Palestine Monetary Authority

PALESTINE MONETARY AUTHORITY

Instructions No. (1) of 2021

Regarding Outsourcing

Pursuant to the provisions of Decision-Law No. (17) of 2012 concerning the National Payments Settlement Law, particularly Article (9) thereof, and after reviewing Instructions No. (1) of 2018 concerning the licensing of payment service companies, and based on what was approved by the Board of Directors of the Palestine Monetary Authority in its meeting No. (230) dated 07/02/2021, and in accordance with the powers delegated to us, and in pursuit of the public interest, we have issued the following Instructions:

---

(1) Article

Definitions

The words and phrases contained in these Instructions shall have the meanings assigned to them below, unless the context indicates otherwise:

Company: A payment service company licensed to operate in Palestine.

Outsourcing: The Company's engagement or assignment of a third party to perform a portion of its operational and technical activities, which are typically performed by the Company's internal departments and divisions.

Third Party: A natural or legal person, resident inside or outside Palestine, qualified and specialized to perform the operational and technical activities assigned to it by the Company, including the parent company, subsidiaries, and sister companies.

---

(2) Article

Objective and Scope of Application

1. These Instructions aim to regulate the procurement of outsourcing services by payment service companies.
2. The provisions of these Instructions shall apply to all payment service companies licensed to operate in Palestine.

---

(3) Article

Activities and Tasks Prohibited from Outsourcing to a Third Party

The Company is prohibited from outsourcing any of the following activities and tasks related to the Company's core management duties and responsibilities to a third party, including decision-making functions, database management, management of core payment service systems, network and security device management, and customer service operations whose access would compromise the confidentiality of customer data and documents.

---

(4) Article

Request for Approval of Outsourcing

1. The Company must, prior to contracting with a third party to obtain outsourcing services, request prior written approval from the Palestine Monetary Authority, accompanied by the following:

   a. A resolution of the Company's Board of Directors approving the contracting to obtain outsourcing services.

   b. A copy of the draft outsourcing agreement to be concluded.

   c. A feasibility study of the outsourcing process demonstrating the expected benefits and objectives, such as achieving cost savings, enhancing competitiveness, accessing specialized expertise not available internally, or achieving strategic objectives for the Company or other considerations that may affect this decision.

   d. A technical and financial feasibility study of the third party, ensuring the necessary expertise and competence to execute the agreed-upon activities throughout the contract period.

   e. Identification and analysis of all risks associated with the outsourcing process, such as operational risks, compliance risks, reputational risks, information security risks, any strategic risks that could affect the integrity of the Company's operations or result in losses upon occurrence, and risks related to external transactions such as the political, economic, and legal environment and regulatory barriers if the outsourced party is outside Palestine.

   f. The Company's policy on outsourcing, which includes managing all risks referred to in paragraph (e) of this Article, approved by the Board of Directors.

   g. A comprehensive plan to ensure business continuity and crisis management, including ensuring the immediate availability of alternatives in the event the third party ceases to perform its duties at any time and for any reason.

2. The Company must obtain prior approval from the Palestine Monetary Authority for any amendments to outsourcing agreements for which approval from the Palestine Monetary Authority has already been obtained.

---

(5) Article

Contractual Terms

1. The engagement with the third party must be formalized by signing a contract compliant with the laws and instructions in force in Palestine.

2. The contract must include, at a minimum, the following:

   a. Quality requirements related to the service outsourced to the third party.

   b. The third party's commitment to maintain the confidentiality of the Company's information, customers' personal and financial data, and any data or information obtained as a result of performing outsourcing operations on behalf of the Company.

   c. The third party's commitment to directly notify the Company of any circumstances or events that may affect its ability to comply with the execution of assigned activities.

   d. The risk management framework adopted by the third party, along with business continuity and crisis management plans.

   e. The Company's right to terminate the contract in the event the third party fails to comply with contractual terms, exposes the Company to risks, or if the Palestine Monetary Authority requests such termination based on corresponding powers granted by law.

   f. The Palestine Monetary Authority's or its delegate's authority to inspect the third party's operations to ensure compliance with regulatory requirements.

   g. The primacy of the Palestine Monetary Authority regarding the services outsourced by the payment service company.

   h. The third party's commitment to comply with providing the Palestine Monetary Authority, upon request and without delay, with any data or information pertaining to operations executed on behalf of the Company.

---

(6) Article

Contracting with a Third Party Outside Palestine

In the event of contracting with a third party outside Palestine, the third party must provide a written commitment to comply with the provisions of Article (5), paragraph (f/2) and paragraph (g/2) of these Instructions.

---

(7) Article

General Provisions

1. The Company, represented by its Board of Directors and executive management, shall remain responsible for managing the Company's operations and any consequences resulting from outsourcing activities.

2. The Company must ensure that outsourcing any operations or activities related to information technology does not in any way hinder the Company's ability to comply with the instructions governing the operations of payment service companies.

3. The Company's executive management must monitor the third party's performance and prepare periodic performance evaluation reports for the Company's Board of Directors.

4. The provisions of these Instructions shall not apply to any arrangements or agreements concluded or to be concluded by the Company with any of the following:

   a. Companies operating in the market for providing data and auxiliary financial services for the purpose of analyzing local and/or external markets.

   b. Agents and brokers of the payment service provider.

   c. External auditors.

   d. Purchase and supply contracts, supplies, maintenance, leasing, and any arrangements related to the Company's specific service matters.

---

(8) Article

Rectification of Status

All payment service companies must rectify their legal status to comply with the requirements of these Instructions within a maximum period of (6) six months from the date of issuance of these Instructions.

---

(9) Article

Implementation and Enforcement

All competent authorities shall, each within their respective jurisdiction, implement the provisions of these Instructions, which shall take effect from the date of their issuance.

Issued in the city of Ramallah on 15/02/2021 AD

Dr. Fares Malham Governor

---

Note:

• Ramallah & Al-Bireh Governorate - Palestine P.O. Box 452
  • info@pma.ps | Fax: +970 2 2415310 | Tel: +970 2 2415251
• Gaza - Palestine P.O. Box 4026
  • Fax: +970 8 2844487 | Tel: +970 8 2825713
• www.pma.ps