Instructions for Regulation of the Electronic Payment of Funds

10- INSTRUCTIONS FOR REGULATION OF
THE ELECTRONIC PAYMENT OF FUNDS
A) Circular No. (2/BS, BS, IBS/415/2018) To all Local Banks, Exchange Companies and Financing/Investment Companies regarding Instructions for Regulation of the Electronic Payment of Funds.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Dr. Mohammad Y. Al-Hashel
The Governor
Muharram 13, 1440 H
December 23, 2018
Circular No. (2/BS, BS, IBS/415/2018)
To all Local Banks, Exchange Companies and Financing/Investment Companies regarding Instructions for Regulation of the Electronic Payment of Funds The Chairman of the Board of Directors, Dear Sir, In light of the Law No. 20 of 2014 for the electronic translations that entrusted the Central Bank of Kuwait with the full powers and authority of oversight over, and regulation of, the electronic payment of funds in addition to promulgation of the relevant binding instructions, and taking into consideration the fast growing usage of modern technology and channels of electronic payment and the commensurate keenness of the Central Bank of Kuwait to introduce the regulatory and organizational frameworks to benefit from such technologies in the field of electronic payment of funds, the Board of Directors of the Central Bank of Kuwait issued its decision No. (44/430/2018) regarding the instructions for regulating the electronic payment of funds. The aforesaid instructions provide for the requirements to be fulfilled by companies and institutions to be enrolled in “Register of Operators and their Agents” with the Central Bank of Kuwait, and covered the obligations of the operators of the electronic payment of funds and their agents. It should be noted that in accordance with Article (3) of the aforesaid instructions, all operators and their agents, who were active prior to implementation of these instructions, should regularize their situations as per the rules and regulations stated in the aforesaid instructions within 12 months from effective date thereof. We enclose herewith a copy of the decisions no. (44/430/2018) regarding the instructions for regulating the electronic payment of funds. With my best wishes, Dr. Mohammad Y. Al-Hashel

N.B.: This English translation is prepared by the Central Bank of Kuwait for information purposes only. In case of any variance between Arabic and English versions, Arabic text shall prevail. Central Bank of Kuwait Resolution No. 44/430 of 2018 Promulgating Instructions for Regulating the Electronic Payment of Funds

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Central Bank of Kuwait
Resolution No. 44/430 of 2018 Promulgating Instructions for Regulating the Electronic Payment of Funds The Board of Directors of the Central Bank of Kuwait Having perused, The Law No. 32 of 1968 Concerning Currency, the Central Bank of Kuwait and the Organization of Banking Business, and its amending laws, The Law No. 106 of 2013 Concerning the Combat of Money Laundering and Financing of Terrorism, amended by Law No. 24 of 2016, The Law No. 20 of 2014 Concerning Electronic Transactions, The Kuwait Companies Law issued by virtue of Law No. 1 of 2016, amended by Law No. 15 of 2017, and The approval of the Board of Directors of the Central Bank of Kuwait passed in its meeting held on 11.06.2018, Resolved
Article One
Provisions of the Instructions for Regulating the Electronic Payment of Funds, attached herewith, shall come into force and applied accordingly.
Article Two
All concerned entities and departments, each within its respective field of competence, shall implement this Resolution and abide by its provisions.
Article Three
This Resolution shall be published in the Official Gazette and shall come into force as of the date of its publication. Dr. Mohammad Y. Al-Hashel The Governor The Chairman of the Board of Directors of the Central Bank of Kuwait

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Instructions for Regulating the Electronic Payment of Funds
Chapter One
“Definitions”
Article (1)
In application of these Instructions, the following words, terms and expressions shall have the meanings, respectively, ascribed to them below:
Instructions : Instructions for Regulating the Electronic Payment of Funds. The Central Bank of Kuwait : Central Bank of Kuwait Activity : Electronic payment and settlement systems. Register : The Central Bank of Kuwait Register of Electronic Payment Infrastructure Providers and their Electronic Payment Agents. Registration : Enrollment in the Register. Company : A shareholding or a limited liability company. Financial institution : The bank, financing company, investment company (financing activity) or exchange company, which are subject to The Central Bank of Kuwait supervision, or any institution authorized to make cash transfers or electronic payments in accordance with the provisions of the applicable laws. Electronic Payment Infrastructure Provider (EPIP) : Any financial institution that takes the form of a shareholding company, and has been listed in the Central Bank of Kuwait register to perform all or part of the operations of electronic payment and settlement systems, provision of service or any other related services, provided the final settlement is made through the local banks. Electronic Payment Agents (EPA) : Any financial institution that takes the form of a shareholding company or limited liability company, and has been listed in Central Bank of Kuwait register to practice all or part of the activities on behalf of the Electronic Payment Infrastructure Provider. Participant : Any party, who is allowed, under the rules of the Electronic Payment and Settlement System, to exchange payments, or process settlements through the system.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Customer : The beneficiary of the services provided by the Electronic Payment Infrastructure Provider or its Electronic Payment EPAs. Electronic Money : A value that has cash equivalent stored in an electronic device or a plastic card or automated system. Settlement : The process of fulfilling obligations by transferring funds between two or more parties. Electronic Payment and Settlement System : An electronic system consisting of a set of means and procedures for payment and settlement of funds to fulfill obligations through the transfer of funds between two or more parties, where its operation is conducted through the execution of electronic processes represented in any transaction or agreement concluded or carried out, in whole or in part, by electronic means and correspondences. Activity Services : Any service that enables money withdrawal and deposit or processing of payment and settlement transactions through the electronic payment channels such as Automated Teller Machines (ATMs), Point of Sale (POS) devices and any service for transfer or issuing of funds, and/or obtaining means of electronic payment. Means of Electronic Payment : Any tangible or intangible mean that enables an individual to obtain money, goods, services, assets or benefits, or to perform electronic payment or e-transfer of funds (e.g. prepaid cards issued in the State of Kuwait, stored-value accounts, which are replenished with equivalent amounts and paid upon request). Financial Technologies (Fintech) : New technologies that relate to the financial industry, and aim to improve and develop financial activities including the launch of advanced products, services and business models in the financial services industry. Regulatory Sandbox : A safe space that allows for the experimentation of innovative products and services relating to Fintech without incurring the cost of obtaining official licenses. The environment caters for those products and services that are based on, or related to, the electronic payment of funds, and that also require the Central Bank of Kuwait’s approval prior to their launch in the market.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Chapter Two
Regulation of Activity
Article (2)
A Register shall be created with The Central Bank of Kuwait in which all EPIPs and EPAs shall be enrolled, and their main information shall be recorded. The Central Bank of Kuwait shall not be responsible for any false or incorrect statements provided in the Register.
Article (3)
The Activity shall not be practiced without registration by virtue of a decision issued by The Central Bank of Kuwait in coordination with the Ministry of Commerce & Industry, which granted the practice license to the EPIP or EPA after The Central Bank of Kuwait ’s approval. All EPIPs and EPAs who practiced their activity prior to the implementation of these instructions should regularize their situations as per the rules and regulations stated herewith within (12) months from the date the Instructions came into effect.
Article (4)
For those who are registered as EPIPs, practicing the activity shall be limited to shareholding companies whose paid-up capital is not less than one million Kuwaiti Dinars. For those who are registered as EPAs, practicing the activity shall be limited to shareholding or limited liability companies whose paid-up capital is not less than 20,000 Kuwaiti Dinars. The minimum capital may be reduced to KD 10,000, for registered EPAs for companies that met the requirements of joining the Regulatory Sandbox, and have passed required technical tests and experiments under the Regulatory Sandbox Framework issued by The Central Bank of Kuwait . In all cases, The Central Bank of Kuwait may increase the minimum paid-up capital based on the size and nature of the Activity.
Article (5)
The registration application shall be submitted to The Central Bank of Kuwait along with the following documents and data:

1. The unconditional final Letter of Guarantee (LG) issued by a local bank to
   The Central Bank of Kuwait of the amount of 100,000 Kuwaiti Dinars, valid for 3 years and renewable for similar periods. The Central Bank of Kuwait will assess the need to provide the said LG or to reduce or increase its amount in light of the conditions and solvency of the company, and may obtain this LG from the company at any stage of registration.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
2) A copy of the company’s Articles and Memorandum of Association, and
Commercial Register. Companies who are subject to The Central Bank of Kuwait supervision and meet the required capital shall submit a commercial register whose date shall not exceed 3 months prior to the application date.
3) The company’s ownership structure showing the names of main partners, and
the ownership percentage of each.
4) Criminal record of Board Members and the Chief Executive Officer, or
managers in case of limited liability companies, and the ownership percentage of each.
5) The company's strategy and a three-year business plan that is aligned with
company’s accurately estimated budget.
6) Description and feasibility of the Activity, indicating the type of payment
services to be provided and payment tools and their conditions.
7) Policies and procedures pertaining to the Activity, including the following:
 Procedures manual, an organizational structure and a list of managers' names and identification.  The mechanism on which the Activity is based, whether it is an automated payment mechanism, or a settlement mechanism or other mechanisms.  Activity rules which will be implemented, including the following:

• Activity scope.
• Payment services to be provided to beneficiaries, taking into
  consideration that they do not conflict with any of The Central Bank of Kuwait ’s instructions, and are in accordance with the Principles of Financial Market Infrastructures (PFMIs) issued by the Bank for International Settlements.
• Clear and final settlement of transactions shall be performed through
  local banks only, as they are the only party allowed to participate in the final settlement mechanisms.
• The responsibilities of each of the EPIPs, EPAs and beneficiaries of
  payment services.
• Terms and conditions pertaining to the EPIPs and EPAs’ receipt,
  rejection or cancellation of payment orders.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
 Risk assessment for the Activity and risk mitigation plan that define the controls and measures in handling risks.  The measures and controls to safeguard the Activity, including the disaster recovery plan to ensure business continuity, measures undertaken to ensure proper governance of the Activity, and effective and precise procedures to measure, monitor and control the risks that the Activity is exposed to, and the submission of relevant reports to concerned parties.  The measures undertaken to secure and protect electronic processes, and to safeguard and store the data related to the system and Participants to prevent disclosure, misuse, damage, destruction, loss and theft; especially in the case of service interruption at any stage of the electronic process.  The undertaken procedures to protect the data pursuant to the relevant laws or any other instructions issued by The Central Bank of Kuwait .
8) Description of the measures undertaken that pertain to the risk management
system and accounting systems followed by the EPIP including the relevant reporting system.
9) Description of the internal control procedures that the EPIP is committed to,
including the network of EPAs, if any, including the procedures to be followed as per Law No. 106 of 2013, its Executive Regulations, and relevant ministerial decisions and instructions issued by The Central Bank of Kuwait in this regard.
10) Description of the procedure to be applied to ensure that any disputes between
EPIPs/EPAs and Customers are resolved, taking into consideration the clarity of the same to ensure effective implementation, as well as the deadline set for Customers to submit their complaint to EPIPs or EPAs, the deadline to respond to the complaint and informing them with their complaint results. The Central Bank of Kuwait will have the right to request any documents or other data deemed necessary for registration. EPIPs and EPAs shall have the priority in registration if they meet the requirements to participate in the Regulatory Sandbox and pass the required experimentation and technical tests according to the Regulatory Sandbox Framework Document issued by The Central Bank of Kuwait . The Central Bank of Kuwait shall issue the resolution of approving or rejection of registration according to the above-mentioned documents and data, and in a way that ensures the stability and integrity of payment and settlement systems in the State of Kuwait. In case of registration, the approved payment means that are to be used will be specified.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Article (6)
The EPIP shall submit an application to The Central Bank of Kuwait to register EPAs in accordance with the procedures stipulated in Article (5) hereof, except for submitting an LG in favor of The Central Bank of Kuwait , and a declaration shall be attached to the application stating the willingness to register and to abide by these instructions once it is registered.
Article (7)
During the Activity, the EPIP shall ensure that the EPA complies with these instructions, and The Central Bank of Kuwait instructions, standards and policies related to supervision and oversight of the Activity, as well as The Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) requirements. In addition, the EPIP shall notify The Central Bank of Kuwait upon cancellation of any of the EPAs in its EPAs network, or any amendments made to the EPA's status or the instructions regulating them, within one week from the date of cancellation or amendment. In all cases, the EPIP shall be responsible for all activities and actions performed by any EPA to whom it has assigned its work, whether wholly or partially.
Chapter Three
Carrying out Activity Services and Confidentiality of Information
Article (8)
EPIPs and EPAs shall comply with the following:

1. Executing payment orders properly in accordance with the Customer’s
   documented orders and the rules of the payment system; otherwise EPIPs and EPAs shall be fully responsible towards the Customer and shall directly refund the amounts in full as per the payment order.
2. Upon receipt of the payment order, the amount shall be deducted from the
   Customer's account and credited to the beneficiary account on the same day, or no later than the end of the next business day.
3. In the event that the Customer's payment order is not processed, or delayed in
   transferring the amounts to the beneficiary's account, both parties shall be notified within a maximum of three days.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
4) Providing the payer with a copy of the payment order issued in accordance to
his request, which may be made electronically, and shall include at least the following data (reference number, amount, date of issuance, due date, beneficiary ID – payment purpose).
5) Providing the beneficiary with a copy of the payment order issued in his favor,
which may be made electronically, and shall include at least the following data (reference number, date of issuance, due date, payer ID – payment purpose).
6) No fees or commissions shall be collected under any title unless The Central
Bank of Kuwait approval was obtained, and after providing the supporting documents related to the nature of such fees and commissions and their actual cost. EPIPs and EPAs shall announce all fees and commissions charged to Customers for services provided through media channels to ensure their awareness of the same, including communicating at the head office of EPIPs and EPAs and through their websites.
7) All documents, records and data related to an Activity shall be kept for a
period of no less than ten years from the date of termination of contractual relationship between EPIPs or EPAs and Customer.
8) The Central Bank of Kuwait shall be notified prior to any amendment or
addition to the scope of the applicable Activity or provided services. The Central Bank of Kuwait ’s written approval shall be obtained before any implementation.
Article (9)
A Customer shall follow the conditions governing the issuance and use of Payment Means, and maintain his own confidential data. A Customer shall bear full responsibility for negligence in maintaining it or delay in reporting loss, theft, and breach of such data or its payment means. A Customer acting in good faith shall not be liable for any financial losses resulting from the use of confidential data or payment means, having notified the EPIP or his EPA of the loss, theft or breach, or any suspicious matters that indicate that he is not the only party who is utilizing the data and the payment means. The EPIP and their EPAs are obliged to provide the appropriate channels for such notifications at all times without interruption.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Article (10)
EPIPs and their EPAs shall ensure the requirements of information security and strict confidentiality of all transactions related to Customers, and are prohibited from providing any data, directly or indirectly, or disclosing it or allowing third parties to access the same. This prohibition shall remain in effect even if the relationship between them and the Customer is terminated for any reason. This prohibition applies to all officials at EPIPs and EPAs, including Board members, current and former managers and employees, and any contracted third party service providers, and anyone who, by virtue of his job or profession, directly or indirectly, has access to such data and information, including external auditors. This prohibition does not apply in case of obtaining the written consent from the Customer, his heirs, or whoever legally acts on their behalf, or in the cases where a law allows disclosure of such information and data.
Chapter Four
Daily Dealing Limits and Risk Coverage
Article (11)
EPIPs who are willing to carry out some of the work through EPAs, should set the total amount limit for the EPA’s daily transactions’ which are governed by these instructions; provided that such a limit shall be revised a maximum of every six months by monitoring the size of Activity and nature of transactions, in light of the activity on EPAs’ accounts and the type of payment services and means used.
Article (12)
EPIPs shall ensure that the policies and procedures of their EPAs include all the requirements of Article (5) hereof, and shall be implemented to ensure availability of the following:

1. Compliance with the application of the rules of Activity and the levels of
   service provided to Customers, so as to ensure settlement of transactions in a correct, clear and conclusive manner.
2. Proper internal control processes to ensure business integrity and continuity.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
3) Procedures and measures necessary to ensure the principle of segregation
between Customers’ and EPAs’ funds, so that the Customers’ funds are totally segregated from any claims to creditors in the event of bankruptcy, while ensuring the ability of tracking funds at any time.
Article (13)
EPIPs must study the size of the risk pertaining to the settlements of funds that are confronted by the EPA to meet their obligations toward their customers. The EPIP must also determine the appropriate amount of guarantees that the EPA has to provide to ensure payment and settlement procedures of electronic payment transactions, including providing a final LG according to Article (11) hereof, if the situation required it, and to provide an insurance policy from a local company estimated based on - the average annual size of EPA’s Activity in order to cover resulting operational risk.
Chapter Five
Methods of Payment
Article (14)
Subject to the provisions of Article (5) hereof, EPIPs and EPAs shall comply with the following:

1. Apply to The Central Bank of Kuwait for approval to add payment means that
   are not previously approved. The payment means shall not be used without obtaining The Central Bank of Kuwait written approval. Priority shall be granted to EPIPs and their EPAs to obtain The Central Bank of Kuwait approval once the requirements for participating in the Regulatory Sandbox have been met, and the required experimentations and technical tests are passed in accordance with The Central Bank of Kuwait Regulatory Sandbox Framework Document.
2. Apply to The Central Bank of Kuwait for approval of amendment of any
   conditions that can financially impact the payment means that are already approved. The amendment shall not be effective until The Central Bank of Kuwait ’s written approval is obtained.
3. Notify The Central Bank of Kuwait in writing in the event of suspending any
   payment means that are already approved.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Article (15)
With regards to electronic payment means, the following should be considered:

1. It should not include granting credit, with the exception of credit cards issued
   by banks, and those authorized by licensed EPIPs.
2. The cash value stored therein shall be equal to the cash deposited.
3. No Customer information or data shall be stored with any unauthorized party
   as EPIP.
   Article (16)
   On demand, all prepaid card issuers and those holding stored value accounts shall pay the value of the Electronic Money at the equivalent value, provided that payment is in cash and in the same currency, or as per the agreement between the card issuer and Customer.
   Chapter Six
   Supervision and Control
   Article (17)
   EPIPs and their EPAs shall be subject to The Central Bank of Kuwait ’s supervision and oversight. The Central Bank of Kuwait Representatives have the right to visit their premises as part of registration procedures or to conduct periodic visits as part of the supervision and oversight system, after notifying them in writing or by other means. The Central Bank of Kuwait will also have the right to engage specialized entities to assist them in carrying out some of the supervision and oversight functions over EPIPs and EPAs, and such entities will have no obligations towards any third party as a result of performing such tasks.
   Article (18)
   EPIPs and their EPAs shall provide all necessary data and information to The Central Bank of Kuwait for the purposes of supervision, oversight and inspection as per the procedure stated by The Central Bank of Kuwait . EPIPs and their EPA shall allow access to all their notes, records, documents and minutes of meetings, and not to take any action that may have a negative impact on The Central Bank of Kuwait ’s supervision, oversight and inspection, and to fully cooperate to accomplish the mission.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Article (19)
All prepaid card issuers, stored value accounts holders and any electronic payment card issuer shall provide statistical data about the funds transferred to the cards in their periodic financial statements submitted to The Central Bank of Kuwait .
Article (20)
EPIPs shall submit periodic reports, data and information specified by The Central Bank of Kuwait instructions in this regard, and pay the administrative expenses set by The Central Bank of Kuwait .
Article (21)
The Central Bank of Kuwait is entitled to take the following actions and procedures:

1. Access any or all of the systems related to the EPIP or its EPAs, in order to
   carry out the tasks of supervision, oversight and inspection on the Activity.
2. Imposing a procedure for accessing any or all of the systems related to the
   EPIP or its EPAs to monitor the compliance with the standards and policies of the electronic payment and settlement systems.
3. Perform all inspection procedures to ensure access to notes, records and
   equipment, interviewing employees and EPAs, or any other procedures deemed necessary to carry out supervision and oversight functions on the Activity.
4. Prepare and publish consolidated reports containing all data and information
   obtained hereunder for statistical purposes.
   Chapter Seven
   Restrictions and Penalties
   Article (22)
   Subject to the provisions of the above Law No. 1 of 2016, in the event that any party carries out the Activity without registration, necessary measures shall be taken by The Central Bank of Kuwait to stop the Activity and that party shall bear all financial and non-financial liabilities, and The Central Bank of Kuwait will bear no liability towards it or towards its EPAs, Customers or third parties.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
Article (23)
The EPIP and its EPAs shall abide by these instructions or any other instructions and directives issued by The Central Bank of Kuwait in this regard. In case of violation of any of these instructions or directives, The Central Bank of Kuwait will be entitled to issue a decision in writing imposing conditions or restrictions on them, as follows:

1. Send a written warning to the EPIP and its EPAs to take all actions to ensure
   compliance with these Instructions.
2. Issue a written directive to the EPIP and its EPAs that is effective within a
   specific period including all or some of the following:
   a) Ceasing to enter any new engagements or contractual business agreements. b) Establishing, amending or cancelling certain rules of the Activity. c) Taking the appropriate measures to carry out certain actions necessary for safeguarding public interest. d) Suspension of any payment activity, in whole or in part, if such activity is deemed to pose a risk to the public interest. The EPIP and its EPAs, to which any of the written directives stated in item (2), shall notify The Central Bank of Kuwait of execution of these directives once completed and The Central Bank of Kuwait , as the case may be, has the right to change any condition or restriction imposed on EPIPs or EPAs, and notify them of this change in writing.
   Article (24)
   The Central Bank of Kuwait may suspend the registration of the EPIP or its EPAs, in the following events:
3. Not practicing the Activity within six months from the date of registration.
   The concerned persons may, within fifteen days from the date of notifying them of the decision to suspend registration, request extension of the said timeframe to a maximum of six months, provided they must provide the justifications therefor. The Central Bank of Kuwait has the right to accept or reject this request after review thereof.
4. If the electronic payment and settlement system is discontinued without
   providing acceptable justifications.

CHAPTER ONE: Supervisory and Regulatory Instructions and Controls
3) If the practices of the EPIP or its EPAs adversely affect the stability and
integrity of payment and settlement systems or the financial system in the State of Kuwait.
4) Declaring bankruptcy, liquidation or dissolution, cessation of legal
personality, or undergoing difficult financial conditions, which are judged as per The Central Bank of Kuwait ’s discretion.
5) If the EPIP or its EPAs take any actions or procedures that would impede the
inspectors' performance of their tasks related to inspection of the activity, or if the inspection reports prove to be repetitive of the same violations of these instructions or any other instructions.
6) If it is found that the practices of the EPIP or its EPAs resulted in damages or
risks against Customers or the public interest.
In all cases, The Central Bank of Kuwait ’s decision to suspend registration shall include the timeframe for taking the necessary actions to pay all obligations due to Customers, and EPIPs shall be notified in writing of the above decision, whether it is related to them or to their EPAs’ only, and The Central Bank of Kuwait may announce this decision through any appropriate channel.
Article (25)
The penalties stipulated under Article (85) of Law No. 32 of year 1968 shall be applied to the entities that violate these Instructions.