BANKY FOIBEN'I MADAGASIKARA

INSTRUCTION NO. 002 DDI/2018 FIXING THE OPERATING PROCEDURES OF THE ACCOUNT CENTRAL OF THE BFM INTEGRATED INFORMATION SYSTEM

The Governor of Banky Foiben'i Madagasikara,

Having regard to Law No. 95-030 of February 22, 1996 on the activity and supervision of credit institutions, as amended (the Banking Law); Having regard to Law No. 2014-038 of January 9, 2015 on the protection of personal data; Having regard to Law No. 2016-004 of July 29, 2016, supplemented by Law No. 2016-057 of February 2, 2017 on the Statutes of Banky Foiben'i Madagasikara; Having regard to Law No. 2016-056 of February 2, 2017 on electronic money and electronic money institutions; Having regard to Law No. 2017-018 of December 19, 2017 governing the BFM Integrated Information System; Having regard to Law No. 2017-026 of February 16, 2018 on microfinance; Having regard to Decree No. 2014-1684 of October 29, 2014 appointing the Governor of the Central Bank of Madagascar.

DECIDES:

Article 1: Object This instruction aims to establish the operating procedures of the Account Central, abbreviated "CdC", which is a component of the BFM Integrated Information System as governed by Law No. 2017-018 of December 19, 2017.

The information declared and processed at the CdC level relates to the opening and closing of bank accounts and similar accounts of all kinds, as provided for in Article 3 of this instruction.

The provisions of this instruction apply to institutions required to feed the CdC, hereinafter referred to as "Declarants":

• credit institutions authorized as territorial banks by the Banking and Financial Commission (CSBF) under Law No. 95-030 of February 22, 1996 on the activity and supervision of credit institutions;

• microfinance institutions (IMF) authorized by the CSBF under Law No. 2017-026 of February 16, 2018;

• electronic money institutions (EME) authorized by the CSBF under Law No. 2016-056 of February 2, 2017 on electronic money and electronic money institutions.

Article 2: Purposes of the CdC The CdC serves to:

• enable the Declarants listed in Article 1 to consult account openings and closures;
• enable BFM to track the development of all open and closed accounts of institutions at the national level;
• enable BFM and the CSBF to obtain statistical information to evaluate, based on accounts, the banking penetration rates of the economy and financial inclusion in Madagascar.

Article 3: Nature of Information to be Declared The Declarants transmit, according to the periodicity and procedures set forth in Articles 4 and 6, the following four files: 3.1. "Third Party" File, 3.2. "Account" File, 3.3. "Third-Party to Account Link" File, 3.4. "Returned Payment Means" File.

Regarding the information contained in the "Third Party" File:

• Information regarding natural persons must match those on official identity documents, specifically:
  • for national natural persons, the National Identity Card number (CIN), full name and first names in the order appearing on the ID;
  • for foreign natural persons, the passport number or resident/foreign ID card number and local address for non-residents;
  • for minors, the identifier to be used is the concatenation of the guardian's CIN number, the minor child's date of birth (DDMMYYYY), and optionally for twins, the order number in the family record book.
• For information regarding legal entities: the Tax Identification Number (NIF) is the reference, followed by: the name comprising the full legal name, usual acronym, statistical number, and registration number with the National Registry of Commerce and Companies (RNCS).
• For the identification of associations, the identifier to be retained is the Tax Identification Number (NIF) or, where applicable, the references of the declaration receipt issued by the Ministry of Interior.

The information collected under this instruction excludes data related to the balance of the relevant account as well as the transactions performed therein.

Article 4: Declaration Periodicity As soon as the following information is available at their level, Banks are required to declare it to Banky Foiben'i Madagasikara on a daily basis:

• account opening and its type;
• account closure and its type;
• modification of previous declarations;
• the emergence of new facts concerning the account holder.

For IMFs and EMIs, the declaration of accounts to Banky Foiben'i Madagasikara is carried out at the end of each month.

Article 5: Quality and Security of Communicated Information The Declarants take all necessary measures at the level of their information systems and internal control procedures to ensure reliable and regular declarations.

The Declarants are responsible for the accuracy, completeness, and consistency of information communicated to the Account Central.

The same applies to the protection, retention, and transmission of data they receive from the CdC in accordance with the personal data protection law.

Article 6: Declaration, Access, and Consultation Procedures 6.1. Information transmission to the CdC is carried out via secure electronic means according to the exchange file descriptions in the annex. 6.2. For any declaration or consultation, access to the CdC by a correspondent acting on behalf and for the account of the Declarants must be authenticated. The application procedures for security devices cover:

• the granting by Banky Foiben'i Madagasikara of an access code, characterized by an identifier and a password;
• authentication by the access code of the authorized correspondent to access the CdC for declaration and consultation;
• the Declarant's obligation to inform Banky Foiben'i Madagasikara as soon as possible in case of change(s) to the correspondent(s);
• the customization and updating of the password by the correspondent. 6.3. The access code is individual. Each Declarant takes all necessary measures for its retention and security; it is responsible for any abusive or unauthorized use of this code. 6.4. Each Declarant may consult the data of its own clients and, in accordance with legal provisions, data on closed accounts are available to all Declarants. 6.5. During data integration into the CdC, only erroneous lines will be rejected and an error report for the Declarant is automatically generated for this purpose. 6.6. Through the bank, IMF, or EME, any concerned person has the right to consult and rectify data in case of error or update information concerning them in the CdC. At the latest ten days after the client's request, the Declarant must submit a rectification request supported by necessary justifications to BFM, via any written communication method.

Article 7: Rights and Obligations of Declarants 7.1. Prior to any account opening, the Declarant informs the account holder of the following information:

• the nature of information transmitted to the CdC;
• the purposes and recipients of data processing;
• the right of access and rectification of data concerning them;
• the appeal procedure in case of dispute. 7.2. The Declarant submits to Banky Foiben'i Madagasikara any rectification request accompanied by justification. To this end, and for all useful purposes, Banky Foiben'i Madagasikara may request additional information. 7.3. Any person authorized to access CdC data, process them, and exploit them is bound by professional secrecy under penalty of sanctions provided by the prevailing penal legislation.

Article 8: Sanctions All breaches of the provisions of this instruction, including delays in information transmission and communication of inaccurate information, are subject to sanctions provided by the texts specifically governing each Declarant as well as Law No. 2017-018 of December 19, 2017 governing the BFM Integrated Information System.

Article 9: Miscellaneous and Final Provisions This instruction enters into force upon its notification to the Declarants, through their respective professional associations.

The Declarants have a period of one (01) month from the effective date of this instruction to declare accounts opened prior to this date.

The annexes listed below form an integral part of this instruction.

Antananarivo, October 24, 2018

THE GOVERNOR ALAIN H. RASOLOFONDRAIBE