial Institutions and Payment System Operators Licensed under the FIA, 2008 Financial Holding Companies Issued a Permit under the FIA Insurance Companies and Insurance Brokers Registered under the Insurance Act, 2018 Bureaux de Change Licensed under the Exchange Control Act Chap 79:50 Payment Service Providers Registered under the Central Bank Act, Chap 79:02 E-Money Issuers Registered under the E-Money Issuer Order, 2020 (as amended) February 11, 2025 2  Section 2.A. of the Guideline specifies that: “The Internal Audit Department should perform regular independent reviews of compliance with the cybersecurity strategy and policies and make relevant recommendations. Companies may also outsource the conduct of the independent review to a third party.” In this regard, independent audit reports must also be submitted to cyberguides@central-bank.org.tt upon completion. Any questions or queries regarding the aforementioned should be submitted electronically to cyberguides@central-bank.org.tt. We appreciate your co-operation and look forward to receiving your submissions by the due date. Yours sincerely Patrick Solomon INSPECTOR OF FINANCIAL INSTITUTIONS