Instruction No. 79/AMF-UMOA/2023 on the Information System Requirements of the Regional Securities Market (BRVM)

INSTRUCTION NO. 79/AMF-UMOA/2023

ON THE INFORMATION SYSTEM REQUIREMENTS OF THE REGIONAL SECURITIES MARKET (BRVM)

The Financial Markets Authority of the West African Monetary Union,

Having regard to the Revised Treaty of the West African Monetary Union (UMOA) of July 12, 2019, which entered into force on October 1, 2022, modifying the name of the Regional Council for Public Savings and Financial Markets (CREPMF) to the Financial Markets Authority of the UMOA (AMF-UMOA);

Having regard to the Convention of July 3, 1996 establishing the Regional Council for Public Savings and Financial Markets, particularly its Annex on the composition, organization, functioning, and powers of the Regional Council for Public Savings and Financial Markets;

Having regard to the General Regulation relating to the organization, functioning, and control of the regional financial market of the UMOA;

Having regard to Instruction No. 2/97 of November 29, 1997 relating to the authorization of the Regional Securities Market;

Having regard to Decision No. 004 of April 29, 2021/CM/UMOA appointing the President of the Regional Council for Public Savings and Financial Markets;

Having regard to the deliberations of the AMF-UMOA in its 98th ordinary session held on December 23, 2023, in Cotonou, Republic of Benin;

HEREBY DECIDES:

2/12 Instruction No. 79/2023/AMF-UMOA

TITLE 1. GENERAL PROVISIONS AND OBLIGATIONS

Article 01: Definitions
For the purposes of this Instruction, the following terms are defined as:

a) Computer Incident: Any event that is not part of the standard functioning of a service and which causes, or may cause, an interruption or a reduction in the quality of that service.

b) Software Platform: Business software used by the Regional Securities Market (quoting software, surveillance software, etc.).

c) Audit Trail: Chronological recording of system activities showing all additions, deletions, and changes made to the system, which allows reconstructing and controlling an operation from its origin to its completion.

d) Business Continuity Plan: A formalized strategic document, regularly updated, for disaster or serious loss reaction planning. Its objective is to minimize the impacts of a crisis or natural, technological, or social disaster on business activity (and thus the sustainability) of an enterprise.

e) User Profile: Description of a user showing the rights they enjoy in the business software.

f) RPO (Recovery Point Objective): The RPO quantifies the data that an Information System may lose as a result of an incident. Usually, the RPO expresses a duration between the incident causing data loss and the date of the most recent data that will be used to replace the lost data.

g) RTO (Recovery Time Objective): The RTO represents the maximum acceptable duration of interruption during which a resource (computer, system, network, software) may be non-functional following a breakdown or disaster.

Article 02: Subject Matter
This Instruction sets the rules regarding security and risk management of the information system of the Regional Securities Market (BRVM).

Article 03: Scope of Application
This Instruction applies to the Regional Securities Market.

3/12 Instruction No. 79/2023/AMF-UMOA

TITLE 2: INFORMATION SYSTEM SECURITY DEVICE OF THE BRVM

Article 04: Audit Trail
An audit trail must be configured on every business software platform to guarantee the recording of actions performed by users of that platform and thus ensure their traceability. Furthermore, access to this audit trail must be restricted so that it is not accessible to data administrators.

Article 05: Logging and Access Rights to the Audit Trail
The business software, Databases, and Operating Systems of the BRVM must possess security characteristics that allow logging of actions performed and thus detect and analyze any irregularity.

This logging (activation of the audit trail) must be effective on business software.

The audit trail of business software must be secured (protected against any modification) and archived adequately to guarantee its integrity and its quality as evidence. It must be accessible only to the Audit or Internal Control Department.

The audit trail of business software as well as the logs of databases and operating systems must be retained for at least five (5) years to serve later in the event of disputes or for analysis purposes.

Article 06: User ID and Password for User Authentication
Access to business software must be done via user authentication (combination of identification and password) so as to authorize only authorized users. Furthermore, the identity of each user must be unique so as to link each activity on the software to a specific user.

Article 07: Prohibition of Simultaneous Access with the Same User Account
Business software should not allow the same user to open multiple sessions from a single or multiple machines.

Article 08: User Profiles
Each business software must have the user profile management functionality. User profiles must prevent the accumulation of incompatible functions and guarantee that the roles or access rights of users to each business software are consistent with the duties of users within the BRVM.

4/12 Instruction No. 79/2023/AMF-UMOA

Article 09: Password Change at First Login
Generally, each new user of a business software is created with a generic password. Therefore, a change of this password at the first login must be mandatory to reduce the risk of identity theft.

Article 10: Automatic User Disconnection After Inactivity
Business software must offer the possibility to configure user disconnection from their session in case of inactivity in the software for a maximum duration of ten (10) minutes.

Article 11: Password Configuration (Length, Complexity, Duration, History, Locking)
The passwords of business software must be configurable so as to define the values of the following parameters:

the minimum password length must be eight (08) characters;
password complexity (at least one uppercase letter, at least one lowercase letter, at least one special character, at least one alphanumeric character);
the maximum password duration cannot exceed ninety (90) days;
account locking after a number of connection attempts not exceeding three (03).

Article 12: Encryption or Hashing of Password Files/Tables
The password files or tables of business software must be encrypted or hashed so that passwords are not readable by administrators of business software or Databases.

Article 13: Surveillance and Conduct of Security Examinations
The BRVM must closely monitor personnel possessing high access privileges to its systems, as they possess the knowledge and resources necessary to bypass the controls implemented in these systems and security procedures. The BRVM must mandatory proceed, once every three (03) years, to a security audit whose results are transmitted to the AMF-UMOA no later than May 15 of the year following the triennial period.

It must adopt the following controls and practices:

implement strong authentication mechanisms for privileged users, particularly for remote access;
limit the number of privileged users;
grant privileged access on a strict functional needs basis;

5/12 Instruction No. 79/2023/AMF-UMOA

record activities performed on systems by privileged users by activating audit logs;
prohibit privileged users from accessing system logs in which their activities and those of other users are recorded;
examine the activities of privileged users in a timely manner;
prohibit the sharing of privileged accounts;
prohibit providers from benefiting from privileged access to systems without close supervision.

The internal control of the BRVM must perform checks (reviews of profiles, access to computer systems, review of audit logs) to identify any irregularity related to the use of computer systems. Periodically and at least every semester (the months of January and July), the reports of these controls must be transmitted to the AMF-UMOA and retained by the BRVM.

TITLE 3: GOVERNANCE AND RISK MANAGEMENT

Article 14: Security Device
In the context of managing risks inherent to information systems, the BRVM must put in place a device allowing, in a continuous manner, to identify and evaluate risks, with a view to reducing or managing them. It elaborates, for this purpose, its risk management strategy approved by its governing bodies.

It must use the following non-exhaustive best practices:

ensure that a solid framework for technological risk management is established and maintained;
ensure that effective internal controls and risk management practices are implemented to ensure the security, reliability, resilience of systems, and business recovery;
establish IT policies, standards, and procedures, which are essential components of the technological risk management framework. Due to rapid changes in the environment and in IT security, policies, standards, and procedures should be regularly reviewed and updated;
implement compliance processes to verify that IT security standards and procedures are applied. Monitoring processes should be implemented so that compliance deviations are known and corrected in a timely manner;
put in place an employee awareness program on IT security. This program should be regularly updated to ensure its content remains relevant, given the evolution of technology and the associated risks;
conduct a triennial audit of its information system.

6/12 Instruction No. 79/2023/AMF-UMOA

Article 15: IT Security Policy
The BRVM develops an IT security policy adapted to its activity and its own IT infrastructure, consistent with the most widespread security requirements on the market, notably the ISO 27001 standard.

This policy must be approved by the Board of Directors of the BRVM and communicated to all users of the Information System (employee, provider). It is updated regularly, at least every three years, to take into account the evolution of the internal and external environment.

Article 16: Business Continuity Plan
The BRVM must ensure that its organization, its system, and its procedures are designed to maintain their critical functions or restore them as quickly as possible in order to fulfill its obligations towards the regulatory authority and approved market users.

To this end, the development of a business continuity plan including an IT backup plan is mandatory. The business continuity plan must be approved by the Board of Directors. This plan must provide, among other things, at minimum the following aspects:

an identification of the company's processes of strategic importance, which are critical and necessary for its survival, and a minimum system configuration capable of supporting said processes;
an evaluation of risks, vulnerabilities, and impacts which will lead to the identification of indispensable human resources, important data for the BRVM, and the efficiency of mitigation controls for existing risks;
a definition of the business continuity strategy, including the plan's trigger criteria, a recovery site with its description, a presentation of the crisis team with the persons authorized to trigger the plan, the acceptable recovery time (RTO: Recovery Time Objective), and the acceptable amount of data loss (RPO: Recovery Point Objective);
training and awareness programs for the plan;
the update and testing program of the business continuity plan.

The BRVM must have a fallback site.

The BRVM's fallback site must be established in at least one other Member State of the UMOA to mitigate the risk that the same disaster affects both sites.

The acceptable delay for complete recovery of activities (RTO: Recovery Time Objective) after a disaster is 24 hours.

The acceptable amount of data loss (RPO) is set at two (02) hours of data.

The exercise to evaluate the effectiveness of the plan must concern, in a non-exhaustive manner, verifiable aspects: (i) the alert procedure, (ii) the functioning of the crisis cell, (iii) the technical procedures for switching to backup mode, (iv) the coordination of different stakeholders, during an exercise responding to a simulated serious incident, (v) targeted training

7/12 Instruction No. 79/2023/AMF-UMOA

of personnel on technical procedures, (vi) the degree of ownership of the plan by BRVM personnel, (vii) the testing of critical elements of the plan at least once a year, and (viii) the regular testing of the backup recovery procedure to verify its adequacy to the organization's needs.

Periodically and at least once a year, the plan must be tested to verify its effectiveness. The test report must indicate the test results, identified weaknesses, and an execution plan to correct these weaknesses.

Article 17: Data Backup and Restoration
The BRVM ensures that its information security policy guarantees the integrity of data backups on appropriate media, the performance of regular restoration tests, and the off-site relocation of backup media to a remote site.

Article 18: Access to IT Infrastructure
Access to the BRVM's IT infrastructure must rely on strong authentication solutions that allow, with a very high degree of assurance, to verify the identity of users. It must use in this regard controlled gateways between the internet and its own IT infrastructure, such as firewalls, proxy servers, antivirus scanners, and content scanners, or other similar up-to-date security solutions. It must ensure that these gateways are correctly designed, configured, and secured, and that they are subject to professional daily management and rigorous monitoring.

Article 19: Incident Management
The BRVM puts in place an information security incident management framework, in order to treat them and contain their impact. It must have an incident management procedure validated by the General Management, which must:

specify which types of incidents it applies to;
establish the roles and responsibilities of personnel involved in the incident management process;
define a method for reporting incidents after their detection;
specify the priority of incidents based on urgency and impact;
define the strategy for assigning incidents to personnel responsible for their resolution, taking into account escalations;
allow tracking and supervising incident management (traceability of any incident) in order to know at any time the resolution level of an incident and to close resolved incidents;
explain the tasks and responsibilities regarding internal and external communication concerning major incidents.

8/12 Instruction No. 79/2023/AMF-UMOA

An incident report taking into account the state and impact of the incident, corrective measures adopted, recommendations, and the implementation plan must be transmitted annually, in January, to the AMF-UMOA.

Finally, any major incident must be systematically communicated to the AMF-UMOA, within a 24-hour deadline.

TITLE 4: CHANGE MANAGEMENT

Article 20: Application Maintenance
The BRVM must put in place a formalized application maintenance environment. This must include a test (homologation) environment and a production environment. These two environments must be clearly separated and allow the application maintenance process through the phases of correction, acceptance testing, and validation before production deployment.

Periodically, the homologation environment must be updated at the configuration level to respond efficiently and objectively to the tests to be performed there.

Article 21: Change Management Process for Production Systems
The BRVM must establish a change management process to ensure that modifications made to production systems are evaluated, approved, implemented, and reviewed appropriately. The change management process must apply to modifications related to software changes and updates, system configurations, and security.

This process must be governed by a change management procedure. This procedure, validated by the Board of Directors, must include the following main steps:

initiation of the change;
risk and impact analysis of the change;
authorization of the change;
prioritization of the change;
quality assurance tests, user acceptance testing (UAT);
rollback plan;
decision to deploy the change to production;
deployment of the change to production respecting the principles of separation of duties;
documentation of the change, user training, and distribution of training materials to users;
post-implementation monitoring of the change.

9/12 Instruction No. 79/2023/AMF-UMOA

TITLE 5: INFORMATION SYSTEM RISK MANAGEMENT

Article 22: Information System Risk Management Process
In the context of managing risks inherent to information systems, the BRVM puts in place a device allowing, in a continuous manner, to identify and evaluate risks, with a view to reducing or managing them. It elaborates, for this purpose, its risk management strategy approved by its Board of Directors. The BRVM proceeds or has proceedings, at its expense if necessary, to the controls necessary for the security of installations and other equipment. It addresses the minutes of these controls to the AMF-UMOA, upon its express request. The BRVM implements the necessary human and material means for security and safety, for the operation of the installations at its disposal.

Article 23: Protection Against Malware and Computer Hacking
The BRVM puts in place prevention, detection, and correction measures, in order to protect its information system against malware and computer hacking.

The General Management of the BRVM must integrate into its annual management report to the Board of Directors a situation of major incidents that occurred during the previous year.

Article 24: Securing Networks, Terminals, and Information
The BRVM takes appropriate security measures to protect information transiting through its network, as well as through its connections with users, data providers, and the AMF-UMOA. It ensures that terminals accessing its information system have the necessary authorizations. Furthermore, it puts in place the adequate configuration, with a view to managing risks inherent to the connection of external users to its information system.

Article 25: Management of Identities and Logical Access to Information Systems
The BRVM ensures that each user, data provider, or member of its personnel is identified and authenticated before any access to information systems, and that they have adequate access rights. Each action must be able to be linked to its author.

Article 26: Physical and Environmental Security Device
The BRVM equips itself with a device for managing physical access of its personnel and third parties to its secure premises. The premises hosting its data center must be equipped with appropriate environmental protection devices, notably smoke and water detectors, automatic fire extinguishing systems, as well as temperature probes.

10/12 Instruction No. 79/2023/AMF-UMOA

Article 27: Management of IT Service Providers
IT service providers play an important role in the management of the BRVM's systems and processes. A meticulous selection and control of IT service providers are essential to minimize security risks to which it might be confronted. It must implement measures to respond to security threats that may arise during its relationships with providers using a risk-based approach. To face these threats, and with a view to ensuring respect for confidentiality, availability, and integrity of data, it must use the following practices:

perform prior due diligence before concluding contracts with service providers for potential services. This diligence must allow for the determination of the viability, reliability, and track record of the service providers;
ensure that the contractual conditions governing the roles, relationships, obligations, and responsibilities of service providers are set out in written agreements (service level agreements) which also specify post-termination obligations. The requirements and conditions covered by these agreements usually include performance targets, service levels, availability, reliability, scalability, compliance, audit, security;
implement non-disclosure agreements (NDA) with service providers;
ensure that the use of service providers and the outsourcing of information systems do not result in a weakening or degradation of the BRVM's internal controls. It must require service providers to rigorously apply security procedures and controls to protect the confidentiality and security of sensitive or confidential information such as its financial data and that of its clients;
perform continuous monitoring (evaluation of clauses defined in service level agreements) of service providers to assess the adequacy and compliance of the operations and services they provide;
establish, maintain, and monitor the rights and actions of service providers in their systems;
establish and implement procedures to terminate service providers' access immediately upon contract termination;
verify the service provider's ability to recover outsourced information systems and services in compliance with acceptable recovery time objectives (RTO) before concluding any agreement with service suppliers. Furthermore, upon contract termination, the BRVM must have the contractual power and means to quickly withdraw or destroy data stored in the systems and backups of service providers.

11/12 Instruction n° 7 9 /2023/AMF-UMOA

TITLE 6: SOFTWARE PLATFORM

Article 28: Business Software
The BRVM must have business software approved by the AMF-UMOA and which must be updated in accordance with developments in the technological and market environment.

These business software must be adapted to its regulatory activities.

Article 29: Minimum functionalities of the business software dedicated to listing
The business software dedicated to listing must have the following minimum functionalities:

a) continuous listing and fixing and trading of the main types of financial instruments authorized on the regional financial market; b) support for all trading, monitoring, and surveillance activities of transactions; c) regulatory observation module; d) generation of data flows to the AMF-UMOA, in the required format; e) interface allowing the implementation by the regulated market operators (SGI) of online trading for their clients; f) reliable calculation of indices and market capitalizations; g) management of order entry periods; h) support for all authorized order stipulations; i) management of active, inactive order books, etc.

Article 30: Backup and Continuity Device
To secure its activities, the BRVM must:

equip its business software with a backup system to guarantee the continuity of the stock market;
organize an alternative information exchange system between the central site, the backup site, and the members;
provide for a contractual clause allowing for the renewal or extension of the operating license of the business software by the Regulator or any other entity designated by it in the event of the cessation of activity of the BRVM.

12/12 Instruction n° 7 9 /2023/AMF-UMOA

TITLE 7: TRANSITIONAL AND FINAL PROVISIONS

Article 31: Transitional Provisions
The Central Depository / Settlement Bank has a maximum period of two (02) years from this date to comply with the provisions of this Instruction.

Article 32: Publication and Entry into Force
This Instruction, published wherever necessary, repeals all previous regulatory provisions contrary to it and enters into force from the date of its signature.

Done in Abidjan, on 29 DEC. 2023

For the UMOA Financial Markets Authority
The President

Badanam PATOKI

Lineage: In force