Regulation on Ensuring Information Security in Payment Systems by Payment System Operators and Payment Service Providers

Resolution of the Board of the Central Bank of the Republic of Uzbekistan, registered on 30.06.2020, registration number 3268

Date of Entry into Force

30.06.2020

All

23.08.2024

28.07.2021

30.06.2020

View

Russian Uzbek O’zb Uzb|Russian

Document lost its force 23.08.2024

[ OKOB: 1. 03.00.00.00 Civil Legislation / 03.11.00.00 Specific Types of Obligations / 03.11.17.00 Calculations (also see 07.21.03.00) / 03.11.17.01 General Rules. Receivable and Payable Debts; 2. 12.00.00.00 Information and Information Provision / 12.08.00.00 Information Security, Protection of Rights of Subjects in the Field of Information Security, Information and Information Provision Processes (also see 16.04.03.00))] [ TSZ: 1. Economy / Information and Information Provision. Electronic Commerce (Document Circulation); 2. Finance / Monetary System. Calculations]

Resolution of the Board of the Central Bank of the Republic of Uzbekistan

On Approval of the Regulation "On Ensuring Information Security in Payment Systems by Payment System Operators and Payment Service Providers"

[Registered by the Ministry of Justice of the Republic of Uzbekistan on June 30, 2020, registration number 3268]

This resolution loses its force on August 23, 2024, based on the Resolution of the Board of the Central Bank of the Republic of Uzbekistan No. 13/1 dated April 24, 2024 "On Approval of the Regulation "On Ensuring Information Security and Cybersecurity in Payment Systems by Payment System Operators and Payment Service Providers and Taking Measures to Prevent Law Violations Committed Using Digital Technologies" (registration number 3513, dated 21.05.2024).

In accordance with the Laws of the Republic of Uzbekistan "On the Central Bank of the Republic of Uzbekistan" and "On Payments and Payment Systems", the Board of the Central Bank of the Republic of Uzbekistan resolves:

1. Approve the Regulation "On Ensuring Information Security in Payment Systems by Payment System Operators and Payment Service Providers" attached hereto.

2. This resolution enters into force from the date of its official publication.

Chairman of the Central Bank M. NURMURATOV

Tashkent city,

June 11, 2020,

No. 13/10

ATTACHMENT

to the Resolution of the Board of the Central Bank of the Republic of Uzbekistan No. 13/10 dated June 11, 2020

REGULATION

On Ensuring Information Security in Payment Systems by Payment System Operators and Payment Service Providers

This Regulation establishes requirements for ensuring information security in payment systems by payment system operators and payment service providers in accordance with the Laws of the Republic of Uzbekistan "On the Central Bank of the Republic of Uzbekistan", "On Payments and Payment Systems", "On Archival Affairs", and "On Personal Data".

Chapter 1. General Provisions

1. The following basic concepts are used in this Regulation:

authorization — granting a specific person or group of persons the right to perform certain actions;

authentication — the procedure for confirming the authenticity of a user, program, device, or data;

identification — assigning identifiers to subjects of payment systems and/or comparing identifiers with a specified list of identifiers;

cryptographic key — a sequence of secret symbols used for encryption, decryption, and verification of electronic signatures through cryptographic algorithms;

remote service system — a set of telecommunications tools, digital and information technologies, software, and equipment that ensures communication between a user of payment services and the provider of these services for using electronic services;

important payment system operators — a legal entity that is an operator of a payment system included in the list of important payment systems by the Central Bank of the Republic of Uzbekistan (hereinafter referred to as the Central Bank in the text), where interruptions (outages) in the operation of the payment system may lead to the emergence of risks in the payment services market of the Republic of Uzbekistan;

payment — fulfillment of a monetary obligation with cash funds or transfer of monetary funds using payment instruments;

payment agent — a legal entity that is not a bank and has concluded an agency contract with a bank or payment institution to provide payment services;

payment sub-agent — a legal entity or individual entrepreneur that is not a bank and has concluded a sub-agency contract with a payment agent to provide payment services;

payment institution — a legal entity that is not a bank and is authorized to carry out activities related to the provision of payment services;

payment system operators — legal entities carrying out activities related to ensuring the operation of a payment system within the territory of the Republic of Uzbekistan;

payment service providers — the Central Bank of the Republic of Uzbekistan, banks, payment institutions, payment agents, payment sub-agents;

security regime — a procedure including measures established by normative legal documents, administrative-legal, organizational, engineering-technical, and others, ensuring the prevention of unauthorized use of the organization's confidential information.

Chapter 2. Protection of Information on Payments

2. Payment system operators and payment service providers develop an information security policy based on the features of their information systems.

3. Payment system operators and payment service providers must take the following measures to ensure continuous protection of information on payments at all stages of its formation, transmission, storage, and processing:

implementing a system of identification, authentication, and authorization;

using methods to prevent unauthorized access to the system (login, password, and others);

protecting payment documents and identification data from forgery, unauthorized modification, and disclosure to third parties;

ensuring and controlling the formation of payment information, verification of the authenticity of payment documents, their processing, and the introduction of justified changes;

ensuring the delivery of payment documents to the original owner during transmission and preventing their dispatch to other persons;

taking measures to prevent unauthorized copying, modification, deletion, and dispatch of information related to executed payments during storage;

ensuring the storage of payment-related information transferred to external storage in a safe (iron cabinet) and appointing responsible employee(s) for data storage;

maintaining control and accounting of software in information systems and ensuring the continuous operation of interpretations of software in information systems, hardware-software devices, and software tools;

ensuring that information systems are in an actual state (latest version), introducing new interpretations of software into the information system after testing;

automatically forming electronic records of processes for processing, transmitting, and storing payment information and ensuring their storage;

organizing an information security service (appointing an employee responsible for information security) and controlling work performed on information security;

ensuring network protection and cryptographic protection, protection against computer viruses, control of access to information systems, configuration of technical tools, and other measures;

providing protection equipment and devices for information protection, establishing procedures for their use, and performing technical maintenance, repair, and other situations to prevent unauthorized use of technical devices;

protecting applied technical tools from unauthorized access from all telecommunications networks, and from modification, deletion, and copying of data therein;

preventing unauthorized outflow of data.

4. Payment system operators and payment service providers must take the following measures to prevent damage from malicious code (computer viruses) and their negative impact on programs and operating systems:

taking measures to detect and prevent the negative impact of codes (computer viruses) damaging the operation of computing equipment (servers, computers, etc.), ATMs, embossers, and payment terminals (depending on technical capabilities);

using only licensed antivirus software in information systems, ensuring the currency of their versions and daily updates of their databases;

ensuring the automatic operation of antivirus software;

checking all electronic data received via the Internet network and email through antivirus software.

5. The application of cryptographic methods for information protection in payment systems and the rules of the payment system must establish:

the procedure for connecting, launching, using, and decommissioning cryptographic protection tools in automated systems;

the procedure for restoring cryptographic protection tools in case of stoppage, failure, and other emergency situations;

the procedure for making changes to cryptographic protection programs and technical documentation;

the procedure for managing cryptographic keys;

the procedure for applying organizational and technical methods for using, storing, modifying, and other actions involving devices carrying cryptographic keys.

Information exchange between payment system operators and payment service providers and the Central Bank of the Republic of Uzbekistan regarding information protection is carried out on the basis of a bilateral agreement.

6. The following measures must be taken to limit unauthorized access and use of information objects by payment system operators and payment service providers:

controlling physical impact on information objects, including ATMs, payment terminals, and electronic devices for payment transfer, as well as access to buildings and rooms equipped with technical equipment;

ensuring physical protection (security regime) of technical tools containing parameters and structures of automated systems, programs, computing equipment, telecommunications devices used for making payments, and data granting the right to work in the payment system (passwords, biometric, and other data), and preventing unauthorized impact;

controlling the access of employees of payment system operators and payment service providers to information objects and implementing systems to protect against unauthorized dissemination of data;

monitoring work processes in rooms where servers and telecommunications equipment are located using video surveillance systems.

7. Payment system operators and payment service providers must ensure the information protection of information systems containing the following data:

information about balances of monetary funds in bank (card) accounts;

information about electronic money balances;

information about executed payments;

information including non-cash settlements;

payment data of interbank payment and clearing systems;

cryptographic keys used to ensure cryptographic protection;

bank secrets, personal data, and other data protected by law processed when making payments.

8. Payment system operators or payment service providers must ensure the following when providing and making changes to programs used by customers to make payments:

developing and providing instructions for using programs to customers while ensuring their currency;

ensuring that changes are made to eliminate identified vulnerabilities;

monitoring the currency of programs used by customers.

9. Payment system operators and payment service providers must develop information security rules including the responsibilities and liabilities of the parties and the requirements of this Regulation, based on the features of the information objects of the parties and their tasks, for the exchange of payment information and data related to payment information via telecommunications networks.

10. The agency contract concluded between a payment agent and a bank or payment institution for the provision of payment services must specify the liabilities of the parties regarding information security.

11. The sub-agency contract concluded between a payment sub-agent and a payment agent for the provision of payment services must specify the liabilities of the parties regarding information security.

12. Payment service providers must maintain a list of suspicious (fraud) operations related to the transfer of monetary funds.

13. When transferring monetary funds of a payment service user, if such payment is in the list of suspicious (fraud) operations, payment service providers must notify the user (via SMS, messenger, or other information systems), obtain repeated confirmation (PIN code or other means of information), and if such confirmation is not received within a specified time interval, the payment operation must be canceled.

14. Payment system operators and payment service providers must create the opportunity for users to stop (block) payment operations related to their accounts.

Chapter 3. Confidentiality of Payment Information and Protection of Personal Data Therein

15. Payment system operators and payment service providers must take the following measures to ensure the confidentiality and integrity of information, including the protection of personal data of users of payment services, and to ensure adequate security:

developing procedures for protecting the integrity and inviolability of confidential and personal data processed in the payment system and for using them;

developing rules and requirements for ensuring security and confidentiality when working with protected data regulated by internal documents;

minimizing the number of employees working with confidential and personal data, concluding obligation agreements (contracts) with employees to prevent disclosure of confidential and personal data, and defining the rights to use such data based on employees' job responsibilities;

using electronic digital signature keys and establishing procedures for storing encrypted data to ensure data integrity and security;

ensuring identification, authentication, and authorization when accessing resources containing confidential and personal data;

preventing unauthorized granting of rights to work with confidential and personal data;

recording actions performed during access, processing, storage, and presentation of protected data by information system users in electronic records;

preventing the removal of external storage devices and technical tools from the building and their theft;

monitoring measures to prevent unauthorized transmission, storage, deletion, processing, and outflow of data.

Chapter 4. Information Security Service

16. Payment system operators and payment service providers must include the following in the duties of the information security service (employee responsible for information security) to ensure information protection in information systems:

checking the compliance of information security of information systems with the requirements of this Regulation;

evaluating whether measures for information security are provided, increasing the level of information security, as well as reducing losses resulting from accidents and employee errors and preventing their occurrence;

monitoring the integrity and security of information infrastructure;

protecting software on servers;

maintaining a list of electronic records of employee actions in all technological processes, as well as actions of users of payment services performed in information systems;

taking measures to ensure cybersecurity in automated systems and prevent unauthorized appropriation of funds;

taking measures to prevent the disclosure of data to third parties;

studying compliance with this Regulation, as well as information protection requirements and internal rules and procedures for information security of the payment system every quarter and formalizing the results of the study with a protocol.

Chapter 5. Restriction of Employee Powers in Information Systems

17. Payment system operators and payment service providers must take the following measures to restrict employee powers during the process of working in information systems, including during development and testing:

developing procedures and rules defining the right to work in information systems, reflecting them in job instructions, and ensuring the procedure for using the system based on relevant documents (application, request, or other form);

forming a list of responsible employees granted the right to work in information systems;

registering actions related to defining and distributing rights to work in information systems;

periodically (at least twice a year) checking that rights to work in information systems are correctly defined logically and based on job responsibilities;

ensuring information security during the operation and testing of information systems and controlling the correctness of granted rights to work in information systems;

preventing the possibility of information system users changing the rights granted to them by the information system and preventing the granting of rights to work to foreign persons.

18. Payment system operators and payment service providers must carry out the following when involving other organizations to make changes to their information systems:

concluding a contract on non-disclosure of confidential and personal data;

carrying out work with payment-related and other protected data in information systems on the basis of permission granted in the prescribed manner;

involving organizations that have the relevant license and (or) other permit (if this activity is carried out on the basis of a license or relevant permit);

developing measures to ensure data confidentiality at the design stage of information systems;

formalizing measures for information protection (work performed, installed programs, devices, etc.), a specific technical assignment, acceptance (plan for conducting test trials), and other relevant documents;

compiling a list of software and organizations that developed and made changes to it (or will make changes);

setting approximate deadlines and conditions for the development and implementation of information systems;

monitoring the justification of changes made to information systems by involved organization employees, their compliance with existing technical assignments, the absence of forgotten programs (system functions) in the information system, and the positivity of test trial results by the information security service (employee responsible for information security) and the employee responsible for informatization.

After the organization that made changes to the automated systems has performed its duties, all confidential information (identifiers, passwords, etc.) known to it must be changed by the information security service (employee responsible for information security).

Chapter 6. Protection of Information Networks from Attacks

19. Payment system operators and payment service providers must take sufficient measures to protect information and the Internet global information network, as well as servers and communication channels, from possible existing attacks. These measures must include:

segmentation of computer networks and use of firewalls;

taking technical (cryptographic and other) and/or organizational measures to prevent unauthorized access to data received and transmitted through information networks, including the Internet global information network, and ensuring filtering of network data (use of firewalls);

identification, multi-factor authentication, and authorization when making payments through information networks and websites (multi-factor authentication is not applied when making mobile and contactless payments);

identifying users using information networks and the Internet global information network, as well as servers and communication channels;

carrying out employees' use of Internet global information network resources through a proxy server, limiting access to websites not necessary for work activity, and recording accessed websites;

ensuring information systems with main and reserve communication channels;

protecting the server network (organizing demilitarized zones (DMZ));

closing ports and stopping services not necessary for work activity on servers;

accounting of objects and resources for accessing the information system;

multi-factor authentication of users when making mobile payments (SMS, QR-code, NFC, fingerprint, iris color recognition, or other verification methods may be used);

ensuring information security of payment information and information systems (databases) when accessing remotely using mobile devices;

establishing the procedure for using (single or multiple) passwords applied for customer authentication in remote service and other information systems, applying verification codes, and specifying the code's active time and others;

preventing fraudulent actions;

recording identification information (IP address, MAC address, and other identifiers) about the device used when accessing automated systems;

using intrusion detection and prevention systems.

20. Payment system operators and payment service providers may use information protection equipment of foreign organizations.

21. Payment system operators must establish technical and organizational measures and work procedures used for information exchange related to payments, and the execution of these procedures must be ensured by payment service providers.

22. To strengthen information protection, the Network Address Translation Protocol (NAT), which allows changing IP addresses of network transit packets in the network protocol (TCP/IP), may be used. In this case, electronic journals of all connections through the network must be maintained indicating the original IP addresses and archived electronically in the prescribed manner.

23. Payment system operators and payment service providers must specify the following in their internal documents:

• procedures for ensuring information networks with secure and reliable communication channels;
• procedures for entering and exiting the payment system;
• procedures for ensuring information security when connecting users to the payment system;
• information security procedures and requirements in processing and clearing processes (if these services are performed);
• risk management measures and methods;
• procedures for creating a single user identifier in automated systems and information programs;
• a list of recorded actions;
• procedures for registering and storing data.

Chapter 7. Monitoring of Information Resources

24. Payment system operators and payment service providers monitor the use of confidential information and highly important logical and physical resources (information networks, information systems, databases, information protection modules). In monitoring, the following are specified:

• accounting of programs and devices used for processing, storing, and transmitting information in the information infrastructure;
• implementation of systems (such as Security Information and Event Management (SIEM) or others) that allow for the analysis of information security adverse events, monitoring of the information security status, and alerting;
• continuous analysis of data from systems performing information security status monitoring and taking measures to eliminate and/or prevent identified situations (unauthorized access to the information network and attempts to access, system failures, lack of information resources, network outages, limitations in ensuring information security, and other adverse events);
• taking measures to prevent unauthorized use of confidential information and highly important logical and physical resources (information networks, information systems, databases, information protection modules);
• recording the date (day, month, year) and time (hour, minute, second) of the user's operation, the identification number assigned to the user in automated systems and information programs, and identification data available for system access (depending on technical capabilities, IP address, MAC address, SIM card number, IMEI code, phone number, and/or other device identifiers), as well as actions related to granting rights to the user by automated systems;
• it is necessary to record user actions (operations) related to the use of information programs and automated systems.

Chapter 8. Detection of Adverse Events Related to Violations of Information Security Requirements

25. To detect adverse events related to violations of requirements for ensuring information protection during the execution of payments and money transfers, payment system operators and payment service providers must organize the following activities in taking organizational measures and using technical means for information protection:

• identifying necessary organizational measures for information protection;
• appointing responsible employees for the use, configuration, and recording of data in existing technical devices;
• taking measures to detect adverse events related to violations of information security requirements and notifying the information security service (employee responsible for information security) when such situations are identified by employees;
• eliminating adverse events arising from violations of information security requirements, identifying causes, analyzing them, and taking relevant measures to prevent the recurrence of identified adverse events;
• registering identified adverse events (maintaining a registry) and alerting customers by posting information about these situations on the official website (or by other means);
• establishing procedures for storing information about identified adverse events;
• taking other measures to ensure information protection.

Payment system operators and payment service providers must promptly notify the Central Bank in writing or electronic form about adverse events related to violations of information security requirements.

26. Payment system operators must establish the following requirements to prevent adverse events related to violations of information security requirements:

• requirements for information security regarding technical and software tools necessary for making payments to other participants of the payment system;
• requirements for the form and procedure for reporting information about adverse events related to the payment system and payments;
• procedures for managing information security risks in the payment system and criteria for their assessment;
• procedures for ensuring the safe operation of payment information processing tools;
• procedures for interaction in the event of adverse events in the payment system.

27. Payment service providers must establish the following requirements to prevent adverse events related to violations of information security requirements:

• taking measures to prevent risks associated with the delivery of payment execution devices to customers;
• notifying payment system operators if situations such as loss, theft, or possession by third parties of payment equipment are identified.

28. Payment system operators must provide information to payment service providers about identified adverse events related to violations of information security requirements in the payment system and submit methodological guidelines for analyzing and eliminating these situations.

Chapter 9. Response Measures to Adverse Events Related to Violations of Information Security Requirements

29. Payment system operators and payment service providers must take the following response measures to identified adverse events related to violations of information protection requirements:

• anticipate and take necessary actions to respond to potential adverse events and define a list of actions to be performed;
• take response measures in a short period for adverse events that have occurred;
• ensure continuity of operations in the event of adverse events, as well as prevent illegal payments and unauthorized changes to balances in accounts, restore information, and eliminate other negative situations;
• ensure compliance with established information security requirements by employees when working with existing information systems;
• formalize, collect, and analyze electronic records of network devices and information systems to identify the causes of adverse events and develop relevant instructions based on them.

Chapter 10. Analysis of Causes of Adverse Events Related to Violations of Information Security Requirements

30. Payment system operators and payment service providers must analyze the causes of identified adverse events related to violations of requirements for ensuring information protection and evaluate the results of their response. In this regard, the system for analyzing the causes of identified adverse events and evaluating the results of their response must include:

• procedures for the information security service (employee responsible for information security) to analyze the causes of adverse events together with relevant departments after response measures have been taken;
• study of relevant electronic records of information systems and obtaining explanations from employees who caused the identified adverse event;
• developing measures to clarify the causes of adverse events and reduce the possibility of harm in such situations (including involving relevant specialists);
• classification and assessment of adverse events based on the degree of their negative impact and assessment criteria.

Information about identified adverse events related to violations of information security requirements, response measures taken, assessment results, and other additional information must be printed and stored in a separate binder.

Chapter 11. Ensuring Information Protection in the Use of ATMs, Info-Kiosks, and Payment Terminals

31. Payment system operators and payment service providers must ensure the information protection of ATMs, info-kiosks, and payment terminals. In this regard, the following measures are applied in ensuring information protection:

• accounting for ATMs, info-kiosks, and payment terminals and preventing unauthorized access to their information programs;
• monitoring the activities of persons providing technical maintenance to ATMs, info-kiosks, and payment terminals and maintaining electronic records of changes made by them;
• controlling the process of working with ATMs through video surveillance systems (ensuring that PIN codes of payment cards inserted into ATMs cannot be recorded through video surveillance systems);
• ensuring that video surveillance data of ATMs located outside the main bank and its infrastructure (branches, mini-banks, etc.) and other guarded objects are recorded directly (online) to technical devices at the main bank or its branch;
• protecting ATM network cables;
• replacing locks on ATMs with those different from other ATMs;
• protecting ATMs from possible attacks (including skimming) via communication channels or physical connection;
• establishing authentication procedures;
• accounting for devices executing payments;
• ensuring physical protection of cash funds in ATMs;
• organizing information protection in information exchange via networks;
• implementing information protection tools and systems in information systems working with international payment systems in accordance with international standards (PCI DSS, PTS, PA DSS).

32. Payment system operators ensure information security in ATMs and info-kiosks in their systems together with banks and control their continuous and correct operation. If responsibility for a specific (or all) information security matters is assigned to a payment service provider, this situation must be recorded in relevant contracts, and necessary conditions (rights to work in the ATM information system) must be created for the organization bearing responsibility.

Chapter 12. Information Security Requirements for Critical Payment System Operators

33. In addition to the security measures specified in this Regulation, critical payment system operators must ensure the following information security measures:

• ensuring the reliability of the continuous operation of the payment system;
• organizing the information security service and defining its obligations;
• ensuring that the readiness and security level of the data center telecommunications infrastructure does not fall below the third degree according to the Oʻz DSt 2875:2014 "Requirements for Data Centers. Infrastructure and Ensuring Information Security" standard;
• aligning with the PCI DSS security standard and the Payment Services Directive (PSD2) payment services directive requirements when using international bank cards;
• ensuring the audit of ICT infrastructure (information security status) by involving reputable international audit organizations regarding the correct organization of information systems;
• fulfilling requirements established for critical payment system operators in the Law of the Republic of Uzbekistan "On Payments and Payment Systems" and other legislative acts. (Paragraph 7 of item 33 was edited by Order No. 16-mh dated July 28, 2021 of the Minister of Justice of the Republic of Uzbekistan (registry number 3313, 28.07.2021) — , 28.07.2021, 10/21/3313/0724)

34. Critical payment system operators must organize main information processing systems and organize reserve information systems at a distance of no less than 50 kilometers from the location of the main systems. In this regard, main and reserve information systems must be organized within the territory of the Republic of Uzbekistan.

Data in the information systems of critical payment system operators (electronic records and other payment-related information) must be stored in electronic archives in at least two copies (specifically, one copy can be stored in each of the main and reserve information systems).

Chapter 13. Establishing Continuous Operation of the Payment System and Maintaining Electronic Archives

35. To ensure the continuous operation and stability of payment systems, the following measures must be taken:

• restoring network and other devices related to the payment system to working condition and ensuring continuous operation in case of failure;
• backing up operating systems, software, information system programs, and data (databases, settings, electronic records), developing procedures (mechanisms) for storing them in electronic archives and restoring them, and maintaining accounting and control over them;
• having reserve technical devices and equipment;
• developing a plan for restoring backed-up (backup) data in case of technical failures and emergencies, and conducting periodic (once a year) information system restoration checks;
• testing changes to programs on servers intended for testing;
• monitoring the operation of devices and equipment in the system;
• preventing situations that may negatively affect the continuity of the payment system and ensuring information protection;
• using diesel power stations and/or other means to ensure continuous power supply (UPS, etc.);
• ensuring the storage of processed data and their maintenance in electronic archives;
• ensuring that customer-related data is stored for at least five years;
• having reserve information transmission networks.

36. Payment system operators who are not critical payment system operators and payment service providers must organize main information processing systems and organize reserve information systems at a distance of no less than 5 kilometers from the location of the main systems. In this regard, main and reserve information systems must be organized within the territory of the Republic of Uzbekistan.

Data in information systems (electronic records and other payment-related information) must be stored in electronic archives in at least two copies (specifically, one copy can be stored in each of the main and reserve information systems).

37. Upon termination of activities, the information resources of the existing electronic archive of payment system operators and payment service providers are handed over to state archives.

When the activities of payment system operators and payment service providers are terminated and merged with another organization, the electronic archive data are handed over to the electronic archive of the merging organization.

Chapter 14. Security Regime

38. Payment system operators and payment service providers must be equipped with rooms for storing and processing payment-related information. These rooms must meet the following requirements:

• be protected against unauthorized physical entry;
• if the room is located on the first floor, its windows must be equipped with iron grilles;
• be equipped with two protection barriers (guarding and fire alarm) with signal stations;
• be equipped with guarding and alerting devices at night;
• be under video surveillance control.

Payment system operators and payment service providers may take other security measures for rooms storing and processing payment-related information in addition to the requirements specified in this paragraph.

39. The storage period for all video surveillance data specified in this Regulation must not be less than one month.

40. Buildings of payment system operators and payment service providers must be equipped with necessary equipment, organizational-technical means, and use relevant software in their protection.

Chapter 15. Control of the Payment Execution Process

41. Payment system operators must conduct control and monitoring activities when taking information security measures in their payment systems.

42. Payment system operators and payment service providers must analyze automated systems, applications, and information infrastructure objects for information security vulnerabilities, conduct unauthorized access checks at least once a year, and control the absence of undocumented capabilities.

43. Payment system operators and payment service providers must submit a report to the Central Bank by no later than April 1 of the following year regarding the state of security assurance.

Chapter 16. Final Provisions

44. Persons guilty of violating the requirements of this Regulation are liable in the manner established by legislative acts. (Item 44 was edited by Order No. 16-mh dated July 28, 2021 of the Minister of Justice of the Republic of Uzbekistan (registry number 3313, 28.07.2021) — , 28.07.2021, 10/21/3313/0724) (National database of legislative acts information, 30.06.2020, 10/20/3268/1112; , 28.07.2021, 10/21/3313/0724)