Procedure for Supervision of the Payment System of the Republic of Tajikistan

1 Registered by the Ministry of Justice of the Republic of Tajikistan under No. 1089 dated July 29, 2021. Approved by the resolution of the Board of the National Bank of Tajikistan under No. 62 dated April 16, 2021. Procedure for Supervision of the Payment System of the Republic of Tajikistan

The Procedure for Supervision of the Payment System of the Republic of Tajikistan (hereinafter referred to as the "Procedure") is developed in accordance with Articles 5 and 6 of the Law of the Republic of Tajikistan "On the National Bank of Tajikistan" and Articles 20 and 28 of the Law of the Republic of Tajikistan "On Payment Services and the Payment System". Its purpose is to facilitate the effective and uninterrupted functioning of the payment system, to define the procedure for the National Bank of Tajikistan to supervise the payment system of the Republic of Tajikistan and its participants, to manage risks in significant payment systems, and to define the procedure for the National Bank of Tajikistan to verify the compliance of significant payment system rules with established requirements.

CHAPTER 1. GENERAL PROVISIONS

1. This Procedure includes the supervision of payment service providers, payment system operators (regardless of whether these operators are credit organizations or not), and payment infrastructure service operators, as well as payment system participants.

2. The following main definitions are used in this Procedure:

• Authentication - a procedure allowing a payment service provider or payment system operator to verify the identity of a payment service user or the validity of rights to use an electronic payment instrument, including the use of personalized user protection data;
• Outsourcing - an agreement of any form between a payment service provider or payment system operator and a third-party provider, under which such provider performs a process, provides a service, or carries out an activity that would otherwise be performed by the payment service provider or payment system operator itself;
• Netting (settlements) - a settlement procedure in which final settlements for money transfer orders occur on a net basis during one or more discrete, pre-specified time periods within a settlement day;
• Offset - the determination of net payment obligations or the determination of the net terminal value of settlement obligations between two or more participants within a payment system;
• Payment clearing - the process of transmitting, reconciling, and/or confirming payment orders for fund transfers or securities before settlement is carried out, and includes the offsetting of payment orders and the creation of final positions for settlement;
• Significant payment system - a systemically significant payment system and a socially significant payment system recognized by the National Bank of Tajikistan;
• Principles for Financial Market Infrastructures - principles jointly developed by the Bank for International Settlements and the International Organization of Securities Commissions. The main objective of the "Principles for Financial Market Infrastructures" is to establish effective internal procedures for assessing the maintenance of financial stability, uninterrupted functioning, and proper risk management of financial market infrastructure, which corresponds to the interests of owners, participants, clients, and employees of such financial market infrastructure.

CHAPTER 2. OBJECTIVES, TASKS, AND PRINCIPLES OF SUPERVISION OF THE PAYMENT SYSTEM

3. The main objectives of supervision of the payment system carried out by the National Bank of Tajikistan are to facilitate the effective and uninterrupted functioning of the payment system, as well as its further development by:

• defining the development policy of the payment system and related infrastructures;
• establishing minimum requirements for the reliability and security of the payment system;
• assessing the safety, stability, and efficiency with which payment systems perform their core functions and manage various risks associated with their activities.

4. The main task of supervision of the payment system of the Republic of Tajikistan is to ensure the stability, safety, and effectiveness of the payment system, stimulate transparency, ensure operational compatibility, increase accessibility, guarantee the protection of the rights of payment service consumers, maintain a competitive environment, and promote financial inclusion.

5. To effectively carry out supervision of the payment system, the National Bank of Tajikistan performs the following tasks:

• develops the regulatory legal framework for supervision of payment systems (establishing minimum requirements and standards);
• defines payment systems that are the object of supervision;
• checks and evaluates the organization and functioning of payment system operators and payment infrastructure service operators to ensure their compliance with the requirements of the regulatory legal acts of the National Bank of Tajikistan, as well as international standards;
• requires payment system operators to take necessary actions upon detection of non-compliance with the requirements of the regulatory legal acts of the National Bank of Tajikistan;
• collects information from payment system operators to analyze their work, and receives advance information about any proposed changes in the operation of the payment system;
• requests and receives information from payment system participants to conduct an analysis of compliance of their activities with the regulatory legal acts of the National Bank of Tajikistan;
• monitors the emergence of risks in the payment system from the moment of preparation of the payment order until its execution;
• conducts checks on information security, including telecommunications channels, evaluates the organization of information security and reliability, continuity of operations, and recovery of payment systems.

6. The National Bank of Tajikistan, as the supervisory authority for the payment system of the Republic of Tajikistan, and in order to implement a risk-based approach to supervision, carries out the following:

• collection, systematization, and analysis of information (including reporting data) concerning the activities of payment system operators and payment system participants, as well as the organization and functioning of payment systems;
• assessment of the activities of payment system operators and payment system participants;
• preparation of proposals for changing the activities of payment system operators and payment system participants based on the results of the said assessment;
• conducting on-site inspections of payment system operators;
• checking compliance by supervised organizations with the requirements of the Law of the Republic of Tajikistan "On Payment Services and the Payment System" and the regulatory legal acts of the National Bank of Tajikistan adopted in accordance therewith;
• checking the activity of a payment system operator for compliance with requirements for the procedure for ensuring uninterrupted functioning of the payment system and the risk management system in the payment system, established by the National Bank of Tajikistan;
• checking compliance with requirements for ensuring information protection in the payment system;
• identification of systemically significant and socially significant payment systems ensuring the functioning of significant payment systems;
• checking the compliance of documents and information submitted to the National Bank of Tajikistan (including reporting data) with the actual activity of the payment system;
• checking the implementation by the payment system operator of the procedure for controlling compliance with the rules of the payment system;
• adoption of the Principles for Financial Market Infrastructures of the Committee on Payments and Market Infrastructures of the Bank for International Settlements and the International Organization of Securities Commissions, their applicability, and ensuring the application of these principles to systemically significant and socially significant payment systems;
• application of urgent corrective measures and enforcement measures in case of violation by the payment system operator of the requirements of the legislation of the Republic of Tajikistan or the regulatory legal acts of the National Bank of Tajikistan;
• assessment of action plans of payment system operators aimed at eliminating identified violations, in cases where the development of such plans was recommended by the National Bank of Tajikistan.

7. The supervision of the payment system by the National Bank of Tajikistan is based on the following principles:

• Transparency - provides for disclosure to the general public of information about the objectives and tasks of supervision, and the objects of the payment system subject to supervision;
• International standards - implies the application of norms and requirements established at the international level, which, in turn, are based on best practices in the field of supervision of payment systems;
• Availability of powers and capabilities - for effective supervision of payment systems, continuous development of the organizational, technical, and personnel capabilities of the National Bank of Tajikistan is necessary;
• Consistency - requirements for payment systems must be applied to all payment systems, including those created and managed by the National Bank of Tajikistan;
• Cooperation with other bodies - to facilitate the effective and uninterrupted functioning of payment systems, the National Bank of Tajikistan cooperates with relevant official bodies and central (national) banks of other countries;
• Functionality - regardless of their legal or organizational form, payment system operators are subject to the same regulation, i.e., regulatory acts and normative requirements will be based on the function performed by payment system operators (i.e., providing payment services), and not on their legal or organizational form. This will create equal conditions for fair competition between various organizations offering the same services;
• Risk-based - supervision requirements will be guided by considerations regarding the safety and efficiency risks of the payment system, i.e., supervision requirements will be developed with the aim of reducing and controlling the risks faced by participants in working within the payment system and the risks they pose to the payment system by participating in it;
• Proportionality - the intensity of supervision, i.e., the level of efforts of the National Bank of Tajikistan to monitor, analyze, and assess the activities of payment system operators, and consequently the resources it allocates to this activity, as well as the strength, breadth, and depth of its supervision requirements - will reflect the risk profile of each subject of the payment system of the Republic of Tajikistan.

8. Documents and information obtained by the National Bank of Tajikistan from payment system operators and by payment system operators from the National Bank of Tajikistan within the framework of supervision are not subject to disclosure to third parties, except in cases established by the legislation of the Republic of Tajikistan.

CHAPTER 3. ASSESSMENT OF THE PAYMENT SYSTEM AND RECOGNITION OF THE SIGNIFICANCE OF THE PAYMENT SYSTEM

9. The National Bank of Tajikistan, in order to carry out supervision, establishes categories of significance of payment systems according to the criteria provided for in the Law "On Payment Services and the Payment System" and in this Procedure.

10. To identify the need to recognize the significance of a payment system, the National Bank of Tajikistan may require a payment system operator to provide additional information necessary to determine the significance of the payment system.

11. The National Bank of Tajikistan classifies a payment system as a significant payment system based on one of the following methods:

• upon issuance of a license for the activity of a payment system operator;
• independently based on the results of supervision of the activity of the payment system;
• based on a written application from the payment system operator with documents confirming that the payment system meets the established criteria for significance established by the National Bank of Tajikistan.

12. In the event of recognizing a payment system as a significant payment system or changing the category of its significance, the National Bank of Tajikistan within 5 (five) working days:

• enters information about the significance of the payment system into the Register of payment system operators;
• publishes this information on its official website on the Internet;
• notifies the payment system operator in writing, except for the National Bank of Tajikistan, about the classification of the payment system as a significant payment system.

13. A payment system is recognized as a significant payment system from the date of entry of information by the National Bank of Tajikistan into the Register of payment system operators.

14. The requirements of the National Bank of Tajikistan to a significant payment system apply after the expiration of 90 calendar days from the date the payment system operator receives notification from the National Bank of Tajikistan recognizing the payment system as significant.

15. In the event of a payment system losing its significance, the requirements for a significant payment system may not be complied with from the date the payment system operator receives notification from the National Bank of Tajikistan recognizing the payment system as having lost systemic or social significance.

CHAPTER 4. VERIFICATION OF COMPLIANCE OF THE RULES OF A SIGNIFICANT PAYMENT SYSTEM WITH ESTABLISHED REQUIREMENTS

16. The National Bank of Tajikistan verifies the compliance of the rules of the payment system with the requirements established by the Law of the Republic of Tajikistan "On Payment Services and the Payment System" and this Procedure when considering an application for a license for the activity of a payment system operator.

17. A payment system operator is not entitled to make changes and additions to the rules of the payment system adopted in accordance with paragraph 16 or to make any changes to the rules of the payment system without prior submission of these changes and additions for consideration by the National Bank of Tajikistan.

18. A payment system operator is obliged to submit changes to the rules of the payment system to the National Bank of Tajikistan no later than the deadline established by legislation for making such changes, for verification of compliance of the rules of the significant payment system.

19. The National Bank of Tajikistan verifies the compliance of the rules of a significant payment system within a period of no more than 90 (ninety) calendar days from the date of submission of the rules of the significant payment system for consideration.

20. The National Bank of Tajikistan has the right to protest any or all changes and additions to the rules of the payment system in cases where these changes and additions:

• do not correspond to public interests;
• are not in the interests of participants of the payment system;
• are not in the interests of persons who may wish to become participants of the payment system in the future;
• do not comply with the established requirements of the legislation of the Republic of Tajikistan and the regulatory legal acts of the National Bank of Tajikistan.

21. Upon expiration of the deadlines established in paragraph 19, and in the event that the National Bank of Tajikistan has not provided any objections, the payment system operator is obliged to notify participants of the payment system of the proposed changes and additions within a period of no less than 2 (two) months before the entry into force of such changes and additions.

22. If the rules of a significant payment system do not comply with the requirements of the Law of the Republic of Tajikistan "On Payment Services and the Payment System" and this Procedure, the National Bank of Tajikistan is obliged to notify the payment system operator of such non-compliance in writing. The notification must contain an indication of the requirements to which the rules of the significant payment system submitted to the National Bank of Tajikistan do not comply, and a deadline that cannot exceed ninety (90) days for their modification and addition and resubmission to the National Bank of Tajikistan for verification of compliance.

CHAPTER 5. RISK MANAGEMENT IN THE PAYMENT SYSTEM

§1. Principles of Risk Management of the Payment System

23. A payment system operator must have appropriate policy, procedure, and structure for comprehensive identification, measurement, monitoring, and management of risks in the payment system.

24. A payment system is obliged to comply with the following principles:

1. Governance: a payment system must implement clear and transparent governance principles, including defining clear and direct lines of responsibility and accountability;
2. Risk management: a payment system must have a robust and proper information technology platform for comprehensive risk management in the payment system, including legal, credit, liquidity, commercial, and operational risks;
3. Finality of settlements: the rules and procedures of a payment system must give participants a clear and definite understanding of the finality of settlements in the payment system;
4. Operational risk: a payment system must create a reliable information technology platform for managing operational risk, which includes systems, policies, procedures, and control mechanisms for monitoring and managing operational risks;
5. Access and participation criteria:

• a payment system is obliged to create equal conditions for access and participation in its payment system and services, based on risk-based participation criteria;
• participation criteria in a payment system must be justified in terms of the safety and efficiency of the payment system and published for free access;
• the rules of a payment system cannot restrict participants of the payment system from participating in other payment systems, discriminate regarding rights and obligations associated with participation in the payment system, or impose restrictions based on the type of participant;
• in the event that a payment system operator denies access to any person, it must indicate the reasons for this in writing based on a risk analysis;
• a payment system operator is obliged to monitor compliance by participants with access criteria to the system and participation in it on a continuous basis;
• a payment system operator is obliged to create and publish non-discriminatory procedures that facilitate the suspension and orderly termination of a participant's rights to participate, in cases where a participant cannot comply with access and participation criteria;

6. Efficiency and effectiveness:

• the structure of a payment system must meet the needs of its participants and the market in which it operates, in particular, regarding the choice of settlement organization and payment clearing; operational structure, clearing, settlement, application of technologies and procedures;
• a payment system must have clearly defined, measurable, and achievable goals and objectives, such as regarding minimum service levels, risk management expectations, and business priorities.

§2. Principles of Risk Management in a Systemically Significant Payment System

25. A systemically significant payment system is obliged to fully, and where applicable, comply with the Principles for Financial Market Infrastructures of the Committee on Payments and Market Infrastructures of the Bank for International Settlements and the International Organization of Securities Commissions, including:

1. Governance:

• a systemically significant payment system must have a governance structure that ensures clear lines of responsibility and accountability. All decisions and agreements on the governance of the payment system must be documented in writing and disclosed to the National Bank of Tajikistan, participants of the payment system, and the general public;
• roles and responsibilities of management must be clearly defined. The management of a systemically significant payment system must have appropriate work experience and a set of skills necessary for performing their duties regarding ensuring the operability of the payment system and managing risks in the payment system;
• the management of a systemically significant payment system is obliged to ensure the existence of a clear and documented risk management structure, which includes the system's policy on acceptable risk levels, defines responsibility and accountability within risk decisions. The management structure must ensure that risk management and internal control departments have sufficient authority, independence, resources, and access to the management of the payment system operator, and the ability to make appropriate decisions in crisis and emergency situations;

2. Comprehensive risk management system:

• a systemically significant payment system must have risk management policies and procedures that allow it to identify, measure, monitor, and manage risks arising or resulting from the operation of the payment system. Risk management structures are subject to review no less than once every 3 (three) years;
• a systemically significant payment system must conduct regular reviews of material risks to which it is exposed by other entities, or risks to which it exposes other entities (such as other systems), as a result of mutual integration, and develop appropriate risk management tools to eliminate such risks.
• a systemically significant payment system is obliged to define scenarios that would allow it to carry out critical operations and services and assess the effectiveness of the full spectrum of recovery or orderly wind-down options. A systemically significant payment system is obliged to prepare appropriate recovery or orderly wind-down plans based on the results of such assessment. Where possible, a systemically significant payment system is also obliged to provide relevant authorities with the information necessary for recovery planning;

3. Credit risk:

• a systemically significant payment system is obliged to create a reliable information technology platform for managing its credit risks towards participants and credit risks arising from its payment, clearing, and settlement processes. Credit obligations may arise from current obligations and possible future obligations;
• a systemically significant payment system is obliged to cover its current, and if any, possible future obligations to each participant in full and with a high level of reliability using collateral and other equivalent financial resources. In the case of deferred netting, a payment system that lacks settlement guarantee but in which participants are exposed to credit risks arising from their payment, clearing, and settlement processes, such a systemically significant payment system is obliged, at a minimum, to maintain sufficient resources to cover the obligations of two participants and their affiliates, which constitute the highest aggregate credit obligation in the system;
• a systemically significant payment system is obliged to create clear rules and procedures that fully cover any credit losses that may arise from any single or combined cases of insolvency among participants regarding any of their obligations in the system;

4. Liquidity risk:

• a systemically significant payment system must have a reliable platform for