MORNBFI Vol. 1 - Planters Development Bank

§§ 4701Q.2 - 4701Q.509.12.31assessment system (RAS) based on the latestregular examination.(4) There are no uncorrected majorfindings/exceptions noted in the latest BSPexamination.(Circular No. 649 dated 09 March 2009)§ 4701Q.3 Approval in principlea. Based on the recommendation ofthe Technical Working Group onElectronic Banking, the Deputy Governor,SES, shall approve in principle theapplication so that QBs may immediatelylaunch and/or enhance their existingelectronic services.b. QBs shall be informed of theconditional approval of the DG, SES andthey shall in turn notify the BSP on the actualdate of its launching/enhancement.(Circular No. 649 dated 09 March 2009)§ 4701Q.4 Documentary requirementsa. Within thirty (30) calendar daysfrom such launching/enhancement, QBsshall submit to the BSP thru the SDC forevaluation, the following documentaryrequirements:(1) A discussion on the services to beoffered/enhanced, the business objectivesfor such services and the correspondingprocedures, both automated and manual,offered through the electronic serviceschannels;(2) A description or diagram of theconfiguration of the QB’s electronic servicessystem and its capabilities showing:(i) how the electronic services systemis linked to other host systems or the networkinfrastructure in the QB;(ii) how transaction and data flowthrough the network;(iii) what types of telecommunicationschannels and remote access capabilities(e.g., direct modem dial-in, internet access,or both) exist; and(iv) what security controls/measures areinstalled;(3) A list of software and hardwarecomponents indicating the purpose of thesoftware and hardware in the electronicservices infrastructure;(4) A description of the security policiesand procedures manual containing:(i) description of the QB’s securityorganization;(ii) definition of responsibilities fordesigning, implementing, and monitoringinformation security measures; and(iii) established procedures forevaluating policy compliance, enforcingdisciplinary measures and reporting securityviolations;(5) A brief description of thecontingency and disaster recovery plans forelectronic facilities and event scenario/problem management plan/program toresolve or address problems, such ascomplaints errors and intrusions and theavailability of back-up facilities;(6) Copy of contract with thecommunications carrier, arrangements forany liability arising from breaches in thesecurity of the system or from unauthorized/fraudulent transactions;(7) Copy of the maintenanceagreements with the software/hardwareprovider/s; and(8) Latest report on the periodic reviewof the system, if applicable.b. If after the evaluation of the submitteddocuments, the Working Group has still someunresolved issues and gray areas, the QBmay be required to make a presentation ofits electronic transactions to BSP.(Circular No. 649 dated 09 March 2009)§ 4701Q.5 Conditions for MonetaryBoard approval. Upon completion ofevaluation, the appropriate recommendationshall be made to the Monetary Board. Thefollowing shall be the standard conditions forapproval:a. Existence at all times of appropriatetop-level risk management oversight;Q RegulationsPart VII - Page 2Manual of Regulations for Non-Bank Financial Institutions