Practice Note for Mobile Money Service Providers

1 Practice Note for Mobile Money Service Provider PRACTICE NOTE FOR MOBILE MONEY SERVICE PROVIDERS MARCH 2019

2 Practice Note for Mobile Money Service Provider Nature of establishment The Central Bank of Eswatini (the Bank) is established by the Central Bank of Swaziland Order of 1974 (as amended), hereinafter referred to as the “Order”. In terms of the Order, the objects of the Bank are to inter alia promote, regulate and supervise the efficient and secure operation of payment systems with the prime aim of promoting a sound financial structure.

3 Practice Note for Mobile Money Service Provider TABLE OF CONTENTS PREFACE ................................................................................3 CHAPTER I: GENERAL PROVISIONS ..................................................5 Purpose ............................................................................5 Definitions .........................................................................5 CHAPTER II: MOBILE MONEY ECO-SYSTEM........................................ 10 Mobile Money Eco-system ..................................................... 10 CHAPTER III: GUIDING PRINCIPLES ................................................ 13 CHAPTER IV: LICENSING PROCEDURE ............................................. 14 Licensing......................................................................... 14 Application for a license ...................................................... 14 Other Documentation.......................................................... 16 Requirement for supervised institutions .................................... 17 Capital Requirements .......................................................... 17 Trust account ................................................................... 18 Letter of Acknowledgement .................................................. 18 Decision on granting license and/or authorization ........................ 19 Authorization or License fees................................................. 19 Examinations .................................................................... 19 Regulatory Fees................................................................. 20 Revocation or Suspension of License or Authorization.................... 20 Discontinuing Mobile Money Transfer Operations.......................... 21 Action of the Central Bank.................................................... 21 Return of the License.......................................................... 22 Merger............................................................................ 22 Insolvency ....................................................................... 22 Dormant Accounts/Unclaimed Funds ........................................ 22 Consumer Protection........................................................... 23 CHAPTER V: MISCELLANEOUS PROVISION ........................................ 26 Outsourcing of activities ...................................................... 26 Agency agreements ............................................................ 27 Requirements for specific services .......................................... 28 Prohibition of exclusivity agreement........................................ 29 Reports and Records ........................................................... 29 Existing Providers............................................................... 29 Remedial Measures and Administrative Sanctions ......................... 29 PREFACE

4 Practice Note for Mobile Money Service Provider This practice note shall be cited as the Central Bank of Eswatini (the Bank) Mobile Money Transfer (MMT) Practice Note No.1/2019/NPSS. The Practice Note applies to domestic and cross border Mobile Money Service Providers (MMSP) that are licensed and/or authorised by the Central Bank of Eswatini including their agents. It also applies to the activities of any third party engaged by the regulated entities for outsourced activities, when acting on behalf of MMSPs offering mobile money financial services to the public. It is supplementary to and does not supersede any existing legislation, guidelines or rules applicable to MMSPs. The Bank will monitor compliance to the Practice Note as part of its regulatory oversight functions. The Practice Note shall also be subject to review from time to time and shall come into force on March 05, 2019. This Practice Note provides minimum requirements to operate mobile money services (MMS) systems within and/or from Eswatini after due authorization processes. The Practice Note mainly outlines authorization and/or the licensing procedures to aid application and consideration thereof regarding provision of MMS. Whereas adoption of international best practice should facilitate a consistent approach to risk management, MMSP shall be expected to have an integrated approach to managing risk that adequately identifies, measures, monitors and controls risk.

5 Practice Note for Mobile Money Service Provider CHAPTER I: GENERAL PROVISIONS Purpose The Practice Note sets forth the rules governing the authorization or licensing by the Bank, of Mobile Money Service Providers (MMSPs) and monitoring of their activities. This Practice Note is set out by the Bank to achieve the following objectives:

1. To make retail payment systems and the financial sector more efficient.
2. To extend the reach of the formal financial sector to the unbanked people, giving them access to a wide range of financial services.
3. To promote financial inclusion while applying sufficient safeguards to mitigate any stability or integrity risk, extending safe and convenient financial services to the poor and unbanked population.
4. To ensure a wide participation of all regulated institutions in the provision of Mobile Money Services as set forth in this practice note.
5. To establish a framework that encourages innovation for the growth of digital ecosystems. Definitions Unless the context otherwise requires, terms and expressions used in this Practice Note have the following meaning: Agents: third party entities or persons that are appointed as agents by the MMSP to provide Mobile Money services on behalf of the MMSP; Agency: The relationship which arises when one party (the agent) acts on behalf of another party (the principal) so as to bring the principal into a contractual relationship with third parties; Agency Agreement: a legal contract creating a fiduciary relationship whereby the “the principal” agrees that the “agent” acts for and on behalf of “the principal”; Branchless banking: a distribution channel strategy used for delivering financial services without relying on bank branches. It entails substantially the use of technology means, such as electronic, digital or similar device, either remotely or through the use of third-party outlets to offer at least basic cash deposit and

6 Practice Note for Mobile Money Service Provider withdrawal in addition to transactional or payment services; and has the backing/support of a commercial bank; Central Bank/the Bank: means the Central Bank of Eswatini established under the provisions of the Central Bank of Swaziland Order, 1974; Customer Due Diligence (CDD): refers to the preliminary screening process of a customer conducted by an accountable institution to assess the risk level of that customer through performing background checks, which will, among other factors, establish a prospective customer’s compliance history, thus leading to a decision on the viability of establishing a relationship with the customer; Digital Finance: refers to- • methods to electronically store and transfer funds; • channels to electronically store, transfer funds, make and receive payments including to borrow, save, insure, invest and manage a person’s or an enterprise’s finances; • These channels include; the internet, mobile phones, ATMs, POS terminals, chips, biometric devices, tablets and any other digital system; Digital Financial Services: refers to the broad range of financial services accessed and delivered through digital channels, including payments, credit, savings, remittances and insurance. The digital financial services (DFS) concept includes mobile financial services (MFS). Interoperability: The ability of users of different mobile money services to transact directly with each other. This refers to a situation in which payment instruments belonging to a given payment scheme may be used in other countries and in systems installed by other payment schemes. Interoperability requires technical compatibility between systems but can only take effect where commercial agreements have been concluded between the payment schemes concerned. Issuer of Payment Instruments: means any entity, which provides payment instruments to users for the purpose of making payments;

7 Practice Note for Mobile Money Service Provider "Know Your Customer (KYC)": means the set of due diligence measures undertaken by an accountable institution in knowing an individual client or how the client’s business operations, the client’s physical address, owner’s physical address, owner’s identity and further possible confirmation of principal owners or real owners of business entities. KYC also pertains to the verification of whether a customer is a potential Politically Exposed Persons (PEP), and the further conducting of an enhanced due diligence thereafter; “Mobile Money” also referred to as “mobile payment” or “mobile money transfer”, generally refers to payment services operated and performed from or via a mobile device as opposed to cash, paper based instruments and card based payments; Mobile Money Services: services provided by the MMSP to support the utility of mobile money for the consumer. These include but are not limited to cash in, cash redemption at various channels and mobile payments services such as person to person, business to person government to person; Mobile Money Service Provider (MMSP): an entity licensed or authorized by the Bank to issue Mobile Money and provide Mobile Money Services; Money Remittance: a funds transfer service where funds are received from an originator without any accounts being created in the name of the originator or the beneficiary, for the sole purpose of transferring a corresponding amount to a beneficiary or to another payment services provider acting on behalf of the beneficiary; Payment account: an account held in the name of one or more payment service users, which is used for the execution of payment transactions; Payment Services: The following activities are payment services:  Services enabling cash to be placed on and/or withdrawn from a payment account in Supervised Institutions as well as all the operations required for operating a payment account.  Execution of payment transactions, including transfers of funds on a payment account in the Supervised Institutions with the user’s payment service provider or with another payment service provider.

8 Practice Note for Mobile Money Service Provider  Execution of payment transactions on a payment account in the Supervised Institutions where the funds are covered by a credit line for payment service user;  Issuing and/or acquiring of payment instruments;  Money remittance;  Execution of payment transactions where the consent of the payer to execute a payment transaction is given by means of any telecommunication, digital or IT device and the payment is made to telecommunication, IT intermediary between the payment service user and the supplier of the goods and services; Payment Services Provider: any entity providing services enabling cash deposits and withdrawals, execution of payment transaction, issuing and or acquisition of payment instruments, money remittances and any other services functional to money. The term does not include solely those who provide online services or by telecommunication services or network access; Payment Transaction: a transfer of funds between, or into or from accounts. A payment transaction may be either a credit or a debit transfer. It is initiated by means of a payment order, which may be written, electronic, digital or any other communication device, or by the use of a payment instrument; Retail Payments: are “everyday” payments between individuals, companies, NGOs and government agencies of relatively low value and typically not of a time-critical nature. Stored value devices: are devices with data encoded in either a magnetic strip or a computer chip that are preloaded with a fixed amount of electronic currency or value. This can be redeemed or transferred to individuals and/or merchants in a manner that is similar to spending physical currency; Supervised Institutions: a bank, a non-bank financial institution or a micro-finance institution within the context and meaning of the Financial Institutions Act and Financial Services Regulatory Authority Act; Suspicious Transaction: A transaction whose funds are suspected to be proceeds of criminal activity or are related to terrorist financing;

9 Practice Note for Mobile Money Service Provider Trust Account: means a bank account held by a licensed institution for and on behalf of the participants in the mobile money service who have deposited cash in exchange for e-money; Unsupervised Institution: a legal entity that does not fall within the definition of a supervised institution in terms of the Financial Institutions Act.

10 Practice Note for Mobile Money Service Provider CHAPTER II: MOBILE MONEY ECO-SYSTEM Mobile Money Eco-system The Mobile Money ecosystem consists of various stakeholders that include the Mobile Money customer, service providers and multiple regulators. When we refer to the ecosystem or stakeholders, we refer to the parties set out below: FIGURE 3.1: MOBILE MONEY ECOSYSTEM

3.1. The Mobile Money Customer The Mobile Money customer is the person/entity that opens a Mobile Money store of value (referred to as a Mobile Money account, interchangeably) and is identified as the account holder of the Mobile Money account. The customer is in control of the Mobile Money store of value and performs transactions in the Mobile Money store of value. 3.2. The Mobile Money Agent These are generally informal and formal service points where prospective and/ or Mobile Money customers access Mobile Money services, namely:

11 Practice Note for Mobile Money Service Provider a) Cash-in and cash-out transactions (i.e. loading value into the mobile money system, and then converting it back to cash); b) Onboarding and/ or registration of new Mobile Money Customers; or c) Provisions of front- line customer service such as teaching new Mobile Money Customers how to transact using their mobile phones; or d) Any other Mobile money services as directed by the MMSP. subject to receipt of Commission from the MMSP. Agents do not have a direct contractual relationship with the Mobile Money customer but with the MMSP(s). 3.3. The Mobile Money Service Provider This is the entity that issues Mobile Money, provides Mobile Money Services and is licensed and/or authorized by the Bank. 3.4. Commercial Bank An entity licensed in the Kingdom of Eswatini in terms of the Financial Institutions Act to conduct banking business, including but not limited to; acceptance of monetary deposits, withdrawals, funds transfers and the granting of loans and advances. In the mobile money eco-system, the banks hold the escrow/trust account on behalf of participants (agents and customers). The bank however, does not have a direct contractual relationship with the Mobile Money participants. The direct relationship is between the participants and the Mobile Money services provider. A bank may be a provider of mobile money services, subject to requisite licensing approvals/requirements 3.5. The Regulators a) Central Bank: Regulates financial activities of MMSPs and is responsible for the supervision of accountable institutions within its jurisdiction including compliance with Anti-Money Laundering (AML) and Counter Terrorist Financing (CTF) provisions. b) Communications Regulator: Regulates and issues domestic electronic communications licenses to Mobile Network Operators for electronic communications operations.

12 Practice Note for Mobile Money Service Provider c) The Financial Intelligence Unit: is a national agent responsible for safeguarding the financial system from illicit use and combat money laundering and terrorist financing through detecting, collecting, analyzing and disseminating financial intelligence to stakeholders. MMSPs report suspicious transactions to the FIU. d) The Financial Services Regulator: is an integrated regulatory and supervisory authority for all non-bank financial services providers who might also offer mobile money services or partner with MMSPs.

13 Practice Note for Mobile Money Service Provider CHAPTER III: GUIDING PRINCIPLES 1 Regulatory Oversight In considering the adoption and/or implementation of this Practice Note, the following principles must be taken into consideration:  The Central Bank of Eswatini is the only regulatory authority that is empowered to regulate the provision of Mobile Money services within its jurisdiction.  The communications regulator is a critical and essential stakeholder in the provision of Mobile Money Services, being responsible for regulating the electronic communications industry. It is therefore essential that the telecommunications regulator be consulted during the formulation of the Mobile Money regulatory framework.  The SFIU is responsible for the receipt of suspicious transactions reports which should be filed by the MMSP as an accountable institution in line with MLFTP Act. The SFIU must be consulted in relation to AML or CTF and applicable provisions for Mobile Money specific transactions and the MMSP must comply with AML regulations as directed by the SFIU. 2 Regional Payment Integration Initiatives Mobile Money standards must be suitable for domestic market conditions whilst taking into consideration regional harmonization objectives and imperatives. The regionalization objective and/or imperatives are, amongst others: i. The implementation of a regional payment, clearing and settlement system; ii. Broader requirements required for regional integration that are discussed in various regional fora.

14 Practice Note for Mobile Money Service Provider CHAPTER IV: LICENSING PROCEDURE Licensing No unsupervised institution shall carry on mobile money services in the Kingdom of Eswatini unless it has been granted a license by the Bank. No supervised financial institution shall carry on mobile money services unless it has obtained prior written authorization from the Bank. Application for a license An application to be licensed as a MMSP shall be made to the Bank in the form prescribed and shall be accompanied by the following: 5.1 Description of the nature and scope of the services to be offered by the MMSP and how these services fit in with its overall business strategy; 5.2 List of products and services to be provided with a breakdown of commissions/prices to be charged to the customer and/or consumer; 5.3 A product/s risk assessment, including money laundering and terrorist financing risks; 5.4 Description of governance structure of the entity to provide the service, including legal definition of relationship with any supervised institution from which it clearly emerges, how liabilities are shared and risks mitigated or reduced; 5.5 Criteria for the selection of agents and/or the outsourcing of parts of the activities, where applicable; 5.6 Copy of any agency or outsourcing agreement, as appropriate, either bilateral or standard; 5.7 A signed document detailing the features and operational modalities of all IT interfaces including the operating systems and software explaining at a minimum the following:

15 Practice Note for Mobile Money Service Provider 5.7.1 A description, including diagrams of the configuration of the institution’s electronic payment system and its capabilities showing: 5.7.1.1 How the electronic payment system is linked to other host systems or the network infrastructure in the institution; 5.7.1.2 How transactions and data flow through the network, settlement process and timing; 5.7.1.3 What types of communication channels and remote access capabilities exist such as direct modem, dial￾in, and internet access; 5.7.1.4 What security controls/measures are in place 5.7.2 A list of software and hardware components indicating the purpose of the software and hardware in the electronic payment infrastructure; and 5.7.3 How the system is interoperable with other existing electronic payment systems. 5.8 A signed document of the relevant portion(s) of the information security policies and procedures manual containing at a minimum: 5.8.1 A description of the institution’s information security organization; 5.8.2 Definition of responsibilities for designing, implementing, monitoring and updating information security measures; and 5.8.3 Established procedures for evaluating policy compliance, enforcing disciplinary measures and reporting information security violations. 5.9 A signed document describing the contingency and disaster recovery plans for electronic payment facilities and event scenario/problem management plan/program to resolve or address problems, such as complaints, errors and intrusions and the availability of back up facilities;

16 Practice Note for Mobile Money Service Provider 5.10 Proof of ability to comply with all applicable Anti Money laundering and combating of financing of Terrorism (AML/CFT) requirements as enshrined in the Money Laundering/Terrorist Financing (Prevention) Act, 2011(as amended), the Anti-Money Laundering (United Nations Security Council Resolutions) Regulations, 2016 and the Suppression of Terrorism Act, 2009, standards and measures. An applicant should submit Policies and Procedures manual outlining its proposed internal rules and systems for compliance with AML/CFT legislation; 5.11 Details of the customer protection measures, including consumer recourse mechanisms and consumer awareness programs; 5.12 Details of data protection policy; 5.13 Float management guidelines and measures; 5.14 Evidence that the regulator for the Communications industry certified the technology infrastructure for payment service provider operating their own network; and 5.15 Any other information as the Bank may require. Other Documentation An institution not supervised by the Bank wishing to provide mobile money services shall further submit to the Bank for consideration to obtain a license: 6.1 An authenticated copy of the memorandum of incorporation and articles of association, or, in case of a foreign institution, such similar documents regulating its affairs or such other documents as the Bank may require to establish the manner of control and regulation of such institution, and, in the case of a public company, a copy of its prospectus or similar document required under law relating to companies, and the name, nationality, and address of every promoter;

17 Practice Note for Mobile Money Service Provider 6.2 A statement of the address of its head office, the name, nationality, qualifications and address of its chairperson, of every director or partner, as the case may be, and of its principal officer; 6.3 A copy of its balance sheet at a date within ninety (90) days prior to the date of its application; 6.4 The location of the principal place and other places of business in the Kingdom of Eswatini and, in the case of a local institution operating outside the Kingdom of Eswatini, any place where it proposes to carry on its activities; 6.5 Evidence in the case of a foreign institution that it is subject to comprehensive supervision or regulation on a consolidated basis by the appropriate authorities in its home country; 6.6 Proof of existence of Trust Account with a licensed commercial bank in Eswatini, set up such that the account is not accessible to the institution for its non-mobile money transfer operations; and 6.7 Any other information as the Bank may require. Requirement for supervised institutions Any institution supervised by the Bank and wishing to provide new or additional mobile money payment services shall provide to the Bank for approval, a detailed description of the payment services it intends to operate, at least ninety (90) calendar days before effecting operations, containing all documents listed in article 5. Capital Requirements Where applicable, capital requirements for institutions supervised by the Bank shall be those established in terms of the Financial Institutions Act unless directed otherwise. For non-supervised institutions, unless directed otherwise, there are no capital requirements.

18 Practice Note for Mobile Money Service Provider Trust account A MMSP shall not issue mobile money services without opening a trust account in accordance with this Practice Note. A MMSP who is: - a. A non-supervised institution shall be required to open and maintain a trust account in a bank or financial institution. b. A bank or a supervised financial institution offering mobile payment services shall be required to open and maintain an account specifically for mobile money services. A MMSP shall ensure that the balance in the trust account shall at all times be equal to the total outstanding (un-claimed) balance of all holders of the e-money under the service. The trust account should be protected from creditors’ claims in the event of insolvency of the holding bank. 9.1 Interest A MMSP shall be expected to negotiate the interest rate with the commercial bank/s that maintain the trust accounts. The negotiated terms shall be submitted to the Bank. Interest earned or otherwise accrued to balances in the trust account shall not be to the benefit of or otherwise paid to the MMSP. 9.2 Record of Interest Earned The record of the interest earned on the trust account shall be kept in a separate account. 9.3 Use of Interest earned on Trust Account Any proposed use of interest accrued in a Trust Account shall be submitted to and approved by the Bank. Letter of Acknowledgement 10.1 Upon receipt of an application letter and supporting documents in accordance with articles 4 and 5, the Bank shall, within fourteen (14) working days, send the applicant a formal letter of acknowledgement or letter of deficiency as the case may be. 10.2 A letter of acknowledgement shall constitute official notice that the documents submitted were received and that the processing or evaluation may commence thereof unless the submissions are found deficient. 10.3 A letter of deficiency shall outline deficiencies in the application and no further action shall be taken by the Bank unless the deficiencies are rectified.

19 Practice Note for Mobile Money Service Provider Decision on granting license and/or authorization 11.1 The Bank shall, within ninety (90) days after the receipt of an application, or if further information has been required, after the receipt of such information, notify the applicant in writing either of the grants or refusal of a license. 11.2 In granting a licence, the Bank may impose conditions to be satisfied by the licensee as the Bank may deem necessary. 11.3 The investigation may require direct contacts with and clarifications by the applicant, to be provided either in writing or verbally. In this instance and where applicable, the Bank shall draft minutes of the meeting to be signed by the applicant. 11.4 Any license or authorization shall be subject to annual renewal. 11.5 Any MMSPs licensed by the Bank shall be announced through a public notice in such a manner as the Bank may deem appropriate. Authorization or License fees 12.1 A non-refundable license or authorization fee shall become due and payable on the date of grant of license or authorization and upon subsequent renewals of the license. 12.2 For Institutions not supervised by the Bank desirous to offer mobile payment services, the license fee shall be determined by the Bank. Examinations 13.1. The Bank shall cause regular on-site and off-site examinations of the operations and affairs of every payment service provider. 13.2. The purpose of an examination under subsection (1) shall be to determine whether: a) The payment service provider concerned is in a sound financial condition to carry out mobile money operations (going concern);

20 Practice Note for Mobile Money Service Provider b) The provisions of this Practice Note are being adhered to by the payment service provider; c) The business of a payment service provider is being operated in a lawful and prudent manner; and d) The business complies with AML/CFT obligations and other regulatory requirements. 13.3. Every payment service provider and every agent of such an institution shall, pursuant to an examination conducted under this Practice Note, produce for the inspection of any examiner duly authorized by the Bank, at such times and in such places as the examiner may specify (being times and places which in the opinion of the examiner, are not detrimental to the conduct of the normal daily business of such institution), all books, minutes, accounts, cash securities documents and vouchers in its possession or custody, relating to the business and shall supply all information concerning the business as may reasonably be required by such examiner within such time as the examiner may specify. 13.4. As soon as possible after the conclusion of an examination, the Bank shall forward a summary of the examiner’s report containing its salient points to the head office of the payment service provider concerned. Regulatory Fees An annual regulatory fee for MMSP and for other relevant service providers shall be determined by the Bank where applicable. Revocation or Suspension of License or Authorization 15.1 The Bank may revoke or suspend the license or authorization granted to a MMSP at any time if the holder: 15.1.1 has not commenced operations within twelve (12) months of the date on which the license was granted to it; 15.1.2 has ceased providing the service for a period of more than one (1) month. 15.1.3 has obtained the license of the Bank through incorrect statements or any other irregular means;

21 Practice Note for Mobile Money Service Provider 15.1.4 does not meet the conditions or requirements described in this Practice Note; 15.1.5 undertakes operations which endanger the stability of the financial system of Eswatini; 15.1.6 or a subsidiary of the MMSP is insolvent without possibility of recovery; 15.2 The Bank may suspend the license if the foreign Payment Service Provider offering mobile money services is undergoing liquidation in its country of origin. 15.3 If in the opinion of the Bank, the service is no longer in the public interest or the service no longer represents the interest of the participants, the Bank may revoke or suspend the license. 15.4 The Bank shall immediately after its decision on the revocation or suspension of the license or authorization, notify its decision to the MMSP. 15.5 The Bank shall as soon as possible publish a notice of the revocation or suspension of the license in a Gazette and in a newspaper of general circulation in the country and shall in addition cause a sufficiently large enough notice to be posted in each place of business of the institution. Discontinuing Mobile Money Transfer Operations No MMSP may terminate its operations in the Kingdom of Eswatini without the prior approval of the Bank. In the case where any service provider wishes to discontinue providing payment service(s) or discontinue carrying on its business, such service provider shall, ninety (90) calendar days prior to discontinuing its mobile operations, notify the Bank in writing. The MMSP shall, over and above the written notice, submit to the Bank a report regarding the discontinuation of providing service(s) or carrying on of the business. Action of the Bank Upon receipt of the notification from the service provider as cited in Article 16 of this Practice Note, the Bank shall have power to order the service provider to make specific performance as directed prior to discontinuation of providing service(s) or discontinue carrying on its business.

22 Practice Note for Mobile Money Service Provider Return of the License Any service provider wishing to discontinue providing service or discontinue carrying on its business shall surrender its license where applicable to the Bank. A MMSP that wishes to terminate its mobile money business is obligated to wind down operations in a structured and orderly manner. In particular, it must: 18.1. Ensure that all of its customers are able to cash-out or transfer to a different account the entirety of their outstanding mobile money balances at no charge; 18.2. Notify all customers through direct communication as well as public information through the media of the termination of the service, any procedures for retrieving their funds as per part (1) above, the locations in which they can do so and the time span during which they can retrieve their funds; 18.3. Give customers a period of at least six (6) months in which to retrieve their funds in this way, counted from the time of informing them of the termination of the service; 18.4. Ensure that the bank holding the trust account has updated identifying information of the associated customers and their respective balances; and 18.5. Must not accept to open any new account for customers in case of termination of services. Merger In the case where the mobile money service provider wishes to merge with other payment service providers, the provision of article 16, 17 and 18 shall be applied mutatis mutandis. Insolvency In the event of insolvency or liquidation of the MMSP, the Trust Account (in which the customer funds are held) and the capital amount shall not be the subject of and/or form part of the assets available for distribution by the liquidator. Dormant Accounts/Unclaimed Funds A MMSP shall be required to have in place an operational policy regarding the treatment of dormant accounts and unclaimed funds which policy should, amongst others contain:

23 Practice Note for Mobile Money Service Provider i. The process for the treatment of dormant accounts, which have not traded/and or had any form of activity for a continuous period of six (6) months. ii. The process for the termination of dormant accounts. iii. The treatment of unclaimed funds in a dormant account. Consumer Protection 22.1. Disclosure of fees and charges: The MMSP shall prominently display all fees and service charges for mobile money services at its head office, branches and places of business. The MMSP shall also ensure that it publishes all fees and service charges on its website. Agents shall prominently display all fees and service charges at their premises using a standard summary sheet provided by the MMSP. The standard summary sheet shall be explained by the Agent to the Customer upon account opening. 22.2. Customer onboarding A MMSP shall adhere to international standards and the Money Laundering and Financing of Terrorism (Prevention) Act, 2011(as amended) requirements on Customer Due Diligence (CDD) when establishing a relationship with a customer. The entity conducting customer due diligence should identify and verify the information on the customer using reliable independent source documents or data based on risk sensitive measures. 22.3. Consumer protection: i. A MMSP, through its agents, shall enter into a written agreement with every Customer for whom they open a Mobile Money Account, ensuring that prospective Customers have understood the general features of the Mobile Money Service. ii. Customers must acknowledge their understanding and acceptance of the terms of the contract with their signature. If they are not able to sign, alternative unique identifier such as a fingerprint can be used. The contract shall clearly identify the Customer and the MMSP that is providing the Services. iii. The MMSP shall maintain a functional dispute and complaints handling desk which shall be equipped to receive complaints through phone calls, emails and personal visits by the Customer. iv. The MMSP shall establish a free-of-charge telephone hotline for Customer comments or complaints, available at least during normal business hours. v. In the contract with the Customer, the MMSP shall provide the email and physical contact of the complaints handling desk and the number of the

24 Practice Note for Mobile Money Service Provider telephone hotline, which shall also be displayed by all Agents in their premises. 22.4. Transactions: a) A mobile money agent shall ensure that a customer presents, at minimum, an identity document before transacting and it should match the details on the mobile money platform. b) A mobile money agent shall carry out transactions only when the mobile money system is up and running and transactions should be in real-time. c) Every transaction shall require authentication by a customer’s PIN. At the time of opening mobile money accounts, mobile money agents should sensitise customers not to disclose their PINs to any other person. d) There must be a mechanism for the customer to verify the name and number of the funds' recipient for confirmation before a transaction is completed. e) The customer shall immediately receive written confirmation of execution of a transaction, including the fee charged. f) The mobile money platform shall be secured through security of data measures including end to end encryption of all messages containing information related to mobile money transactions. g) The mobile money service provider shall provide in writing the balance remaining in the customer’s mobile wallet as well as a statement on previous transactions, including hard copies if requested by customers. 22.5. Complaint Procedures: 22.4.1. A MMSP shall set up effective procedures that allow mobile money users to submit complaints. At a minimum, these procedures shall: a) Provide easily understood information about the customer care system that should be easily accessible at least during normal business hours; b) Allow for complaints to be lodged orally or in writing. c) Be provided free of charge; and d) Generate a customer reference number and be given to the customer. 22.4.2. A MMSP shall acknowledge all complaints filed with them within two (2) working days; 22.4.3. At the time of making a complaint, the complainant shall be advised of the expected actions and timing for investigating and resolving the complaint;

25 Practice Note for Mobile Money Service Provider 22.4.4. A MMSP shall put in place processes to provide complainants with sufficient information and the means to inquire on the progress of complaints and such processes may include complaint reference numbers or other identifiers in order to facilitate timely and accurate responses to subsequent inquiries by complainants; 22.4.5. Complainants shall be advised of the outcome of the investigation of their complaint, and any resulting decision by the MMSP; 22.4.6. Where a complainant is not satisfied with a decision reached pursuant to a complaint, the MMSP entity shall give the complainant the option of pursuing an identified escalation process by which the decision may first be examined by a suitably qualified person in the MMSP organization and, if still unresolved, by the Bank. 22.6. Data Protection: A MMSP, its staff and their agents, shall uphold privacy and confidentiality of all Customer information and data, unless sharing Customer information and data is authorized by the Customer in writing or data are accessed based on a court order or legislative provisions as the case may be. The conditions under which Customer information and data will be kept shall be disclosed before the Customer enters into agreement with the MMSP. Provisions of data protection including confidentiality shall be in tandem with all relevant laws.

26 Practice Note for Mobile Money Service Provider CHAPTER V – MISCELLANEOUS PROVISION Outsourcing of activities 23.1 Parties are free to outsource parts of their payment services activities subject to prior written approval from the Bank, provided that this does not result in an increase in risk and a reduction in protection of customers. 23.2 Any outsourcing agreement shall be in writing and comprise at a minimum the following elements: 23.2.1 Definition of the rights, responsibilities and apportioning of liabilities between parties, stating how the parties plan to manage the issue of any expected risk; 23.2.2 Accurate definition of the activities to be outsourced; 23.2.3 Mechanisms to ensure that the outsourced activities are subject to monitoring mechanisms by the institution and that regulatory review is permitted in order to grant to the Bank inspecting officers full and timely access to internal systems, documents, reports, and records. 23.2.4 Specify that the third party must ensure safe-keeping of all relevant records, data and documents/files for at least five (5) years; or alternately, such record is shifted to the institution at regular pre￾specified intervals which will then ensure safe keeping of this record for at least five (5) years or longer if requested by the Bank, Eswatini Financial Intelligence Unit (EFIU) and other law enforcement agents. 23.2.5 State that all information/data that the third party collects in relation to payment services, whether from the customers or the institution or from other sources, is the property of the institution, and the institution will be provided with copies of related working papers/files it deems necessary, and any information pertaining to the institution must be kept confidential. 23.3 Establish a protocol for changing the terms of the service contract and stipulations for default and termination of the contract; 23.4 State that staff of the third party is not considered staff of the institution.

27 Practice Note for Mobile Money Service Provider 23.5 Institutions supervised by the Bank providing mobile money services may decide to outsource banking activities or use agents, in particular for the provision of branchless banking. In that case, the institution supervised by the Bank must communicate such intention to the Bank under the terms and conditions set forth in Article 6 of this Practice Note and will be permitted to operate only following approval of the Bank. Agency agreements 24.1 Payment Service Providers and third-parties in charge of parts of the payment activities by way of outsourcing can use agents, provided that the customers are always fully aware of the existing agency relationship, of whether this depends from the Payment Services Provider or the relevant Third Party, and of consequences resulting from the use of agency networks. 24.2 When a payment services provider intends to provide payment services through an agent, it shall keep a registry of its agents, including the name and address of such agents. The registry shall be available for inspection at the request of the Bank. 24.3 The service provider shall be expected to keep records showing the identity of directors and persons responsible for the management of the agencies. 24.4 Any agency agreement shall be in writing and provide at a minimum the following elements: 24.2.1 Definition of the rights expectations, responsibilities and apportioning of liabilities between parties, stating how the parties plan to manage the issue of agent liquidity, and how the institution plans to handle the uncovered liability of its agents; 24.2.2 Indication of the work to be performed by the agent and the sharing of fees/revenues between the institution and the agent; 24.2.3 Mechanisms to ensure that the activities performed by the institution and that regulatory review is permitted in order to grant to the Bank inspecting officers full and timely access to internal systems, documents, reports, and records;

28 Practice Note for Mobile Money Service Provider 24.2.4 State that the agent will not perform management functions, make management decisions, or act or appear to act in a capacity equivalent to that of a member of management or an employee of the institution; 24.2.5 Specify that the agent must ensure safe-keeping of all relevant records, data and documents/files for at least five (5) years; or alternately, such record is shifted to the institution at regular pre￾specified intervals which will then ensure safe-keeping of this record for at least five (5) years unless directed otherwise. 24.2.6 State that all information/data that the agent collects in relation to payment services, whether from the customers or the institution or from other sources, is the property of the institution and the institution will be provided with copies of related working papers/files it deems necessary, and any information pertaining to the institution must be kept confidential; 24.2.7 Establish a protocol for changing the terms of the service contract and stipulations for default and termination of the contract; 24.2.8 State that staff of the agent are not considered staff of the institution; and 24.2.9 Clarify that the MMSP (licensed institution) is ultimately liable to the clients. 24.2.10State that the MMSP is the accountable institution in terms of AML/CFT. Requirements for specific services For domestic Money Remittances the maximum amount to be held in a mobile money wallet, amount to be transacted per day and in total for each month shall be fixed by the licensing authority where applicable. For international Money Remittances the maximum amount to be transferred from Eswatini shall also be determined by the licensing authority, that is, for each day, for each month and for each year where applicable.

29 Practice Note for Mobile Money Service Provider Prohibition of exclusivity agreement Contracts with exclusivity are not permitted by this Practice Note unless specifically authorized, in writing, by the Bank and do not conflict with applicable competition laws in the country. Reports and Records 27.1 Payment Service Providers are required to submit to the Bank on a monthly basis, within 10 working days of the end of each calendar month, a report of their transactions in terms of values and volumes, number of account subscribers or account holders, number of agents, logged service interruptions and security breaches and any other information as may be required by the Bank from time to time. 27.2 Any changes or enhancements that shall expand the scope or change the nature of payment services as originally provided shall be reported to the Bank and subject to prior approval of the Bank. These include but are not limited to: 27.5.1 Additional capabilities of the branchless instrument, like access to new channels; 27.5.2 Change in technology of service providers and other major partners in the business; other changes or enhancements (such as changes in commissions/prices structure or selection criteria for agents). Existing Providers Licensed non-supervised Financial Institutions already authorized to provide mobile money services at the time of the entry into force of this Practice Note, will be required to comply with the requirements contained herein within twelve (12) months of its entry into force, failing which the license and/or authorization will be suspended or withdrawn. Remedial Measures and Administrative Sanctions Any entity engaging in payment services without a license and/or the proper authorization of the Bank will be sanctioned in terms of the National Clearing and Settlement System Act and shall be required to cease and desist from such activities. If a MMSP fails to comply with any provision contained in this Practice Note in a flagrant manner and which results, or threatens to result, in an unsafe or unsound operating condition, as determined by the Bank, any or all corrective actions and penalties as provided for under the National Clearing and Settlement Systems Act, 2011 and/or the Financial Institutions Act, 2005, where applicable will be pursued by the Bank.