Bank of Albania Regulation on the Licensing of Payment and Electronic Money Institutions

R E P U B L I C O F A L B A N I A BANK OF ALBANIA SUPERVISORY COUNCIL DECISION No. 59, dated 24.11.2021 ON APPROVAL OF REGULATION “ON THE LICENCING OF PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS AND THE REGISTRATION OF PAYMENT SERVICE PROVIDERS” In accordance with article 3, paragraph 3, article 12, letter “a” and article 43, letter “c” of the Law No. 8269, dated 23.12.1997 “On Bank of Albania”, as amended; article 4, point 46 and article 126 of the Law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended; articles 4, 7, 8, 9, 13, 14, 15, 21, 28 and 31 of the Law No. 55/2020, dated 30.4.2020 “On payment services”, and article 194, paragraph 4 of law 52/2014, dated 22.05.2014 “On insurance and reinsurance activity”, having regard to the proposal from the Supervision Department, the Supervisory Council of the Bank of Albania, DECIDED:

1. To approve the Regulation “On the licencing of payment institutions and electronic money institutions and the registration of payment service providers”, according to the decision attached herewith.
2. The subjects of this regulation shall be responsible for the implementation of this Decision.
3. The Supervision Department and the Payment Systems and Accounting and Finance Department of the Bank of Albania shall be responsible for monitoring the implementation of this Decision.
4. The Governor's Office and the Research Department shall be responsible for the publication of this Decision, in the Official Journal of the Republic of Albania and in the Official Bulletin of the Bank of Albania, respectively. This Decision shall enter into force on 1 January 2022. SECRETARY CHAIRMAN Elvis ÇIBUKU Gent SEJKO

2 REGULATION “ON THE LICENCING OF PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS AND THE REGISTRATION OF PAYMENT SERVICE PROVIDERS” (Adopted upon Decision No. 59, dated 24.11.2021 and amended upon Decision No. 11, dated 1.4.2026 of the Supervisory Council of the Bank of Albania) CHAPTER I GENERAL PROVISIONS Article 1 Purpose This regulation lays down the conditions, requirements, time frame, documentation and procedures on: a) licensing of payment institutions and electronic money institutions, in the Republic of Albania; b) registration of payment service providers in the Republic of Albania, who benefit from an exemption pursuant to article 4, letters “gj” and “h” and to article 28 of Law “On payment services”; c) granting approval by the Bank of Albania, during the exercise of the activity of these entities, and d) obligations of entities to notify the Bank of Albania during the execution of the activity from these entities. Article 2 Legal ground This regulation is issued in accordance with: a) article 3, paragraph 3, article 12, letter “a” and article 43, letter “c” of the Law No. 8269, dated 23.12.1997 “On Bank of Albania”, as amended; b) article 4, point 46 and article 126 of the Law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended, which hereinafter shall be referred in this Regulation as the Law “On banks”; c) article 4, 7, 8, 9, 13, 14, 15, 21, 28 and 31 of the Law No. 55/2020, dated 30.4.2020 “On payment services”, which hereinafter shall be referred in this regulation, as the Payment Services Law; d) article 194, paragraph 4 of law 52/2014, dated 22.05.2014 “On insurance and reinsurance activity”.

3 Article 3 Subjects Subjects to this regulation are: a) payment institutions, as defined in point 13 of article 5 of the Payment Services Law. Savings and loans associations carrying out activity, even as a payment institution, can provide payment services only to their members; b) electronic money institutions, as defined in point 46 of article 4 of the Law “On banks”; c) account information service providers, as defined in point 27 of article 5 of the Payment Services Law; d) service providers carrying out an activity referred to in letters “gj” and “h” of article 4 of Payment Services Law, as provisioned in article 62 and article 63 of this regulation. Article 4 Definitions

1. The terms used in this regulation shall have the same meaning as those defined in the Payment Services Law and the Law “On banks”.
2. In addition to paragraph 1 of this article, for the purpose of this regulation’s implementation, the following terms shall have these meanings: a) “agent of electronic money institution”- means a natural or legal person, who acts in the name and on behalf of an electronic money institution for the distribution and redemption of funds and/or payment services. The electronic money institution cannot issue electronic money through agents; b) “bearer shares” - are shares of a legal person, whose ownership is transferred to the person that owns or holds the certificate/document of the bearer shares without the need of an agreement/contract for transferring the ownership of these shares; c) “nominee shareholder” - is the registered shareholder of a legal person that holds shares on the current shareholder’s behalf (beneficiary owner), according to an agreement; d) “shell bank” - shall have the same meaning as defined in the law “On the prevention of money laundering and terrorist financing”; e) 1 “beneficiary owner” - shall have the same meaning as defined in the legislation in force governing the register of beneficiary owners;
3. The terms “share capital”, “supervisory/administration board” and “shareholder/partner” used in this regulation for payment institutions, shall mean the 1 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

4 terms “capital”, “steering council” and “member”, respectively, for savings and loans associations to be licensed as payment institutions. 4. 2For the purposes of this regulation, a person of “good repute” is considered a shareholder/partner, beneficiary owner, administrator and member of the governing body of the entity, who is characterized by professional ethics and moral and financial integrity, as well as by compliance with the legal and regulatory framework. A shareholder/partner, beneficiary owner, administrator, or member of the governing body shall be considered to have good reputation if he/she meets the following criteria: a) is not under indictment in criminal proceedings; b) has not been convicted of a criminal offence; c) has no outstanding financial or tax liabilities; d) is not subject to compulsory execution procedures; e) is not included in the international sanctions lists. CHAPTER II LICENCING AS PAYMENT INSTITUTIONS AND AS ELECTRONIC MONEY INSTITUTIONS SUBCHAPTER I GENERAL REQUIREMENTS Article 5 Minimum initial capital

1. The respective minimum initial paid-in capital, required for obtaining a license as a payment institution, is as follows: a) where the payment institution provides only the payment service as referred to in paragraph 6 of Annex 1 of the Payment Services Law, its capital shall at no time be less than 2.5 million ALL; b) where the payment institution provides only the payment service as referred to in paragraph 7 of Annex 1 of the Payment Services Law, its capital shall at no time be less than 6.5 million ALL; c) where the payment institution provides any of the payment services as referred to in paragraphs 1 to 5 of Annex 1 of the Payment Services Law, its capital shall at no time be less than 16 million ALL.
2. The minimum initial capital required for payment institutions that apply for a license to provide 2 (two) or more payment services from those provided in letters “a”, “b” 2 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

5 and “c” of paragraph 1 of this article, should be equal to the amount that belongs to the highest level of capital required in paragraph 1 of this article. 3. The minimum initial capital requirement for electronic money institutions shall be ALL 45 (forty five) million. 4. Each payment of minimum paid-in capital, its later increase and any change in the capital structure of the payment institution and of the electronic money institution shall be accompanied with the submission to the Bank of Albania of the information on the source of the capital, according to the documentation laid down, respectively in article 26 and article 45 of this regulation. 5. The Bank of Albania has the right to request further information and carry out further checks relating to the creation source/sources of contributions/funds that shall serve as a minimum initial capital or as a future increase in its structure. 6. Where the Bank of Albania concludes, or is reasonably suspicious of the capital structure or its source being associated to persons with criminal convictions by a final court decision, who have family relations or close personal, working or business relationship in accordance with legal stipulations, with 3 the shareholders/partners and the beneficiary owners, or is related to companies registered in tax havens or offshores, it notifies and requires from 4 the Financial Intelligence Agency whether it has information regarding 5 the shareholders/partners and the beneficiary owners, and shall suspend the procedure on granting the license up to a response from the latter. Article 6 Characteristics of the license

1. The license is perpetual, non-transferable and non-tradable.
2. The license of the payment institution and of the electronic money institution shall include the trade name of the entity, the number and the date of its issue, and has as an integral part the annex of the activities and services, for which the subject is licensed.
3. The license for the payment institution encompasses the words “payment institution” in addition to the name of the institution.
4. The license for the electronic money institution encompasses the words “electronic money institution” in addition to the name of the institution. 3 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 4 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 5 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

6 Article 7 Criteria for granting or refusing a license

1. The Bank of Albania shall decide to grant the license only after it is convinced that the entity complies with the requirements set out in article 13 of Payment Services Law and in this regulation.
2. The Bank of Albania shall refuse to grant a license when the requirements set out in article 13 of Payment Services Law and in this regulation are not met, taking also into consideration the following situations: a) at least one of founders, 6 shareholders/partners with qualifying holding has been subject of procedures declaring insolvency or bankruptcy; b) details on the identity of the founders, 7 shareholders/partners with qualifying holding have not been produced; c) when at least one of the founders, 8 shareholders/partners/beneficiary owners: i. is under criminal investigation or has been convicted by a final court decision for committing a criminal offense with high social risk; ii. is under criminal investigation or has been convicted by a final court decision for a criminal offence related to money laundering or financing of terrorism; iii. is barred by a court decision from exercising the profession; iv. owns bearer shares or is a nominee shareholder (if applicable); v. has a complex ownership and control structure; vi. is a shell bank; vii. represents high risk, based on the evaluations of the Bank of Albania; viii. 9 lacks a good reputation; ix. 10has been part of the ownership structure of a financial institution whose licence has been revoked as a measure by the Bank of Albania or by another supervisory authority.
3. The Bank of Albania shall refuse the granting of license, in any case when it judges that the licensing of the entity would infringe the public interest.
4. To perform the evaluation set forth in this article, the Bank of Albania, in addition to reviewing the submitted documentation, shall cooperate with and request information from homologous supervisory authorities and institutions specialized in the fight against economic crime and organized crime and in anti-money laundering, 11the Financial Intelligence Agency, the Financial Supervisory Authority, the Competition Authority, the General Directorate of Police, the Directorate of Taxes, etc.
5. 12The Bank of Albania, when assessing the fulfilment of the suitability and integrity criteria of the shareholders/partners, beneficiary owners, the administrator, and members of the governing bodies, shall verify the sanctions lists issued by the United 6 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 7 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 8 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 9 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 10 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 11 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 12 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

7 Nations (UN) and the European Union (EU), the United Nations (UN) press releases, as well as Integrated Lists of Announced Persons. Article 8 Licensing procedures and terms

1. The Bank of Albania, for the licensing payment institutions and electronic money institutions, shall review the documents submitted in accordance with the requirements set out in Payment Services Law and in this regulation.
2. Within 3 (three) months from the date of receiving the license application, the Bank of Albania shall grant or reject the license for a payment institution or electronic money institution. The receiving date of the license application shall be the date when the applicant has met all the requirements, in accordance with Payment Services Law and this regulation. The Bank of Albania shall notify the applicant, in writing, of this date.
3. When the submitted documentation is incomplete and/or fails to meet the requirements specified in Payment Services Law and in this regulation, the Bank of Albania shall notify the applicant, within 30 (thirty) business days, on the shortfalls or noncompliance with the provisions of Payment Services Law and this regulation, together with the request for additional information or documentation.
4. The Bank of Albania interrupts the procedures for reviewing the license application, when data and/or required documents for licensing are not completed by the institution within 6 (six) months from the submission of the initial application. In the case of halting consideration of the application, the Bank of Albania shall notify the institution in writing. 13The entity has the right to reapply for licensing by submitting the relevant documentation.
5. Following the submission of the complete documentation, in accordance with Payment Services Law and this regulation, and the submission of additional information in accordance with paragraph 4 of this article, the Bank of Albania shall: a) consider and review the submitted documentation; b) assess the professional capacity and the integrity of the administrators; c) meet, when necessary, with the administrators of the payment institution or electronic money institution, to discuss the submitted documentation and information.
6. The Bank of Albania may inspect the premises/offices, where the institution shall conduct the activities for which it requires to be licenced, to verify whether the technical and security conditions are met to conduct these activities, in compliance with the by-laws issued by the Bank of Albania. 13 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

8 7. The documentation provided in this regulation must be in Albanian language, in original or in notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries, other than the Republic of Albania, the documentation must also be legalized by the responsible authorities. 8. The documentation shall be submitted to the Bank of Albania in a sealed envelope or sent by registered mail. 9. The Bank of Albania, if it deems it reasonable, may request the submission of updated certificates on the judicial status, criminal prosecution and the status of tax liabilities issued by the competent bodies, in case the validity period of the submitted documentation expires before the date of license’s approval, registration and other approvals. Article 9 Publication of decision on granting the license

1. The Bank of Albania shall publish the decision on granting the license to operate as a payment institution or electronic money institution.
2. The decision shall be published in the Official Bulletin of the Bank of Albania.
3. Bank of Albania shall register in the licensed entities’ register, the payment institution, the electronic money institution, and the list of their agents (if applicable) with their data, in compliance with Bank of Albania’s by-laws. Article 10 Applicable fees
4. The entity applying for a license to operate as a payment institution or electronic money institution shall pay an application processing fee of ALL 30.000 (thirty thousands) to the Bank of Albania, upon submission of the application and of the respective documentation.
5. The fee set out in this article shall not be reimbursed even when the Bank of Albania rejects the granting of the license. Article 11 Revocation of license
6. The Bank of Albania revokes the license of a payment institution or electronic money institution when the conditions set out in article 15 of Payment Services Law, are met.
7. The revocation decision shall enter into force on the date set out by the Bank of Albania.

9 3. The payment institution and electronic money institution shall be prohibited to carry out the activities specified in the license, after the decision of Bank of Albania for revoking the license has entered into force. 4. The Bank of Albania shall publish in its Official Bulletin, the decision for revoking the license to operate as a payment institution or electronic money institution and makes the relevant amendments in the licensed entities’ register. 5. 14A payment institution or an electronic money institution against which the measure of license revocation has been imposed by the Bank of Albania, shall not be permitted to reapply for licensing. SUBCHAPTER II INFORMATION REQUIRED FROM APPLICANTS FOR LICENSING AS PAYMENT INSTITUTIONS Article 12 General requirements

1. The requirements set out in this subchapter, are applied to applicants for authorisation as payment institutions, which intend to provide any payment service(s) referred to in paragraphs 1-7 of Annex I of Payment Services Law, or the service referred in paragraph 8 of Annex 1 of Payment Services Law, along with other payment services. Applicants that intend to provide only the service referred to in paragraph 8 of Annex 1 of Payment Services Law are subject to the specific set of rules for account information service providers (AISPs) set out in chapter III of this regulation.
2. Savings and loan associations that submit the application to be licensed as payment institutions, apply all the requirements provided in this regulation for payment institutions, with the exception of the requirements of article 5, paragraph 4; article 26; articles 66-68 and article 73 of this regulation, to which, respectively, shall apply the requirements provided in article 5, paragraph 8, article 6, paragraph 2, letters “e”, “f” and “g”, articles 13-15 and article 33/1 of the regulation “On licensing and activity of savings and loan associations and their Unions”.
3. The application to obtain a license as a payment institution shall be submitted in writing by the founders or the administrator of the institution or any other legally authorized person (according to form no.1 of this regulation). The application is submitted together with the filled forms attached and part of this regulation, as well as the documentation set out in article 7 of the Payment Services Law and in articles 13-30 of this regulation. 14 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

10 4. The entity that applies for licensing as a payment institution, submits to the Bank of Albania, information according to Payment Services Law requirements and this regulation, which shall be truthful, complete, accurate and up to date. 5. The entity that applies for licensing as a payment institution, for the submission of documentation / information required in the Bank of Albania, in relation to the internal acts / procedures or documents of the activity, extracts the relevant sections of these acts / procedures or documents, as well as submits the references to these sections, according to the relevant requirements provided in this regulation. 6. Where the Bank of Albania may require further clarifications on the documentation/information that has been submitted, the applicant must provide such clarification within a reasonable time. Article 13 Requirements on the identification data of the entity

1. The entity that applies for licensing as a payment institution, submits to the Bank of Albania the identification data according to form no. 3 of this regulation, which should contain the following information: a) the applicant’s corporate name and, if different, trade name; b) the extract of the Commercial Registry for the registration of the subject as a legal person, issued by the National Business Center, in which it is defined the activity/ies for which the subject is submitting an application for licensing, as well as the Unique Identification Number of the Entity (NUIS); c) the statute of the company; d) the address of the applicant’s head office; e) the applicant’s electronic address and website, if available; f) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details; g) information whether or not the applicant has ever been, or is currently being, regulated and supervised by another supervisory authority in the financial services sector; h) information whether the applicant is a member or plans to join any trade association in relation to the provision of payment services, where applicable. Article 14 Requirements on the programme of operations
2. In accordance with article 7, paragraph 1, letter “a” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, the programme of operations which should contain the following information:

11 a) a detailed description of the type of payment services envisaged, including a description of how the activities and the operations are identified by the applicant to correspond to the categories of payment services listed in Annex 1 of Payment Services Law; b) a declaration of whether the applicant will at any point enter or not into possession of funds (obtained from the users of the payment services provided); c) a description of the execution of the different payment services, detailing all parties involved in transaction, and including for each payment service provided, the following elements: i. a diagram of flow of funds, unless the applicant intends to provide payment initiation services only; ii. settlement arrangements directly or as a sub-participant in the payment systems, unless the applicant intends to provide payment initiation services only; iii. draft contracts between all the parties involved in the provision of payment services, including those with payment card schemes, if applicable; iv. processing times; d) a copy of a draft framework contract, as defined in article 5, paragraph 19 of Payment Services Law; e) the estimated number of branches from which the applicant intends to provide the payment services, and/or carry out activities related to the provision of the payment services, if applicable; f) a description of any operational and ancillary services to the payment services provisioned in article 19, paragraph 1, letter “a” of Payment Services Law, which will be provided (if applicable). In case the entity will offer the activity of operating the payment systems, it must submit sufficient information to the Bank of Albania on its business plan in relation to the operation of payment systems, participants in the system and services provided in relation to this activity, in order to assess the application of article 20, paragraph 2 or 3 of Payment Services Law; g) a declaration of whether or not the applicant intends to grant credit as provisioned in article 19, paragraph 4 of Payment Services Law, and if so, within which limits; h) information of whether or not the applicant intends, for the next three years, to provide or already provides other business activities as referred to in article 19 of Payment Services Law, including a description of the type and expected volume of the activities; i) the information specified in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees” under article 7, paragraphs 2, 3 and 4 of Payment Services Law, where the applicant intends to provide payment services 7 and 8 (payment initiation services and account information services) listed in Annex 1 of Payment Services Law; j) information on investments in information and communication technology systems, accompanied by a list of equipment, software, etc.

12 Article 15 Requirements on the business plan

1. In accordance with article 7, paragraph 1, letter “b” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, the business plan which should contain the following information: a) an analysis of the entity’s competitive position in the payment market segment concerned; b) a description of the categories of payment services users; c) a forecasted financial situation calculation for the first three financial years of activity, demonstrating that the applicant is able to operate soundly, which should include: i. a forecasted income statement and balance-sheet and explanations of their main items, including information on the volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability, etc; ii. a forecasted statement of capital changes; iii. a diagram and detailed breakdown of the estimated cash flows for the next three years; d) an annual forecast of the composition by items, of the regulatory capital for the first three years of activity, calculated in accordance with the method defined in article 11 of the Payment Services Law and in the Bank of Albania’s bylaws, except when the applicant requests to provide only payment initiation service or only payment initiation service and account information service; e) a forecast regarding the implementation of the regulatory and supervisory framework (indicators of prudence, reports, etc.) for the next 3 (three) years; f) if the entity has carried out another activity, before applying for licensing as payment institution, the audited annual financial statements for the previous three years, and in the case of a newer company, the audited financial statements, since its establishment. Article 16 Requirements on the structural organisation
2. In accordance with article 7, paragraph 1, letter “h” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the structural organisation which should contain the following information: a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, and descriptions of the functions and responsibilities, in particular those in charge of internal control functions; b) a forecast of the overall staff number for the next three years;

13 c) a copy of draft operational outsourcing agreements for the transfer of operational payment service functions and a description of these arrangements consisting of: i. the identity and geographical location of the outsourcing provider; ii. the identity of the persons within the payment institution that are responsible for each of the outsourced activities; iii. a clear description of the outsourced activities and their main characteristics; d) a description on branches and agents, where applicable, including: i. a forecast of the off-site and on-site audits that the applicant intends to perform, at least annually, on branches and agents and their frequency; ii. the IT systems, the processes and the infrastructure that are used by the applicant’s agents that will perform activities on behalf of the applicant; iii. in the case of agents, the selection policy, monitoring procedures and agents’ training; iv. information on the fulfillment of technical and security conditions for the branches and/or agents, according to the regulation “On minimum security requirements regarding premises where banking and financial activities are conducted and transportation of monetary values”, in case the subject carries out the activity of payment services, through counters and/or agents; e) information whether the applicant is a participant on the national and/or international payment system; f) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Article 17 Requirements on the evidence of initial capital The entity that applies for licensing as a payment institution, as the evidence of required minimum initial capital in accordance with article 7, paragraph 1, letter “c” of the Payment Services Law, submits to the Bank of Albania, a certificate issued by a bank or branch of a foreign bank licensed by the Bank of Albania, certifying that the subject has frozen, in an account at the bank, the amount of the required capital in accordance with article 5 of this regulation. This amount shall be released upon the notification of the Bank of Albania, at the conclusion of the licensing procedure. 15In any case, if during the licensing process the equivalent amount in Albanian Lek is not met as a result of exchange rate fluctuations, the Bank of Albania shall require the replenishment of the deposited amount of capital, defined in article 5 of this regulation. Article 18 Safeguarding the payment service users’ funds requirements

1. For the entities that require to offer payment services 1-6 listed in Annex 1 of Payment Services Law, which will safeguard the payment service users’ funds 15 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

14 through depositing funds in a separate account in a bank or through an investment in liquid and low risk assets, the applicant submits a description of the safeguarding measures, in accordance with article 7, paragraph 1, letter “ç” of the Payment Services Law, which should contain: a) a description of the investment policy to ensure the assets chosen are liquid and low risk, if applicable; b) the number of persons that have access to the safeguarding account and their functions; c) a copy of the draft contract with the bank(s); d) an explicit declaration by the payment institution of compliance with article 12 of Payment Services Law (according to form no. 12 of this regulation). 2. For the entities that require to offer payment services 1-6 listed in Annex 1 to Payment Services Law, which will safeguard the funds of the payment service users through an insurance policy or comparable guarantee from an insurance company or a bank, the applicant submits a description of the safeguarding measures, in accordance with article 7, paragraph 1, letter “ç” of the Payment Services Law, which should contain the following: a) confirmation from the entity that the insurance policy or the comparable guarantee from an insurance company or a bank, is issued from an entity that is not part of the same group as the payment institution (applicant); b) details of the reconciliation process, to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times; c) duration and renewal of the insurance/guarantee; d) a copy of the (draft) insurance agreement or the (draft) comparable guarantee. Article 19 Requirements on governance arrangements and internal control mechanisms

1. In accordance with article 7, paragraph 1, letter “d” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the governance arrangements and internal control mechanisms, which should consist of: a) a description of the risks identified by the applicant (including branches and agents, if applicable) and the procedures the applicant will put in place to assess and prevent such risks; b) the procedures to carry out periodical and permanent controls, including the frequency of these controls and the human resources allocated; c) the accounting procedures by which the applicant will record and report its financial information; d) the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to￾date curriculum vitae of these persons;

15 e) the composition of the supervisory/administration board, of the audit committee and, of any other committee in supervisory/administration board level, if applicable; f) a description of the way outsourced operational functions are monitored and controlled, so as to avoid an impairment in the quality of the payment institution’s internal controls; g) a description of the way any agents and branches are monitored and controlled, within the framework of the applicant’s internal controls; h) where the applicant is the subsidiary of a foreign regulated entity, a description of the management bodies and of the entities of the group. Article 20 Requirements on procedures for monitoring, handling and following up on security incidents and security-related customer complaints

1. In accordance with article 7, paragraph 1, letter “dh” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints, which should contain: a) organisational measures and tools for the prevention of fraud; b) details of the individual(s) and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; c) reporting lines in cases of fraud; d) the contact point for customers, including a name and email address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including notification of major incidents to the Bank of Albania in compliance with article 89 of Payment Services Law and the relevant by-laws; f) the monitoring instruments that will be used and the follow-up measures and procedures in place to mitigate security risks. Article 21 Requirements on the process for filing, monitoring, tracking and restricting access to sensitive payment data
2. In accordance with article 7, paragraph 1, letter “e” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the procedure in place to file, monitor, track and restrict access to sensitive payment data, consisting of: a) a description of the flows of data classified as sensitive payment data in the context of the payment institution’s business model; b) the procedures in place to authorise access to sensitive payment data; c) a description of the monitoring instruments;

16 d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) unless the applicant intends to provide payment initiation services only, a description of how the collected data are filed; f) unless the applicant intends to provide payment initiation services only, the expected internal and external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented including encryption and/or tokenisation; h) identification of the individuals, bodies and/or committees with access to the sensitive payment data; i) an explanation of how breaches of confidentiality and integrity of information will be detected and addressed; j) an annual internal control programme in relation to the safety of the IT systems. Article 22 Requirements on the business continuity plan

1. In accordance with article 7, paragraph 1, letter “ë” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the business continuity plan consisting of the following information: a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets, including information; b) the identification of (any) back-up sites in case of activation of the business continuity plan, access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant discontinuity of service events and disruptions, such as the failure of key systems, the loss of key data, the inaccessibility of the premises, or the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; e) a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts. Article 23 Requirements on the collection of statistical data on the progress of activities, transactions and fraud
2. In accordance with article 7, paragraph 1, letter “f” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the principles and definitions applied for the collection of

17 statistical data on the progress of activities, transactions and fraud consisting of the following information: a) the type of data that is collected, in relation to customers, type of payment service, channel, instrument, and currencies; b) the data, in terms of the activities and entities concerned, including branches and agents; c) the means of collection; d) the purpose of collection; e) the frequency of collection; f) supporting documents, such as a manual, that describe how the system works. Article 24 Requirements on the security policy document

1. In accordance with article 7, paragraph 1, letter “g” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a security policy document containing the following information: a) a detailed assessment of the risks related to the payment services the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; b) a description of the IT systems, which should include: i. the architecture of the systems and their network elements; ii. the business IT systems supporting the business activities provided, such as the applicant’s website, wallets, the payment engine, the risk and fraud management engine, and customers’ identification and accounting; iii. the support IT systems used for the organisation and administration of the applicant, such as accounting, reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers; iv. information on whether those systems are already used by the applicant or its group, and the estimated date of implementation, if applicable; c) the type of authorised connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under letter “c”, the logical security measures and mechanisms in place, specifying the control the applicant will have over such access as well as the nature and frequency of each control, such as technical versus organisational, preventative versus detective, and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system

18 monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include: i. the technical and organisational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; ii. how the issue of client environment segregation is dealt with in cases where the applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the payment processes, which should include: i. the customer authentication procedure used for both consultative and transactional access, and for all underlying payment instruments; ii. an explanation of how safe delivery to the legitimate payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal; iii. a description of the systems and procedures that the applicant has in place for transaction analysis and the identification of suspicious or unusual transactions; h) a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; i) main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation, which take also into consideration the requirements of regulation “On the use of information and communication technology in entities licenced by the Bank of Albania”. Article 25 Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing

1. In accordance with article 7, paragraph 1, letter “gj” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, a description of the internal control mechanisms that the applicant has established in order to comply, with those legal and regulatory requirements in force for anti-money laundering and counter terrorism financing, which should contain the following information: a) the assessment of the money laundering and terrorism financing risks associated with applicant’s business activities, including the risks associated with the applicant’s customer base, the products and the payment services provided, the distribution channels used and the geographical areas of operation;

19 b) the measures the applicant has or will put in place to mitigate the risks and comply with applicable anti-money laundering and counter terrorism financing legal and regulatory requirements, including the risk assessment process by the applicant, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities; c) the systems and controls the applicant has or will put in place to ensure that its branches and agents comply with applicable anti-money laundering and counter terrorism financing requirements in force; d) mechanisms the applicant has or will put in place to ensure that staff and agents are appropriately trained in anti-money laundering and counter terrorism financing matters; e) the identity of the person(s) in charge of ensuring the applicant’s compliance with anti-money laundering and counter-terrorism financing legal and regulatory requirements, and evidence that its(their) anti-money laundering and counter￾terrorism expertise is sufficient to enable him(them) to fulfil this role effectively; f) the systems and controls the applicant has or will put in place to ensure that its anti-money laundering and counter terrorism financing policies and procedures remain up to date, effective and relevant; g) the systems and controls the applicant has or will put in place to ensure that the agents do not expose the applicant to increased money laundering and terrorist financing risk; h) the anti-money laundering and counter terrorism financing manual for the staff of the applicant. Article 26 Requirements on the identity and assessment of suitability of qualifying shareholders/partners

1. In accordance with article 7, paragraph 1, letter “i” of the Payment Services Law, the entity that applies for licensing as a payment institution, for the purpose of the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant’s (payment institution’s) capital, should submit to the Bank of Albania the following information: a) description of the group to which the applicant belongs to and an indication of the parent undertaking, where applicable; b) a chart setting out the structure of the shareholders/partners 16and beneficiary owners, including: i. the name and the percentage holding (capital/voting right) of each person that has a direct holding in the share capital of the applicant, identifying those that are considered as shareholders/partners with qualifying holdings and the reason for such qualification; 16 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

20 ii. the name and the percentage holding (capital/voting rights) of each person that has an indirect holding in the share capital of the applicant, identifying the persons that are considered as shareholders/partners with indirect qualifying holdings and the reason for such qualification 17and the beneficiary owners; c) a list of the names of all persons that have qualifying holdings in the applicant’s capital, indicating for each such person: i. the number and type of shares or other quotas subscribed; ii. the nominal value of such shares or capital’s quotas. 2. Where a person who has a direct or indirect qualifying holding in the applicant’s capital is an individual or a natural person, the entity applying for a license as a payment institution submits the following information to the Bank of Albania relating to the identity and suitability of that person: a) the person’s name, date and place of birth, citizenship, personal identification number or passport number, address and copy of the official identity document; b) for the individual, a detailed curriculum vitae stating the education and training, previous professional experience, any dismissal from employment and any professional activities or other functions currently performed (according to form no.4 of this regulation); c) the following certificates issued by the competent authorities, according to their territorial jurisdiction: i. that the person is not under criminal investigation; ii. that the person is not standing trial for a criminal offence; iii. that the person has not been convicted by a court for committing a criminal offence; and iv. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. d) a personal statement on any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; e) the borrower's certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state, issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania; f) a declaration for any refusal or revocation by a supervisory authority/Bank of Albania or a public sector entity in the financial services sector or any expulsion by a professional association; 17 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

21 g) a list of undertakings that the person directs or controls, the percentage of control either direct or indirect in these companies, their status (whether or not they are active, dissolved, etc.); h) the outcome of the assessment, where an assessment of reputation of the person has already been conducted by the Bank of Albania or by a supervisory authority in the financial services sector, including the identity of that authority; i) audited financial statements/data by statutory auditors for the last three years (in accordance with the form no. 11 of this regulation); j) for natural persons, the extract from the Commercial Registry and a certificate of the taxation authorities affirming compliance with the fiscal duties; k) a statement containing the information about close personal, working or business relationships in accordance with legal stipulations, with persons with criminal convictions by a final court decision (according to form no. 9 of this regulation); l) a declaration whether the person is a politically exposed person and whether it has links to politically exposed persons, as defined in law “On preventing money laundering and terrorism financing” (according to form no. 10 of this regulation). 3. Where a person or entity who has direct or indirect qualifying holding in the applicant’s capital is a legal person, the entity that applies for licensing as a payment institution submits to the Bank of Albania the following information relating to the identity and suitability of that person: a) name of the entity; b) the extract of the Commercial Registry (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); c) the addresses of its head office; d) contact details; e) the statute of the company, or, where the person is registered abroad, a summary explaining the main legal features of the legal form or the entity; f) decision of the decision-making body of the company on participation in the capital of the payment institution; g) whether or not the legal person has ever been or is regulated by Bank of Albania/another supervisory authority in the financial services sector or by any other government body; h) the information referred to in letters “c” to “l” of paragraph 2 of this article in relation to the legal person; i) the shareholders’ 18/partners’/beneficiary owners’ structure of the legal person, including at least: their name, date and place of birth (for the individuals), address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or partners and beneficial owners19; 18 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 19 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

22 j) a description of the regulated financial group to which the applicant belongs, or may become a part, indicating the parent undertaking and other entities within the group and the name of their supervisory authorities; k) annual financial statements, at the individual and, where applicable, the consolidated levels, for the last three financial years, where the legal person has been in operation for that period (or, if less than three years, the period for which the legal person has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm within the meaning of the law on the statutory auditor, where applicable, including each of the following items: i. the balance sheet; ii. the profit-and-loss (income) statement; iii. the annual reports and financial annexes; l) certificate by competent authorities on compliance with fiscal duties (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); m) where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the three financial years prior to the date of the application, the application shall set out the existing financial statements (if any); n) where the legal person has its head office abroad, general information on the regulatory regime of that country as applicable to the legal person, including information on the extent to which the third country’s anti-money laundering and counter-terrorist financing regime is consistent with the FATF20 Recommendations; o) for entities in the form of collective investment undertakings or trusts, the application shall set out the following information: i. the identity of the persons who manage assets and of the persons who are beneficiaries or subscribers; ii. a copy of the document establishing and governing the entity including the investment policy and any restrictions on investment applicable to the entity. 4. The entity that applies for licensing as a payment institution submits to the Bank of Albania the following information, for each individual, natural or legal person who has a qualifying holding in the capital of the applicant: a) detailed information of that person’s financial or business reasons for owning that holding and the person’s strategy regarding the holding, including the period for which the person intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; b) details of the person’s intentions in respect of the applicant and of the influence the person intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the 20 Financial Action Task Force Recommendations.

23 applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention; c) information on the person’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; d) the content of any intended shareholder’s or partner’s agreements (including financial arrangements) with other shareholders or partners in relation to the applicant; e) an analysis as to whether or not the qualifying holding will impact in any way, on the ability of the applicant to provide timely and accurate information to the Bank of Albania; f) the identity of each member of the supervisory/administration board or of the administrator who will be appointed by such shareholders or partners, together with the information set out in article 27 of this regulation. 5. The entity that applies for licensing as a payment institution submits to the Bank of Albania the following documentation for the capital and its source (to provide sufficient information to the Bank of Albania that the funds were generated from legal activities): a) notarized statement of shareholders or partners that the source of the initial paid￾in capital of the payment institution is not a loan, credit or advance from third parties; b) notarized statement of the shareholders or partners on the source of the creation of the initial paid-in capital and for any addition to it during the development of the activity, accompanied by the following documentation: i. for legal entities:

• evidence of the source of funding, presented in a legally acceptable form (report of the certified public accountant, annual balance sheet, gifts or other resources intended for the purchase of shares 21or quotas of the payment institution) and 22documents issued by the competent authorities that provide data on the balance sheet of the company and the regularity of payment of taxes; ii. for individuals or natural persons:
• evidence of the source of funding, presented in legally acceptable form (purchase or sale, gifts, salaries, monetary deposits in banks or other evidence of the source of funds) and certificates of relevant state fiscal authorities related to the settlement of tax liabilities. 21 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 22 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

24 6. The information requirements established in this article are applicable to the licencing process of payment institutions and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in article 8, paragraphs 1 and 2 of the Payment Services Law. Article 27 Requirements on suitability assessment of administrators and persons responsible for the management of the payment institution

1. The entity that applies for licensing as a payment institution, submits to the Bank of Albania the identity of each member of the supervisory/administration board, of the administrator and of each member of the audit committee.
2. In accordance with article 7, paragraph 1, letter “j” of the Payment Services Law, the entity that applies for licensing as a payment institution, for the purposes of the assessment of the suitability of the supervisory/administration board, of administrator and of the chairman of the audit committee, submits to the Bank of Albania the documentation provisioned in article 67 of this regulation. In any case, these persons should meet the criteria set out in article 66 of this regulation.
3. The requirements established in this article are applicable, also in the case of change or re-appointment (extension of the term of appointment) of any of the persons referred to in paragraph 2 of this article. Article 28 Requirements on the statutory auditor or audit firm In accordance with article 7, paragraph 1, letter “k” of the Payment Services Law, the entity that applies for licensing as a payment institution submits to the Bank of Albania, information on the statutory auditor or audit firm, which shall contain the name, address and contact details of the auditor. Article 29 Requirements on professional indemnity insurance or a comparable guarantee for payment initiation services and account information services
4. The entity that intends to provide payment initiation service or account information service, as defined in article 7, paragraphs 2 and 3 of the Payment Services Law and in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, as evidence of a professional indemnity insurance or comparable guarantee, submits to the Bank of Albania the following information:

25 a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, showing the coverage of the relevant liabilities; b) the documentation of how the applicant has calculated the minimum amount in a way that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, including all applicable components of the formula specified therein. Article 30 Requirements on agents

1. When the payment institution intends to provide payment services through the agent, except the provisions in article 21 of the Payment Services Law, submits to the Bank of Albania the following information/documentation: a) information according to form no. 8 of this regulation; b) for the agents, different from payment services providers, the following certificates issued by the competent authorities, according to their territorial jurisdiction that certify: i. that the person is not under criminal investigation; ii. that the person is not standing trial for a criminal offence; iii. that the person is not criminally convicted (by the Ministry of Justice); iv. that the person is not under a mandatory execution process (as certified by the Bailiff’s Office); The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. c) 23extract from the commercial register issued by the National Business Center (NBC), in which the conduct of activity as an agent of the payment institution is clearly specified, also indicating the full name of the respective institution.
2. The payment institution keeps in separate files, the certificates provided in letter “b” of paragraph 1 of this article, for the administrator and the persons responsible for the administration of the activity of payment services that the agent will perform on behalf of the payment institution.
3. The requirements established in this article are applicable during the licencing process of payment institutions and in cases of new agents. 23 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

26 SUBCHAPTER III INFORMATION REQUIRED FROM APPLICANTS FOR LICENSING AS ELECTRONIC MONEY INSTITUTIONS Article 31 General requirements

1. The requirements set out in this subchapter, are applied to applicants for authorisation as electronic money institutions, which intend to provide electronic money services and, if applicable, any payment service(s) referred to in paragraphs 1-8 of Annex 1 of Payment Services Law. Applicants that intend to provide only payment services referred to in paragraphs 1-7 of Annex 1 of Payment Services Law or services referred to in paragraph 8 of that Annex in combination with other services referred to in paragraphs 1-7 without providing e-money services, should refer to the specific requirements on the information/documentation required for authorisation as payment institutions set out in subchapter II of this chapter. Applicants that intend to provide only the payment service referred to in paragraph 8 of Annex 1 of Payment Services Law without providing e-money services, should refer to the requirements set out in chapter III of this regulation, on the information/documentation required for registration of account information service providers.
2. The application to obtain a license as an electronic money institution shall be submitted in writing by the founders, administrator of the institution or any other legally authorized person (according to form no. 1 of this regulation). The application is submitted together with the filled forms attached and part of this regulation, as well as the documentation set out in articles 32-49 of this regulation.
3. The entity that applies for licensing as an electronic money institution, submits to the Bank of Albania, information according to requirements of this regulation, which shall be truthful, complete, accurate and up to date.
4. The entity that applies for licensing as an electronic money institution, for the submission of documentation/information required in the Bank of Albania, in relation to acts/procedures or internal documents of the activity, extracts the relevant sections of these acts/procedures or documents, as well as submits references to these sections, according to the relevant requirements provided in this regulation.
5. Where the Bank of Albania may require clarifications on the documentation/information that has been submitted, the applicant must provide such clarification within a reasonable time.

27 Article 32 Requirements on the identification data of the entity

1. The entity that applies for licensing as an electronic money institution, submits to the Bank of Albania the identification data according to form no. 3 of this regulation, which should contain the following information: a) the applicant’s corporate/entity name and, if different, trade name; b) the extract of the Commercial Registry for the registration of the subject as a legal person, issued by the National Business Center, in which it is defined the activity/ies for which the subject is submitting an application for licensing, as well as the Unique Identification Number of the Entity (NUIS); c) the statute of the company; d) the address of the applicant’s head office; e) the applicant’s electronic address and website, if available; f) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details; g) information whether or not the applicant has ever been, or is currently being, regulated and supervised by another supervisory authority in the financial services sector; h) information whether the applicant is a member or plans to join any trade association in relation to the provision of e-money services and/or payment services, where applicable. Article 33 Requirements on the programme of operations
2. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, the programme of operations which should contain the following information: a) a description of the e-money services the entity intends to provide: issuance, redemption, distribution; b) a detailed description of the type of payment services envisaged (if applicable), including a description of how the activities to be offered are identified by the applicant to correspond to the categories of payment services listed in Annex 1 of Payment Services Law and a description of whether these payment services would be provided in addition to electronic money services or whether they are linked to the issuance of electronic money; c) a declaration of whether the applicant will at any point enter or not into possession of funds (obtained from the clients); d) a description of the execution of the different e-money services and, if applicable, payment services, detailing all parties involved, and including for each e-money service and, if applicable, for each payment service provided, the following elements:

28 i. a diagram of flow of funds; ii. settlement arrangements directly or as a sub-participant in the payment systems; iii. draft contracts between all the parties involved in the provision of payment services including those with payment card schemes, if applicable; iv. processing times; e) a copy of a draft framework contract between the electronic money issuer and the electronic money holder and a copy of a draft framework contract, as defined in article 5, paragraph 19 of Payment Services Law, if the applicant pretends to provide payment services in addition to e-money services; f) the estimated number of branches from which the applicant intends to provide the services, if applicable; g) a description of any operational and ancillary services to e-money services and, if applicable, to payment services, provisioned in article 19, paragraph 1, letter “a” of Payment Services Law. In case the entity will offer the activity of operating the payment systems, it must submit sufficient information to the Bank of Albania on its business plan in relation to the operation of payment systems, participants in the system and services provided in relation to this activity, in order to assess the application of article 20, paragraph 2 or 3 of the Payment Services Law; h) when the applicant intends to provide payment services in addition to e-money services, a declaration of whether or not the applicant intends to grant credit as provisioned in article 19, paragraphs 4 and 7 of Payment Services Law and, if so, within which limits; i) information of whether or not the applicant intends, for the next three years, to provide or already provides other business activities as referred to in article 19 of Payment Services Law, including a description of the type and expected volume of the activities; j) the information specified in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees”, under article 7, paragraphs 2, 3 and 4 of Payment Services Law where the applicant intends to provide payment services 7 and 8 (payment initiation services and account information services) listed in Annex 1 of Payment Services Law. k) information on investments in information and communication technology systems, accompanied by a list of equipment, software, etc. Article 34 Requirements on the business plan

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, the business plan which should contain the following information: a) an analysis of the entity’s competitive position in the e-money market and, if applicable, in the payment market segment concerned; b) a description of the payment service users and electronic money holders;

29 c) a forecasted financial situation calculation of the entity for the first three financial years, demonstrating that the applicant is able to operate soundly, which should include: i. a forecasted income statement and balance-sheet and explanations of their main items, including assumptions on the volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability, etc; ii. a forecasted statement of capital changes; iii. a diagram and detailed breakdown of the estimated cash flows for the next three years. d) an annual forecast of the regulatory capital items for the first three years of the activity, according to the method defined in Bank of Albania’s bylaws, if the electronic money institution will provide only e-money services, or according to the method defined in article 11 of Payment Services Law and in Bank of Albania’s bylaws, if the applicant intends to provide payment services (unless the applicant requests to provide payment initiation service only or payment initiation service and account information service only), in addition to e-money services; e) a forecast regarding the implementation of the regulatory and supervisory framework (indicators of prudence, reports, etc.) for the next 3 (three) years; f) if the entity has carried out another activity, before applying for licensing as an electronic money institution, the audited annual financial statements for the previous three years, and in the case of a newer company, the audited financial statements, since its establishment. Article 35 Requirements on the structural organisation

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the structural organisation which should contain the following information: a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible and descriptions of the functions and responsibilities, in particular those in charge of internal control functions; b) a forecast of the overall staff number for the next three years; c) a copy of draft operational outsourcing agreements and a description of these arrangements consisting of: i. the identity and geographical location of the outsourcing provider; ii. the identity of the persons within the electronic money institution that are responsible for each of the outsourced activities; iii. a clear description of the outsourced activities and their main characteristics. d) a description on branches and agents, where applicable, including: i. a forecast of the off-site and on-site audits that the applicant intends to perform, on branches and agents and their frequency;

30 ii. the IT systems, the processes and the infrastructure that are used by the applicant’s agents that will perform activities on behalf of the applicant; iii. in the case of agents, the selection’s criteria, monitoring procedures and agents’ training; iv. information on the fulfillment of technical and security conditions for the branches and/or agents, according to the regulation “On minimum security requirements regarding premises where banking and financial activities are conducted and transportation of monetary values", in case the subject carries out the activity through counters and/or agents; e) information whether the entity is a participant on a national and/or international payment system; f) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Article 36 Requirements on the evidence of initial capital The entity that applies for licensing as an electronic money institution, as the evidence of required minimum initial capital, submits to the Bank of Albania, a certificate issued by a bank or branch of a foreign bank licensed by the Bank of Albania, certifying that the subject has frozen, in an account at the bank, the amount of the required capital in accordance with article 5 of this regulation. This amount shall be released upon the notification of the Bank of Albania, at the conclusion of the licensing procedure. 24In any case, if during the licensing process the equivalent amount in Albanian Lek is not met as a result of exchange rate fluctuations, the Bank of Albania shall require the replenishment of the deposited amount of capital, defined in article 5 of this regulation Article 37 Safeguarding requirements for the funds of electronic money users and/or payment service users

1. For the entities that will safeguard the electronic money users’ and/or payment service users’ funds through depositing funds in a separate account in a bank or through an investment in liquid and low risk assets, the applicant submits a description of the safeguarding measures, which should contain: a description of the investment policy to ensure the assets chosen are liquid and low risk, if applicable; a) the number of persons that have access to the safeguarding account and their functions; b) a copy of the draft contract with the bank(s); c) an explicit declaration by the electronic money institution of compliance with article 12 of Payment Services Law (according to form no. 12 of this regulation). 24 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

31 2. For the entities that will safeguard the electronic money users’ and/or payment service users’ funds (if applicable), through an insurance policy or comparable guarantee from an insurance company or a bank, and unless the applicant intends to provide payment initiation service only, the applicant submits a description of the safeguarding measures, which should contain the following: a) confirmation from the entity that the insurance policy or the comparable guarantee from an insurance company or a bank, is issued from an entity that is not part of the same group as the electronic money institution (applicant); b) details of the reconciliation process, to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times; c) duration and renewal of the insurance/guarantee; d) a copy of the (draft) insurance agreement or the (draft) comparable guarantee. Article 38 Requirements on governance arrangements and internal control mechanisms

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the governance arrangements and internal control mechanisms, which should consist of: a) a description of the risks identified by the applicant (including for branches and agents, if applicable), and of the procedures the applicant will put in place to assess and prevent such risks, in relation to e-money services and, if applicable, payment services; b) the procedures to carry out periodical and permanent controls, including the frequency of these controls and the human resources allocated; c) the accounting procedures by which the applicant will record and report its financial information; d) the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to￾date curriculum vitae of these persons; e) the composition of the supervisory/administration board, of the audit committee and, of any other committee in supervisory/administration board level (if applicable); f) a description of the way outsourced operational functions are monitored and controlled, so as to avoid an impairment in the quality of the electronic money institution’s internal controls; g) a description of the way any agents, branches are monitored and controlled within the framework of the applicant’s internal controls; h) where the applicant is the subsidiary of a foreign regulated entity, a description of the management bodies and of the entities of the group.

32 Article 39 Requirements on procedures for monitoring, handling and following up on security incidents and security-related customer complaints

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints, which should contain: a) organisational measures and tools for the prevention of fraud; b) details of the applicant’s individual(s) and bodies responsible for assisting customers in cases of fraud, technical issues and/or complaint/claim management; c) reporting lines in cases of fraud; d) the contact point for customers, including a name and email address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including for applicants that intend to provide payment services in addition to e-money services, and the notification of major incidents to the Bank of Albania in compliance with article 89 of Payment Services Law and the relevant by-laws; f) the monitoring instruments that will be used and the follow-up measures and procedures in place to mitigate security risks. Article 40 Requirements on the process for filing, monitoring, tracking and restricting access to sensitive payment data
2. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the procedure in place to file, monitor, track and restrict access to sensitive payment data consisting of: a) a description of the flows of data classified as sensitive payment data in the context of the electronic money institution’s business model; b) the procedures in place to authorise access to sensitive payment data; c) a description of the monitoring instruments; d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) a description of how the collected data are filed; f) the expected internal and/or external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented including encryption and/or tokenisation; h) identification of the individuals, bodies and/or committees with access to the sensitive payment data; i) an explanation of how breaches of confidentiality and integrity of information, will be detected and addressed;

33 j) an annual internal control programme in relation to the safety of the IT systems. Article 41 Requirements on the business continuity plan

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the business continuity plan consisting of the following information: a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets, including information; b) the identification of (any) back-up sites, access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant discontinuity of service events and disruptions, such as the failure of key systems, the loss of key data, the inaccessibility of the premises, or the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; e) a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts. Article 42 Requirements on the collection of statistical data on the progress of activities, transactions and fraud
2. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the principles and definitions applied for the collection of statistical data on the progress of activities, transactions and fraud consisting of the following information: a) the type of data that is collected, in relation to customers, type of payment service, channel, instrument, and currencies; b) the data, in terms of the activities and entities concerned, including branches and agents; c) the means of collection; d) the purpose of collection; e) the frequency of collection; f) supporting documents, such as a manual, that describes how the system works. Article 43 Requirements on the security policy document
3. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a security policy document containing the following information:

34 a) a detailed assessment of the risks related to e-money services and, where applicable, the payment services the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect e-money service users and, where applicable, payment service users against the risks identified; b) a description of the IT systems, which should include: i. the architecture of the systems and their network elements; ii. the business IT systems supporting the business activities provided, such as the applicant’s website, wallets, the payment engine, the risk and fraud management engine, and customers’ identification and accounting; iii. the support IT systems used for the organisation and administration of the electronic money institution, such as accounting, reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers; iv. information on whether those systems are already used by the electronic money institution or its group, and the estimated date of implementation, if applicable; c) the type of authorised connections from outside, such as with collaborators/partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under letter “c”, the logical security measures and mechanisms in place, specifying the control the electronic money institution will have over such access, as well as the nature and frequency of each control, such as technical versus organisational, preventative versus detective, and real￾time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include: i. the technical and organisational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; ii. how the issue of client environment segregation is dealt with in cases where the applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the e-money and, where applicable, payment processes, which should include: i. the customer authentication procedure used for both consultative and transactional access, and for all underlying payment instruments; ii. an explanation of how safe delivery to the legitimate e-money services user and, where applicable, payment service user and the integrity of

35 authentication factors, such as hardware tokens and mobile banking applications, are ensured, at the time of both initial enrolment and renewal; iii. a description of the systems and procedures that the electronic money institution has in place for transaction analysis and the identification of suspicious or unusual transactions; h) a detailed risk assessment in relation to its e-money services and, where applicable, its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; i) main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation, which take also into consideration the requirements of regulation “On the use of information and communication technology in entities licenced by the Bank of Albania”. Article 44 Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing

1. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, a description of the internal control mechanisms that the applicant has established in order to comply, with those legal and regulatory requirements in force for anti-money laundering and counter terrorism financing, which should contain the following information: a) the assessment of the money laundering and terrorism financing risks associated with applicant’s business activities, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographical areas of operation; b) the measures the applicant has or will put in place to mitigate the risks and comply with applicable anti-money laundering and counter terrorism financing legal and regulatory requirements, including the risk assessment process by the applicant, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities; c) the systems and controls the applicant has or will put in place to ensure that its branches and agents comply with applicable anti-money laundering and counter terrorism financing requirements in force; d) mechanisms the applicant has or will put in place to ensure that staff and agents are appropriately trained in anti-money laundering and counter terrorism financing matters; e) the identity of the person(s) in charge of ensuring the applicant’s compliance with anti-money laundering and counter-terrorism financing legal and regulatory requirements, and evidence that its(their) anti-money laundering and counter￾terrorism expertise is sufficient to enable him (them) to fulfil this role effectively;

36 f) the systems and controls the applicant has or will put in place to ensure that its anti-money laundering and counter terrorism financing policies and procedures remain up to date, effective and relevant; g) the systems and controls the applicant has or will put in place to ensure that the agents do not expose the applicant to increased money laundering and terrorist financing risk; h) the anti-money laundering and counter terrorism financing manual for the staff of the applicant. Article 45 Requirements on the identity and assessment of suitability of qualifying shareholders/partners

1. The entity that applies for licensing as an electronic money institution, for the purpose of meeting the requirements on the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant’s (electronic money institution’s) capital, should submit to the Bank of Albania the following information: a) description of the group to which the applicant belongs to and an indication of the parent undertaking, where applicable; b) a chart setting out the shareholders’/partners’ 25and beneficiary owners’ structure of the applicant, including: i. the name and the percentage holding (capital/voting right) of each person that has a direct holding in the share capital of the applicant, identifying those that are considered as shareholders/partners with qualifying holdings and the reason for such qualifications; ii. the name and the percentage holding (capital/voting rights) of each person that has an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying shareholders/partners and the reason for such qualification 26and the beneficiary owners; c) a list of the names of all persons that have qualifying holdings in the applicant’s capital, indicating for each such person: i. the number and type of shares or capital quotas subscribed; ii. the nominal value of such shares or capital quotas.
2. Where a person who has a direct or indirect qualifying holding in the applicant’s capital is an individual or a natural person, the entity that applies for licensing as an electronic money institution should submit to the Bank of Albania all of the following information relating to the identity and suitability of that person: a) the person’s name, date and place of birth, citizenship, personal identification number or passport number, address and copy of the official identity document; 25 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 26 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

37 b) for the individual, a detailed curriculum vitae (CV) stating the education and training, previous professional experience, any dismissal from employment and any professional activities or other functions currently performed (according to form no. 4 of this regulation); c) the following certificates issued by the competent authorities, according to their territorial jurisdiction: i. that the person is not under criminal investigation; ii. that the person is not standing trial for a criminal offence; iii. that the person has not been convicted for committing a criminal offence; and iv. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office. The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. d) a personal statement on any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; e) the borrower's certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state, issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania; f) a declaration for any refusal or revocation by a supervisory authority/Bank of Albania or a public sector entity in the financial services sector or any expulsion by a professional association; g) a list of undertakings that the person directs or controls, the percentage of control either direct or indirect in these companies, their status (whether or not they are active, dissolved, etc.); h) the outcome of the assessment, where an assessment of reputation of the person has already been conducted by the Bank of Albania or by a supervisory authority in the financial services sector, including the identity of that authority; i) audited financial statements/data by statutory auditors for the last three years (in accordance with the form no. 11 of this regulation); j) for natural persons, the extract from the Commercial Registry and a certificate of the taxation authorities affirming compliance with the fiscal duties; k) a statement containing the information about close personal, working or business relationships in accordance with legal stipulations, with persons with criminal convictions by a final court decision (according to form no. 9 of this regulation); l) a declaration whether the person is a politically exposed person and whether it has links to politically exposed persons, as defined in law “On preventing money laundering and terrorism financing” (according to form no. 10 of this regulation). 3. Where a person or entity who has a direct or indirect qualifying holding in the applicant’s capital is a legal person, the entity that applies for licensing as an

38 electronic money institution should submit to the Bank of Albania the following information relating to the identity and suitability of that person: a) name of the entity; b) the extract of the Commercial Registry issued by the National Business Center (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); c) the addresses of its head office; d) contact details; e) the statute of the company, or, where the person is registered abroad, a summary explaining the main legal features of the legal form or the entity; f) decision of the decision-making body of the company on participation in the capital of the electronic money institution; g) the information whether or not the legal person has ever been or is regulated by Bank of Albania/another supervisory authority in the financial services sector or other government body; h) the information referred to in letters “c” to “l” of paragraph 2 of this article in relation to the legal person; i) the shareholders’ 27/partners’/beneficiary owners’ structure of the legal person, including at least their name, date and place of birth (for individuals), address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders/partners and beneficial owners28; j) a description of the regulated financial group to which the applicant belongs, or may become a part, indicating the parent undertaking and other entities within the group and the name of their supervisory authorities; k) annual financial statements, at the individual and, where applicable, the consolidated levels, for the last three financial years, where the legal person has been in operation for that period (or, if less than three years, the period for which the legal person has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm within the meaning of the law on the statutory auditor, where applicable, including each of the following items: i. the balance sheet; ii. the profit-and-loss (income) statement; iii. the annual reports and financial annexes; l) certificate by competent authorities on compliance with fiscal duties (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); m) where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the three financial years prior to the date of the application, the application shall set out the existing financial statements (if any); 27 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 28 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

39 n) where the legal person or the entity has its head office abroad, general information on the regulatory regime of that country as applicable to the legal person, including information on the extent to which the third country’s anti-money laundering and counter-terrorist financing regime is consistent with the FATF29 Recommendations; o) for entities in the form of collective investment undertakings or trusts, the application shall set out the following information: i. the identity of the persons who manage assets and of the persons who are beneficiaries or subscribers; ii. a copy of the document establishing and governing the entity including the investment policy and any restrictions on investment applicable to the entity. 4. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania the following information, for each individual, natural or legal person who has a qualifying holding in the capital of the applicant: a) detailed information of that person’s financial or business reasons for owning that holding and the person’s strategy regarding the capital holding, including the period for which the person intends to hold the holding and any intention to increase, reduce or maintain the level of the capital holding in the foreseeable future; b) details of the person’s intentions in respect of the applicant and of the influence the person intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention; c) information on the person’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; d) the content of any intended shareholder’s or partner’s agreements (including financial arrangements) with other shareholders or partners in relation to the applicant; e) an analysis as to whether or not the qualifying holding will impact in any way, on the ability of the applicant to provide timely and accurate information to the Bank of Albania; f) the identity of each member of the supervisory/administration board or of the administrator who will be appointed by such shareholders or partners, together with the information set out in article 46 of this regulation. 5. The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, the following documentation for the capital and its source (to provide sufficient information to the Bank of Albania that the funds were generated from legal activities): 29 Financial Action Task Force Recommendations.

40 a) notarized statement of shareholders or partners that the source of the initial paid￾in capital of the electronic money institution is not a loan, credit or advance from third parties; b) notarized statement of the shareholders or partners on the source of the creation of the initial paid-in capital and for any addition to it during the development of the activity, accompanied by the following documentation: i. for legal entities:

• evidence of the source of funding, presented in a legally acceptable form (report of the certified public accountant, annual balance sheet, gifts or other resources intended for the purchase of shares 30or quotas of the electronic money institution) and 31documents issued by the competent authorities that provide data on the balance sheet of the company and the regularity of payment of taxes; ii. for individuals or natural persons:
• evidences of the source of funding, presented in legally acceptable form (purchase or sale, gifts, salaries, monetary deposits in banks or other evidence of the source of funds) and certificates of relevant state fiscal authorities related to the settlement of tax liabilities.

6. The information requirements established in this article are applicable to the licencing process of the electronic money institution and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in article 8, paragraphs 1 and 2 of the Payment Services Law. Article 46 Requirements on suitability assessment of administrators and persons responsible for the management of the electronic money institution
7. The entity that applies for licensing as an electronic money institution, submits to the Bank of Albania the identity of each member of the supervisory/administration board, of administrator and of each member of the audit committee.
8. The entity that applies for licensing as an electronic money institution, for the purposes of the assessment of the suitability of the chairman of supervisory/administration board, of administrator and of the chairman of the audit committee, submits to the Bank of Albania the documentation provisioned in article 67 of this regulation. In any case, these persons should meet the criteria set out in article 66 of this regulation. 30 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 31 Amended upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

41 3. The requirements established in this article are applicable in the licencing process of the electronic money institutions and in the case of change or re-appointment (extension of the term of appointment) of any of the persons referred to in paragraph 2 of this article. Article 47 Requirements on the identity of statutory auditor or audit firm The entity that applies for licensing as an electronic money institution submits to the Bank of Albania, information on the statutory auditor or audit firm, which shall contain the name, address and contact details of the auditor. Article 48 Requirements on professional indemnity insurance or a comparable guarantee for payment initiation services and account information services

1. The entity that applies for licensing as an electronic money institution that, in addition to e-money services, intends to provide payment initiation service or account information service, as defined in article 7, paragraphs 2 and 3 of the Payment Services Law and in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, as evidence of a professional indemnity insurance or comparable guarantee, submits to the Bank of Albania the following information: a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, showing the coverage of the relevant liabilities (responsibilities); b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, including all applicable components of the formula specified therein. Article 49 Requirements on agents and outsourcing arrangements
2. When the electronic money institution intends to provide services through the agent, in addition to what is provided in article 21 of the Payment Services Law, the electronic money institution also applies the requirements provided in article 30 of this regulation.
3. Electronic money institutions may not issue electronic money through agents, but may distribute and/or redeem funds through one or more agents, who act on their behalf.

42 3. The electronic money institution may enter into outsourcing agreements for the transfer of operational functions, to which the requirements of article 21 of the Payment Services Law apply. 4. The requirements established in this article are applicable during the licencing process of electronic money institutions and in cases of new agents and new outsourcing agreements. CHAPTER III REQUIREMENTS FOR REGISTRATION OF PAYMENT SERVICES PROVIDERS WHO BENEFIT FROM EXEMPTIONS, ACCORDING TO DEFINITIONS IN PAYMENT SERVICES LAW SUBCHAPTER I INFORMATION REQUIRED FROM APPLICANTS FOR REGISTRATION FOR THE PROVISION OF SERVICE 8 OF ANNEX I OF PAYMENT SERVICES LAW Article 50 General requirements

1. The requirements set out in this subchapter, are applied to applicants for registration as account information service providers that intend to provide only the service as defined in Annex 1, paragraph 8 of the Payment Services Law. Should the applicant intend to provide additional services to those of account information services, they should apply for authorisation as a payment institution and refer to the rules set out in chapter II of this regulation for payment institutions.
2. The application to register as an account information service provider shall be submitted in writing by the founders or the administrator of the entity or any other legally authorized person (according to form no. 1 of this regulation). The application is submitted together with the filled forms attached and part of this regulation, as well as the documentation set out in articles 51-61 of this regulation.
3. The entity that applies for registration as account information service provider, submits to the Bank of Albania, information according to Payment Services Law requirements and this regulation, which shall be truthful, complete, accurate and up to date.
4. The entity that applies for registration as account information service provider, for the submission of documentation/information required in the Bank of Albania, in relation to acts/procedures or internal documents of the activity, extracts/issues/detaches the relevant sections of these acts/procedures or documents,

43 as well as submits references to these sections, according to the relevant requirements provided in this regulation. 5. The Bank of Albania for the registration as account information service provider, reviews the submitted documentation, according to the deadlines defined in this article and in accordance with Payment Services Law’s and this regulation’s requirements. 6. The Bank of Albania registers the account information service provider, within 3 (three) months from the receiving date of the registration application. The receiving date of the registration application is considered the date when the applicant has met all the requirements, according to Payment Services Law and this regulation. The Bank of Albania shall notify the applicant, in writing, of this date. 7. If the submitted documentation is not complete and/or does not meet the requirements set out in the Payment Services Law and in this regulation, the Bank of Albania within 30 (thirty) working days shall send a notice of deficiencies or discrepancies with the provisions of the Payment Services Law and of this regulation, together with the request for additional information or documentation. 8. The Bank of Albania terminates the procedures for reviewing the application for registration, in case the data and/or documentation required for registration is not completed by the entity within 6 (six) months after the date of the initial application for registration. The Bank of Albania shall notify the entity, in writing, in case of termination of the procedure for reviewing the registration application. 32The entity shall be entitled to request the reopening of the review procedure for registration, by submitting the relevant documentation. 9. Where the Bank of Albania may require further clarifications on documentation/information that has been submitted, the applicant must provide such clarification within a reasonable time. 10. The entity applying for registration as account information service provider shall pay an application processing fee of ALL 10.000 (ten thousands) to the Bank of Albania, upon submission of the application and of the respective documentation. This fee shall not be reimbursed even when the Bank of Albania rejects the registration of the entity. 11. The Bank of Albania registers in the register of entities, the account information service provider, as well as the list of its agents (if applicable), with the relevant data, according to the Bank of Albania’s bylaws. 32 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

44 12. The Bank of Albania provides the account information service provider with the decision for registration in the public register. Article 51 Requirements on the identification data of the entity

1. If the applicant is a natural person, the identification details that shall be provided according to form no. 3/1 of this regulation, should contain the following information: a) name, date and place of birth, nationality, personal identification number or passport number and address; b) copy of the identity card/passport or an official equivalent identification document; c) an updated curriculum vitae (according to form no. 4 of this regulation); d) the following certificates issued by the competent authorities, according to their territorial jurisdiction: i. that the person is not under criminal investigation; ii. that the person is not standing trial for a criminal offence; iii. that the person has not been convicted for committing a criminal offence; The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. e) the name(s) of the person(s) in charge of dealing with the application file and authorisation procedure, and their contact details.
2. If the applicant is a legal person, the identification details that shall be provided according to form no. 3/1 of this regulation, should contain the following information: a) the applicant’s corporate/entity name and, if different, trade name; b) the extract of the Commercial Registry for the registration of the subject as a legal person, issued by the National Business Center, in which it is defined the activity for which the subject is submitting an application for registering, as well as the Unique Identification Number of the Entity (NUIS); c) the statute of the company; d) the address of the applicant’s head office; e) the applicant’s electronic mail address and website (if available); f) the name(s) of the person(s) in charge of dealing with the application file and registration procedure, and their contact details; g) the information whether or not the applicant is currently being, or has ever been, regulated by a competent authority in the financial services sector. Article 52 Requirements on the programme of operations
3. In accordance with article 7, paragraph 1, letter “a” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to

45 the Bank of Albania, the programme of operations which should contain the following information: a) a description of the account information service that is intended to be provided, including an explanation of how the applicant determined that the activity fits the definition of account information services, as defined in article 5, paragraph 38 of Payment Services Law; b) a declaration of the applicant that he will not enter at any time into possession of customers/users of payment services funds; c) a description of the provision of the account information service, including: i. draft contracts between all the parties involved in the provision of payment service, if applicable; ii. terms and conditions of the provision of the account information services; iii. processing times; d) the estimated number of branches from which the applicant intends to provide the services, if applicable; e) a description of any operational and ancillary services to the account information service, provisioned in article 19, paragraph 1, letter “a” of Payment Services Law, if applicable; f) information of whether the applicant intends, for the next three years, to provide, or already provides, business activities other than account information services, as referred to in article 19 of Payment Services Law, including a description of the type and expected volume of the activities; g) the information specified in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees”, under article 7, paragraphs 2, 3 and 4 of Payment Services Law where the applicant intends to provide only the service according to paragraph 8 of Annex 1 of Payment Services Law (account information service); h) information on investments in information and communication technology systems, accompanied by a list of equipments, softwares, etc. Article 53 Requirements on the business plan

1. In accordance with article 7, paragraph 1, letter “b” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, the business plan, which should contain the following information: a) an analysis of the applicant’s competitive position; b) a description of account information service users’ categories in the market segment concerned; c) a forecasted financial situation of the applicant for the first three financial years, demonstrating that the applicant is able to operate soundly, which should include:

46 i. a forecasted income statement and balance-sheet and explanations of their main items, including information on the number of clients, pricing and expected increase in profitability; ii. a diagram and detailed breakdown of the estimated cash flows for the next three years; d) if the entity has carried out another activity, before applying for registration as account information service provider, the audited annual financial statements for the previous three years, and in the case of a newer company, the audited financial statements, since its establishment. Article 54 Requirements on the structural organisation

1. In accordance with article 7, paragraph 1, letter “h” of the Payment Services Law, if the entity that applies for registration as account information service provider, is a natural person, it submits to the Bank of Albania, the description of the structural organisation which should contain the following information: a) a forecast of the overall staff number for the next three years; b) a copy of draft operational outsourcing agreements and a description of these arrangements consisting of: i. the identity and geographical location of the outsourcing provider; ii. the identities of the persons within the account information service provider that are responsible for each of the outsourced activities; iii. a detailed description of the outsourced activities and their main characteristics; c) if applicable, a description of branches and agents, including: i. a forecast of the off-site and on-site audits that the applicant intends to perform on branches and agents and their frequency; ii. the IT systems, processes and infrastructure that are used by the applicant’s agents that will perform activities on behalf of the applicant; iii. in the case of agents, the selection policy, monitoring procedures and agents’ training; d) a list of all natural or legal persons that have close links with the applicant, indicating their identity and the nature of those links.
2. In accordance with article 7, paragraph 1, letter “h” of the Payment Services Law, if the entity that applies for registration as account information service provider, is a legal person, it submits to the Bank of Albania, the description of the structural organisation which should contain the following information: a) a detailed organisational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible and descriptions of functions and responsibilities, in particular those in charge of internal control functions; b) a forecast of the overall staff number for the next three years;

47 c) a copy of draft operational outsourcing agreements and a description of these arrangements consisting of: i. the identity and geographical location of the outsourcing provider; ii. the identities of the persons within the account information service provider that are responsible for each of the outsourced activities; iii. a detailed description of the outsourced activities and their main characteristics; d) if applicable, a description of branches and agents, including: i. a forecast of the off-site and on-site audits that the applicant intends to perform on branches and agents and their frequency; ii. the IT systems, processes and infrastructures that are used by the applicant’s agents that will perform activities on behalf of the applicant; iii. in the case of agents, the selection policy, monitoring procedures and agents’ training; e) a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. 3. In cases when the account information service provider intends to provide the payment service through the agent, submits to the Bank of Albania the information according to form no. 8 of this regulation, which contains: a) the name, Unique Identification Number of the Entity (NUIS) and the address of the agent; b) the identity of the administrator and the persons responsible for the administration of the payment services activity that the agent will perform in the name and on behalf of the entity; c) the payment service to be performed by the agent. 4. The requirements provided in paragraph 3 of this article are applicable in the process of registration of the account information service provider and in cases of new agents. Article 55 Requirements on governance arrangements and internal control mechanisms

1. In accordance with article 7, paragraph 1, letter “d” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, a description of the governance arrangement and internal control mechanisms, which should consist of: a) a description of the risks identified by the applicant (including for branches and agents, if applicable) and the procedures the applicant will put in place to assess and prevent such risks; b) the procedures intended to carry out periodical and permanent controls, including the frequency, and the human resources allocated; c) the accounting procedures by which the applicant will record and report its financial information;

48 d) the identity of the person(s) responsible for the internal control functions, including for the periodic, permanent and compliance controls, as well as an up￾to-date curriculum vitae of these persons; e) the composition of the supervisory/administration board, of the audit committee and, of any other committee in supervisory/administration board level (if applicable); f) a description of the way outsourced operational functions are monitored and controlled, so as to avoid an impairment in the quality of the applicant’s internal controls; g) a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; h) where the applicant is the subsidiary of a regulated entity in another country, a description of the group management bodies. Article 56 Requirements on procedures for monitoring, handling and following up on security incidents and security-related customer complaints

1. In accordance with article 7, paragraph 1, letter “dh” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, a description of the procedures in place to monitor, handle and follow up on security incidents and security-related customer complaints, which should contain: a) organisational measures and tools for the prevention of fraud; b) details of the individuals and bodies responsible of the applicant for assisting customers in cases of fraud, technical issues and/or claim management; c) reporting lines in cases of fraud; d) the contact point for customers, including a name and e-mail address; e) the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including the notification of major incidents to Bank of Albania under article 89 of Payment Services Law, and in line with relevant Bank of Albania’s bylaws; f) the monitoring instruments used and the follow-up measures and procedures in place to mitigate security risks. Article 57 Requirements on the process for filing, monitoring, tracking and restricting access to sensitive payment data
2. In accordance with article 7, paragraph 1, letter “e” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, a description of the process in place to file, monitor, track, and restrict access to sensitive payment data, consisting of:

49 a) a description of the flow of data classified as sensitive payment data in the context of the account information service provider’s business model; b) the procedures in place to authorise access to the sensitive payment data; c) a description of the monitoring instruments; d) the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; e) a description of how the collected data are filed; f) the expected internal and/or external use of the collected data, including by counterparties; g) the IT system and technical security measures that have been implemented, including encryption and/or tokenisation; h) identification of the individual(s), bodies and/or committee(s) with access to the sensitive payment data; i) an explanation of how breaches of confidentiality and integrity of information will be detected and addressed; j) an annual internal control programme in relation to the safety of the IT systems. Article 58 Requirements on the business continuity plan

1. In accordance with article 7, paragraph 1, letter “ë” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, a description of the business continuity plan, consisting of the following information: a) a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets, including information; b) the identification of the back-up site in case of activation of the business continuity plan, access to IT infrastructure, and the key software and data to recover from a disaster or disruption; c) an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems, the loss of key data, the inaccessibility of the premises, or the loss of key persons; d) the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded. Article 59 Requirements on the security policy document
2. In accordance with article 7, paragraph 1, letter “g” of the Payment Services Law, the entity that applies for registration as account information service provider, submits to the Bank of Albania, a security policy document, containing the following information:

50 a) a detailed assessment of the risks related to payment service the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; b) a description of the IT systems, which should include: i. the architecture of the systems and their network elements; ii. the business IT systems supporting the business activities provided, such as the applicant’s website, the risk and fraud management engine, and customers’ identification and accounting; iii. the support IT systems used for the organisation and administration of the account information service provider, such as accounting, reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers; iv. information on whether or not those systems are already used by the applicant or its group, and the estimated date of implementation, if applicable; c) the type of authorised connections from outside, such as with collaborators/partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; d) for each of the connections listed under letter “c”, the logical security measures and mechanisms in place, specifying the control the payment institution will have over such access as well as the nature and frequency of each control, such as technical versus organisational, preventative versus detective, real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; e) the logical security measures and mechanisms that govern the internal access to IT systems, which should include: i. the technical and organisational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; ii. how the issue of client environment segregation is dealt with in cases where the applicant’s IT resources are shared; f) the physical security measures and mechanisms of the premises and the data centre of the applicant, such as access controls and environmental security; g) the security of the payment processes, which should include: i. the customer authentication procedure used for both consultative and transactional access; ii. an explanation of how safe delivery to the legitimate payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;

51 iii. a description of the systems and procedures that the applicant has in place for transaction analysis and the identification of suspicious or unusual transactions; h) a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; i) main written procedures in relation to the applicant’s IT systems or, for procedures that have not yet been formalised, an estimated date for their finalisation, which take also into consideration the requirements of regulation “On the use of information and communication technology in entities licenced by the Bank of Albania”. Article 60 Requirements on suitability assessment of administrators and persons responsible for the management of the account information service provider

1. The entity that applies for registration as an account information service provider, submits to the Bank of Albania the identity of each member of the supervisory/administration board, of administrator and of each member of the audit committee.
2. In accordance with article 7, paragraph 1, letter “j” of the Payment Services Law, the entity that applies for registration as account information service provider, for the purposes of the assessment of the suitability of the chairman of the supervisory/administration board, of administrator and of the chairman of the audit committee, submits to the Bank of Albania the documentation provisioned in article 67 of this regulation. In any case, these persons should meet the criteria set out in article 66 of this regulation.
3. The requirements established in this article are applicable also in the cases of change or re-appointment (extension of the term of appointment) of the persons referred to in paragraph 2 of this article, after the registration of the entity. Article 61 Requirements on professional indemnity insurance or any comparable guarantee for account information services
4. The entity that applies for registration as account information service provider, as provisioned in article 7, paragraph 3 of the Payment Services Law and in Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, as evidence of a professional indemnity insurance or comparable guarantee, should provide the following information:

52 a) an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, showing the coverage of the relevant liabilities; b) documentation of how the applicant has calculated the minimum amount in a way that is compliant with the Guideline “On the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantees”, including all applicable components of the formula specified therein. SUBCHAPTER II REQUIREMENTS FOR REGISTRATION OF PERSONS WHO BENEFIT FROM EXEMPTIONS, ACCORDING TO ARTICLE 4, LETTER “GJ” AND “H” OF THE PAYMENT SERVICES LAW Article 62 Registration of service providers provisioned in article 4, letter “gj”, subparagraphs “i” and “ii” of the Payment Services Law

1. The requirements of the Payment Services Law and of this regulation, except as provided in article 31 of the Payment Services Law and in this article, will not apply to service providers who perform one of the activities or both at the same time, according to subparagraphs “i” and “ii” of letter “gj” of article 4 of the above mentioned law.
2. In case the Bank of Albania, pursuant to article 31, paragraph 2 of the Payment Services Law, takes a well-reasoned decision not to continue the exemption from the scope of the law, the service provider must submit information and documentation in accordance with article 51 of this regulation, in order to be registered in the public register defined in article 16 and article 31, paragraph 4 of the Payment Services Law.
3. The Bank of Albania may perform on-site verification in these entities or persons, on the fulfillment of the requirements of this article.
4. The Bank of Albania provides the service providers as stipulated in article 4, letter “gj”, subparagraphs “i” and “ii” of the Payment Services Law, with the decision for registration in the public register. Article 63 Registration of service providers defined in article 4, letter “h” of Payment Services Law
5. The service provider as provided in letter "h" of article 4 of the Payment Services Law notifies the Bank of Albania and submits the annual opinion of the statutory

53 auditor according to article 31, paragraph 3 of the Payment Services Law, and the documentation in accordance with article 51 of this regulation, for the purpose of registration in the public register defined in article 16 and article 31, paragraph 4 of the Payment Services Law. 2. The Bank of Albania provides the service provider provisioned in letter “h” of article 4 of the Payment Services Law, with the decision for registration in the public register. 3. The requirements of Payment Services Law and of this regulation shall be applied on service providers defined in article 4, letter “h” of Payment Services Law, only in case the following conditions are met: a) the value of any single payment transaction exceeds ALL 3,000 (three thousand); b) the cumulative value of transactions, of each client, exceeds ALL 30,000 (thirty thousand) per month; and c) the prepaid value in total, for transactions of each client, in case of prepaid accounts, exceeds ALL 30,000 (thirty thousand) per month. 4. In case the limits provided in paragraph 3 of this article are exceeded, the service providers defined in paragraph 1 of this article, must apply for licensing as a payment institution and apply the requirements provided in the Payment Services Law and in chapter II of this regulation for payment institutions. 5. The service providers defined in paragraph 1 of this article, except as provided in article 31, paragraph 3 of the Payment Services Law, submit any additional information and documentation required by the Bank of Albania. 6. The Bank of Albania may conduct on-site verification on these subjects or persons, on the implementation of the requirements laid down in this article. CHAPTER IV APPROVALS AND OBLIGATION FOR NOTIFICATION SUBCHAPTER I APPROVALS DURING THE CARRYING OUT OF ACTIVITY Article 64 Approvals during the carrying out of activity

1. Without the prior approval of the Bank of Albania, the payment institution and the electronic money institution may not:

54 a) offer payment services provisioned in Annex 1 of Payment Services Law, which are not specified in the license; b) decrease the capital; c) appoint/re-appoint one or more administrators, the chairman of the supervisory/administration board and the chairman of the audit committee; d) to change (through purchase, sale or transfer) the direct or indirect qualifying holding or the control of the entity, as provided in article 8, paragraph 1 of the Payment Services Law; e) to conduct the activity as an insurance agent. 2. The account information service provider, without the prior approval of the Bank of Albania, may not appoint/re-appoint one or more administrators, the chairman of the supervisory/administration board and the chairman of the audit committee. 3. Bank of Albania may grant or reject the approval, as stipulated in paragraph 1 and 2 of this article, within 2 (two) months from the completed submission of the application, based on the documentation set out in article 65 of this regulation. 4. Bank of Albania shall interrupt the procedures of the reviewing of the application for approval, as stipulated in paragraph 1 and 2 of this article, in case the required data and/or documentation are not completed by the entity within 3 (three) months after the date of the initial application. In case of interruption of procedures of the examination of the application for the approval, as set out in paragraph 1 and 2 of this article, the Bank of Albania shall inform the entity, in writing. 33The entity shall be entitled to request the reopening of the review procedure of the application for approval, by submitting the relevant documentation. Article 65 Requirements on documentation for the approvals

1. To obtain the approval stipulated in letters “b”, “c”, “d” and “e” of article 64 of this regulation, the payment institution and the electronic money institution submits a written application to the Bank of Albania, accompanied by the following documents: a) for the capital decrease: i.decision of the Assembly to decrease capital; and ii.supporting report with the reasons for this change; b) for the appointment/re-appointment of the administrator(s), the chairman of the supervisory/administration board and the chairman of the audit committee: i. documents in accordance with article 67 of this regulation; 33 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

55 c) for the change (through purchase, sale or transfer) of the direct or indirect qualifying holding or the control of the entity, as provided in article 8, paragraph 1 of the Payment Services Law: i. decision of the Assembly approving this change; ii. documents requested under article 26 for the payment institutions and in article 45 of this regulation for the electronic money institutions; and iii. copy of the signed agreement for changing the qualifying holding or the control of the institution; d) for conducting the activity as an insurance agent: i. decision by the decision-making body of the company to carry out the activity; ii. extract of the Commercial Registry issued by the National Business Centre, determining the requested activity; and iii. the business plan for the next three years of the activity. 2. The Bank of Albania may request, when necessary other documents in addition to those stipulated in this article. 3. To perform the evaluation set forth in this article, the Bank of Albania, in addition to reviewing the submitted documentation, shall cooperate with and request information from homologous supervisory authorities and institutions specialised in the fight against economic crime and organized crime and in anti-money laundering, the Financial Supervisory Authority, the Competition Authority, the General Directorate of Police, the Directorate of Taxes, etc. Article 66 Criteria for the appointment/re-appointment of the members of the supervisory/administration board, administrator and members of the audit committee

1. The payment institution, the electronic money institution and the account information service provider, in accordance with the nature, size, complexity of the activity and the risk profile of the entity, may set up specialized committees in supervisory/administration board level, such as the audit committee, risk(s) committee, etc., which advise/assist the board on specific issues.
2. Members of the supervisory/administration board and the administrator of the payment institution, of the electronic money institution and of the account information service provider shall meet at least the following criteria: a) hold a university degree or at least has completed the second cycle studies in higher education institutions (in the case of Albanian citizens), as a rule, in economics or law;

56 b) have a professional experience of not less than 5 (five) years, of which 3 years in the banking and/or financial sector or in any other related field considered as compatible by the Bank of Albania; c) have good ethical and professional reputation. 3. In addition to paragraph 2 of this article, the members of supervisory/administration board and the administrator, shall meet at least the following criteria: a) have never caused or been responsible for the bankruptcy of an entity that carries out economic activity; b) are not under criminal investigation or found guilty by the court for committing a criminal offence; c) have not been subject of procedures declaring insolvency or bankruptcy and are relieved of outstanding liabilities; d) have not been penalized by the Bank of Albania in the past 5 (five) years for breaching the Law “On banks” and Payment Services Law. 4. In addition to stipulations in letters “a” to “d” of paragraph 3 of this article, the members of the audit committee (if applicable), shall meet at least the following criteria: a) hold a university degree, as a rule in economics; b) have good ethical and professional reputation; and c) have a professional experience of not less than 3 years in accounting, auditing or lending. Article 67 Documentation for the prior approval of the chairman of the supervisory/administration board, administrator and the chairman of audit committee

1. The payment institution, the electronic money institution and the account information service provider shall submit an application in written form to the Bank of Albania, for the approval of supervisory/administration board chairman, administrator and the audit committee chairman, accompanied by the following documentation: a) the competent body decision, for the appointment of the person and the planned starting date (for the appointment) and the duration of the mandate; b) the name, place and date of birth, address and nationality, as well as the personal identification number and copy of identity card or of another identification document (passport); c) the academic degree in accordance with the requirements in article 66 of this regulation and documents certifying other qualifications of the person; d) the signed Curriculum Vitae (in accordance with the form no. 4 of this regulation); e) at least one reference/recommendation letter regarding the professional experience, issued by previous officers or employers; f) where applicable, information on the suitability assessment carried out by the entity, which should include details of the result of any assessment of the

57 suitability of the individual performed by the institution/provider, such as relevant board minutes or suitability assessment reports or other documents; g) a detailed description of the job, about the position to be held by the proposed person and its key duties and responsibilities; h) personal statement on the payment of all tax liabilities; i) personal statement, declaring he has never been responsible for the bankruptcy of any entity carrying out economic activity; j) a statement containing the information about close personal, working or business relationships in accordance with legal stipulations, with persons with criminal convictions by a final court decision (according to form no. 9 of this regulation); k) the following certificates issued by competent authorities, which certify that: i. the person is not under criminal investigation; ii. the person is not subject of any judgement for criminal offence committed; iii. the person has never been convicted for committing a criminal offence (by the Ministry of Justice); iv. the person is not under an obligatory execution procedure (by the Bailiff’s Office); The aforementioned documents in letter “k”, must be issued no earlier than 3 (three) months from the date of the application submission. l) 34the borrower’s certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state, which has been issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. 2. In addition to the documentation stipulated in paragraph 1 of this article, where the proposed individual is a foreign citizen, he shall submit to the Bank of Albania the residence and work permit (if applicable) in accordance with the Law on foreigners. 3. The payment institution, the electronic money institution and the account information service provider, at the event of the re-appointment of the chairman of the administration/supervisory board, the administrator and the chairman of audit committee, shall submit to the Bank of Albania, the application in written form, for the approval of this re-appointment. This application is accompanied by the following documentation: a) the re-appointment document, in accordance with paragraph 1, letter “a” of this article; b) the updated Curriculum Vitae, completed in accordance with the form no. 4 of this regulation; c) a detailed information/report for the assessment and contribution of the chairman of the administration/supervisory board, the administrator and the chairman of audit committee on the effective governance of the entity; d) other supplementary information that may be deemed as necessary. 34 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

58 Article 68 Documentation for the members of supervisory/administration board and of the audit committee The payment institution, the electronic money institution and the account information service provider holds in separate folders, the documentation stipulated in article 67 of this regulation, for the members of the supervisory/administration board and of the audit committee, which are not subject to approval by the Bank of Albania. SUBCHAPTER II ADDITIONAL ACTIVITIES/SERVICES Article 69 Additional activities/services During its activity, the payment institution or the electronic money institution may ask the Bank of Albania to allow the institution to conduct other activities/services as provisioned in Annex 1 of Payment Services Law, not envisaged in the original license, complying with requirements set out in article 5 and article 70 of this regulation. Article 70 Documentation of the approval of additional activity/service

1. The application for additional activities is submitted in writing by the administrator of the institution, or an authorized person and is supported by the following documents: a) decision by the decision-making body of the institution on carrying out the additional activity/service; b) extract from the Commercial Registry, issued by the National Business Centre, setting out the additional activities/services of the institution; c) document certifying the payment of additional minimum initial capital, if the calculated capital does not comply with the capital requirement for the activity this institution applies to carry out, according to article 5 of this regulation; d) information on compliance with technical and security conditions, in accordance with the regulation “On the minimum security requirements regarding premises where banking and financial activities are conducted and on transportation of monetary values” for the additional activities, when they will be carried out through counters and/or agents; e) applicable regulations and/or manuals to carry out the additional activity/service; f) three-year projections of financial indicators relating to the additional activities/services and their impact on the general financial position of the institution.
2. 35In cases where the entity seeks to carry out additional activities/services as stipulated in points 4 and/or 5 of Annex 1 of Payment Services Law, it shall submit 35 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

59 the request and the documentation provided for in paragraph 1 of this article, and, where the entity also envisages granting credit linked to these additional services, it shall notify the Bank of Albania thereof, as well as of the maximum limit up to which it will grant credit relating to payment services. Article 71 Review of application for additional activities/services

1. The Bank of Albania shall review the application for compliance with the capital requirement and the documents required to carry out additional activities/services, in accordance with articles 5 and 70 of this regulation.
2. The Bank of Albania shall grant the approval for the additional activities/services, when it finds that such activities/services do not pose a risk to financial stability of the payment institution or electronic money institution and that the technical requirements are met for their safe operation.
3. When the application is rejected, the Bank of Albania shall give, in writing, the reasons for such rejection. SUBCHAPTER III OBLIGATION FOR NOTIFICATION Article 72 Requirements on the obligation for notification
4. The payment institution and the electronic money institution shall immediately notify the Bank of Albania when: a) risk positions reach the maximum allowed exposure limits, as defined in the by￾laws of the Bank of Albania; b) there are justifiable causes for abating or suspending a licensed activity/service; c) there is a cause for withdrawal of the license.
5. The payment institution and the electronic money institution shall notify the Bank of Albania, within 30 (thirty) days on the following: a) change of the name; b) change of the statute; c) increase of capital; d) changes to the structure of the shareholders’ capital, which are not subject of approval according to this regulation; e) changes to the organisational structure; f) opening or closure of branches or changes of their address; g) change of the headquarter and its address; h) departure of administrators, chairman of the supervisory/administration board and chairman of the audit committee; i) list of agents or any relevant changes; j) other changes that is required to be registered in the Commercial Registry;

60 k) cases when plans to offer other activities as operational and ancillary services, as defined in article 19, paragraph 1, letter “a” of Payment Services Law; l) cases when plans to offer other business activities, different from payment services, as defined in article 19, paragraph 1, letter “c” of Payment Services Law36 , including a description of the type and the forecasted volume of activities; m) all additional products in the list, the financial transactions and electronic communication means, which take place after the commencement of the activity, supported by the following documents: i. procedures and technical data for electronic financial transactions and internal audit programme for that purpose; ii. the agreement signed with the company, on the realisation of the informatics support of the entity's activity, when applicable; iii. list clarifying the financial transactions that the institution shall carry out together with the communication channels that will be employed. 2/1. 37The payment institution and the electronic money institution, in the case of the capital increase, shall submit to the Bank of Albania the following documentation: a) the decision of the shareholders/partners assembly for the increase of the capital; b) an accompanying report on capital increase; c) the notarized declaration relating to the creation source of the capital, accompanied by the justifying documentation, in accordance with the stipulation set out in paragraph 5 of article 26 or paragraph 5 of article 45 of this regulation. 2/2. 38The payment institution and the electronic money institution, in the case of the changes in the capital’s structure, shall submit to the Bank of Albania the following documentation: a) the act for the respective legal action, that following shall bring about the changes in the capital structure; b) the decision of the governing body of the entity on granting the approval for the transfer of the shares’/quotas’ ownership (if applicable); c) the accompanying report for the changes in the capital structure; d) notarized declaration of the beneficiary shareholders/partners relating to the creation source of the capital, accompanied by the justifying documentation in accordance with the stipulation set out in paragraph 5, letter “b” of article 26 or paragraph 5, letter “b” of article 45 of this regulation; e) certifications on beneficiary shareholders/partners, issued by competent authorities in accordance with the relevant jurisdiction, that: i. the person is not under indictment in criminal proceedings (where applicable), iii. the person has not been convicted for committing criminal offence (where applicable), iv. the person is not under an compulsory execution process for outstanding liabilities, v. the person is not subject of any insolvency, bankruptcy or liquidation procedures, etc. (where applicable). The aforementioned certificates must be issued no earlier than 3 (three) months from the date of the notification submission to the Bank of Albania. 36 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 37 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 38 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

61 f) a statement of the beneficiary shareholder/partner, containing information about close personal, working or business relationship, accordance with legal stipulations, with persons with criminal convictions by a final court decision (according to form no. 9 of this regulation); g) the borrower’s certificate or report from the credit registry for the shareholder/partner, or an equivalent document issued by the competent authorities of the foreign state, which has been issued no earlier than 3 (three) months from the date of the application submission to the Bank of Albania. 2/3. 39The Bank of Albania may require, on a case-by-case basis, additional documents or information, if deeming necessary, in addition to that stipulated in this article. 3. Natural or legal persons that benefit from the exemptions, according to article 28 of the Payment Services Law, as well as service providers that perform activities according to letters “gj” and “h” of article 4 of Payment Services Law, shall notify immediately the Bank of Albania in cases when they no longer meet the conditions provided in the Payment Services Law and in the Bank of Albania’s bylaws, to benefit from the exemption. 4. The account information service provider shall notify the Bank of Albania within 30 (thirty) days in the cases provided in letters “a”, “b”, “e”, “f”, “g”, “h”, “i”, “j”, “k” and “l” of paragraph 2 of this article. Article 73 Re-assessment process

1. The payment institution, the electronic money institution and the account information service provider conduct the re-assessment of the suitability of the shareholders/partners, members of the supervisory/administration board, administrators and members of the audit committee, at least once a year, as well as when deemed necessary, based on specific circumstances or facts.
2. The payment institution, the electronic money institution and the account information service provider, through the re-assessment process of the suitability of the shareholders/partners, members of the supervisory/administration board, administrators and members of the audit committee, shall ensure the ongoing fulfillment of the criteria laid down in this regulation, and shall report to the Bank of Albania, the results of the re-assessment process, annually, within the first quarter of the following year.
3. The payment institution, the electronic money institution and the account information service provider shall document the re-assessment process of the suitability of the shareholders/partners, members of the supervisory/administration board, administrators and members of the audit committee, and shall predict the obligation for all these persons, who must notify the entity of any circumstance or 39 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

62 fact that has a significant impact on their suitability or confirm, at least once a year, that the criteria set out in this regulation continue to be met. 4. Where the payment institution, the electronic money institution and the account information service provider conclude that the terms provided for in this regulation are not met by shareholders/partners, members of the supervisory/administration board, administrators and members of the audit committee, they shall promptly inform the Bank of Albania, but no later than within 5 business days from its conclusion. 5. Following the notification in accordance with paragraph 4 of this article, as well as where it concludes this fact while conducting its oversight process, the Bank of Albania shall: a) take measures for the entity in accordance with Payment Services Law and Bank of Albania’s bylaws; and b) require the dismissal of the members of the supervisory/administration board, administrators or members of the audit committee. CHAPTER V FINAL PROVISIONS Article 74 Transitional provisions

1. Non-bank financial institutions, electronic money institutions and savings and loans associations licensed by the Bank of Albania prior to the entry into force of Payment Services Law and which carry out the activity of payment services and money transfer, shall take the measures for the organization of the activity and internal structure, in compliance with the requirements laid down in Payment Services Law and in this regulation, within 2 July 2022.
2. Non-bank financial institutions, electronic money institutions and savings and loans associations licensed by the Bank of Albania prior to the entry into force of Payment Services Law, and which carry out the activity of payment services and money transfer, shall submit to the Bank of Albania, within 2 July 2022, the documents and information provisioned in article 99, paragraph 4 of Payment Services Law.
3. Electronic money institutions, licensed by the Bank of Albania after the entry into force of the Payment Services Law and before the entry into force of this regulation, submit to the Bank of Albania, within July 2, 2022, the documentation and information provisioned in article 99, paragraph 4 of Payment Services Law.
4. The requests for obtaining a license as an electronic money institution, which are being reviewed by the Bank of Albania, at the moment of entry into force of this regulation, will be treated in accordance with the requirements of regulation no. 1,

63 dated 17.1.2013 “On the granting of license to non-bank financial institutions”, as amended. These entities, after licensing shall apply the paragraph 3 of this article. CHAIRMAN OF THE SUPERVISORY COUNCIL Gent SEJKO

64 ANNEX 1 FORM NO. 1 APPLICATION TO THE BANK OF ALBANIA ON GRANTING THE LICENSE AS PAYMENT INSTITUTION / E-MONEY INSTITUTION / ON REGISTERING AS PAYMENT SERVICE PROVIDER Name of entity: ________________________________________________ Address of proposed location: ________________________, Albania (City) (District) We hereby submit this application to the Bank of Albania, providing information in line with its requirements for granting a license to carry out activities Activities for which the entity required to be licensed: 1. 2. ….. as a payment institution / e-money institution / for registering us as a payment service provider that benefits from exemptions under Article 28 of the law "On payment services". We commit to comply with the Law “On payment services” / “On banks in the Republic of Albania” and other Albanian legislation throughout the activity we apply to exercise. Applicants

---

Note: The application with the documents and forms required in accordance with this Regulation shall be submitted to the following address: Supervision Department Bank of Albania “Skënderbej” Square, No.1 Tirana, ALBANIA

65 FORM NO. 2 DECISION OF ----------------------------------------------- (DECISION-MAKING BODY) FOR APPOINTING REPRESENTATIVES _______________________ (The decision-making body) hereby certifies that, to our knowledge and belief, the information set out herein is full, true and correct. In addition, _______________________ (the decision-making body) appoints and assigns as representative/s:

---

(First Name) (Father’s Name) (Last Name) Address: __________________________________________________________ (Street, No) (City) (Country)

---

(Telephone/Cell number) (Email address) The aforementioned representative is authorized to represent the entity and be present and sign before the Bank of Albania, except when the Bank of Albania requests personal actions from the members of _____________________________ (the decision-making body). This person is authorized to perform any action, as needed, as completely as possible and meet all the objectives and goals in the same capacity as the authoriser would have done if he received/submitted and performed personally all the correspondence and documents to the Bank of Albania. Date _____________, (First name and Last name) (Signature)

---

Note: This form shall be certified by a public notary.

66 FORM NO. 3 INDENTIFICATION DATA OF THE ENTITY The entity applying for license as a payment institution or e-money institution shall submit to the Bank of Albania the identification data which consists of the information below: a) name of the corporate/entity applying: and, if different, the trade name: b) head office address of the applicant; c) email address and official website of the applicant (if available); Email: Official website (if any): d) information on whether or not the applicant is currently or has ever been subject to the regulation and supervision of another supervisory authority in the financial services sector. (If yes, following the submission of the application, the relevant details shall be provided). (Please respond with a Yes or No) e) information on whether or not the applicant is a member or plans to join a trade association in relation to the provision of payment services and/or e-money services, if applicable; Title of the association: Address: Head office address Telephone number Fax number

67 FORM NO. 3/1 IDENTIFICATION DETAILS OF THE APPLICANT APPLYING FOR REGISTRATION AS ACCOUNT INFORMATION SERVICE PROVIDER

1. If the applicant is a natural person, the identification details to be provided to the Bank of Albania should contain the following information: a) a ) First name: Last name: b) ( b ) Date of birth: Day / month / year c) Place of birth: Country: City/town d) Nationality: e) Have you ever had/do you have a different nationality? → No → Yes → Give details for other nationalities below f) Current address: Full address and postcode Town Country g) Confirm that the curriculum vitae has been submitted as part of the application. → Yes → No → If no, give an explanation.

68 h) Confirm that the following certificates issued by the competent authorities, according to their territorial jurisdiction (issued no earlier than 3 (three) months), have been submitted with the application: i. that the person is not under criminal investigation; ii. that the person is not standing trial for a criminal offence; iii. that the person has not been convicted by a court for committing a criminal offence. → Yes → No → if no an explanation should be given i) Do you have any links to politically exposed persons, as defined in law “On the prevention of money laundering and financing of terrorism”? → No → Yes → if yes an explanation should be given. 2. If the applicant is a legal person, the identification details to be provided to the Bank of Albania should contain the following information: a) the applicant’s corporate name: and, if different, trade name: b) applicant’s head office; c) applicant’s electronic address and website address, if applicable; Email address Website address (if any) d) information on whether or not the applicant is currently or has ever been subject to the regulation and supervision of another supervisory authority in the financial services sector. (If yes, following the submission of the application, the relevant details shall be provided) (Please respond with a Yes or No) Head office address Telephone Number: Facsimile Number:

69 FORM NO. 4 CURRICULUM VITAE (of the proposed administrator, individual partner/ shareholder, member of the supervisory/administration board, member of the audit committee) First name and last name: Address Date of Birth Place of Birth Citizenship Telephone number (work) Telephone number (mobile) E-mail EDUCATION (Starting with the most recent, list all the education institutions you have attended, duration of studies, graduation date, academic title/degree awarded)

1. Name of institution and address Dates Title of qualification awarded
2. Name of institution and address Dates Title of qualification awarded FOREIGN LANGUAGES (list the foreign languages and your skills and competences, from 5 to 1 (5 = very good, 4 = good , 3 = average etc.) ADVANCED TRAINING (Starting with the most recent, list all the training courses you have attended, dates, subjects, organisers)

70 PARTICIPATION IN STEERING BODIES/PROFESSIONAL ASSOCIATIONS (List the associations you presently are or have been a member of the steering body, dates, etc.) WORK EXPERIENCE (Starting with the most recent, list your employment records, title and position, dates, main activities and responsibilities for each position)

1. Name and address of employer Dates (month/year - month/year) Type of employment a. employed !! b. self-employed !! c. unemployed !! d. student (full-time) !! Position Responsibilities (detailed) Reason/s for leaving a) Resigned !! b) Downsizing !! c) Retired !! d) End of contract !! e) Dismissed !! f) Other !! Specify
2. Name and address of employer Dates (month/year - month/year) Type of employment a. employed !! b. self-employed !! c. unemployed !! d. student (full-time) !! Position Responsibilities (detailed) Reason/s for leaving a) Resigned !! b) Downsizing !! c) Retired !! d) End of contract !! e) Dismissed !___!

71 f) Other !! Specify 3. Name and address of employer Dates (month/year - month/year) Type of employment a. employed !! b. self-employed !! c. unemployed !! d. student (full-time) !! Position Responsibilities (detailed) Reason/s for leaving a) Resigned !! b) Downsizing !! c) Retired !! d) End of contract !! e) Dismissed !! f) Other !! Specify 4. Name and address of employer Dates (month/year - month/year) Type of employment a. employed !! b. self-employed !! c. unemployed !! d. student (full-time) !! Position Responsibilities (detailed) Reason/s for leaving g) Resigned !! h) Downsizing !! i) Retired !! j) End of contract !! k) Dismissed !! l) Other !___! Specify First name and last name (Signature) Date

72 FORM NO. 5 DECLARATION I hereby certify that the information provided herein is to the best of my knowledge true and correct. The information reflects all the assets and liabilities and does not hide any facts. I affirm that the information is provided by me, on voluntary basis, to the Bank of Albania. Erroneous information or omissions in this report may constitute grounds for the Bank of Albania to reject the request. In case additional or more detailed financial information is required, I shall provide it as requested from the Bank of Albania.

---

(Date) (Signed full name) If applicable:

---

(Signature of the compiler) Signed on this date __________ of _________, 20.

---

(Signature of the public notary) Note: This declaration should be completed by each of the founders40/shareholders/partners of the payment institution and electronic money institution. 40 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

73 FORM NO. 6 AUTHORISATION TO GIVE CONFIDENTIAL INFORMATION (Both authorisation forms to be completed in original!) I __________________________ hereby authorise and request every person, company, official, legal body, association or institution having control of any documents, records and other information about me, to make available the original or a copy of such documents, records or information to the Bank of Albania, its Supervision Department or any other authorised person.

---

Name (in print)

---

---

Date (date/month/year) Full address Signature Signed in my presence date__, 20____ THIS DOCUMENT IS VALID FOR 6 MONTHS

---

(Signature of the public notary) _ I __________________________ hereby authorise and request every person, company, official, legal body, association or institution having control of any documents, records and other information about me, to make available the original or a copy of such documents, records or information to the Bank of Albania, its Supervision Department or their authorised person.

---

Name (in print)

---

---

Date (date/month/year) Full address

---

Signature Signed in my presence date__, 20____ THIS DOCUMENT IS VALID FOR 6 MONTHS

---

(Signature of the public notary) Note: This declaration should be completed by each of the founders41/shareholders/partners of the payment institution and electronic money institution. 41 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

74 FORM NO. 7 PREMISES AND LOCATION OF THE ENTITY42

1. Capital proposed to be invested in fixed assets, type of ownership: • Permanent premises, rented. • Permanent premises, owned property. • Temporary premises.
2. Description of premises: a) Rented premises : i. estimated annual cost of the rent for the entity; ii. description of the renovations and expected improvements to the building. b) Owned premises: i. name and address of vendor, date of construction finalisation, cost of premises (object) purchase; ii. cost and description of the necessary restorations, renovations and alterations to the building and the surrounding environment. c) Temporary premises: i. location of temporary premises; ii. details of temporary premises, including their dimensions, type of the construction, key facilities to be installed in the building; iii. if the temporary premises are to be purchased, the estimated cost, approximate reselling value, a copy of the standard form of the purchasing agreement; iv. if the temporary premises shall be rented, the estimated monthly rent price.
3. Proposed investment in furniture, equipment and description of items.
4. Investment proposed to meet the minimum technical and security requirements for exercising the activity.
5. 43Information on particular space/areas needed, as well as appropriate conditions for the evidence, maintenance, storage and archiving of the documentation related to the exercise of the activity 42 Note: The payment institution and the electronic money institution shall provide as much of this information as possible at the time of the application. 43 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

75 FORM NO. 8 LIST OF DATA OF AGENTS OF PAYMENT INSTITUTIONS/ELECTRONIC MONEY INSTITUTIONS/ ACCOUNT INFORMATION SERVICE PROVIDERS No. Name of agent NUIS (Unique Business Registratio n Number)/ Personal number of identificati on document Location (address) of agent Administrator of agent/ persons responsible for the administration of the activity of payment services (Name, Father's name, Surname) Personal number of identificati on document of persons in column (5) District City / Munici pality Contacts (e-mail, telephone) Payment services that the agent will carry out44 (1) (2) (3) (4) (5) (6) (7) (8) (9) (10) (11) 1 2 3 4 5 6 7 8 EM 45 44 The entity checks with the sign “X” the service/all payment services, listed in paragraphs 1-8 of Annex 1 of Payment Services Law that the agent will carry out and that are included in the licence’s annex. 45 The entity checks with the sign “X” column (11), if the agent offers the e-money services “EM”.

76 FORM NO.9 STATEMENT Through which I declare that I have/do not have family relations or close personal, working or business relationships in accordance with legal stipulations, with persons with criminal convictions by a final court decision. Note: Where the proposed shareholder / partner 46/ beneficiary owner / administrator / member of the supervisory/administration board / member of the audit committee, declares that he/she has family relations or close personal, working or business relationships in accordance with legal stipulations, with persons with criminal convictions by a final court decision, shall list the names of the persons. I hereby declare that the information provided, is voluntarily presented to the Bank of Albania/Entity ____________ by me. Any wrong doing or exclusion of the facts in this report shall be a motivation for the Bank of Albania to refuse my approval as the shareholder / partner 48/ beneficiary owner / administrator / chairman of the supervisory/administration board / chairman of the audit committee of the entity __________, or that the Entity _____________ shall refuse my appointment/re-appointment as member of the supervisory/administration board / member of the audit committee. Shall further or more detailed information be required by the Bank of Albania/Entity ________________, I remain at disposal to provide it.

---

(Name/Surname of the proposed shareholder / partner 49/ beneficiary owner / administrator / member of the supervisory/administration board / member of the audit committee) _____// (Date)

---

(full signature) 50Note: For the purposes of completing this form, family relations with a person shall be considered close relatives as defined in Article 4, point 10 of Law no. 9662, dated 18.12.2006 "On banks in the Republic of Albania", which includes: a) children (or adopted); b) the children of the children; c) spouse; d) parents; e) brothers, sisters, and their children; f) persons under his custody. 46 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 47 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 48 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 49 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 50 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. No Name of the person related to the proposed shareholder/ partner47/beneficiary owner /administrator/ member of the supervisory/ administration board/ member of the audit committee Specifying the type of the relationship (family or close personal, working or business relationship in accordance with legal stipulations) Criminal conviction by a final court decision exists (explain the type of conviction) 1 2 3 ...

77 FORM NO.10 STATEMENT Through which I (for individuals) declare that I am/am not a politically exposed person and that I have/do not have links to politically exposed persons, as defined in Law “On preventing money laundering and terrorism financing”. Note: Where the shareholder/partner with qualifying holding declares to have links to politically exposed persons, as defined in Law “On preventing money laundering and terrorism financing”, shall list the names of the persons. Nr. Name of the person related to the shareholder/ partner with qualifying holding Specifying the type of the relationship (family or close personal, working or business relationship in accordance with legal stipulations) 1 2 3 ... I hereby declare that the information provided, is voluntarily presented to the Bank of Albania/Entity ____________ by me. Any wrong doing or exclusion of the facts in this report shall be a motivation for the Bank of Albania to refuse my approval as the shareholder / partner of the entity __________. Shall further or more detailed information be required by the Bank of Albania/Entity ________________, I remain at disposal to provide it.

---

(Name/Surname of the individual (natural person) shareholder/partner /legal representative of the legal person shareholder/partner) _____// (Date)

---

(full signature) Note: This declaration should be completed by shareholder/partner with qualifying holding in the capital of payment institutions / electronic money institutions 51 For the purposes of completing this form, family relations with a person shall be considered close relatives as defined in Article 4, point 10 of Law no. 9662, dated 18.12.2006 "On banks in the Republic of Albania", which includes: a) children (or adopted); b) the children of the children; c) spouse; d) parents; e) brothers, sisters, and their children; f) persons under his custody. 51 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

78 FORM NO.11 THE 52CONFIDENTIAL PERSONAL FINANCIAL REPORT * TO BE FILLED BY EACH SHAREHOLDER/PARTNER OWNING 10 PER CENT OR MORE OF THE CAPITAL. THE FINANCIAL STATE AS AT ________________________ (Date) Deposited by: For the natural persons provide: name, father’s name, surname, date and place of birth, citizenship, residence address. To SUPERVISION DEPARTMENT OF THE BANK OF ALBANIA Relating to:

---

(Particular reasons for presenting this report) INSTRUCTIONS: Type or print this report. Provide full answers to the questions. If the answer is “No”, or “None” or “not applicable” you are pleased to provide it. In case of insufficient room, please attach a special statement to this form. The information included in this special statement is noted by numbers and letters to adapt to this form and all the statements shall be signed and contain a date. An incorrect and incomplete report shall not be accepted and be a reason for refusal of the application for a license. Each page of the information included in the 53Confidential Personal Financial Report must be signed, dated by the individual that fills the latter and be certified by a public notary. To clarify any question related to this REPORT the person that has filled it shall contact directly the Bank of Albania, Supervision Department.

• ALL THE DATA SHALL BE PROVIDED IN ALBANIAN LEK. DESCRIBE THE METHOD USED FOR THE EXCHANGE RATE OF THE CURRENCY AND NOTE THE EXCHANGE RATE. 52 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026. 53 Added upon the decision of the Bank of Albania’s Supervisory Council, No. 11, dated 1.4.2026.

79 FORM NO.11 (page 2) INCOME STATEMENT INCOME Wages, Payments and compensations Dividend and interests income Net income from leases and investments Other income

TOTAL INCOME* DIFFERENCE Discounts and adjustments Income taxes TOTAL DIFFERENCE NET INCOME (Total income minus the discounts)

• Explain special cases for the first year 20___ ________LEK

---

_____LEK 20 ________LEK

---

_____LEK 20 ________LEK

---

---

________LEK Value of the continuing year _________LEK

---

---

________LEK If one of the reasons to fill this report is the inclusion for the purchasing of shares, fill the following form: Amount of purchased shares Fair value Purchase price/share Total value of the purchase Describe the payment means. If the assets shall be liquid to finance the purchase, please provide details:

---

80 FORM NO.11 (Page 3) FINANCIAL REPORT54 ASSETS LIABILITIES

1. Cash on hand and at banks _______
2. Certificates, loans and other receivable accounts considered as regular and collectable _________
3. Owned real estate __________
4. Tradable securities _________ 5)Ownership interests _________
5. Other assets __________ TOTAL ASSETS _________
6. Uninsured current liabilities ___________
7. Insured current liabilities ___________
8. Uninsured long-term liabilities _________
9. Long-term insured liabilities _________
10. Income interest and payable tax _______
11. Other liabilities and obligations ________ TOTAL LIABILITIES _______ 13)Net wealth (total assets minus total liabilities) ___________ TOTAL LIABILITIES AND NET WEALTH _______ UNSECURED LIABILITIES Along with the liabilities and passive assets noted above, I have signed, guaranteed or on the other hand I am indirectly or casually responsible for the liabilities of the others as follows: Name and address of debtor Name and address of creditor Collateral description Current value of collateral Interest rate Liability date Present outstanding 54 This table shall be provided in details in the following tables.

81 FORM NO.11 (page 4) CASH ON HAND AND AT BANKS55 (only personal accounts) NAME OF BANK ACCOUNT CODE AMOUNT (IN LEK)

Amount of cash at banks Plus (+) Cash on hand Transferred from point (1) of the financial report TOTAL

CERTIFICATES, LOANS AND OTHER RECEIVABLE ACCOUNTS CONSIDERED AS REGULAR AND COLLECTABLE56 Name and address of debtor Date of obligation Description of collateral Current value of collateral Current outstanding (in LEK) Transferred from point (2) of the financial report

T0TAL

55 Details of Financial Report point 1. 56 Details of Financial Report point 2.

82 FORM NO.11 (page 5) OWNED REAL ESTATE57 Description and location Name of the holder of the title Receiving date Current value of your interest (in LEK)

Transferred from point (3) of the financial report TOTAL

TREADABLE SECURITIES58 (LISTED IN THE STOCK EXCHANGE OR TREADABLE IN THE REGULAR FREE MARKET) Name of the security Number of shares Description (shares, bonds, etc.) Real market value ( in LEK)

Transferred from point (4) of the financial report TOTAL

57 Details of Financial Report point 3. 58 Details of Financial Report point 4.

83 FORM NO.11 (page 6) OWNERSHIP INTERESTS/LEGAL PERSONS WITHOUT PUBLIC BID59 Below, provide, in relevant columns, the required information regarding all of similar businesses or enterprises in which you owned an interest owner or legal right. Examples are: single ownership, partnership, joint venture and other legal person’s shares which are not listed on the stock exchange or traded in the free adjusted market. In the column "Form of business, describe the legal form of business or enterprise. If the trade is a legal person, determine the nature and percentage of owner interest in your business or enterprise. In the column "Current Value", describe the value of the full current market your property. NOTE: Present the latest data on the state or other data evaluation, to justify the values given in the table which represent an amount equal to 10 percent or more of your net wealth. Business’ name and address Form of business Nature of business Type of your business Current Value ( In LEK ) Transferred from point (5) of the financial report TOTAL

OTHER ASSETS60 DESCRIBE THE ASSETS, PRINCIPLES AND METHODS OF THEIR ASSESSMENT CURRENT VALUE (In LEK)

Transferred from point (6) of the financial report TOTAL

59 Details of Financial Report point 5. 60 Details of Financial Report point 6.

84 FORM NO.11 (page 7) SHORT-TERM LIABILITIES61 Disclose the required information regarding all the liabilities amounting to LEK 500.000 or higher for which you are accountable and which should be paid in one year or less than one year. (The part of long-term liabilities is not included in this form.) Name and address of the creditor Control if insured Secured by Interest rate Date of the obligation beginning Date of obligation payment Amount (In LEK)

Transferred from point (7) of the financial report TOTAL of uninsured liabilities (in LEK) Transferred from point (8) of the financial report TOTALI of insured liabilities (in LEK)

TOTAL OF SHORT-TERM LIABILITIES LONG-TERM LIABILITIES62 Disclose the required information relating to all the liabilities amounting to LEK 500,000 or higher for which you are accountable and which should be paid for one year or later. Name and address of the creditor Control if insured Insured by Interest rate Date of the obligation beginning Monthly payment (In LEK) Current Outstandi ng (In LEK)

Transferred from point (9) of the financial report TOTAL of uninsured liabilities (in LEK) Transferred from point (10) of the financial report TOTAL of insured liabilities (in LEK)

TOTAL OF LONG-TERM LIABILITIES 61 Details of Financial Report points 7 and 8. 62 Details of Financial Report points 9 and 10.

85 FORM NO.11 (Page 8) OTHER OBLIGATIONS AND LIABILITIES63 Description Date of obligation Amount (In LEK) Transferred from point (12) of the financial report TOTAL

CERTIFICATE/ STATEMENT By the virtue of which I Certify that the information disclosed thereto as I believe is true and correct, it reflects all the assets and obligations and does not contain any hinder of facts. I certify that the provided information is provided willingly from me to the Bank of Albania. Any incorrect or missing evidence in this report may be a reason for Bank of Albania refuses my participation in the application and at the level that this incorrect or missing submission of evidences reflects my honesty and personality may serve as a reason for the refusal of the application. If needed other additional financial information, I shall provide this latter as requested by the Bank of Albania.

---

(Date) (full signature) If applicable: __________________________________ (Signature of the compiler) TITLE:________________________________ ADDRESS: ___________________________ Sworn and signed by on the day _________ of ___________, 20.

---

(Signature of the public notary) Service commissions: 63 Detail of the financial report point 12.

86 FORM NO.11 (page 9) AUTHORISATION FOR THE DISCLOSURE OF THE CONFIDENTIAL INFORMATION (Authorisation to be filled in two copies in original) To whom it may concern: I, __________________________, by the virtue of which authorize and ask any person, company, employee, legal authority, association, organisation or institution which are in control of any document, database or other information that has to do with me, to present the original or copies of any document or other information to the Bank of Albania, Supervision Department, or any other authorized person by it for purposes of inspection or copying them in accordance with the Albanian Legislation.

---

Name (typed or printed) Full address _______________________

---

Date (date /month/year) Signature Signed in my presence date__, 20____ THIS DOCUMENT IS AVAILABLE FOR SIX MONTHS

---

(SIGNATURE OF PUBLIC NOTARY) _

87 FORM NO.12 STATEMENT I hereby certify that the payment institution/electronic money institution __________________________, shall comply with the requirements of the article 12 of the Payment Services Law.

---

(Name/Surname of the legal representative of the payment institution/electronic money institution) _____// (Date)

---

(full signature) Note: This declaration should be completed by payment institution and the electronic money institution.