BCFSA Considers Reporting Requirements For Technology And Cybersecurity Incidents

British Columbia Financial Services Authority (BCSFA) wants to impose mandatory reporting requirements on financial institutions that experience information security incidents, by establishing a new rule under the Financial Institutions Act.The proposed new rule would apply to all credit unions, insurance companies and trust companies authorized to do business in British Columbia, including extra-provincial companies with customers in British Columbia. Though the rule would not apply to pension plan administrators, they remain subject to existing incident reporting expectations as outlined in BCFSA's current Information Security Guideline.

According to a Discussion Paper issued by BCSFA on January 17, 2022, the proposed rule would require financial institutions to report material information security incidents to BCFSA in writing as soon as possible and no later than 24 hours after the incident is identified. The financial institution would also be required