Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 9.2 d) All computer accesses, including messages received and security violations (suspected or attempted) shall be reported to the Central Bank of Liberia and follow up action taken promptly. e) All e-payment service providers shall ensure that the information technology systems maintain a complete audit log of all users’ activities. Backup, recovery & business continuity: a) All e-payment service providers shall be required to ensure adequate back up of data for their operations. Licensed Institutions shall have, well documented and tested business continuity plans that address all aspects of the financial institution’s business. b) All e-payment service providers shall put systems in place to test the effectiveness of the backup infrastructure and business continuity plan at least on a semi-annual basis. 10.0 OPERATIONAL REQUIREMENTS 10.1 Minimum administrative procedures including the following shall be in place: a) b) c) d) e) f) Operational plans and policies approved by the Board Business operating manuals Accounting procedural manuals and the required IT systems Competent and well-trained staff Dispute resolution/Consumer protection systems Any other conditions specified by the Central Bank of Liberia 10.2 All e-payment service providers shall also ensure that: a. There are appropriate security measures in place, both physical and logical together with other requisite risk management controls and a strategy has been developed and documented. The strategy shall clearly outline the policies, practices and procedures that address and control all of the risks associated with electronic payment systems and that it shall be updated periodically to be in tandem with technological changes; b. All e-payment service providers should deploy a security appliance (i.e. firewall) and a solution to prevent a direct connection between the Licensed Institution back end system and the Internet; c. External devices such as Automated Teller Machines (ATMs), Personal Computers (PCs), installed at remote sites and/or branches, etc. that are permanently connected to the entity’s 11