Participants in financial 'sandbox' required to notify Central Bank of data leaks within 24 hours

In Uzbekistan, a new regulation for participants in the 'regulatory sandbox'—projects where financial services are tested under the supervision of the Central Bank—came into force on October 20. Cyber incidents and unauthorized disclosure of personal data must be reported to the regulator no later than 24 hours from the moment of detection.

The procedure and timeline for notification must be specified in the temporary rules of each project. If a serious incident leads to the disclosure or loss of client data or information constituting banking secrecy, the Central Bank must decide on the early termination of trials and revoke the company's participant status within five working days.

Companies are obligated to inform clients about the trial mode of the service and explain potential risks. Advertising must also indicate the experimental nature of the service. Additionally, participants must ensure the confidentiality of data and take measures to protect clients from cyber fraud and phishing.

Upon project termination, obligations under concluded contracts remain in effect, and the procedure for refunding funds and further client servicing must be determined in advance. After the special regime concludes, participants must delete collected personal data and banking secrecy information unless the law requires their retention. The new regulation replaced the procedure in effect since 2022 and established three testing directions: innovation, acceleration, and technological cooperation. The total duration of the special regime may not exceed three years.