Notice No. 6/GBM/2026 - Establishes Procedures and Requirements for Data Processing and Storage by Credit Institutions and Financial Companies

ProofMonday, August 31, 2026 I SERIES — Number 166OFFICIAL PUBLICATION OF THE REPUBLIC OF MOZAMBIQUENATIONAL PRESS OF MOZAMBIQUE, E.P.NOTICEThe material to be published in the «Boletim da República» must be submitted in a duly authenticated copy, one for each subject, containing, in addition to the necessary indications for this purpose, the following endorsement, signed and authenticated:For publication in the «Boletim da República».SUMMARYBank of Mozambique:Notice No. 6/GBM/2026Establishes the procedures and requirements for data processing and storage by credit institutions and financial companies and revokes Notice No. 4/GGBM/2003, of September 10.BANK OF MOZAMBIQUENotice No. 6/GBM/2026of August 18Whereas it is necessary to establish the procedures and requirements for data processing and storage by credit institutions and financial companies, in order to adapt them to the innovations and technological challenges of the financial sector, the Bank of Mozambique, under the combined provisions of paragraph d) of no. 2 of article 3, paragraph d) of no. 2 of article 37 of Law no. 1/92, of January 3, nos. 3 and 4 of article 21 of the Data Centers Regulation, approved by Decree no. 71/2025, of December 31, and no. 4 of article 5 of the Cloud Computing Regulation, approved by Decree no. 72/2025, of December 31, determines:CHAPTER IGeneral ProvisionsArticle 1Object1. This Notice establishes the procedures and requirements for data processing and storage to be observed by credit institutions and financial companies.2. This Notice also establishes the procedures and requirements applicable to the operation of data centers of credit institutions and financial companies and to the contracting of services provided by the operators of these data centers.Article 2ScopeThis Notice applies to credit institutions and financial companies, hereinafter referred to as “institutions”.Article 3DefinitionsThe definitions of the terms and expressions used in this Notice are contained in the Glossary, annexed hereto, which forms an integral part thereof.CHAPTER IIData Processing and StorageArticle 4Location of data centers1. Institutions must have primary and secondary data centers.2. The primary data centers of institutions must be located in national territory.3. Secondary data centers may be located outside national territory, with the authorization of the Bank of Mozambique.Article 5Requirements for the authorization request1. Authorization requests submitted under no. 3 of the preceding article must include the following elements:a) License or registration issued by the Regulatory Authority for Information and Communication Technologies;b) Indication of the jurisdiction where the data center is intended to be located and the respective technical justification;c) Proposed contract to be entered into with the data center operator;d) Description of the services to be provided and respective service levels;e) Information and classification of the data to be stored and processed;f) Assessment of risks associated with contracting, including technological, cyber, legal, and concentration risks;g) Information security and cybersecurity measures implemented by the data center operator;1656 I SERIES — NUMBER 166Proofh) Business Continuity Plan and Disaster Recovery mechanisms; andi) Identification of subcontracts and respective control mechanisms, if applicable.2. For the purposes of no. 3 of the preceding article, the Bank of Mozambique decides within 30 days.Article 6Communication on changes and restrictions to data center operations1. Institutions must notify the Bank of Mozambique whenever one of the following situations occurs:a) Any circumstance that restricts or prevents, even temporarily, the equivalence between primary and secondary data centers, with the communication to be made immediately after the occurrence of the event; andb) Any structural change to technological infrastructures, information systems, or data centers, whenever foreseeable, with a minimum advance notice of 30 days.2. For the purposes of this article, structural changes include, but are not limited to:a) Change of location of data centers in national territory, requiring authorization from the Bank of Mozambique in the cases provided for in no. 3 of article 4 of this Notice;b) Migration of technological or operational environments;c) Replacement or update of critical systems;d) Changes in technological infrastructure; ande) Subcontracting of new providers for the provision of critical services.3. The communication must include:a) Detailed description of the proposed change or migration, the impacted services, and their criticality;b) Risk assessment and respective mitigation measures;c) Architecture of the infrastructure and information systems;d) Implementation project, including timeline and execution strategy; ande) Business Continuity Plan and Disaster Recovery Plan.4. After the completion of the change or migration, a detailed report must be submitted to the Bank of Mozambique, containing:a) Description of the activities carried out;b) Incidents occurred and respective corrective actions;c) Results obtained against the defined objectives; andd) Confirmation of the operational stability of the systems or technological infrastructure.5. The Bank of Mozambique may request additional information whenever necessary.Article 7Information systems1. The information systems of institutions can be classified as main and peripheral.2. Institutions must have their main systems hosted and operated from data centers located in national territory.3. Institutions may have peripheral systems hosted outside national territory, with the authorization of the Bank of Mozambique.4. The provisions of the preceding paragraphs do not apply to systems provided in accordance with the policies of specific global providers, which are subject to prior communication to the Bank of Mozambique, with a minimum advance notice of 30 days.Article 8Contracting of management, co-location, and cloud computing services1. Institutions are authorized to contract management, co-location, and cloud computing services, in accordance with the rules provided in this Notice and other applicable legislation.2. When contracting cloud computing services, institutions must observe the following conditions:a) For main systems in national territory, with the authorization of the Bank of Mozambique;b) For peripheral systems in national territory, by mere communication to the Bank of Mozambique; andc) For peripheral systems abroad, with the authorization of the Bank of Mozambique.3. Authorization requests for contracting management, co-location, and cloud computing services must include the following elements:a) Identification of the service provider;b) Proposed contract;c) License or registration of the service provider, issued by the Regulatory Authority for Information and Communication Technologies, where applicable; andd) Information on the type of data that the proposed solution will process, including source and destination systems, as well as respective storage details.4. For the purposes of paragraphs a) and c) of no. 2 of this article, the Bank of Mozambique decides within 30 days.5. For the purposes of paragraph b) of no. 2 of this article, communication must be made to the Bank of Mozambique within 15 days after the conclusion of the respective contract.Article 9Cloud infrastructure typology1. Cloud computing services can be contracted according to the following cloud infrastructure typologies:a) Public – available for use by the general public, with open system access;b) Private – available for exclusive use by a single entity or a restricted set of entities, with controlled access in a closed system; andc) Hybrid – composed of two or more distinct cloud infrastructures, public and private, interconnected by technologies that ensure data portability and interoperability between systems.August 31, 2026 1657Proof2. Information from banks, microbanks, and electronic money institutions must be processed exclusively in private clouds.3. The Bank of Mozambique may determine, on a case-by-case basis, the subjection of a particular institution to the restricted regime of information processing exclusively in private clouds, taking into account, among other factors, the following:a) Technological and cyber risk profile;b) Size;c) Governance structure;d) Operating environment;e) Volume of transactions;f) Degree of sophistication of products and services; and,g) Interconnection with other entities.Article 10Requirements for contracting co-location, management, and cloud computing services1. For contracting co-location, management, and cloud computing services, institutions must ensure that service providers meet the necessary legal, technical, and operational requirements for the provision of services, including, among others, the following requirements:a) Possess a license or registration issued by the Regulatory Authority for Information and Communication Technologies; andb) Possess accredited and relevant certifications for the provision of the service.2. Institutions must ensure, during the contractual relationship, that the service provider guarantees:a) Access to the data to be processed or stored;b) The availability of information and management resources adequate for monitoring the services to be provided;c) The confidentiality, integrity, availability, and recovery of processed or stored data;d) Security measures aimed at protecting data in transit and at rest, including encryption, multi-factor authentication, identification and correction of vulnerabilities, and access controls;e) Technical support measures for resolving problems related to data processing and storage; andf) The implementation of corporate governance and management practices proportionate to the relevance of the service to be contracted and the risks to which they are exposed.Article 11Minimum clauses for management, co-location, and cloud computing service contractsService provision contracts must include, at a minimum:a) Indication of the country(ies) and region where the services are provided;b) Service level agreements with parameters and metrics that comprehensively cover aspects related to availability, performance, security, response times, error correction, and incident resolution;c) 24/7 technical support (twenty-four hours a day, seven days a week);d) Security measures adopted for data transmission, storage, and segregation;e) Right of audit by the Bank of Mozambique, including remote audits or by an entity expressly designated by it;f) Permission for the Bank of Mozambique to access contracts and agreements signed for the provision of services, documentation and information regarding the services provided, stored data and information about its processing, as well as data backups;g) Prior communication to the institution, with a minimum advance notice of 90 days, regarding the subcontracting of services and any limitations that may affect the provision of services or compliance with current legislation and regulation;h) Forms of contract termination;i) Indication of the location and mechanisms applicable to dispute resolution;j) Obligation to use information exclusively for the purposes of contract execution;k) Obligation of the service provider to communicate, in writing, the intention to discontinue its services, totally or partially, with a minimum advance notice of 30 days, except in cases of duly justified force majeure;l) Obligation of the service provider, in case of contract termination:i. To present an exit plan and define migration conditions that ensure the reversibility of services;ii. To assume responsibility for any losses, corruptions, or inconsistencies of data resulting from the migration process, committing to their immediate correction;iii. To ensure access, extraction, and transfer of data to a new service provider or to the institution, in a structured, commonly used, and interoperable format;iv. To securely and irreversibly delete data, after confirmation of the integrity and availability of the data received by the institution;v. To ensure the cessation of use of the accesses assigned to it, as well as compliance with confidentiality duties after the termination of the contract.m) The contracting institution's access to:i. Information related to the certifications of its services issued by external entities;ii. Information and management resources adequate for monitoring the services to be provided; andn) Obligation of the service provider to preserve and retain information in accordance with current legislation.CHAPTER IIITransitional and Final ProvisionsArticle 12Transitional regime1. Institutions in operation on the date of entry into force of this Notice must adapt their data centers and contracts for management, co-location, and cloud computing services.2. For the purposes of the preceding paragraph, a maximum period of 12 (twelve) months is granted for full compliance with this Notice, counted from its entry into force.3. Institutions must submit to the Bank of Mozambique, within 60 days after the publication of this Notice, a report containing:a) A survey of the information systems and data storage and processing infrastructures in use;b) The identification of data centers and their respective locations; andc) A list of current management, co-location, and cloud computing service contracts.Article 13Subsidiary regimeIn cases not covered by this Notice, the legislation pertaining to credit institutions and financial companies and the general regime regarding data centers and cloud computing services, under the Data Centers Regulation, approved by Decree no. 71/2025, of December 31, and the Cloud Computing Regulation, approved by Decree no. 72/2025, of December 31, shall apply subsidiarily.Article 14Sanctioning regimeNon-compliance with the provisions of this Notice constitutes an offense punishable under the Law on Credit Institutions and Financial Companies.Article 15RevocationNotice No. 4/GGBM/2003, of September 10, is hereby revoked.Article 16Clarification of doubtsDoubts arising from the interpretation and application of this Notice must be submitted to the Prudential Supervision Department of the Bank of Mozambique.Article 17Entry into forceThis Notice enters into force 60 days after the date of its publication.The Governor, Rogério Lucas Zandamela.AnnexGlossaryCData Center – physical installation composed of hardware, software, network systems, and auxiliary resources, designed for the storage, processing, and management of data, in digital format.Primary Data Center – main installation where systems, data, and all fundamental information for carrying out operations are hosted.Secondary Data Center (replica) – installation used to ensure service continuity and recovery in case of disaster, failure, or interruption of the primary data center.RPhysical risks – risks likely to cause economic costs and financial losses resulting from extreme weather events and gradual long-term climate changes.SCo-location services – services where the institution rents one or more spaces in the data center operator's facilities to place its own servers, with the data center operator responsible for ensuring the availability of space and the power and security conditions necessary for the installation and operation of the institution's servers.Management services – services where the institution contracts the data center operator to use its physical facilities and respective servers, with the operator responsible for ensuring their operation, maintenance, and management, as well as guaranteeing the availability of space, the power and security conditions necessary for the installation or use of the institution's systems, and ensuring the security, availability, integrity, and confidentiality of the data stored on the servers.Cloud computing services – provision, via the Internet and upon request by third parties, of scalable and centrally managed technological resources and infrastructures, including physical or virtual servers, data storage systems, networks, databases, computer applications, and computer programs.Information system – set of physical and logical resources used to process, store, and make available information necessary for the execution of the institution's activities.Peripheral system – refers to an information system that is not essential for the institution's main operations, being important for the business but not critical for its ability to function and provide customer service, allowing the performance of functions such as marketing and sales, human resources management, budgeting, collaboration, reconciliation, monitoring, security, and data analysis, among others.Main (core) system – information system essential for the institution's operations whose failure or interruption has a significant impact on the business. These are based on any technological components (software, hardware, database, processes, applications, among others) intended for the execution of functions such as financial operations management, bank card management, digital channels, and financial market transaction management.Systems provided in accordance with the policies of specific global providers – set of infrastructures and services intended to:(i) facilitate international transfers (e.g., SWIFT);(ii) provide information on global markets (e.g., Bloomberg, Reuters);(iii) manage payment networks and financial operations, namely global bank card management networks (e.g., Visa, Mastercard, American Express); and(iv) support clearing and settlement operations between clearing houses, central counterparties, and settlement institutions and their members.ProofPrice — 30.00MTNATIONAL PRESS OF MOZAMBIQUE, E.P.