REPUBLIC GAZETTE

OFFICIAL PUBLICATION OF THE REPUBLIC OF MOZAMBIQUE

NATIONAL PRESS OF MOZAMBIQUE, S.A.

NOTICE

Matters to be published in the "Republique Gazette" must be submitted as duly authenticated copies, one per subject matter, containing besides the necessary indications for this purpose, the following endorsement, signed and authenticated: For publication in the "Republique Gazette".

---

TABLE OF CONTENTS

Bank of Mozambique:

Notice No. 8/GBM/2025: Establishes guidelines for the reporting of technological and cyber incidents.

Notice No. 9/GBM/2025: Establishes limits on foreign payments made through bank cards.

---

BANK OF MOZAMBIQUE

Notice No. 8/GBM/2025 of November 20

The importance of technological and cyber resilience in the national financial sector has become increasingly significant, indicating the need to ensure the timely detection, communication, mitigation and recovery of incidents that may affect consumer confidence, service integrity and financial system stability.

In these terms, the Bank of Mozambique, in exercise of the powers conferred upon it by paragraph d) of paragraph 2 of Article 37 of Law No. 1/92, of January 3, Organic Law of the Bank of Mozambique, determines:

CHAPTER I

General Provisions

ARTICLE 1 Subject Matter

This Notice establishes guidelines for the reporting of technological and cyber incidents.

ARTICLE 2 Scope

This Notice applies to credit institutions and financial companies, hereinafter referred to as “institutions”.

ARTICLE 3 Definitions

The terms and expressions used in this Notice are defined in the Glossary, Annex 1, which forms an integral part thereof.

CHAPTER II

Classification and Reporting of Incidents

ARTICLE 4 Classification of incidents

1. Technological and cyber incidents may be classified according to nature or severity.

2. Institutions shall consider the taxonomy presented in Annex 2 of this Notice for classifying the nature of incidents.

3. Institutions shall classify and report technological and cyber incidents, which encompass external and internal events, whether intentional or accidental, in accordance with the severity levels described in Annex 3 of this Notice.

ARTICLE 5 Reporting template

1. Institutions shall report critical, high and medium level incidents by completing the incident reporting template to be approved by Circular.

2. Without prejudice to the foregoing, low level incidents shall be duly documented and available for review.

ARTICLE 6 Reporting deadlines

1. Institutions shall report incidents incrementally within the following deadlines:

   (a) Preliminary Report: twenty-four hours from the time of occurrence;

   (b) Interim Report: ten business days from the date of submission of the preliminary report; and

   (c) Final Report: within thirty business days from the date of submission of the interim report.

2. If the incident is not resolved within the deadline set forth in paragraph (c) of the preceding paragraph, institutions shall submit to the Bank of Mozambique, within the same timeframe, the final report and an action plan containing mitigation measures adopted or planned to resolve the incident and prevent its recurrence.

---

Annex 4 List of Acronyms

APT – Advanced Persistent Threat DDoS – Distributed Denial of Service DoS – Denial of Service IDS – Intrusion Detection System IPS – Intrusion Prevention System RTO – Recovery Time Objective SLA – Service Level Agreement SPAM – Sending and Posting Advertisement in Mass IT – Information Technology

Notice No. 9/GBM/2025 of December 2

In view of the need to establish limits for foreign payments using bank cards, the Bank of Mozambique, under the combined provisions of paragraph a) of Article 9 of Law No. 28/2022, of December 29, Exchange Law, and paragraph 4 of Article 17 of Law No. 2/2008, of February 27, National Payments System Law, determines:

ARTICLE 1 Subject Matter

This Notice establishes limits on foreign payments made through bank cards.

ARTICLE 2 Scope

This Notice applies to credit institutions subject to the supervision of the Bank of Mozambique and to natural and legal persons holding bank cards issued in Mozambique, regardless of whether they are resident or non-resident for exchange control purposes.

ARTICLE 3 Definitions

For the purposes of this Notice, the following shall be understood as:

(a) bank card: a payment instrument, generally in the form of a plastic card, provided by a credit institution to the holder so that, through access to a telecommunications network and based on the bank account associated with the card or balance loaded therein, it may carry out banking operations. The bank card, according to its function, may be credit, debit or prepaid;

(b) foreign payment: any payment operation carried out abroad with a bank card issued by a credit institution authorized by the Bank of Mozambique; and

(c) holder: natural or legal person, resident or non-resident for exchange control purposes, who enters into an agreement with a credit institution for the issuance of a bank card and is permitted to use it.

ARTICLE 4 Limits on foreign payments

1. Natural and legal persons may only make foreign payments using a bank card up to an annual limit equivalent to 6,000,000.00 MT (six million meticais).

2. The annual limit corresponds to the aggregate value across the entire national banking system, fixed for each holder, regardless of the number of contracts concluded with credit institutions, the number of bank cards and the payment channels through which transactions are made, including cash withdrawals.

3. The annual limit does not prejudice the daily limits defined for each card by the credit institution.

4. Upon reaching the limit set forth in paragraph 1, all credit institutions shall block bank cards of the same holder for foreign transactions.

ARTICLE 5 Determination of limits by the Bank of Mozambique

1. The Bank of Mozambique may determine, on a case-by-case basis and upon request, limits different from those set forth in paragraph 1 of the preceding article.

2. The additional limit to be determined under the preceding paragraph shall not exceed 6,000,000.00 MT (six million meticais).

3. The request shall be justified and submitted by the holder to a credit institution of its choice, accompanied by the following information:

   (a) Supporting documents evidencing the triggering event; (b) Amount; (c) Period; (d) Destination country; and (e) Other relevant information.

4. The credit institution shall review, issue the appropriate opinion and submit it to the Bank of Mozambique within 5 business days.

5. Upon receipt of the aforementioned opinion, the Bank of Mozambique shall decide within 15 business days.

ARTICLE 6 Duty to notify

1. Credit institutions shall notify bank card holders whenever:

   (a) Half of the annual limit is reached; (b) The annual limit is reached; and (c) Bank cards are blocked.

2. The Bank of Mozambique shall notify credit institutions of the facts referred to in paragraphs (a) and (b) of the preceding paragraph.

ARTICLE 7 Application of the Bank Cards Regulation

Without prejudice to the provisions of this Notice, credit institutions shall comply with the duties set forth in the Bank Cards Regulation approved by Notice No. 1/GBM/2014, of June 4, amended and republished by Notice No. 10/GBM/2017, of June 7.

---

DECEMBER 9, 2025 | 2031

ARTICLE 8 Additional instructions

The Bank of Mozambique shall issue, by Circular, additional instructions regarding this Notice.

ARTICLE 9 Sanctioning regime

A violation of the provisions of this Notice constitutes an exchange control offence punishable in accordance with Law No. 28/2022, of December 29.

ARTICLE 10 Clarifications

Doubts regarding the interpretation and application of this Notice shall be submitted to the Licensing and Exchange Control Department of the Bank of Mozambique.

ARTICLE 11 Entry into force and duration of validity

This Notice enters into force on the date of its publication and remains valid for twelve months.

Maputo, December 2, 2025. — The Governor, Rogério Lucas Zandamela.