Notice No. 19/2022, October 12 - Payment System Regulatory Sandbox

PUBLISHED IN THE OFFICIAL GAZETTE, Iª SERIES NO. 194, OF OCTOBER 12 AVISO N.º 19/2022 SUBJECT: PAYMENT SYSTEM

• Regulatory Sandbox Given the need to establish rules regarding the operation of the Regulatory Sandbox, aimed at evaluating and testing new business models and emerging technologies, providing legal certainty, efficiency, and effectiveness, within the Innovation Laboratory of the Payment System of Angola; Under the combined provisions of Article 6 of Law No. 40/20, of December 16, Articles 18, 21, and paragraph 1 of Article 98 of Law No. 24/21, of October 18, the Law of the Banco Nacional de Angola. I HEREBY DETERMINE: Article 1. (Approval) The Regulation defining the organization and operation rules of the Regulatory Sandbox, attached to this Notice and forming an integral part thereof, is hereby approved. Article 2. (Doubts and Omissions) Doubts and omissions arising from the interpretation and application of this instrument shall be resolved by the Banco Nacional de Angola. Article 3. (Entry into Force) This Notice shall enter into force on the date of its publication. PUBLISHED. Luanda, October 6, 2022. THE GOVERNOR JOSÉ DE LIMA MASSANO

REGULATORY SANDBOX REGULATION

Page 2 of 28

1. Introduction The evolution of the Angolan Financial System, both in terms of entities operating in the financial sector and in the provision of financial products and services, has enabled the modernization of payment systems while safeguarding risk mitigation, in order to drive financial inclusion and ensure the stability of the financial system. Given the constant monitoring of the evolution and modernization of payment systems, the Banco Nacional de Angola, as the regulatory authority, advocated for the creation of a Regulatory Sandbox (Sandbox) with the objective of providing innovative technological payment solutions (Fintech) in the financial sector to enhance the supply of financial products and services. The present Regulation aims to establish the terms and conditions for the operation of the controlled environment known as the Regulatory Sandbox, with the objective of conducting tests, in a real environment, of financial products and services, business models, innovative technological solutions applicable to the financial system, as well as the conditions for access and participation. With the implementation of the Regulatory Sandbox, it is expected to reduce the time and potential costs incurred by Participants in obtaining innovative products for the market and, ultimately, the emergence and/or improvement of new technologies, products, services, and business models that meet the reality of Angolan society, establishing a participatory structure that allows greater access to the financial sector, driving financial inclusion.

Page 3 of 28 2. Responsibility The Banco Nacional de Angola is the entity responsible for the Regulatory Sandbox, being a unique environment for the execution of projects promoted by the public and/or private sectors. 3. Definitions Without prejudice to the definitions established in current Legislation, for the purposes of this Regulation, the following shall be understood as: a) Candidate: Natural or legal person interested in participating in the Sandbox, who proposes to present a financial service and/or product project, business model, or solution based on innovative financial technology; b) Fintech: technological solutions that promote innovations in financial markets through the use of technology, with the potential to create business models; c) Participant: Candidate authorized by the Banco Nacional de Angola to participate in the Sandbox; and, d) Regulatory Sandbox or regulatory testing environment: a Regulatory regime that allows entities to test innovative projects in the financial sector for a determined period, safeguarding consumer interests, the security, and integrity of the financial system. 4. Objectives of the Sandbox With the implementation of the Regulatory Sandbox, the Banco Nacional de Angola aims for the following objectives: a) Enhance business models, products, and financial services that promote sustainable financial inclusion for the Angolan population; b) Stimulate innovation and diversity of business models to improve access to digital financial services; c) Reduce the time to market for innovative products, services, and business models;

Page 4 of 28 d) Foster competition, increase efficiency, and reduce costs in the national market through financial technology; e) Promote open and transparent communication between the regulator and financial market stakeholders; and f) Develop and improve the regulation and supervisory processes of the Banco Nacional de Angola. 5. Participation Requirements in the Sandbox For participation in the Sandbox, the Banco Nacional de Angola establishes eligibility criteria for Sandbox candidates, namely: 5.1. Participants a) National entities: i. Financial institutions under the supervision of the Banco Nacional de Angola with innovative technological initiatives; and, ii. Natural or legal persons wishing to participate with technological solutions of an innovative nature at the level of the financial system, whose business models are regulated or not. 5.2. Projects: The projects presented by candidates must cumulatively meet the following criteria: a) Innovation: the products and services must bring technologically innovative element(s) or be applied innovatively in the financial system; b) Consumer benefits: i. The financial product or service, business models, or innovative technological solutions must be intended for the Angolan financial system; ii. The financial product or service, business models, or innovative technological solutions, must promote the improvement of efficiency and effectiveness in risk management, security, integrity, as well as promote growth, competition, and the solidity of the financial system; iii. The financial product or service, business models, or innovative technological solutions, must promote the diversity of solutions, access and use of financial services, or open new opportunities for financing or investments in the economy; iv. The financial product or service, business models, or innovative technological solutions, must encourage financial inclusion or have the potential to financially include more citizens in the formal financial sector. c) Need for Participation: the financial product or service, business model, or innovative technological solutions, must necessarily require legal or regulatory coverage, or if existing, be inadequate or insufficient; d) Readiness for testing: the financial product or service, business model, or innovative technological solutions, must be ready for immediate testing in the Sandbox and possess a testing plan and adequate customer protection measures, a customer communication plan, including risks and respective identification, management, mitigation measures, as well as mechanisms for resolving conflicts between the Sandbox participant and their respective customers, as stipulated in the contract to be signed between the parties; e) Technical capacity, material and financial resources: the candidate must possess technical knowledge, material, and financial resources to conduct tests; and, f) Security Measures: the financial product or service, business model, or innovative technological solutions, must contain a description of cybersecurity measures or other relevant measures to ensure the integrity and stability of the financial system and technological systems. 5.3. Business Plan:

Page 5 of 28 A business plan duly suited for the implementation of financial products or services at scale after exiting the testing environment. 5.4. Prohibitions The candidate must not have family or affinity ties with professionals of the Innovation Laboratory of the Payment System of Angola and the Banco Nacional de Angola. 6. Operationalization of the Sandbox

1. The Sandbox will be operationalized through scheduled cycles, the duration of which will be determined by the Banco Nacional de Angola, and must be limited to a period of 12 (twelve) months, extendable only once for 6 (six) months, counted from the date of project submission by the participant.
2. Exceptionally, and whenever justified, the execution of tests in the Sandbox may be extended.
3. Application Requirements
4. To participate in the Sandbox, the candidate must submit the following: a) Completed application form via online through the electronic page of the Innovation Laboratory of the Payment System (www.lispa.ao); b) Supporting documentation to substantiate the information provided in the application form; and, c) Other information that may be necessary to substantiate the candidate's availability and capacity to participate in the Sandbox.
5. Candidates must also include the following information: a) Description of the candidate's organizational structure, including their financial situation, technical experience, and business domain expertise; b) Description of the financial service to be tested in the Sandbox; c) Presentation of the project to assess eligibility criteria;

Page 6 of 28 d) Customer communication plan, which must include the disclosure of potential risks; e) Testing plan; f) Description of goals and key performance indicators, which will be used to determine the success of the tests; g) Description of any outsourcing agreement, including the due diligence carried out by the Candidate with the contracted company with the objective of ensuring information security; h) Sandbox exit plan; and i) Business plan, which must include the implementation strategy for the product and/or service and respective schedule. 3. The candidate must present a single project per each Sandbox program. 4. The Banco Nacional de Angola may, at any time, request additional information and documentation, as well as conduct due diligence it deems necessary, for the authorization of the application. 5. Without prejudice to the criteria defined by the Banco Nacional de Angola for participation in the Sandbox program, candidates must comply with current regulation on policies provided for in the Notice on Rules for the Prevention and Combating of Money Laundering and Terrorist Financing. 6. Supporting documents must be submitted via the electronic address: lispa@bna.ao. 7. The Banco Nacional de Angola defines the deadline for applications for a given Sandbox program, as well as the maximum number of participants. 8. Application Authorization

1. The Banco Nacional de Angola evaluates applications based on eligibility criteria and the information presented by candidates.

Page 7 of 28 2. The decision to admit or reject the application is reasoned and notified to the candidate within 30 (thirty) days from the date of the last day of receipt of the application. 3. The Banco Nacional de Angola may, whenever it considers appropriate for the objectives of the Sandbox, admit the participation of additional candidates presenting similar innovative projects. 4. The Banco Nacional de Angola promotes the publication of the selection of candidates and their respective received and admitted projects in the Sandbox on its electronic page and/or through usual communication channels. 9. Application Rejection

1. The Banco Nacional de Angola may reject the application when: a) It does not meet the eligibility criteria; b) It does not present all required elements and documents as per this Regulation; c) It provides false or incomplete information; and d) Lack of suitability of the candidate and their respective partners or members of the administrative or management bodies is verified, if applicable.
2. Whenever the application or documentation presents deficiencies or irregularities that can be remedied, the Banco Nacional de Angola notifies the candidate and establishes a new reasonable deadline for them to correct it, after which a decision on their application is made.
3. Indicators of lack of suitability include: a) Revocation, cancellation, or cessation of registration, authorization, admission, or license to exercise a business activity, by a supervisory authority, professional order, or analogous body, or dismissal from holding a position by a national or foreign public entity;

Page 8 of 28 b) Prohibition, by judicial or supervisory authorization, professional order, or analogous body, to act as an administrator or manager of a commercial company or in the performance of other functions; c) Registration of non-compliance in the Credit Risk Information and Registry Center (CIRC), or in any other analogous registry centers, by the competent authority; d) Declared insolvency in Angola or abroad, of a citizen or respective administrative or supervisory board member; e) Conviction, in Angola or abroad, for crimes against property, financial crimes, document forgery crimes, money laundering, crimes committed in the exercise of public functions, tax crimes, crimes specifically related to the exercise of activities in the financial sector, namely, banking, insurance, and capital markets; f) Conviction, in Angola or abroad, for violations of the norms governing the activity of financial institutions; g) Other relevant situations indicating their inability to decide in a prudent and careful manner, or their tendency not to fulfill their legal obligations or present behaviors incompatible with preserving the confidence of clients and the market in general; h) The application may be rejected even in situations where the candidate or their partner, management and supervisory board members are not accused or formally charged with the crimes referred to in the preceding subparagraphs, provided that the stability and confidence of the financial system are at stake. 4. The rejection of the application is reasoned and notified to the participant and may be subject to publication on the Banco Nacional de Angola's electronic page, as well as in other usual communication channels.

Page 9 of 28 5. A candidate whose project has not been accepted in the Sandbox may subsequently submit their application to the Banco Nacional de Angola, doing so under the terms of this Regulation. 10. Expiration of Approval

1. The authorization to participate in the Sandbox expires whenever the participant: a) Fails to participate in the Sandbox within 15 (fifteen) days after the established start date, including the date set for conducting the tests; b) Expressly renounces the authorization to participate, through a letter addressed to the Banco Nacional de Angola, with a minimum advance notice of 30 (thirty) days before the start of the program; and c) Is declared insolvent or is undergoing dissolution proceedings, including the declaration of dissolution.
2. After the expiration of the testing period, the approval to participate in the Sandbox expires automatically.
3. Whenever duly justified, the participant must submit a written request, within a maximum of 30 (thirty) days, before the end of the testing period, to extend the testing period, indicating the additional time required, which must not exceed 3 (three) months.
4. The expiration of the approval is notified to the participant and may be subject to publication on the electronic page of the Banco Nacional de Angola or LISPA, as well as in other usual communication channels.
5. Revocation of Approval
6. The Banco Nacional de Angola may revoke the authorization granted to the Sandbox participant at any time, whenever the following occurs: a) The provision of false or incomplete information that concealed or failed to reveal material facts during the application for participation in the Sandbox;

Page 10 of 28 b) Violation of any legal or regulatory provision of the Banco Nacional de Angola or any applicable law in Angola or abroad that may affect the integrity and reputation of the participant; c) Situation of insolvency or liquidation; d) Violation of security requirements, data confidentiality, and professional secrecy in general and the financial system in particular, under applicable legislation; e) Inability to implement any of the safeguards requested by the Banco Nacional de Angola during the tests; f) Inability or impossibility for the participant to achieve expected progress or results with the tests conducted; g) Non-compliance with the provisions of this Regulation; h) Violation of industrial or intellectual property rights over projects, products, and services, under applicable legislation; i) Inability to conduct tests or comply with guidelines issued by the Banco Nacional de Angola; j) That the business/solution is harmful or negatively impacts clients or the general public, or represents a risk to the stability of the financial system; k) The manifestation of behavior or acts that threaten or harm the integrity, reputation, or image of clients, the general public, the financial system, other participants, or the Banco Nacional de Angola; l) The existence of project risks to clients or the financial system manifestly superior to the expected benefits for clients and the financial system without risk measurement, control, and mitigation measures; m) Inability to resolve any technical defects, failures, or vulnerabilities in the project that cause recurring service interruptions or fraud incidents;

Page 11 of 28 n) Failure to resolve any technical defects, or vulnerabilities in the product, service, or solution that cause recurring service interruptions or fraud incidents; and o) Any other reason determined by the Banco Nacional de Angola. 2. The Banco Nacional de Angola must, before revoking the authorization to participate in the Sandbox: a) Send a notification 30 (thirty) days in advance of the scheduled revocation date, with the grounds for revocation; and b) The Participant may respond within 15 (fifteen) days after receiving the notice referred to in the preceding subparagraph. 3. The authorization may be voluntarily renounced provided the participant clearly demonstrates that the interests of their clients have been safeguarded with the knowledge and authorization of the Banco Nacional de Angola. 4. Without prejudice to the preceding paragraph, the Banco Nacional de Angola reserves the right to revoke the authorization without prior notice, whenever there are grounds of force majeure to preserve the integrity of the financial system, the participant, their clients, and the general public. 5. The participant may challenge the Banco Nacional de Angola's decision to revoke the authorization via a letter within 30 (thirty) days from the effective date of the authorization revocation. 6. After the revocation of an approval, the Participant must: a) Immediately implement their exit plan to cease the offering of the product, service, or technological solution; b) Inform clients about the cessation and their rights to redress or compensation, if applicable; c) Maintain confidentiality regarding any client information or data;

Page 12 of 28 d) Comply with obligations imposed by the Banco Nacional de Angola to securely store or transfer all confidential information, including personal client information collected during the tests; and e) Compensate clients who suffered financial losses during the testing period, according to the prevention measures presented by the Participant. 7. Submit to the Banco Nacional de Angola, within 5 (five) days after receiving the revocation notification, a report on the completion of the actions provided for in the preceding paragraph. 8. The expiration of the approval is notified to the participant and may be subject to publication on the electronic page of the Banco Nacional de Angola and LISPA, as well as in other usual communication channels. 12. Purpose

1. The program aims to conduct tests of financial products and services, business models, innovative technological solutions in a real environment under the supervision of the Banco Nacional de Angola and according to previously determined parameters, as well as the collection of statistically relevant data, namely success or failure indicators of the tests and compliance with the objectives proposed by the participant.
2. The program comprises guidance, support, and technical monitoring, as well as providing clarifications on the legal and regulatory norms applicable to the tests and financial activity in general.
3. General Principles
4. The participation of candidates and the presentation of their respective projects depends on the prior authorization of the Banco Nacional de Angola.

Page 13 of 28 2. Program participants must manifest in writing their consent to participate in the Sandbox under the terms provided in this regulation. 3. The Banco Nacional de Angola defines the areas of interest for the submission of project applications destined for the Sandbox. 4. The Banco Nacional de Angola defines in a communication the deadline for submitting project applications to participate in the Sandbox. 5. The Banco Nacional de Angola may, whenever there is a need for limitation due to operational capacity, limit the number of participants per Sandbox program. 6. At the end of participation in the Sandbox, the Banco Nacional de Angola grants a certificate for the product, service, or financial solution valid for a period of one year. 14. Testing, Readiness, and Monitoring

1. For the conduct of tests, the participant's testing plan must contain at minimum the following criteria: a) Test parameters, conditions, or restrictions, relating to the duration of the test; b) The selection and number of clients and transactions; c) Consumer protection measures; d) Policies and measures for the prevention and combating of money laundering, terrorist financing, and the proliferation of weapons of mass destruction; e) Protection against cyberattacks, illicit operations, or criminal activities, among others.
2. For the purposes of the preceding paragraph, the Banco Nacional de Angola communicates to the participant their suitability or unsuitability for conducting the tests.
3. Before the start of the tests, participants must:

Page 14 of 28 a) Sign a statement of acceptance of the test parameters and present a testing plan, which must include the following elements: (1) schedule; (2) success indicators; (3) test parameters; and (4) Sandbox exit strategy (exit plan). b) Present a document with client consent. 4. For testing purposes, the Banco Nacional de Angola may, if deemed prudent, attenuate or waive certain regulatory requirements or restrictions approved by itself. 5. Without prejudice to the preceding paragraph, requirements or consumer protection measures, of pr