Financial Regulatory Authority Board Resolution No. 141 of 2023 on the Fintech Outsourcing Registry for Non-Banking Financial Activities

The Egyptian Gazette - No. 150, Part (A) dated July 11, 2023

Financial Regulatory Authority
Board Resolution No. 141 of 2023
dated June 21, 2023

Regarding the Outsourcing Registry in Fintech Fields for Non-Banking Financial Activities

The Board of Directors of the Financial Regulatory Authority
Having reviewed Law No. 5 of 2023 on the Regulation and Development of Fintech Use in Non-Banking Financial Activities;
Having reviewed Personal Data Protection Law No. 151 of 2020;
Having reviewed the Authority's Board Resolution No. 139 of 2023 on equipment, technological infrastructure, information systems, and necessary protection and insurance means for using fintech to conduct non-banking financial activities;
Having reviewed the Authority's Board Resolution No. 140 of 2023 on digital identity, digital contracts, the digital registry, fintech application fields for non-banking financial activities, and compliance requirements;
Having approved the Authority's Board Resolution at its meeting held on June 21, 2023;

Resolved:

(Article 1)
The attached rules regarding the outsourcing registry in fintech fields for non-banking financial activities shall apply.

(Article 2)
Companies wishing to be registered in the registry must fulfill the requirements set forth in the attached rules, as well as the necessary documents specified by the Authority.

(Article 3)
This resolution shall be published in The Egyptian Gazette, and shall take effect from the day following its publication date.

Chairman of the Board of Directors
Financial Regulatory Authority
Dr. Mohamed Farid Saleh

---

The Egyptian Gazette - No. 150, Part (A) dated July 11, 2023

First - Establishment of the Registry

A registry for recording outsourcing service providers in fintech fields for non-banking financial activities is established under the Authority, named (the Outsourcing Registry).
The registry must contain the main data and information of outsourcing service providers, as specified by the Authority.
Only entities registered in the registry may perform any of the outsourcing services.

Second - Registration Conditions

Subject to the laws and resolutions governing the use of fintech in non-banking financial activities, the following conditions must be met for registration:

• 1- The company must be an Egyptian joint-stock company, or any other legal form, provided it undertakes to convert its legal form into a joint-stock company within a maximum of 12 months from the date of its registration.

• 2- The company's capital must not be less than the minimum limit specified by the Authority.

• 3- It must possess appropriate expertise relevant to its field, as proposed by the Authority.

• 4- The company must have the necessary governance rules and their applications, which ensure a sound internal control environment.

• 5- It must possess the necessary technological capabilities to ensure the security of outsourcing clients' data, protect the privacy and confidentiality of service-related data, and implement necessary corrective procedures in case of any performance level discrepancies and record related events.

• 6- Undertake to conclude an insurance policy against technological risks and professional liability.

• 7- Pay the registration fee in the registry amounting to 25,000 Egyptian pounds for each field.

---

The Egyptian Gazette - No. 150, Part (A) dated July 11, 2023

Third - Registration Application Procedures

The registration application shall be submitted on the form approved by the Authority for this purpose, accompanied at a minimum by the following:

• 1- The nature and description of the service for which registration is sought.

• 2- The technical methods adopted by the company to ensure information and cyber security.

• 3- The various regulatory reports provided by the outsourcing service provider to the outsourcing entity.

• 4- Assurance of compliance with the rules and regulations issued by the Authority in implementation of Law No. 5 of 2023 on the Regulation and Development of Fintech Use in Non-Banking Financial Activities.

• 5- Information system governance methods, including the requirements stipulated in resolutions issued by the Financial Regulatory Authority.

The Authority shall rule on the registration application within thirty days from its submission, provided it is accompanied by supporting documents.

Fourth - Conditions for Continued Registration

To maintain registration, the outsourcing service provider must comply with the following obligations:

• 1- Notify the Authority as specified when concluding any outsourcing contract, or making a material amendment to it.

• 2- Apply the outsourcing entity's compliance requirements according to the regulations issued by the Authority and the regulator.

• 3- The outsourcing service provider shall not retain the data of its clients and post-process operations.

• 4- Provide the Authority with any information or documents necessary for the exercise of its affairs.

Fifth - Registration Duration and Renewal

The registration duration is renewable under the same conditions, and registered entities are granted a grace period of one month from the day following the registration expiration date. As of the day following the end of this one-month period, the company is considered deregistered, and the Authority's Board may extend the deadlines stipulated in this paragraph.

---

The Egyptian Gazette - No. 150, Part (A) dated July 11, 2023

Except for warnings, registration renewal is not permitted for those against whom an administrative measure has been taken, unless one year has passed from the date of the decision regarding that measure. Furthermore, previously deregistered entities may be re-registered, provided sixty months have passed since the deregistration date.

In all cases, the Authority's Board may grant exceptions to the time periods stipulated in the preceding paragraph, based on justifications submitted by the outsourcing service provider.

Sixth - Administrative Measures

The Authority's Board may, upon finding that a service provider has lost one of the registration or continuation conditions, or violated any obligations stipulated in the laws and resolutions governing fintech use in non-banking financial activities for outsourcing service providers, take any of the following measures:

• 1- Issuing a warning regarding the stipulated violations and specifying the time period required to remove their causes.

• 2- Temporary suspension of registration for a period not exceeding one year.

• 3- Convening the company's Board of Directors or management, as applicable, to review the stipulated violations and obligating them to take necessary action to rectify them.

• 4- Deregistration from the registry.