The Central Bank of Uzbekistan has developed a draft of new regulations aimed at strengthening cybersecurity requirements and preventing fraud in the sphere of remote financial services. These proposals provide for additional guarantees for banking operations and expanded client control over their funds.
The proposed draft resolution includes a number of measures designed to enhance the security of digital banking operations and reduce the likelihood of financial fraud. One of the key proposals is to supplement existing SMS confirmation codes with biometric identification methods and transaction authentication linked to clients' devices.
According to these rules, clients will be able to independently freeze and unfreeze any portion of the funds held in their bank accounts, which will give them greater control over access to money. Furthermore, the Central Bank intends to implement a mechanism for temporarily suspending suspicious transactions to prevent potential cases of fraud.
Specific provisions concern risks associated with malicious software on clients' devices. In accordance with the draft regulatory acts, banks are obliged to notify clients within one hour of detecting malware on their gadgets. Additionally, certain important banking operations conducted through compromised devices will be restricted.
The proposal also includes alternative identity verification methods for individuals who cannot undergo biometric authentication. Banks will also be required to report cybersecurity incidents to the Central Bank within 24 hours. Additional requirements will regulate the security of information exchange between banks and their partners.
The draft regulatory acts have been posted on the public portal of Uzbekistan for consultation on regulatory legal acts, where individuals and legal entities can review the proposed changes and submit their comments and recommendations. The Central Bank also reminded citizens to adhere to basic financial security measures, including refraining from sharing SMS confirmation codes, bank card details, or passwords with third parties, emphasizing that bank employees do not request such confidential information over the phone.