Law of the Republic of Azerbaijan on Payment Services and Payment Systems

THE LAW OF THE REPUBLIC OF AZERBAIJAN on payment services and payment systems Pursuant to Para 10, 11, 12 and 15 of Part I of Article 94 of the Constitution of the Republic of Azerbaijan, this Law shall define the legal basis for activities of payment systems, payment services, payment organizations, electronic money institutions and payment system operators and legal, organizational, and economic grounds for related regulation and supervision. Chapter 1 General provisions Article 1. Main definitions 1.1. The main definitions used herein shall bear the following meanings: 1.1.1. authentication – a procedure that enables the payment service provider to verify the identity of the payment service user or the reliability of the payment instrument, as well as the use of personalized security information of the payment service user. 1.1.2. authorization – consent of the payment service user to the payment service provider to carry out a payment transaction. 1.1.3. direct debit – a payment instrument used to debit the payer's payment account based on the payee's payment order with the prior consent of the payer to the payee and the payment service provider. 1.1.4. blocking – suspension of operations with a payment instrument. 1.1.5. durable medium – any instrument which enables to store information a period adequate to the purposes of the information and which allows the unchanged reproduction of the information stored. 1.1.6. periodic payment – a payment made periodically by the payer in the payee’s favor in the predetermined amount or within the amount limit. 1.1.7. acquiring – a service provided by payment service providers for receipt and processing of information on transactions with payment instruments by concluding an agreement with the payee and resulting in the transfer of funds in favor of the payee, or the cash withdrawal. 1.1.8. electronic money – a payment instrument placed at the disposal of the payment service user in the amount of money received, stored electronically, allowing to carry out payment transactions and accepted for payment by third parties along with the issuer. 1.1.9. issue of electronic money – transfer of electronic money by the issuer of electronic money to the payment service user. 1.1.10. electronic money issuer (hereinafter – the issuer) – a party issuing electronic money hereunder. 1.1.11. outstanding electronic money - face value of electronic money in the payment account of the electronic money holder.

1.1.12. electronic money holder – a payment service user who has the right to dispose of electronic money. 1.1.13. electronic money institution – a legal entity that issues e-money and performs payment transactions related to electronic money under the license obtained hereunder, and that has the right to provide other payment services if provided for in the license. 1.1.14. transaction day – a specific time set by the payment service provider for receipt of payment orders and conduct of payment transactions. 1.1.15. operational or security incident - an event unplanned by the payment system operator or payment service provider that adversely affects or may adversely affect the completeness, confidentiality, reliability and/or sustainability of payment services, completeness and/or continuity of the processing, clearing and/or settlements of payment transactions in payment systems, the safe and effective operation of the payment service operator and payment service provider. 1.1.16. personalized security information – personalized information assigned by the payment service provider to the payment service user for the authentication purposes. 1.1.17. emergency cases – geological, natural fires, meteorological blasts, fires, building or structure collapse, power supply system failures and other natural and man-caused accidents and other emergencies. 1.1.18. strong customer authentication – authentication designed to protect the confidentiality of authentication information, that does not exclude reliability of others if one is violated, is based on the use of only two or more of elements known only to, belonging to and owned by the user. 1.1.19. settlement agent – a legal entity that carries out settlements on payment orders within the payment system over the accounts opened for participants. 1.1.20. account information service – online service to provide information on payment accounts held by the payment service user with one or more than one payment service provider. 1.1.21. account information service provider – a payment service provider that renders payment account information service. 1.1.22. account servicing payment service provider –a payment service provider providing and maintaining a payment account for a payer. 1.1.23. sensitive payment information – information that may be used for fraudulent transactions, including personalized security information (excluding the information on the name and account number of the payment service user during provision of the payment service provided for in Articles 3.1.6 and 3.1.7 hereof). 1.1.24. local branch of a foreign payment institution (local branch of a foreign electronic money institution and a foreign operator) – a branch registered in the Republic of Azerbaijan that carries out relevant activities on behalf of a foreign payment institution (foreign electronic money institution, foreign operator) established outside the Republic of Azerbaijan under the license obtained hereunder. 1.1.25. clearing - the process of reformation of claims and liabilities arising from payment amounts transferred to one or several participants of the settlement system or received from them, into a net claim or a net liability, representing their difference.

1.1.26. credit transfer (payment order) – a payment instrument used by the payment service provider servicing a payment account based on the payer's payment order for the purpose of transferring funds. 1.1.27. own funds – capital set under this Law to ensure uninterrupted operation of the payment or electronic money institution. 1.1.28. qualifying holding – direct or indirect ownership of a share that constitutes ten or more percent of initial capital of a payment institution, an electronic money institution or an operator, or that allows to have significant influence on decision-making of a legal entity in which it is a contractual partner. 1.1.29. supervised entity – a payment institution, an electronic money institution and a payment system operator, that provides license or registration-based activities hereunder. 1.1.30. operator – a person that organizes activities of the payment system hereunder and determines procedures for that system. 1.1.31. payment agent – a legal entity or an unincorporated individual providing payment services on behalf of a bank, a payment institution or an electronic money institution based on the agreement concluded with them. 1.1.32. payment instrument – a set of any personalized instrument and/or procedures used by payment service users to issue a payment order and agreed upon with the payment service provider. 1.1.33. payment transaction – depositing, transfer or withdrawal of funds initiated by either the payer or the payee, regardless of whether an obligation exists between them. 1.1.34. payment initiation service – a service of issuing a payment order on the payment account opened with another payment service provider at the payment service user’s request. 1.1.35. payment account – an account opened for executing payment transactions of one or several payment service users. 1.1.36. payment service – services provided by the payment service provider set forth in Article 3.1 hereof. 1.1.37. payment service user – a person that uses payment services as a payer and/or a payee. 1.1.38. payment service provider – persons providing payment services to the payment service user hereunder and those specified in Article 3.3 herein. 1.1.39. payment order – an instruction issued by the payment service user to the payment service provider using a payment instrument to execute a payment transaction. 1.1.40. payment system – a funds transfer system with three or more participants, with formalized and standardized common mechanism and rules for processing, clearing and/or settlements of payment transactions. 1.1.41. payment system participant – a person that enters into an agreement for participation in a payment system and is acknowledged as a participant under payment system rules. 1.1.42. payment terminal – a device that allows execution of a payment transaction using payment instruments, including cash.

1.1.43. payment institution – a legal entity that provides other payment services in aggregate or separately, except for the issuance of electronic money and payment operations with electronic money under the license obtained hereunder. 1.1.44. payer – a person who gives a payment order to a payment service provider to conduct a payment transaction. 1.1.45. money remittance – a transaction involving transfer of funds to the payee without opening a payment account in the payer’s and/or payee’s name. 1.1.46. digital content – goods or services produced and presented in a digital form, the use (consumption) of which is possible only with the help of and limited to technical devices. 1.1.47. unique identifier – a combination of letters, numbers or symbols issued by a payment service provider to a payment service user and used to identify him/her and/or a payment account when a payment transaction is executed. 1.1.48. payment initiation service provider – a payment service provider that renders a payment initiation service to conduct a payment transaction. 1.1.49. payee – the person supposed to receive funds on the payment transaction. 1.1.50. civil impeccability – compliance of beneficiary owners of supervised entities, persons who discharge management functions, as well as persons with qualifying holding in initial capital, and the manager of the management body if that person is a legal entity, with the requirements of Article 17 of the Law of the Republic of Azerbaijan ‘on Prevention of the legalization of criminally obtained property and the financing of terrorism. 1.2. Pursuant to Articles 7.5, 7.6, 48.12, 52, 53, 54.2, 57, 58.2, 60.1, 60.3 and Chapter 7 of this Law, local branches of foreign payment institutions, foreign electronic money institutions and operators shall be subject to the requirements of the present Law with respect to payment institutions, electronic money institutions and operators accordingly. 1.3. Other definitions used in the present Law shall bear the meanings defined with normative legal acts of the Republic of Azerbaijan. Article 2. Payment services and payment systems legislation 2.1. Payment services and payment systems shall be regulated with the Constitution of the Republic of Azerbaijan, international treaties seconded by the Republic of Azerbaijan, the Civil Code of the Republic of Azerbaijan, the present Law, the Laws of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’, ‘on Banks’, ‘on Non-bank credit institutions’ and ‘on Postal services’, other normative legal acts of the Republic of Azerbaijan that regulate related relations, as well as related regulations of the Central Bank of the Republic of Azerbaijan (hereinafter – the Central Bank). 2.2. Relations on payment services and payment systems in the Alat free economic zone shall be regulated pursuant to the requirements of the Law of the Republic of Azerbaijan ‘on Alat free economic zone’. Article 3. Payment services and payment service providers

3.1. Payment services shall include: 3.1.1. depositing funds to and/or from the payment account. 3.1.2. executing payment transactions using credit transfer, direct debit, payment card or other similar payment instruments. 3.1.3. issuing payment instruments and/or acquiring payment transactions. 3.1.4. money remittances. 3.1.5. issuing e-money and execution of payment operations with electronic money. 3.1.6. payment initiation services. 3.1.7. account information service. 3.2. For the purposes of this Law, the following shall not be considered payment services: 3.2.1. payment transactions made by the payer in cash directly in payee’s favor. 3.2.2. payment transactions executed by the payer in favor of the payee only on behalf of the payer and the payee by means of a trade representative (agent) authorized to sign contracts on trading of goods, performance of works and supply of works. 3.2.3. foreign exchange transactions in cash without opening a payment account. 3.2.4. transactions on a VAT deposit account opened and maintained in a single treasury account, and on VAT refund as per normative legal acts. 3.2.5. letter of credit, encashment, cheque, and promissory note payment transactions. 3.2.6. payment transactions between participants of payment systems, as well as payment transactions on depositing and/or withdrawal of funds of the parties provided with banking services by the Central Bank to the payment account with the Central Bank. 3.2.7. payments arising from securities transactions by persons licensed in the securities market and the central depository, including dividends and interest payments. 3.2.8. services based on payment instruments used in settlements on trading of goods and supply of services within issuer’s own economic agents (objects). 3.2.9. in addition to telecommunication services to subscribers by mobile operators, payment transactions provided for purchase of digital content and voice-based services and as part of charitable activities (provided that the amount of these payment transactions does not exceed the amount established by regulations of the Central Bank). 3.2.10. payment transactions between payment service providers, their branch offices and/or payment agents not linked to the execution of payment orders of payment service users. 3.2.11. payment transactions not related to customer transactions executed between the parent undertaking and its subsidiaries or between subsidiaries of the parent undertaking, with involvement of the payment service provider that belongs to the same group of companies. 3.2.12. services provided to payment service users for cash withdrawals via payment terminals by the institutions acting on behalf of one or several payment card issuers, which are not a party to an agreement with the payment service user, provided that payment services specified in Article 3.1 hereof are not provided. 3.2.13. services provided by technical service providers to support the provision of payment services without taking ownership of the funds transferred at any point in the transfer process (these services include data processing, storage, authentication, security, including information technologies used in maintaining payment services, communication network, as well as supply and support of technical devices).

3.3. Payment service providers shall include: 3.3.1. the Central Bank 3.3.2. banks and local branches of foreign banks 3.3.3. credit institutions functioning in accordance with the Law of the Republic of Azerbaijan ‘on Non-bank credit institutions’ 3.3.4. the national postal operator 3.3.5. payment organizations 3.3.6. electronic money institutions 3.4. Payment service providers specified in Article 3.3.3 herein shall only supply payment services as per the Law of the Republic of Azerbaijan ‘on Non-bank credit institutions’. Chapter 2 Requirements for activities of payment service providers Article 4. Initial capital and own funds of payment and electronic money institutions 4.1. Payment and electronic money institutions shall have initial capital and own funds. 4.2. Requirements with respect to payment institution’s and electronic money institution’s initial capital and minimum amount of own funds, calculation procedure of own funds, as well as its structure and elements shall be determined by the Central Bank’s regulations. 4.3. The requirements established by this Law for minimum initial capital and own funds shall not apply to the payment institution exclusively engaged in the provision of account information services. Article 5. Activities of payment and electronic money institutions 5.1. Payment and electronic money institutions may, in addition to provision of payment services, carry out the following activities: 5.1.1. exchange of foreign currency in accordance with the procedure established by the Central Bank for execution of the payment order (except for payment institutions that exclusively provide payment services specified in Articles 3.1.6 and/or 3.1.7 specified herein). 5.1.2. issue of loans to payment service users under conditions agreed with them in the order and within the requirements set by the Central Bank for payment transactions defined by Article 3.1.2 herein. 5.1.3. storage, transportation, data storage, processing and transmission directly related to the payment service provided. 5.1.4. operator activities under the license obtained hereunder, as well as other activities that the operator may carry out as set forth in Article 43.6 herein. 5.1.5. arrangement of trainings and consulting services, as well as development of software related to payment services. 5.2. Payment and electronic money institutions may not engage in activities other than those specified hereunder (except for the cases provided for in Article 64 herein).

5.3. Payment and electronic money institutions (except for payment initiation services and/or account information services) shall comply with the requirements of the Laws of the Republic of Azerbaijan ‘on Prevention of the Legalization of Criminally Obtained Property and the Financing of Terrorism’, ‘on Targeted Financial Sanctions’ and ‘on Currency Regulation’ and regulations adopted in accordance with them. 5.4. Funds received from the payment service user for provision of payment services by the payment and electronic money institutions shall not be considered a deposit. No interest or any other form of income may be paid on storage of those funds. With the exception of the electronic money issuance service to the payment account, money may only be deposited for execution of payment transactions. Article 6. Payment account 6.1. Payment accounts of legal entities and individual entrepreneurs may only be with banks, non-bank credit institutions (with respect to loans obtained), the national postal operator and electronic money institutions. Legal entities and individual entrepreneurs may use services of payment institutions without opening an account. 6.2. Unless otherwise specified herein, requirements of other normative acts of legal nature and regulations regarding ‘bank account’ and/or ‘account’ (except for the cases where it is clear from the content of those requirements that they only belong to the account opened by a bank) shall apply to payment accounts and other payment service providers along with banks. Article 7. Security of funds 7.1. An electronic money institution providing payment services specified in Articles 3.1.1- 3.1.5 herein shall ensure security of funds received for payment transactions at least by: 7.1.1. keeping them in a separate account opened for the purpose by banks and local branches of foreign banks operating in the Republic of Azerbaijan and/or investing in low-risk assets established by the Central Bank, in case the funds are not transferred to the payee or any payment service provider no later than the working day following the day they are received. 7.1.2. ensuring a civil liability insurance at an insurer that is not a related party and does not belong to the same financial group in the amount not less than the amount of damage that may arise because of non-performance of the received cash liability or obtaining a guarantee from a credit institution or an insurer that is not a related party and does not belong to the same financial group. 7.2. Irrespective of the methods of ensuring security of received funds, the electronic money institution shall ensure execution of relevant execution documents in accordance with the legislation when a request is made on the execution document of the payment service user's payment account. 7.3. Where the security of funds received for payment transactions is maintained by the method provided for in Article 7.1.1 herein, the electronic money institution may not deposit its own funds to the account where funds received for payment transactions from payment service users or other payment service providers are stored and the execution document on that account

may be directed only in connection with the execution of the liability of the electronic money institution to the payment service user. 7.4. Claims of other creditors of payment or electronic money institutions, including execution documents (including claims filed in the bankruptcy process), may not be directed to the funds of payment service users and the assets acquired at the expense of those funds. Other aspects of bankruptcy procedures for payment and electronic money institutions shall be governed by the Law of the Republic of Azerbaijan ‘on Bankruptcy and insolvency’. 7.5. In case of liquidation of a local branch of a foreign payment institution or a foreign electronic money institution, the foreign payment institution or the electronic money institution shall be kept fully responsible for liabilities of the local branch. 7.6. Where liquidation proceedings commence for the foreign payment or electronic money institution, local branch’s assets shall be primarily used to cover liabilities resulting from the local branch office’s payment services provided in the Republic of Azerbaijan. Article 8. Accounting and financial statements 8.1. Payment and electronic money institutions shall maintain accounting and preparation, submission, and publication of financial statements in accordance with the Law of the Republic of Azerbaijan ‘on Accounting’. 8.2. Payment and electronic money institutions shall submit annual financial statements and consolidated financial statements to the Central Bank within the period specified in Article 12.1 of the Law of the Republic of Azerbaijan ‘on Accounting’. If the payment and the electronic money institution involve a payment agent, operations performed by the payment agent on payment services shall be incorporated in consolidated financial statements of the payment or the electronic money institution. 8.3. Payment and electronic money institutions shall engage an independent auditor each year to verify accuracy of annual financial statements. The external auditor reviewing the payment or electronic money institution shall report any breaches and deficiencies identified in provision of payment services to the Central Bank in writing during audit reviews. Article 9. Payment agent 9.1. Banks, payment, and electronic money institutions may engage payment agents domestically to provide payment services specified in Articles 3.1.1, 3.1.2 and 3.1.4 herein and banks and electronic money institutions also for the sale of electronic money and pay back of the outstanding amount of electronic money. In this case, the payment service provider shall be kept fully responsible for payment services related activities of payment agents they engage. 9.2. Prior to commencing the provision of payment services through payment agents banks, payment and electronic money institutions shall submitrelated written information to the Central Bank. The information shall be attached with an original or a notarized copy of the agreement signed with the agent, as well as documents confirming compliance with the requirements specified in Article 9.6 herein.

9.3. Within 10 (ten) days from the day the application specified in Article 9.2 herein is received the Central Bank shall enter the payment agent to the Register specified in Article 65 herein and inform the applicant payment service provider accordingly. The payment agent may not provide payment services without being entered to the Register. 9.4. Where the information specified in Article 9.2 hereof is not fully submitted by the bank, the payment and electronic money institution or shortcomings are found in submitted documents or the agreement concluded with the agent does not comply with Article 9.6 herein, the Central Bank shall send a written notice to the payment service provider within 5 (five) working days from the day the application is received. 9.5. The applicant shall eliminate shortcomings specified in the notice no later than 10 (ten) working days from the day the notice is received. Delivery of the written notice by the Central Bank shall suspend the period specified in Article 9.3 herein for review of the application, and the suspended period shall not be included in the period of review of the application. After the applicant sends a written notice to the Central Bank on elimination of shortcomings, the period shall be resumed. Where shortcomings are not eliminated, the Central Bank shall refuse to enter the payment agent to the Register and send a written notice to the payment service provider within the period specified in Article 9.3 herein indicating reasons for refusal. The payment service provider that receives refusal, may apply to the Central Bank again for the entry of the payment agent to the Register after shortcomings are eliminated. 9.6. Requirements for involving payment agents and provision of payment services by payment agents, including requirements for conditions of the agreement signed with payment agents shall be determined by regulations of the Central Bank. 9.7. Control over activities of payment agents by banks, payment and electronic money institutions shall be determined by internal procedures of payment service providers. The payment agent may not charge a service fee or any other amount on top of the service fees charged by the payment service provider for provision of payment services. 9.8. The payment agent may act on behalf of one or several banks, payment, and electronic money institutions. This right of the payment agent may not be limited in any way, directly or indirectly. 9.9. Payment agents shall inform payment service users about the payment service provider they represent. 9.10. Where banks, payment or electronic money institutions fail to control activities of payment agents in accordance with their internal rules, the Central Bank shall issue an obligatory instruction to suspend provision of payment services by the relevant payment service provider through agents. 9.11. The payment service provider shall notify the Central Bank within 5 (five) working days where the agreement concluded with the payment agent is changed or terminated. The payment agent the agreement of which has been terminated shall be removed from the Register by the Central Bank. Article 10. Incident notification and reporting

10.1. The payment service provider shall report operational or security incidents to the Central Bank in the cases and manner established by regulations of the Central Bank. 10.2. Where the incident is likely to cause financial damages to the payment service user, the payment service provider shall promptly inform payment service users on the incident and actions they may take to prevent it from happening. Article 11. Appeals handling and dispute resolution The payment service provider shall handle the appeal within 7 (seven) working days from the date the complaint was lodged by the payment service user and inform him/her on results. Where it is impossible to handle the appeal within this deadline, the payment service user shall be informed on appeal handling period justifying the reasons for extension of the appeal handling period not later than that period. Lodging of an appeal with the payment service provider shall not preclude the payment service user from exercising his/her right to initiate a lawsuit. Chapter 3 Electronic money Article 12. Issue of electronic money 12.1. Electronic money shall be issued in the Republic of Azerbaijan by: 12.1.1. banks and local branches of foreign banks 12.1.2. the national postal operator 12.1.3. electronic money institutions 12.2. Electronic money issuer shall immediately issue e-money in the amount of the funds received for issuing electronic money and enable the electronic money holder to use it. 12.3. Currency, maximum amount of e-money issued, maximum amount of liabilities for the e-money issued by one issuer shall be determined by the Central Bank’s regulations. Article 13. Interactions between the issuer and the electronic money holder 13.1. The issuer shall provide at least the following information to the party willing to become an electronic money holder prior to issuing electronic money on paper or on another durable medium: 13.1.1. the issuer’s name and legal address 13.1.2. regulations on the issuance and use of electronic money 13.1.3. procedures for reimbursement of electronic money’s outstanding amount and if applicable, fees payable for payout of the electronic money. 13.1.4. acceptance and review procedures for electronic money holder’s appeals. 13.1.5. security requirements for the use of electronic money. 13.1.6. procedures for delivery of information to the electronic money holder on transactions executed involving the use of e-money and outstanding electronic money.

13.2. Electronic money may be obtained by a legal entity, a local branch of a foreign legal entity and an individual entrepreneur only by transferring from their bank accounts to the issuer. 13.3. The issuer shall provide the electronic money holder with personalized security information for remote authentication. 13.4. The issuer shall have internal rules in place for the issuance, use and sale of e-money, as well as transactions, information sharing, receipt, and handling of applications. 13.5. The issuer shall promptly, at the electronic money holder’s demand, refund the outstanding electronic money. 13.6. When the outstanding electronic money is returned to the legal entity, the local branch of the foreign legal entity and individual entrepreneur, the money shall be transferred only digitally to the bank account of the legal entity, local branch of the foreign legal entity and individual entrepreneur. 13.7. Except for the revocation of the issuer's license, if stipulated in the agreement with the electronic money holder, the issuer may charge a service fee to reimburse the outstanding electronic money when: 13.7.1. outstanding amount reimbursement is required before the term specified in the agreement. 13.7.2. outstanding amount reimbursement is required 1 (one) year after the end date of the agreement. 13.8. In case of revocation of the issuer's license, the issuer shall stop issuing electronic money immediately after receiving the relevant decision of the Central Bank and outstanding electronic money shall be returned to electronic money holders free of charge. Article 14. Notification on payment accounts opened Information on payment accounts opened by electronic money institutions to legal entities, local branches of foreign legal entities and individual entrepreneurs shall be submitted to the authority (institution) designated by the relevant executive authority in the form and time determined by the authority (institution) designated by the relevant executive authority. Chapter 4 Notification on provision of payment services and requirements for agreements Article 15. Information provided to the payment service user 15.1. Where a payment account is opened, an agreement shall be concluded between the payment service provider and the payment service user. 15.2. Prior to concluding a payment service agreement between the payment service provider and the payment service user, the following information shall be delivered to payment service users on paper or on another durable medium: 15.2.1. on the payment service provider: 15.2.1.1. payment service provider’s name and legal address, as well as e-mail address

15.2.1.2. the date, number and issuing authority of the license issued to the payment service provider 15.2.2. on the use of the payment service: 15.2.2.1. payment services provided 15.2.2.2. information or a unique identifier required for proper initiation or execution of the payment order 15.2.2.3. procedures for issuing and rejecting the payment order, and irrevocability of the payment order in accordance with Articles 22 and 28 hereof 15.2.2.4. the period the payment order is accepted for execution, and execution period in accordance with Article 26 and 29 hereof 15.2.2.5. where a payment instrument is used, its characteristics 15.2.3. on service fees and currency exchange: 15.2.3.1. if applicable, service fees charged for provision of payment services and procedure for their payment 15.2.3.2. if applicable, currency exchange rate 15.2.3.3. if applicable, procedures for modifying the currency exchange rate with reference to Article 18.2 hereof. 15.2.4. on communication: 15.2.4.1. means of communication (contact phone, electronic mail address, etc.) for data and appeal transmission between the parties in an agreed manner, technical requirements for the payment service user’s hardware if applicable 15.2.4.2. period (frequency) of submitting information specified in Articles 16-18 and 25 herein this Law 15.2.5. on security arrangements: 15.2.5.1. actions to be taken by the payment service user to ensure security of the payment instrument and procedure for notifying the payment service provider in accordance with Article 38.1.3. herein. 15.2.5.2. conditions for the payment service provider’s right to block the payment instrument in accordance with Article 37 herein. 15.2.5.3. procedure for informing the payment service provider on an unauthorized or erroneously executed payment transaction of the payment service user in accordance with Article 25 hereof, as well as the payment service provider’s obligations for an unauthorized payment transaction. 15.2.5.4. the payment service provider’s obligation for unexecuted or erroneously executed payment order under Articles 31 and 32 herein. 15.2.5.5. refund of payment transaction amounts in accordance with Article 33 herein. 15.2.5.6. procedures for the payment service provider’s secure notification to the payment service user when fraudulent activities or security threats are anticipated or have occurred 15.3. Where a payment service agreement is concluded between the payment service provider and the payment service user, the agreements shall specify the following along with the information specified in Articles 13.1 and 15.2 herein: 15.3.1. duration of the agreement

15.3.2. procedure for making changes to or cancellation of the agreement according to Articles 18.1 and 19 herein 15.3.3. dispute resolution procedure, including the payment service user's right to file an out-of-court complaint according to Article 11 herein Article 16. Provision of information prior to execution of the payment order 16.1. Prior to executing the payment transaction, the payment service provider shall provide the payment service user with or make available the following information on the payment services provided by them: 16.1.1. information or a unique identifier required to execute the payment order 16.1.2. time for execution of the payment order 16.1.3. if applicable, fees charged for provision of payment services 16.1.4. if applicable, currency exchange rate 16.1.5. contact information of the supervisory authority 16.2. Where a payment order is issued by a payment initiation service, in addition to those specified in Article 16.1 hereof, the payment initiation service shall provide the payer with the following information or ensure that such information is easily accessible by the payer before the payment order is issued: 16.2.1. payment initiation service’s name, legal address, and other contact information. 16.2.2. amount of the service fee paid to the payment initiation service for conduct of the payment transaction. 16.3. The payment initiation service shall provide the payer and, if applicable, the payee, at least with the following information in an easily accessible form immediately after issuing the payment order: 16.3.1. confirmation of successful transfer of the payment order to the payment service institution serving the payer's account 16.3.2. a reference number to allow the payer and payee to identify the payment transaction 16.3.3. amount of the payment transaction 16.3.4. amount of the service fee paid to the payment initiation service for the payment transaction. 16.4. When the payment order is issued by a payment initiation service, the latter shall provide the reference number allowing the identification of the payment transaction to the payment service provider that serves the payer's account. Article 17. Notification after execution of the payment order 17.1. Following the execution of the payment order, the payment service provider shall provide the payment service user with the following information at a minimum on paper or on another durable medium: 17.1.1. the name and tax identification number of the payment service provider 17.1.2. the reference number to enable identification of the payment transaction 17.1.3. amount of the payment transaction in the currency of execution

17.1.4. service fees paid for execution of the payment transaction 17.1.5. if applicable, currency exchange rate 17.1.6. the execution date of the payment order 17.2. At the request of the payment service user, the payment service provider shall provide the payment service user with the information as defined in Article 17.1 hereof on payment transactions on the payment account at least once a calendar month, free of charge on paper or on another durable medium. Article 18. Notification on changes to the agreement 18.1. The payment service provider shall notify the payment service user of any changes to conditions of the agreement at least 30 (thirty days) prior to the introduction of such changes. If the payment service user does not object to such changes during that period, such changes shall be deemed accepted by the payment service user. 18.2. If the agreement between the payment service provider and the payment service user stipulates so, changes to the currency exchange rate referred to in the agreement shall immediately take effect without compliance with the notice period set by Article 18.1 hereof. 18.3. More favorable interest or exchange rate changes for payment service users may be applied without compliance with the notice period provided for in Article 18.1 hereof. Article 19. Cancellation of the agreement 19.1. The payment service user may at any time cancel the agreement unilaterally by notifying the payment service provider, without any charge, unless the agreement stipulates a different agreed-upon timeframe (except for the case provided for in Article 13.7.1 hereof). The timeframe agreed upon in the agreement shall not exceed 1 (one) month. 19.2. Until the agreement is cancelled, the payment service user shall pay service fees for the payment services used. If service fees were paid in advance, they shall be refunded to the payment service user no later than the next working day of the agreement cancellation day, less service fees to be paid for the services provided prior to the agreement cancellation. 19.3. If the underlying agreement so stipulates, the payment service provider may cancel the agreement signed for an indefinite period by giving the payment service user a 30 (thirty) day notice. This provision shall not apply to cases when the payment services activity of the payment service provider is terminated. Article 20. Exceptions in provision of information on payment instruments 20.1. When a small-value payment instrument is used by the payment service user: 20.1.1. the payment service provider shall provide the payment service user only with the details of the payment instrument’s main features, including the use of it, responsibilities of the parties, service fees if applicable and make other information specified in Article 15 hereof accessible.

20.1.2. if specified in the agreement, after a payment transaction is executed without applying Article 17 herein, the payment service provider shall provide the payment service user with a reference number that allows the payment service user to identify the payment transaction, the amount of this payment transaction and service fees charged and/or when several payment transactions of the same type are made in the same payee’s favor, the information on total amount of conducted payment transactions and service fees. 20.2. When using a payment instrument that does not require identification of the payment service user as per regulations of the Central Bank, the payment service provider shall not be required to provide the information specified in Article 20.1.2 herein, provided that the payment service provider shall enable the payment service user to verify the balance of the funds maintained in the payment instrument. 20.3. Criteria for determining small-value payment instruments shall be determined by regulations of the Central Bank. Article 21. Information fee and burden of proof 21.1. Except for the cases provided for in Article 21.2 hereof, the payment service provider shall inform the payment service user as per Chapter 4 of the Law at no cost. 21.2. The agreement between the payment service provider and the payment service user may specify an information fee at the request of the payment service user in the following cases: 21.2.1. provision of information in addition to that stipulated in Article 15 hereof 21.2.2. provision of information on a more frequent basis than the one defined in Article 17.2 hereof or the agreement 21.2.3. transmission of information via means of communications not defined by the underlying agreement 21.3. The burden of proof with respect to provision of information as specified in Article 13.1 and Chapter 4 shall rest with the payment service provider. Chapter 5 Execution of a payment order and responsibilities of the parties Article 22. Issuance and rejection of the payment order 22.1. When the payer issues a payment order, the payment transaction shall be deemed authorized. 22.2. The payment order may be rejected at any time until the time set under Article 28.1 hereof. As a result of refusal of the order issued on the execution of periodic payment transactions at the payer’s discretion only expired transactions or all subsequent payment transactions shall be deemed unauthorized and not be executed. 22.3. The form and procedure for issuing a payment order, as well as its refusal shall be determined in the agreement concluded between the payment service provider and the payer and/or business practices applied in payment services, unless otherwise provided for by regulations of the Central Bank

Article 23. Execution of payment transactions through payment initiation services 23.1. Where the payment account is managed remotely, the payment service user may use a payment initiation service to make payment transactions. In this case, the payment service provider servicing the payment account shall: 23.1.1. communicate with the payment initiation service provider only via secure network channels. 23.1.2. immediately after receiving the payment order from the payment initiation service provider, provide all the information on initiation of the payment transaction to the payment initiation service provider for executing the payment transaction. 23.1.3. execute payment orders transferred through the payment initiation service provider without any discrimination, without giving priority to payment orders delivered directly by the payer or without creating difference in service fees. 23.2. The payment initiation service provider shall: 23.2.1. not retain funds of payment service users for provision of payment initiation services. 23.2.2. prevent other parties from accessing personalized security information, except for the payment service user and the payment service provider serving its account and ensure security of the transmitted data. 23.2.3. provide the information on the payment service user obtained during the payment initiation service to the payee only with his/her consent. 23.2.4. identify itself with the payment service provider servicing the account during each payment transaction and establish contact with the provider servicing the account, the payer, and the payee in compliance with security requirements through secure network channels. 23.2.5. not ask the payment service user for additional information not required for provision of payment services. 23.2.6. not store sensitive payment data of the payment service user related to provision of payment initiation services, not use, store, or attempt to access any information without consent of the payment service user, unless it is related to provision of the payment service. 23.2.7. not change payment transaction amount, the payee, or any requisite of the payment transaction. 23.3. The provisions of Articles 23.1 and 23.2 hereof shall also apply in cases where there is no agreement between the payment initiation service provider and the payment service provider servicing the payment account. Article 24. Rules of access and use of payment account information within the account information service 24.1. Where the payment account is managed remotely, the payment service user may use the account information service. When the payment service user requests access to the payment account information using the account information service provider, the payment service provider servicing the account shall:

24.1.1. communicate with account information service providers through secure network channels. 24.1.2. not apply a discriminatory approach to information requests transmitted through the account information service provider without objective reasons. 24.2. The account information service provider shall: 24.2.1. provide services to the payment service user only with his/her consent. 24.2.2. prevent other parties from accessing personalized security information, except for the payment service user and the payment service provider serving its account and ensure security of transmitted data. 24.2.3. identify itself with the payment service provider servicing the payment service user’s account during each communication session. 24.2.4. communicate with the payment service provider and the payment service user servicing the account through secure network channels. 24.2.5. access only requested payment accounts and necessary information on related payment transactions. 24.2.6. not request sensitive payment information related to payment accounts. 24.3. The provisions of Articles 24.1 and 24.2 hereof shall also apply in cases where there is no contractual relationship between the account information service provider and the payment service provider servicing the payment account Article 25. Notice on unauthorized or erroneously executed payment transactions 25.1. If the payment service user has been informed on execution of the payment transaction carried out by the payment service provider as per Article 17.1 herein, he/she shall immediately inform the payment service provider if he/she identifies any unauthorized or erroneously executed payment transactions no later than 6 (six) months after its execution. This period shall not apply if the payment service provider has not informed the payment service user on execution of the payment transaction as set forth in this Law. 25.2. If the payment service provider fails to provide the evidence specified in Article 25.5 hereof within 5 (five) working days (for the transactions with payment instruments abroad, within the period determined by the rules of the payment system in which it is a participant) once a notification is received from the payment service user on the unauthorized payment transaction on the basis specified in Article 25.1 hereof, it shall refund the amount of the payment transaction to the payer no later than the next working day. 25.3. The payment service provider shall reimburse the amount of the unauthorized payment transaction to the payer together with all costs incurred by the payer for execution of this payment transaction. 25.4. Where a payment transaction is initiated by the payment initiation service provider, the requirements of Article 25.1 herein shall apply too. If an unauthorized payment is initiated by the payment initiation service provider, the payment service provider that services the account shall reimburse the funds to the payer as per Article 25.2 herein. If the payment initiation service provider is found to be at fault for an unauthorized payment transaction, it shall compensate costs incurred by the payment service provider in returning funds to the payer.

25.5. If the payment service user rebuts having authorized the payment transaction or reports that the payment transaction was executed erroneously, the payment service provider shall prove that the payment transaction was authenticated and correctly registered, that the amount of the payment transaction was in fact deposited to the payment account specified by the payment service user and that the payment transaction was not affected by any technical failure or through any other fault of the payment service provider. 25.6. If the payment transaction is initiated by a payment initiation service provider, the payment initiation service provider shall prove that the payment transaction is authenticated, properly registered and has not been affected by any technical failure or other deficiency. 25.7. If the payment service user rebuts having authorized the payment transaction executed, the fact of using the payment instrument shall not be sufficient to prove that the payment service user authorized the payment transaction or acted fraudulently or intentionally or neglectfully failed to meet the provisions set forth in Article 38 hereof. In this case, the payment service provider, if necessary, the payment initiation service provider shall provide relevant evidence confirming occurrence of the fraudulent transaction or gross negligence by the payment service user. Article 26. Time of acceptance of the payment order for execution 26.1. The payment service provider shall accept the authorized payment order for execution if the payment order is not defective, and all conditions specified in the agreement concluded with the payer are met. 26.2. If the authorized payment order is submitted after the transaction day, the payment order shall be deemed accepted for execution on the next transaction day. Article 27. Execution and refusal to execute the payment order 27.1. Payment orders accepted for execution shall be executed in the sequence as defined in Article 965 of the Civil Code of the Republic of Azerbaijan. 27.2. The obligation of the payment service provider servicing the payer shall be deemed executed as soon as funds for the payment transaction are deposited to the account of the payee’s payment service provider. If both the payer and payee are serviced by the same payment service provider, the obligation to execute the payment order shall be deemed executed as soon as the funds in question are deposited to the payee’s account. 27.3. If the payment service provider refuses to execute a payment order, it shall inform the payment service user of the reasons and existing deficiencies no later than the next working day, provided that the law does not prevent from presenting such information. 27.4. The payment service provider servicing the payer’s payment account may not refuse to execute the authorized payment order except for the cases stipulated in the legislation regardless the payment is initiated by the payer, the payee, or the payment initiation service provider.

27.5. The payment service provider may not determine or control the directions of use of funds of the payment service user, neither may in any way limit the payment service user’s right to dispose of the funds, unless otherwise provided by the law or the agreement. 27.6. Payment service providers servicing the payer and the payee, as well as other payment service providers involved in execution of the payment order, shall ensure full transfer of the information on the payment order during execution of the payment order. Article 28. Revocation of the payment order 28.1. The payment order sent to the payment system shall be deemed irrevocable from the moment specified in the payment system rules. 28.2. If the payment service user agrees a certain day for execution of the payment order with the payment service provider, the payment service user may revoke the payment order by the close of business of the working day immediately preceding the agreed upon day the latest. 28.3. If the payment transaction is initiated by the payment initiation service provider, the payer may not revoke the payment order after giving consent to the payment initiation service provider to initiate the payment transaction. 28.4. If a direct debiting instrument is applied, the payer may revoke the order to execute the payment by the close of business on the day immediately preceding the day set for charging the funds off from the payment account the latest. 28.5. Following the deadlines set forth in Articles 28.2 and 28.3 hereof, the payment order may only be revoked in cases as defined in the agreement between the payment service provider and payment service user and if the funds have not been deposited to the payee’s payment account. 28.6. Service fees for revocation of payment orders shall be applied if stipulated by the agreement signed between the payment service provider and the payment service user. Article 29. Execution period of the payment order 29.1. The payment service provider shall execute the payment order no later than the working day immediately following the day the payment order was accepted for execution 29.2. Except for a payment institution, a different term for execution of that order may be agreed upon in the payment order issue for other payment service providers. The agreed period shall be deemed the payment order’s execution period. If this period falls on a non-working day, the execution period of the payment order shall be considered the next working day. 29.3. The payment service provider shall, to enable execution of the payment transactions related to direct debit in the agreement concluded with the payee on the agreed date, ensure that the payment order presented by the payee is sent to the payer’s payment service provider on the date agreed upon with the payee. 29.4. Except for the case specified in Article 36 herein, funds received by the payment service provider in the payee’s favor shall be deposited to the payee’s payment account on the same transaction day, and/or access shall be provided to these funds. If the currency of the funds to be deposited to the account differs from the currency of the amount in the account, the period

of depositing the funds to the account shall be regulated by the agreement concluded between the payment service user and payment service provider. Article 30. Charging of fees for execution of the payment order 30.1. The payment service provider servicing the payer and/or payee, as well as the payment service provider involved in execution of the payment transaction shall transfer full amount of the payment transaction and unless otherwise agreed upon with the payment service user, shall not charge any fee from the amount transferred. 30.2. The payment service provider may agree with the payee upon charging a service fee from the amount transferred prior to depositing the amount received for the payment transaction to the payee’s payment account. In this case, the information presented to the payee shall separately specify full amount of the payment transaction and the service fee charged from the amount transferred. Article 31. Non-execution or incorrect execution of the payer’s payment order, unreasonable write-off of funds from the payment account 31.1. The payment service provider shall be liable to the payer for non-execution, erroneous execution of the payer’s payment order and unreasonable write-off of funds from the payment account. In this case the payer’s payment service provider shall immediately return to the payer’s payment account the amount of the payment transaction that has not been executed or executed incorrectly, or unreasonably written off the payment account. 31.2. If the payment service provider proves the timely and correct execution of the payment transaction, the payee’s payment service provider shall be liable to the payee for proper execution of the payment transaction. In this case the payment service provider servicing the payee shall immediately deposit the amount of the payment transaction into the payee's payment account or, if there is no payment account, place it at the payee’s disposal. 31.3. If the payment transaction is initiated by the intermediary, the payment service provider servicing the account shall return the payer the amount of the payment transaction that has not been executed, executed incorrectly or unreasonably written off the payment account no later than the next working day. If the payment initiation service provider is liable under Article 31.4 hereof for non-execution, erroneous execution of the payment order or unreasonable write￾off of funds, the payment service provider shall be compensated for the losses resulting from return of funds to the payer. 31.4. If the payment initiation service provider fails to prove that the payment order was received to the payer’s payment account by the payment service provider servicing the payer's account, that the payment transaction was authenticated, correctly registered and was not affected by technical failure or other deficiency, it shall be liable for non-execution, incorrect execution of the payee’s payment order and unreasonable write-off of funds from the payment account. 31.5. If the payment service provider, including the payment initiation service provider, is liable for execution of unexecuted, incorrectly executed payment transactions or unreasonable

write-off of funds from the payment account, the amount of service fees and other expenses paid by the payment service user shall also be reimbursed. 31.6. The payment service user may demand from the payment service provider to pay interest in accordance with Article 449 of the Civil Code of the Republic of Azerbaijan in addition to the amount of the payment transaction, service fee and other expenses for unexecuted, incorrectly executed payment transactions or unreasonable write-off of funds from the payment account. 31.7. The payment service provider shall not be liable for non-execution or incorrect execution of the payment order due to incorrect information provided by the payment service user in the payment order. 31.8. The payment service provider servicing the payer shall, at the payer’s request, without charging any service fee, keep track and report back to the payer on the progress of the payment transaction on the unexecuted, incorrectly executed payment transaction or unreasonable write￾off of funds from the payment account. In this case, the payee’s payment service provider shall share the information not prohibited under the law with the payer’s payment service provider. Article 32. Non-execution or incorrect execution of the payment order by the payee 32.1. When the payment order is issued by the payee, the payee’s payment service provider shall be liable to the payee for timely and proper sending of the payment order to the payer’s payment service provider. 32.2. The payer’s payment service provider shall be liable for failure to execute or incorrectly execute the payment order sent by the payee’s payment service provider. In this case, the payer’s payment service provider shall ensure that the funds for the incorrectly executed payment order are immediately returned to the payer’s payment account or, if required, that the payment order is properly executed. 32.3. When the payment order is presented by the payee directly to the payer’s payment service provider, the payment service provider shall be liable under Article 32.2 hereof. 32.4. When the payment order is issued by the payee, the payee’s payment service provider, shall, at the payee’s request, without charging any service fee keep track and report back to the payee on the progress of the payment transaction on non-executed or incorrectly executed payment order. Article 33. Refund of funds on the payee’s executed payment order 33.1. The payer shall set a limit on the amount to be paid on direct debit. The payer’s payment service provider shall refund the amount of the payment transaction if the payment transaction exceeds the amount determined by the payer for the payee-issued payment order. 33.2. The payer may appeal to his/her payment service provider within 2 (two) months from the date of withdrawal of funds from his/her payment account in the case provided for in the second sentence of Article 33.1 hereof. 33.3. The payment service provider shall refund payment transaction’s amount already paid within 5 (five) working days from the date the payer’s refund claim was received in

accordance with the second sentence of Article 33.1 hereof or provide the payer with substantiated information on the reasons for refusal. Article 34. Unique identifier-based payment transactions 34.1. Unique identifier-based payment transactions shall be deemed duly executed in favor of the payee identified with a unique identifier. 34.2. If the unique identifier presented by the payment service user is incorrect, the payment service provider shall not be liable for payment transactions unexecuted or incorrectly executed due to the said reason. 34.3. If the payment service user presents additional information besides the unique identifier on the payment order, the payment service provider shall be liable for execution of the payment transaction only in consistency with the unique identifier. Article 35. Authentication 35.1. Except as otherwise provided by the regulations of the Central Bank, the payment service provider shall apply strong customer authentication when: 35.1.1. the payer enters the payment account remotely (via Internet, telephone, and other communication channels). 35.1.2. the payer carries out the payment transaction electronically. 35.1.3. the payer carries out any activity that may lead to risks related to fraud and other abuses through channels that may create remote access to the payment account. 35.2. When payment transactions are executed remotely in electronically, the payment service provider shall apply strong customer authentication that consists of elements dynamically related to the transaction amount and the payee. 35.3. The payment service provider, including the payment initiation service provider and the payment service provider providing the account information service, shall protect confidentiality and integrity of the personalized security information of payment service users. Requirements for strong customer authentication applied when using services of payment service providers shall be determined by the Central Bank. 35.4. The payment service provider servicing the payment account shall enable the payment initiation service provider and the account information service provider to trust the authentication procedures applied to payment service users. Article 36. Provision of payment services via payment terminals 36.1. When the payment service provider provides payment services via payment terminals, it shall transfer the funds received from the payer to the payee’s payment account no

later than the next transaction day, unless otherwise provided in the agreement with the payee (the period stipulated in the agreement may not exceed 5 (five) working days). 36.2. Except as otherwise provided by the Central Bank, the payment terminal shall provide the payment service user with information confirming the payment transaction. Requirements for the information confirming payment transactions made through payment terminals and the procedure for submitting information shall be determined by regulations of the Central Bank. Article 37. Restrictions on use of payment instruments and access to payment accounts 37.1. The payment service provider and the payer shall agree upon the maximum amount of payment transactions involving payment instruments. 37.2. In addition to the cases provided by law, the payment service provider shall have the right to block the use of the payment instrument to: 37.2.1. ensure security of the payment instrument. 37.2.2. prevent the payment instrument from being used for fraudulent purposes or by an unauthorized party. 37.2.3. prevent the threat of payer's inability to fulfill his/her liabilities under the credit line allocated for payment instruments. 37.3. The payment service provider shall, in the cases specified in Article 37.2 herein, inform the payer on blocking the payment instrument and its substantiated reason in advance, if possible, or immediately after the blocking at the latest, unless the law prohibits provision of such information. 37.4. The payment service provider shall unblock or replace the payment instrument with a new one, once the situation that caused the payment instrument to be blocked is eliminated. 37.5. The payment service provider servicing the payment account may refuse to allow the account service provider or the payment initiation service provider to access or operate the payment account only if it may justify that it was done without permission or for fraudulent purposes. In such cases, the payment service provider servicing the payment account shall inform the payer of the reasons for refusal. 37.6. The payment service provider that declined access to the payment account shall permit the account information service provider or the payment initiation service provider to gain access to the payment account once the reasons specified in Article 37.5 hereof are eliminated. 37.7. In the cases specified in Article 37.5 hereof, the payment service provider shall immediately notify the Central Bank on the incident that involved the account information service provider or the payment initiation service provider. The information shall include relevant details of the incident and the reasons for the action taken. The Central Bank shall investigate the issue and take appropriate actions under the present Law. Article 38. Responsibilities of the payment service user in relation to the payment instrument and personalized security information 38.1. In relation to the payment instrument the payment service user shall: 38.1.1. use the payment instrument in compliance with the terms and conditions of issue and use of the payment instrument.

38.1.2. immediately ensure security of personalized security information of the payment instrument as soon as the payment instrument is received. 38.1.3. immediately inform the payment service provider or an assignee thereof when it identifies loss, theft, or use of the payment instrument by an unauthorized party. Article 39. Responsibilities of the payment service provider in relation to the payment instrument 39.1. The payment service provider issuing the payment instrument shall: 39.1.1. ensure that personalized security information of the payment instrument is not disclosed to any party other than the payment service user authorized to use the payment instrument. 39.1.2. not send the payment instrument to the payment service user without the latter’s request except for replacement of the payment instrument previously issued to the payment service user. 39.1.3. give a notice to the payment service user within 24 (twenty) four hours in accordance with Article 38.0.3 hereof and provide him/her with appropriate means of communication to request unblocking of the payment instrument, as well as ensure that the supply of notice is maintained for 18 (eighteen) months. 39.1.4. block the payment instrument immediately after a notice is issued by the payment service user in accordance with Article 38.1.3 hereof. 39.1.5. ensure safe sending of the payment instrument and any related personalized security information to the payment service user. Article 40. Exceptions to the use of payment instruments 40.1. For small-value payment instruments specified in Article 20.3 hereof: 40.1.1. Articles 38.1.3, 39.1.3, 39.1.4 and 41.4 hereof shall not apply if the payment instrument does not allow for blocking and restriction of subsequent usage. 40.1.2. Articles 25 and 41 hereof shall not apply if the payment service user uses a non￾identified payment instrument or the payment service provider is unable to prove that the payment transaction was authorized due to other payment instrument-specific reasons, in cases stipulated by regulations of the Central Bank. 40.1.3. If the payer is aware of non-execution of the payment order, the payment service provider may not inform the payment service user about the refusal to execute the payment order. 40.1.4. notification requirements before and after the execution of the payment order determined by Articles 16 and 17 herein, the requirements for withdrawing the payment order determined by Article 28 of this Law shall not apply. 40.1.5. a period different from the one specified in Article 29.4 herein may be applied. Article 41. The payer’s responsibility limit on unauthorized payment transactions

41.1. The payer may incur losses of up to 100 (hundred) manats or up to 100 (hundred) manat equivalent in foreign currency for each unauthorized payment transaction when the payment instrument is lost, stolen, or used by an unauthorized party, other than in cases defined in Article 25.2 hereof. 41.2. Except when the payer has committed fraudulent actions, the payer shall not be liable for losses incurred in case he/she was not aware of the loss, theft, or use of the payment instrument by an unauthorized party prior to the payment transaction, or as a result of use of the payment instrument due to the activity or inactivity of the payment service provider. 41.3. In case of violation of the requirements of Article 38 herein intentionally or through gross negligence, the payer shall be fully responsible for losses incurred on unauthorized payment transactions. 41.4. Except when the payer has committed fraudulent actions, he/she shall not be responsible for the losses incurred through loss, theft, or use of the payment instrument by an unauthorized party, after the payer has informed the payment service provider or its assignee to this effect. 41.5. Except when the payer has committed fraudulent actions, the payer shall not be liable for the losses incurred through use of the payment instrument if the payment service provider has failed to provide the payer with means of communication to report loss, theft, or unauthorized use of the payment instrument or if it does not apply strong customer authentication in accordance with Article 35 hereof. Article 42. Data protection 42.1. Bank secrecy regime shall apply to the information on payment service users, payment accounts and payment transactions, subject to the requirements hereof. 42.2. Delivery of the information on the payment service user by the payment service provider to the payee and other persons involved to the execution of the payment transaction during the provision of the payment service, limited to the information necessary for the payment transaction, shall not be deemed the violation of the bank secrecy regime. 42.3. Payment service providers, other parties involved in provision of payment services, current and former members of governing bodies of such parties, as well as other current and former employees shall be prohibited to illegally disclose the information on payment service users, payment accounts and payment transactions they have come to know through managing payment service providers or discharging their professional duties. 42.4. Payment service providers shall ensure that the provisions of Articles 42.1 and 42.2 hereof are duly reflected in agreements signed with the parties involved in execution of payment transactions. Chapter 6 Payment systems Article 43. Organization of payment systems

43.1. A payment system shall be set up by the operator based on the agreement concluded between at least three direct payment system participants. 43.2. The following parties may be the payment system operators: 43.2.1. the Central Bank 43.2.2. a legal entity with a payment service operator license as per the present Law 43.3. Initial capital of the operator operating under a license shall not fall below the amount of the minimum initial capital set by the Central Bank. 43.4. On the organization of a payment system the operator shall: 43.4.1. determine payment system rules, exercise control over compliance with them by payment system participants. 43.4.2. arrange a risk management system in the payment system. 43.4.3. ensure uninterrupted operation of the payment system, inform the Central Bank and payment system participants in case of an interruption in operation of the payment system. 43.4.4. ensure security of the internal control system, as well as the information system. 43.5. Articles 8 and 10.1 hereof shall also apply to operators operating under license. 43.6. Considering Articles 5.1, 5.2 and 64 hereof, along with arrangement of payment systems by the licensed operator (except for a bank, a local branch of a foreign bank, the national postal operator), no other activities may be carried out other than the maintenance of issuance and acquiring of payment cards. 43.7. Operators, payment system participants, other parties involved in the operation of payment systems, current and former members of governing bodies of those parties, as well as other existing and former employees shall be prohibited to illegally disclose the information on payment service users, payment accounts, as well as processed payment transactions they have come to know through managing payment services or discharging their professional duties. 43.8. Operators shall ensure that the requirements of Articles 42.1 and 42.2 hereof are reflected in the agreement it concludes with the parties involved in the operation of payment systems. 43.9. Interactions between the operator and participants of the payment system shall be governed by the agreement and payment system rules. 43.10. The payment system rules may stipulate direct or indirect participation. 43.11. A direct payment system participant shall open a correspondent or current account with the settlement agent, while the indirect participant with the direct participant to make settlements with other payment system participants. 43.12. Interactions between the payment system’s direct and indirect participants shall be governed by the agreement and payment system rules. Article 44. Payment system rules 44.1. The payment system rules shall cover at least: 44.1.1. conditions for participation, suspension of participation, and exit from the payment system 44.1.2. rights and responsibilities of the operator and participants. 44.1.3. operating procedures of the payment system. 44.1.4. procedures, format and structure of clearing, settlements, and reporting.

44.1.5. format and structure of processed payment orders. 44.1.6. conditions for acceptance and irrevocability of payment orders. 44.1.7. set up and management of information systems, as well as information security guidelines. 44.1.8. risk management and reporting arrangements. 44.1.9. liquidity provision technique in case of completion of settlements. 44.1.10. settlement currency(ies). 44.1.11. services provided and fees charged. 44.1.12. dispute resolution between participants. 44.1.13. responsibilities of parties for violation of payment system rules. 44.2. The operator shall ensure compliance of payment system rules with the requirements of the present Law. 44.3. The operator may unilaterally change payment system rules. Changes to payment system rules shall be applied 1 (one) month after notification of system participants. 44.4. The operator shall not discriminate between participants in payment system rules, and not hinder participation in the payment system, unless it is necessary to prevent any potential risks for the payment system from occurring. 44.5. Payment system rules may not impose any of the following requirements upon participants: 44.5.1. restriction of participation in any other payment systems. 44.5.2. any terms that would differentiate among payment system participants in respect of their rights and responsibilities. 44.5.3. any restrictions depending on the type of the payment service provider. Article 45. Settlements 45.1. A payment system participant may also be a settlement agent and/or an operator of the payment system. 45.2. The Central Bank, a domestic bank or a local branch of a foreign bank may act as the settlement agent. In the payment system, only the Central Bank shall act as a settlement agent for settlements in manats between local banks, local branches of foreign banks and/or the national postal operator. 45.3. The operator and settlement agent shall operate in compliance with the requirements of the present Law, payment system rules and the agreement signed with payment system participants. 45.4. The settlement agent shall settle payment orders over participants’ correspondent or current accounts. 45.5. The settlement agent may complete settlements in the clearing payment system by establishing requirements with respect to participants’ correspondent and current accounts, as well as by applying collateral mechanisms for cash, government bonds or securities issued by the Central Bank. Such collateral shall be deemed financial collateral, and Articles 1078-23.19 of the Civil Code of the Republic of Azerbaijan shall apply to the collateral of these funds, and until the

settlements in the payment system are completed, these funds may not be seized at the request of third parties. Article 46. Irrevocability of payment orders in payment systems The payment order accepted by the payment system may not be revoked by the participant or other party from the time specified by the payment system rules Article 47. Finality of payment system settlements 47.1. When resolution of the payment system participant or operator, voluntary restructuring of liabilities or bankruptcy proceedings are initiated, the execution procedure of the payment order shall be determined by the present Law and the Law of the Republic of Azerbaijan ‘on Banks’. 47.2. Payment orders included in the payment system and deemed irrevocable under payment system rules shall remain valid if a decision is made on the actions specified in Article 47.1 hereof and be binding upon third parties, provided that the payment orders are irrevocable until the decision enters into force and that the operator is not proven to have been aware of the decision until the payment order’s irrevocability. 47.3. No normative legal act or order that invalidates or delays any deals concluded before the decisions on the actions specified in Article 47.1 hereof took effect shall invalidate results of the clearing operation processed through the payment system. 47.4. The participant shall immediately send information on the actions specified in Article 47.1 hereof to its payment system operator. 47.5. The operator shall immediately notify other payment system participants when it receives information about the participant on the actions specified in Article 47.1 hereof. Chapter 7 Licensing and agreement-based activities of foreign payment institutions, electronic money institutions and operators Article 48. General licensing and registration requirements 48.1. The payment institution, the electronic money institution, and the operator (except for the Central Bank) may carry out activities in payment services and payment systems after obtaining a license under the present Law. 48.2. The use of the words ‘payment system’ in the name of the parties not engaged in operator activities, and ‘payment institution’ or ‘electronic money institution’ in the name of the parties not engaged in provision of payment services shall be prohibited. 48.3. The payment institution exclusively engaged in provision of account information services may provide account information services by registering with the Central Bank hereunder. If that payment institution wishes to provide other payment services, it shall obtain a license hereunder.

48.4. Banks and local branches of foreign banks, non-bank credit institutions, as well as the national postal operator shall provide payment services under the licenses obtained in accordance with the Laws of the Republic of Azerbaijan ‘on Banks’ and ‘on Postal Service’. These institutions shall notify the Central Bank in writing at least 1 (one) month prior to proceeding with the payment services specified in Articles 3.1.5 - 3.1.7 hereof. 48.5. The license, specified in Article 48.1 herein, shall be perennial and take effect upon issuance, may be used only by an obtaining party, and may not be transferred to third parties. 48.6. The license issued to the payment institution, electronic money institution and the operator shall specify: 48.6.1. the license date and registration number 48.6.2. the name and address of the issuing authority 48.6.3. license holder details (name and legal address of the legal entity, a branch office of the foreign legal entity) 48.6.4. the type of licensed activity 48.6.5. the name of the payment system if an operator 48.7. A state duty shall be payable for issuance of a license in the amount and under the procedure established by the Law of the Republic of Azerbaijan ‘on State Duties’. 48.8. The Central Bank shall obtain information from public authorities (institutions) to verify the information contained in submitted documents. Public authorities (institutions) shall provide the information requested by the Central Bank within 7 (seven) working days. This request shall also apply to persons (if a legal entity, heads of its executive bodies) willing to acquire shares in the payment institution, the electronic money institution, and the operator subsequently and beneficiary owners. Public authorities (institutions) may not refuse to provide the requested information, with reference to whether the requested information is a commercial secret, a tax secret or other confidential information protected by law, except for state secrets. 48.9. Where the documents or information specified in Chapter 7 herein can be obtained from the relevant public authority (institution) through the Electronic Government Information System, those documents or information shall not be requested from the applicant. Where such documents or information cannot be obtained through the Electronic Government Information System, their submission shall be requested from the relevant public authority (institution) upon request with the consent of the applicant or shall be provided by the applicant. 48.10. Conviction of persons for whom the civil impeccability requirement is established by this Law shall be determined based on a reference issued by the authority (institution) determined by the relevant executive authority upon request of the Central Bank. If those persons are foreigners, a reference shall be submitted on whether they have been prosecuted by relevant authorities of their country of residence. 48.11. Documents submitted by foreigners and foreign legal entities for obtaining a license provided for in Chapter 7 herein shall be legalized or apostilled according to the legislation. 48.12. When reviewing the documents submitted for issuance of a license to the foreign payment institution, electronic money institution and a local branch of the operator, the Central Bank may appeal to relevant authorities of foreign countries for clarification of information on submitted documents.

48.13. After the payment institution, the electronic money institution and the operator are licensed, the Central Bank shall inform the authority (institution) designated by the relevant executive power authority within 5 (five) working days. Article 49. Appeal for licensing of payment and electronic money institutions 49.1. A license applicant shall apply to the Central Bank specifying the type of payment services for the activity to be licensed. 49.2. Considering the requirements of Article 48.9 herein, the application shall be attached with the following information and documents: 49.2.1. a decision of the authorized body of the legal entity 49.2.2. a copy of the charter and extract from the state register of legal entities either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’ 49.2.3. information and documents on the amount of initial capital, a share (stock) per participant and the source of funds channeled to acquisition of shares (stocks). 49.2.4. documentary evidence that the amount of the initial capital is not below the required minimum established by the Central Bank in accordance with Article 4.2 hereof. 49.2.5. documents confirming compliance of qualifying holding owners with Article 61.4 herein. 49.2.6. information on civil impeccability of applicant’s persons performing management functions, including a copy of documents that confirm that the head of the management body meet the requirements specified in Articles 60.1 and 60.3 herein either notarized or approved as per Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’ 49.2.7. information on applicant’s organizational structure, management bodies, relations between its participants in the form specified by the Central Bank and beneficiary owners, including information on their civil impeccability established with the present Law. 49.2.8. an action plan for payment services to be provided and a business plan for first 3 (three) years. 49.2.9. information on the applicant's internal control and risk management system, as well as security measures to protect against fraudulent activities and illegal use of personal data while providing payment services. 49.2.10. emergency business continuity and recovery plan. 49.2.11. procedures to record, monitor, track and restrict access to sensitive payment information. 49.3. The Central Bank shall determine requirements for the activity program and the business plan on the payment service to be provided, internal control and risk management systems, including security measures on the provision of payment services, business continuity and recovery plans in emergency situations, as well as the procedures specified in Article 49.2.11 herein. Article 50. License application review for payment and electronic money institution

50.1. The review of the license applications shall be carried out within 60 (sixty) days from the submission date. 50.2. Where the Central Bank identifies any deficiencies in the license submissions that may be remedied and do not cause refusal to issue a license, it shall submit or send a written notice to the applicant to this effect within 20 (twenty) working days from the registration date of the license application and shall explain legal ramifications of non-compliance with formal requirements. 50.3. The applicant shall eliminate such deficiencies within 15 (fifteen) working days at the latest from the date the written notice was received. The written notice submitted or sent by the Central Bank shall suspend the license application review period as identified under Article 50.1 hereof and such suspension time shall not be added to the license application review period. The license application review period shall be reinstated after the applicant notifies the Central Bank in writing on removal of deficiencies. 50.4. When the Central Bank decides to issue a license, it shall inform the applicant on paying the state fee within 2 (two) working days. 50.5. Within no later than 2 (two) working days from submission of a documentary evidence of payment of the state license fee to the Central Bank, the license shall be submitted or sent to the applicant. If the document confirming the fact of payment of the state license fee is not submitted within 5 (five) working days, the license shall be revoked by the Central Bank and related information shall be submitted or sent to the applicant within 2 (two) working days. 50.6. The Central Bank shall refuse to issue a license when: 50.6.1. the applicant fails to eliminate deficiencies indicated in the written notice within the timeframe specified in Article 50.3 hereof or the documents submitted have been found to contain inaccurate or distorted information. 50.6.2. the actions plan for payment services to be provided and business plan, amount of initial capital, internal control, and risk management systems, including security measures for provision of payment services, emergency business continuity and recovery plan, as well as procedures provided for in Article 49.2.11 hereof do not meet the requirements of Article 49.3 hereunder. 50.6.3. applicant’s persons performing management functions fail to meet the civil impeccability requirement, head of the executive body fails to meet the requirements specified in Articles 60.1 and 60.3 herein. 50.6.4. qualifying holding owners fail to meet the requirements specified in Article 61.4 herein, while beneficiary owners fail to meet the civil impeccability requirement. 50.6.5. facts are available that the influence of qualifying holding or beneficial owners on the applicant will endanger its reliable and prudential management, or the source of applicant’s initial capital is unknown. 50.7. Where the Central Bank decides to refuse to issue a license, the decision shall be submitted or sent to the applicant substantiating the reasons for refusal within 2 (two) working days. 50.8. After the applicant that received refusal to be licensed eliminates identified errors and deficiencies, it shall re-apply to the Central Bank for a license. In this case, it shall be reviewed as a new appeal according to Article 50.1 herein.

50.9. The applicant may appeal a decision on refusal to issue a license in court. 50.10. Where the payment or electronic money institution is reorganized, its name or legal address changes, it shall appeal to the Central Bank to make relevant changes in the register and re-formalization of the license. In consideration of the requirements of Article 48.9 herein, the application shall be attached with the current license, the renewed charter, and an excerpt from the state register of legal entities either notarized or approved in accordance with Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 50.11. After the application and attached documents are received according to Article 50.10 herein, the Central Bank shall review the appeal on re-formalization of the license within 5 (five) working days and in case of no deficiency in submitted documents, it shall provide a re￾formalized license for an applicant. Where deficiencies are revealed in submitted documents, a decision is made on refusal to issue a re-formalized license and written information is provided to the applicant within 2 (two) working days substantiating the reasons for refusal. The re￾formalized license shall be submitted or sent to the payment or electronic money institution. 50.12. If the payment institution or electronic money institution applies for a payment service outside the scope of its current license, it shall attach relevant changes to the documents specified in Articles 49.2.8 – 49.2.11 herein with the appeal. The Central Bank shall review the appeal within 30 (thirty) working days and make a relevant decision. Within 2 (two) working days after the decision is made, the re-formalized license or a substantiated decision on the issue of the license shall be submitted or sent to the payment or electronic money institutions. 50.13. If the payment or electronic money institution applies for a payment service outside the scope of its current license, Articles 50.2, 50.3, 50.6.1 and 50.6.2 herein shall apply to the review by the Central Bank of the appeal of the payment or electronic money institution on re￾formalization of the license. 50.14. Where the license is lost, damaged, or destroyed, the payment or electronic money institution shall apply to the Central Bank for a duplicate license. If a license duplicate is requested for a damaged license, the application shall be attached with the damaged license. 50.15. The Central Bank shall, within 7 (seven) working days from receipt of the application and supporting documents filed in accordance with Article 50.14 hereof, develop a duplicate of the license lost, damaged, or destroyed and submit or send to the payment or electronic money institution. 50.16. During the license re-formalization or duplication period according to Articles 50.10 and 50.14, the payment and electronic money institution shall provide their operations based on a relevant document submitted by the Central Bank. 50.17. The renewed license issued to the payment or electronic money institution under this Article shall reference to all previously issued licenses by the Central Bank. 50.18. The information and documents to be sent in accordance with Articles 50.2, 50.3, 50.5, 50.7, 50.11, 50.12 and 50.15 herein shall be sent either electronically or by registered mail. Article 51. Opening of branch and representative offices of payment or electronic money institutions

51.1. Payment and electronic money institutions shall be free to open branches and representative offices considering the requirements of the present Law. 51.2. Payment and electronic money institutions, that are compliant with the requirements specified in Article 49.3 herein, as well as that have information systems available to transmit information on operations conducted in branch offices to payment and electronic money institutions in a real time mode may open branch offices in the Republic of Azerbaijan. 51.3. The payment and electronic money institution shall send a written notice to the Central Bank within 7 (seven) working days after a decision on the opening of a branch office is taken. The notice shall be attached with a copy of the decision of the authorized management body on opening a branch office approved appropriately and a copy of the ID card of the branch manager either notarized or approved in accordance with Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’ considering the requirements of Article 48.9 herein. The notice shall include the information on the address of the branch, its commencement date, and the payment services to be provided by the branch. If the Central Bank fails to pass an opinion on the notice within 14 (fourteen) working days or a written notice is not sent on non-observance of the corrective measures of the present Law, as well as on incompliance by the payment or electronic money institution with the requirements specified in the present Law for the opening of a local branch, the local branch may start functioning. 51.4. Payment and electronic money institutions shall submit to the Central Bank written information on opening of a representative office in the Republic of Azerbaijan within 5 (five) working days from the day a relevant decision was made. The information shall specify the name and address of the representative office and a copy of the ID card of the representative office manager either notarized or approved in accordance with Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’ considering the requirements of Article 48.9 herein. 51.5. A payment or an electronic money institution that opens a branch or representative office in a foreign country shall provide written information to the Central Bank within 5 (five) working days after starting functioning in its host country. 51.6. When payment and electronic money institutions decide to suspend or terminate their branches and representative offices, they shall send a written notice to the Central Bank within 5 (five) working days substantiating the reasons. The notice shall specify the procedure for transfer of assets and liabilities of the structural unit either suspended or terminated to the payment or electronic money institution or their other structural unit. Article 52. Licensing of the local branch of the foreign payment institution and foreign electronic money institution 52.1. The foreign payment institution and foreign electronic money institution shall submit the following documents to the Central Bank for obtaining a license for a local branch office considering the requirements of Article 48.9 herein: 52.1.1. copies of the charter of the foreign payment or electronic money institution, as well as the statute of the local branch of the foreign payment or electronic money institution and the

excerpt from the state register of legal entities either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 52.1.2. a copy of the decision made by the competent body of the foreign payment or electronic money institution on establishment of a branch office and appointment of the head of the branch. 52.1.3. a copy of the payment institution and electronic money institution’s license or other documentary authorization obtained in the home country to engage in the business of the payment or electronic money institution. 52.1.4. audited financial statements of the foreign payment and electronic money institution for the last financial year and auditor opinion. 52.1.5. documentary evidence confirming that funds allocated to the local branch of the foreign payment and electronic money institutions are not less than the minimum amount set under Article 4.2 herein. 52.1.6. documents identified in Articles 49.2.6-49.2.11 hereof. 52.1.7. copies of documents confirming compliance of the head of the branch with the requirements specified in Articles 60.1 and 60.3 herein either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 52.1.8. documentary evidence confirming that the foreign payment institution and electronic money institution shall be responsible for local branch office’s liabilities. 52.1.9. a list of qualifying holding owners of the foreign payment institution and electronic money institution, indicating their respective shares. 52.2. The local branch office shall provide payment services limited solely to the range of the payment services provided by the foreign payment institution or electronic money institution specified in Article 3.1 hereof. 52.3. License applications for establishing a local branch office shall be reviewed and licenses shall be issued in accordance with Article 50 hereof. 52.4. The Central Bank shall refuse to issue a license for the local branch office of the foreign payment and electronic money institution when: 52.4.1. there are grounds specified in Articles 50.6.1 and 50.6.2. 52.4.2. the head of the local branch does not meet the requirements of Articles 60.1 and 60.3 hereof. 52.4.3. the financial condition of the foreign payment institution and foreign electronic money institution is unsatisfactory for safe operation of the local branch. 52.4.4. the home country’s laws do not impose supervisory requirements with respect to the payment institution or electronic money institution’s operations that are the same or more stringent than those established under the laws of the Republic of Azerbaijan, or the Central Bank fails to discharge its functions because supervisory authorities of that country refuse to cooperate. Article 53. Activities of foreign payment service institutions, electronic money institutions and operator on a contractual basis

53.1. Payment service providers may enter into agreement with foreign payment service providers and foreign operators for provision of payment services, provided that the foreign service provider and foreign operator have an appropriate license (permit) in accordance with the legislation of the country of registration and/or exercise control over their activities, including control over the prevention of the legalization of criminally obtained funds and the financing of terrorism. 53.2. The payment service provider shall notify the Central Bank and the authority (institution) designated by the relevant executive authority on the agreement concluded with the foreign payment service provider or foreign operator in accordance with Article 53.1 hereof, as well as the termination of the agreement no later than 5 (five) working days. Article 54. Revocation of the license of the payment or electronic money institution 54.1. The Central Bank shall revoke the license of the payment institution and electronic money institution issued hereunder if any of the following applies: 54.1.1. the license holder applies for revocation of the license 54.1.2. the payment and electronic money institution fail to perform corrective actions applied hereunder. 54.1.3. incorrect report or information is intentionally submitted to the Central Bank, or no report is submitted as of the last two consecutive reporting dates. 54.1.4. activities out of the scope of the license are carried out. 54.1.5. in case of imposition of an administrative penalty on the payment or electronic money institution more than twice within a year for violation of the requirements of the Laws of the Republic of Azerbaijan ‘on Prevention of the legalization of criminally obtained property and the financing of terrorism’ and ‘on Targeted financial sanctions’ 54.1.6. the payment or electronic money institution is liquidated or declared bankrupt. 54.1.7. later in the process incorrect or inaccurate information is found in documents submitted for the issuance of a license. 54.1.8. the payment or electronic money institution has not started its operation within 12 (twelve) months from the date of entry into force of the license or it was found out that it did not provide payment services for 6 (six) consecutive months. 54.1.9. there are facts that indicate that the influence of qualifying holding or beneficial owners on the licensee will endanger its reliable and prudent management. 54.2. The license issued to the local branch of the foreign payment or electronic money institution shall be revoked if any or some of the following applies: 54.2.1. there are grounds stipulated by Articles 54.1.1-54.1.8 hereof exist. 54.2.2. the foreign country’s competent authority has prohibited the local branch office of the foreign payment or electronic money institution from operating. 54.2.3. the license (or document confirming the right for this activity) of the foreign payment or electronic money institution to provide relevant payment services in its home country has been revoked.

54.2.4. the Central Bank fails to supervise the local branch of the foreign payment or electronic money institution, since the regulatory and supervisory authority of the home country of the foreign payment or electronic money institution does not supervise it properly. 54.3. The license shall be revoked by the Central Bank’s resolution with reference to the circumstances stated in Articles 54.1 and 54.2 hereof. The resolution shall be sent to the relevant payment institution, electronic money institution or the authority (institution) designated by the relevant executive power authority not later than the working day immediately following the date of issue, as well as announced in media. 54.4. The Central Bank’s resolution to revoke a license may be appealed in court. Filing of an appeal shall not affect the enforcement of the Central Bank’s relevant resolution Article 55. Appeal for a license for the operator 55.1. The application submitted to the Central Bank for an operator license shall be attached with the following information and documents considering the requirements of Article 48.9 herein: 55.1.1. a decision of the competent governing body of the legal entity on the provision of the operator activity. 55.1.2. copies of the charter and an excerpt from the public register of legal entities either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 55.1.3. information and documents on the amount of initial capital, a share (stock) per participant and the source of funds channeled to acquire the share (stock). 55.1.4. documentary evidence that the amount of initial capital is not below the minimum amount established by Article 4.2 herein. 55.1.5. documents confirming compliance of qualifying holding owners with Article 61.4 herein. 55.1.6. copies of documents confirming compliance of the head of the applicant’s governing body with the requirements of Article 60.2 herein either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 55.1.7. a business plan for the first 3 (three) years. 55.1.8. payment system rules that meet the requirements specified in Article 44 herein. 55.1.9. a list of key hardware and software operated in support of the payment system, a topological diagram of their interactions. 55.1.10. names and legal addresses of the settlement agent and a statement on integration agreed with the settlement agent (if the operator is not acting as the settlement agent). 55.1.11. information on integrated payment systems and an integration scheme. 55.1.12. information on the applicant's organizational structure, governing bodies, relations between participants as determined by the Central Bank, and beneficiary owners, including information on their civil impeccability specified by the present Law. 55.1.13. information on internal control system, management system of financial, operational, and other risks the payment system participants may face, as well as security

measures to protect against fraudulent activities, illegal use of sensitive payment information and personal data. 55.1.14. emergency business continuity and recovery plan. 55.2. Banks and local branches of foreign banks applying for a license to operate as operators shall submit the documents specified in Articles 55.1.1, 55.1.7 – 55.1.11 and 55.1.13 hereof. 55.3. The Central Bank shall determine requirements for the operator’s business plan, internal control system, risk management system, including security measures to protect against frauds, illegal use of sensitive payment data and private information, as well as emergency business continuity and recovery plan. Article 56. Review of the operator license appeal 56.1. The Central Bank shall review the appeal for an operator license in the order specified in Articles 50.1-50.5 and 50.8 herein. 56.2. The Central Bank shall refuse to issue a license when: 56.2.1. the applicant fails to eliminate shortcomings specified in a written notice within the deadline set in Article 50.3 herein or documents submitted have been found to contain inaccurate or distorted information. 56.2.2. submitted documents have been found to be non-compliant with the requirements of this Law 56.2.3. the head of the applicant’s governing body fails to meet the requirements specified in Article 60.2 and 60.4 herein. 56.2.4. qualifying holding owners fail to meet the requirements specified in Article 61.4 herein, and beneficiary owners fail to meet the civil impeccability requirement. 56.2.5. facts are available that the influence of qualifying holding or beneficial owners on the applicant will endanger its reliable and prudential management, or the source of applicant’s initial capital is unknown. 56.2.6. the business plan, internal control system, risk management system, including security measures to protect against frauds, illegal use of sensitive payment data and private information, as well as emergency business continuity and recovery plan fail to meet the requirements specified in Article 55.3 herein. 56.3. The decision on rejection to issue a license shall be substantiated with reference to the grounds for rejection. The applicant may appeal such a decision in court. 56.4. Where the operator is reorganized, renamed or its legal address is changed, it shall apply to the Central Bank for license re-formalization and for a duplicate license if the license is lost, damaged, or destroyed. Those appeals shall be reviewed as per Articles 50.10, 50.11 and 50.14-50.17 hereof. Article 57. Licensing of the local branch of the foreign operator 57.1. To obtain a license for the local branch of the foreign operator, the following documents shall be submitted to the Central Bank: 57.1.1. copies of the charter of the foreign operator, the statute of the local branch of the foreign operator, as well as an extract from the state register of legal entities either notarized or

approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Public Procurements’. 57.1.2. a copy of the decision made by the authorized body of the foreign operator on establishment of the branch and appointment of the head of the branch. 57.1.3. a copy of the valid operator license or documentary authorization to act as an operator obtained in the home country. 57.1.4. documents specified in Articles 55.1.6 – 55.1.14 hereof. 57.1.5. copies of documents confirming compliance of the head of the branch with the requirements established by Article 60.2 hereof either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Public Procurements’. 57.1.6. a list of foreign operator’s qualifying holding owners, indicating their shares. 57.1.7. documentary evidence that the funds allocated to the local branch of the foreign operator do not fall below the minimum amount according to Article 4.2 herein. 57.1.8. a document confirming the obligation of the foreign operator to be responsible for liabilities of the local branch. 57.2. License application for the foreign operator shall be reviewed in accordance with Article 56 hereof. 57.3. The Central Bank shall reject to issue a license for the local branch in the following cases 57.3.1. in cases provided for in Articles 56.2.1, 56.2.2 and 56.2.6 hereof. 57.3.2. the head of the local branch of the foreign operator fails to meet the requirements under Articles 60.2 and 60.4 hereof. 57.3.3. the home country’s laws do not impose supervisory regime with respect to the foreign operator’s activities that are the same or more stringent than those established under the laws of the Republic of Azerbaijan, or the Central Bank fails to discharge its functions because supervisory authorities of that country refuse to cooperate. Article 58. Revocation of the operator’s license 58.1. The Central Bank shall revoke the license issued for the operator issued hereunder if one or some of the following applies: 58.1.1. the license holder applies for cancellation of the license. 58.1.2. the operator fails to perform corrective actions applied hereunder. 58.1.3. incorrect report or information is intentionally submitted to the Central Bank, or no report is submitted as of last two consecutive reporting dates. 58.1.4. the operator is liquidated or declared bankrupt. 58.1.5. later in the process inaccurate or distorted information is found in the documents submitted for the issuance of a license. 58.1.6. the operator has not started its operation within 12 (twelve) months from the date of entry into force of the license or it did not perform any operation on the payment system for 6 (six) consecutive months. 58.1.7. the banking license of the bank or the local branch of the foreign bank acting as an operator is revoked.

58.1.8. activities out of the scope of Article 43.6 hereof are performed. 58.1.9. facts are available that the influence of qualifying holding or beneficial owners on the operator will endanger its reliable and prudential management. 58.2. The license issued to the local branch of the foreign operator shall be revoked if any or some of the following applies: 58.2.1. circumstances stipulated in Articles 58.1.1-58.1.8 hereof exist. 58.2.2. the foreign country’s competent authority prohibits the local branch office from operating. 58.2.3. the license (or document confirming the right for this activity) of the foreign operator to carry out operator activity in its home country is revoked. 58.2.4. the Central Bank fails to supervise the local operator of the foreign operator since the regulatory and supervisory authority of the home country of the foreign operator does not supervise it properly. 58.3. The license shall be revoked by the Central Bank’s resolution with reference to the circumstances stated in Articles 58.1 and 58.2 hereof. The resolution shall be sent to the operator and the authority (institution) designated by the relevant executive power authority not later than the working day immediately following the date of issue, as well as announced in media. 58.4. The Central Bank’s resolution to revoke a license may be appealed in court. Filing of an appeal shall not affect the enforcement of the Central Bank’s relevant resolution. Article 59. Registering and de-registering of the account information service provider 59.1. A legal entity willing to exclusively provide account information services shall apply to the Central Bank for the payment institution status and to be included in the register. 59.2. The application shall be attached with the following documents in consideration of the requirements of Article 48.9 herein: 59.2.1. copies of the charter and the excerpt from the public register of legal entities either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Public Procurements’. 59.2.2. an activity plan for the payment service to be provided. 59.2.3.a document confirming civil liability insurance at an insurer that is not a related party and does not belong to the same financial group in the amount not less than the amount of damage or issue of a guarantee from a credit institution or an insurer that is not a related party and does not belong to the same financial group. 59.2.4. copies of documents confirming compliance of the head of the applicant’s governing body with the requirements specified in Article 60.1 herein either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Public Procurements’. 59.2.5. information on applicant’s organizational structure, governing bodies. 59.2.6. a business plan for the first 3 (three) years. 59.2.7. information on the applicant’s internal control and risk management system, as well as security measures to protect against fraudulent activities while providing payment services and illegal use of personal data. 59.2.8. an emergency business continuity and recovery plan.

59.2.9. procedures for recording, monitoring, tracking, and restricting access to sensitive payment information 59.3. The Central Bank shall review documents attached with the application within 15 (fifteen) working days from the date of receipt and inform the applicant institution within 2 (two) working days in writing about the reasons for inclusion or refusal to be included in the register. 59.4. The Central Bank shall refuse to include the institution in the register when: 59.4.1. documents are not submitted in full and have been found to contain inaccurate or distorted information. 59.4.2. the head of the applicant's executive body fails to meet the requirements established by Article 60.1 hereof. 59.4.3. incompliance has been found in submitted documents with the requirements of the present Law and regulations of the Central Bank according to the present Law. 59.5. The applicant may appeal the refusal decision made by the Central Bank in court. 59.6. The Central Bank de-registers (removes from the register) the account service information provider if any or some of the following applies: 59.6.1. the account information service provider files a relevant application. 59.6.2. the account information service provider fails to perform corrective actions imposed in accordance with the present Law, regulations of the Central Bank. 59.6.3. incorrect report or information is intentionally submitted to the Central Bank, or no report is submitted as of last two consecutive reporting dates. 59.6.4. the account information service provider is liquidated or declared bankrupt. 59.6.5. later in the process inaccurate or distorted information is found in the documents submitted for inclusion in the register of the account information service provider. 59.6.6. the account information service provider has not started its operation within 12 (twelve) months from the date of its registration or it was found out that it did not provide any account information service for 6 (six) consecutive months. 59.6.7. it is found that it provides other payment services other than account information services. 59.7. The Central Bank shall notify the account information service provider and the authority (institution) designated by the relevant executive power authority not later than the working day immediately following the date of de-registering, as well as announce in media. 59.8. The Central Bank’s resolution to de-register may be appealed in court. Filing of an appeal shall not affect the enforcement of the Central Bank’s relevant resolution. Article 60. Requirements for heads of supervised entities 60.1. Heads of governing bodies of payment or electronic money institutions, local branches of foreign payment or electronic money institutions shall meet the following requirements: 60.1.1. higher education 60.1.2. at least two-year experience in payment services or four-year experience with the Central Bank or in areas of activity where financial services, regulated and supervised by the Central Bank are provided 60.1.3. civil impeccability

60.2. the head of the operator’s governing body shall meet the requirements specified in Articles 60.1.1 and 60.1.3 herein, have at least four-year experience with the Central Bank or in areas of activity where financial services, regulated and supervised by the Central Bank are provided or in payment systems. 60.3. Persons who were in charge of the executive body (member) or directly in charge of payment services management of the payment or electronic money institution for a period of not less than one year prior to the date of revocation of the license of the payment or electronic money institution on the grounds provided for in Articles 54.1.2-54.1.7 hereof, shall not serve as the head (member) of the governing body of another payment or electronic money institution, or the head of the local branch of the foreign payment or electronic money institution and may not directly guide the management of payment services for the period of 2 (two) years. 60.4. A person who was the head (member) of the operator's executive body for a period of not less than 1 (one) year prior to the date of revocation of the operator's license on the grounds provided for in Articles 58.1.2 - 58.1.5 herein may not be the head (member) of the executive body of another operator for a period of 2 (two) years. 60.5. Provisions of Article 60.2 hereof shall not apply to heads of banks, local branches of foreign banks and the head of the national postal operator acting as an operator 60.6. The requirements specified in Articles 60.2 and 60.4 shall also apply to heads of local branches of foreign operators. 60.7. The appeal addressed to the Central Bank for changes in the register on executive bodies or heads of supervised entities shall be attached with documents confirming compliance of those parties with the requirements of Article 60 hereof. Article 61. Qualifying holding 61.1. A qualifying holding owner of the payment or electronic money institution or operator shall meet the requirements set forth in Article 61.4 hereof. Any party may acquire qualifying holding in initial capital of the payment or electronic money institution or operator, as well as an additional share that would increase their current share to qualifying holding, including a share that increases the qualifying holding to 20, 33 or 50 percent of the initial capital, exceeds that level, or would result in the payment institution, electronic money institution or operator becoming a subsidiary of that party only upon consent of the Central Bank in accordance with this Law. 61.2. Prior to acquiring a share under Article 61.1 hereof, the payment or electronic money institution or operator shall apply in writing to the Central Bank to obtain a permit. 61.3. The application shall be attached with the following documents considering the requirements of Article 48.9 herein: 61.3.1. if the qualifying holding owner is an individual: 61.3.1.1. a copy of the individual’s ID either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 61.3.1.2. documents confirming compliance with the eligibility criteria for grant of permit specified in Articles 61.4.1 and 61.4.2 herein. 61.3.2. if the qualifying holding owner is a legal entity:

61.3.2.1. copies of an excerpt from the public register of legal entities and the charter either notarized or approved according to Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 61.3.2.2. a copy of the decision of its competent authority to acquire the intended qualifying holding. 61.3.2.3. documents confirming compliance of the legal entity and the head (members) of the executive body of the legal entity with the terms specified in Article 61.4 herein. 61.3.3. a source of funds of the qualifying holding owner channeled to acquisition of qualifying holding. 61.4. Conditions for issue of permit for acquisition of qualification holding shall include: 61.4.1. the head (members) of the governing body of the individual and legal entity who will acquire qualifying holding shall meet the civil impeccability requirement. 61.4.2. no court decision in effect on criminal and legal proceedings or bankruptcy proceedings against the legal entity that will acquire qualifying holding. 61.4.3. the source of funds channeled to acquisition of qualifying holding is known, as well as there are no facts available that the influence of the qualifying holding owner on the payment or electronic money institution or the operator will endanger its reliable and prudential management. 61.5. Compliance with the condition specified in Article 61.4.2 herein shall be confirmed with the information signed by the applicant. 61.6. The application and attached documents shall be reviewed within 60 (sixty) days from the date of submission as per Articles 50.2, 50.3, 50.7 and 50.8 herein. In the event the Central Bank fails to express its attitude to the application in writing during that period, the application shall be deemed to have been positively reviewed. 61.7. The decision on granting or rejecting a permit shall be submitted to the payment institution, electronic money institution or operator within 2 (two) working days from the date it was made or sent either electronically or by registered mail. The permit issued by the Central Bank shall specify the deadline for the acquisition of the participation share to be completed. 61.8. In case the documents specified in Article 61.3 are submitted not in full, or there is incompliance with the conditions specified in Article 61.4 herein, a substantiated decision shall be made on rejecting to issue a permit. The payment or electronic money institution may appeal the decision in court. 61.9. Within 5 (five) working days from the end of the deadline for paying the qualifying holding as specified in Article 61.7 hereof, the supervised entity shall submit a written notification on acquisition of shares to the Central Bank. 61.10. In case any party willing to acquire qualifying holding fails to acquire or fully acquire that share by the deadline set for the share payment, the Central Bank shall revoke the permit in full or to the extent of the shortfall within 5 (five) working days after the deadline for notification specified in Article 61.9 expires and submit a written notice to that person or send it either electronically or by registered mail. 61.11. In the event any person acquires qualifying holding without a prior permit or after the deadline specified in Article 61.7 expires, the Central Bank shall issue a written instruction to cancel that party's unauthorized part of the share in the relevant payment institution, electronic

money institution or operator until the date it specifies. The right of that party to vote in the part to be cancelled shall not be considered in making decisions of the payment institution, electronic money institution or operator. 61.12. If the operator is a bank, requirements for qualifying holding owners shall apply as outlined in the Law of the Republic of Azerbaijan ‘on Banks’. Chapter 8 State regulation and supervision of payment services and payment systems Article 62. Regulation and supervision 62.1. The Central Bank shall regulate and supervise the activities of payment service providers and operators in the Republic of Azerbaijan. 62.2. Activities of banks, local branches of foreign banks, non-bank credit institutions and the national postal operator in payment services shall be regulated and supervised in accordance with the Laws of the Republic of Azerbaijan ‘on Banks’, ‘Non-bank credit institutions’ and ‘on Postal Service’, considering the requirements of this Law as well. 62.3. According to the present Law, to regulate and supervise payment services and systems the Central Bank shall: 62.3.1. adopt regulations on execution of payment transactions by payment service providers, requirements for payment instruments and ensuring of information security by supervised entities, as well as other regulations under the present Law. 62.3.2. license supervised entities and include them to the register in the cases specified in the present Law. 62.3.3. receive and analyze reports and documents on activities of supervised entities, as well as information and documents on operations of payment service users. 62.3.4. inspect supervised entities, including payment agents. 62.3.5. impose corrective actions pursuant to the law, revoke issued licenses. 62.3.6. take actions to protect the rights of payment service users. 62.3.7. take other regulatory and supervisory measures according to the Laws of the Republic of Azerbaijan ‘on Banks’, ‘on Non-bank credit institutions’ and ‘on Postal services’ 62.4. The format, content, frequency, and submission rules of reports (except for financial statements) submitted by supervised entities shall be determined by the Central Bank 62.5. The Central Bank shall inspect activities of supervised entities pursuant to the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’ and relevant regulations of the Central Bank. 62.6. The Central Bank shall be entitled to establish other standards and requirements adopted in international practice, in addition to the standards and requirements provided for in this Law, to ensure stable and secure operation of supervised entities and payment agents 62.7. To support development of payment systems, the Central Bank shall be entitled to set a cap on interchange (service fee tariffs) charged between participants of the Central Bank payment systems, requirements for arrangement of standardized, secure, and reliable operation of network

channels used between the operator and payment system participants, as well as payment service providers. 62.8. The decision of the Central Bank on changes to the requirements for the payment institution, electronic money institution and the operator's initial capital and the minimum amount of its own funds shall be applied to supervised entities in operation no later than 6 (six) months from the date of the decision takes effect. 62.9. Decisions by the Central Bank on discharge of regulatory and supervisory functions may be appealed in court. Filing an appeal shall not suspend the enforcement of that decision. 62.10. If the Central Bank discovers that any party provides payment services or acts as an operator without being properly licensed or registered hereunder, it shall send a demand to such a party to immediately cease such activities and inform competent authorities (institutions) to this effect. 62.11. State control over the compliance of credit unions with competition legislation shall be carried out in accordance with the procedures set forth in the Competition Code of the Republic of Azerbaijan. Article 63. Corrective measures 63.1. In the event the cases of or the cases that may lead to the violation of the requirements of the Laws of the Republic of Azerbaijan ‘on Prevention of the Legalization of Criminally Obtained Funds and the Financing of Terrorism’ and ‘on Targeted Sanctions’ and regulations of the Central Bank by payment and electronic money institutions, on an individual or a consolidated basis with respect to supervised entities the Central Bank shall: 63.1.1. issue obligatory instructions on elimination of revealed violations or circumstances that may lead to violations. 63.1.2. restrict or suspend payment services provided by licensed supervised entities. 63.1.3. suspend the provision of payment services through payment agents. 63.1.4. prohibit opening of new branches and/or terminate the activity of the existing branch(es). 63.2. In the event the Central Bank reveals the cases of or the cases that may lead to the violation of the requirements of the present Law and regulations of the Central Bank, on an individual or a consolidated basis depending on the nature of these cases it shall: 63.2.1. issue binding instructions on elimination of revealed violations or circumstances that may lead to violations. 63.2.2. require changes to payment system rules. 63.2.3. require replacement of the settlement agent. 63.2.4. require removal of the participant from the payment system, that violates the safe and effective operation of the payment system 63.3. The instruction specified in Articles 63.1.1 and 63.2.1 herein shall set a deadline for elimination of revealed violations or the circumstances that may lead to violations. Article 64. A special regulatory regime

64.1. The Central Bank shall apply a special regulatory regime to test innovative services and products in payment services. 64.2. The special regulatory regime on payment services shall be regulated with the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’. Article 65. Register 65.1. The Central Bank shall develop a public registry of supervised entities and payment agents. The registry shall contain information on the names, legal addresses, names of executives, registration number and date of issued and revoked licenses, type of licensed activities of supervisory entities and their branches and representative offices, as well as the names and addresses of payment agents, their executives (if a legal entity), types of licensed activities, supervised entities, and payment agents the activities of which have been terminated. 65.2. Supervised entities shall notify the Central Bank in writing within 5 (five) working days from the date of the change to the information submitted for obtaining a license hereunder, as well as the information included in the register. The change to the information shall be specified and documents confirming this change shall be submitted. Article 66. Unions and associations of payment service providers 66.1. Payment service providers and operators may establish unions and associations to coordinate their activities, as well as to jointly represent and defend their common interests. 66.2. Payment service providers and operators may not enter into agreements aimed at restricting competition and monopolizing the market. Unions and associations shall comply with the requirements of the competition legislation while carrying out their activities. Chapter 9 Final provisions Article 67. Liability for violation of this Law Persons violating the requirements of this Law shall be liable in the manner prescribed by the law Article 68. Transitional provisions 68.1. This Law shall take effect 3 (three) months after the publication. 68.2. Until this Law takes effect, persons engaged in payment services shall obtain a license and be included in the register, as well as adjust their activities to the requirements of the present Law within 6 (six) months after this Law takes effect. Ilham ALIYEV,

President of the Republic of Azerbaijan Baku city, 14 July 2023 № 987-VIQ