Regulatory Alerts2019-08-06
Added · Updated
Circular on Cybersecurity Measures for Electronic Fund Transfers
The Central Bank of Jordan mandates banks operating in the Kingdom to implement electronic channels with appropriate security standards, including Two-Factor Authentication, to verify sender identity for fund transfers. Banks must also instruct employees to exercise due care in verifying email-based transfer requests until these systems are fully deployed. This circular voids previous circular No. 4/10/10611 and requires banks to submit an implementation timeline for the new security provisions.
In the Name of Allah, the Most Gracious, the Most Merciful
[Logo of the Central Bank of Jordan]
Number: 4/10/1196 Date: 4/Dhu al-Qi'dah/1440 AH Corresponding to: 7/7/2019 AD
Circular to Banks Operating in the Kingdom
Greetings,
Given the recent incidents of hacking into the email accounts of several bank clients, and the subsequent sending of transfer requests from the compromised emails without the clients' knowledge, which led to the execution of transfers from clients' accounts to unrelated parties, we request confirmation of adherence to the following:
A. It is essential to make your services available through the use of electronic channels that enable the application of appropriate security standards, including the ability to verify the sender's identity. Examples include, but are not limited to, Online banking, Mobile application, Digitally signed email, with a preference for using Two-Factor Authentication (2FA) technology, and the necessity to encourage your clients to use these technologies.
B. Until the above is implemented, please disseminate to all relevant employees the necessity to exercise due professional care and utmost caution regarding transfer requests received via email or any similar means. It must be verified, under the bank's responsibility, that the incoming transfer request was based on the request of the bank's client and not from any other party impersonating them, by following all available means to avoid falling into such incidents.
C. The contents of our circular No. (4/10/10611) dated 2019/07/25 are hereby considered void, with the necessity to provide us with the timeline for implementing the provisions of item (A) above.
Accept our highest regards,
Governor Dr. Ziad Friez