Central Bank of Tunisia Circular No. 2023-06 dated November 2, 2023

Tunis, November 2, 2023

Central Bank of Tunisia Circular No. 2023-06 fixing the list of required documents and information for the study of an approval application for the exercise of loan-based crowdfunding activity and prior authorization applications related to this activity

The Governor of the Central Bank of Tunisia, Having regard to Organic Law No. 2004-63 of July 27, 2004, on the protection of personal data; Having regard to Law No. 2016-35 of April 25, 2016, fixing the status of the Central Bank of Tunisia; Having regard to Law No. 2020-37 of August 6, 2020, on crowdfunding and in particular its Articles 3, 12, 32, and 47; Having regard to Decree-Law No. 2023-17 of March 11, 2023, on cybersecurity; Having regard to Decree No. 2022-766 of October 19, 2022, organizing loan-based crowdfunding activity and in particular its Articles 3 and 7; Having regard to the opinion of the National Data Protection Authority dated August 31, 2023; Having regard to the compliance control committee opinion No. 2023-6 dated October 25, 2023, as provided for in Article 42 of Law No. 2016-35 of April 25, 2016; Decides:

Article 1 - This circular fixes the documents, information, and data required for the study of an approval application for the exercise of loan-based crowdfunding activity and prior authorization applications for operations covered by Article 7 of Decree No. 2022-766 of October 19, 2022, cited above.

Article 2 - The approval or prior authorization application file must include a request addressed to the Governor of the Central Bank of Tunisia, accompanied by the documents and data specified in the annexes to this circular.

Article 3 - The approval or prior authorization application and the documents and data specified in this circular must be submitted to the Central Bank of Tunisia by registered letter with acknowledgment of receipt, directly at the Central Bank of Tunisia headquarters' registry office against a receipt, or by email to the electronic address agrement@bct.gov.tn.

Article 4 - After examining the documents and information listed in Annex 1 of this circular, the Central Bank of Tunisia notifies the applicant either with a reasoned refusal decision or with a request to complete their file with the documents specified in Annex 2 of this circular when it intends to grant approval. When all supplementary documents and information are communicated within three months from the date of the request, and after their examination and verification, the Central Bank of Tunisia notifies the applicant either with a reasoned refusal decision or with a decision granting approval for the exercise of loan-based crowdfunding activity.

Article 5 - This circular enters into force from the date of its publication. The Governor, Marouane EL ABASSI

ANNEX 1: Documents and data required for an approval application for the exercise of loan-based crowdfunding activity.

1. Required documents:

• A request addressed to the Governor of the Central Bank of Tunisia.
• Form 1: "Applicant's Profile" signed by the applicant.
• Form 2: "Sworn Declaration" signed by the applicant attesting to the accuracy of the documents and data provided in the approval application.
• Form 3: "Identity of Future Shareholders": a brief presentation of the shareholders specifying in particular their activities and the shareholdings they intend to hold.
• Form 4 "Sworn Declaration" of the future chairman of the board of directors, directors, managing director, deputy managing director, chairman and members of the executive board, chairman and members of the supervisory board of the loan-based crowdfunding service company.
• The draft standard contract between project owners and contributors as provided for in Article 6 of Law No. 2020-37.
• The draft agreement between the loan-based crowdfunding service company and the bank or postal account custodian as provided for in Article 8 of Law No. 2020-37.
• The draft professional civil liability insurance contract as provided for in Article 44 of Law No. 2020-37.

2. Information on the shareholding of the loan-based crowdfunding company:

• A comprehensive list of future individual and corporate shareholders who will hold direct and indirect shareholdings.
• A copy of the identity card, curriculum vitae, and a criminal record extract issued within the last three months for future individual shareholders.
• A recent extract from the national business register or other equivalent document for corporate shareholders.
• The individual and consolidated financial statements (where applicable) certified by the statutory auditors for the last three financial years of future corporate shareholders holding 10% or more of the capital of the company to be created.

3. Company presentation: strategy and business model

• A letter of intent signed by the applicant indicating the motivations for the approval application.
• The company's development strategy, target business model: strategic choices and objectives, targeted contributors and project owners, services to be commercialized, pricing policy, and communication policy with stakeholders.
• The study of the company's economic and financial environment and its target market positioning.
• A note on the nature and extent of risks to which the loan-based crowdfunding service company will be exposed (strategic risks, financial risks, legal risks, technological risks, reputational risks, operational risks, cyber risks...).

4. Governance and organizational framework:

• The target governance model (executive management and board of directors or executive board and supervisory board).
• The envisaged composition of the board of directors or supervisory board and the various committees emanating from these bodies.
• The draft articles of association of the company.
• The draft shareholders' agreement, if any.
• A file regarding future members of the board of directors or supervisory board and executive management (managing director and deputy managing directors) or executive board, including an updated and signed curriculum vitae indicating academic and professional background.
• The target organization, description of business processes, human and technical resources to be mobilized with the curriculum vitae of the first heads of functions:

• internal control, compliance and anti-money laundering and counter-terrorist financing control;
• risk management; and
• internal audit.

• The conflict of interest management policy.

5. Human and technical resources:

• Recruitment policy: target workforce, remuneration policy, and required qualifications and expertise over a 5-year period.
• A detailed report on technical resources and the information system including in particular:

• a description of information system governance and IT security.
• a description of procedures and tools guaranteeing IT security including: ✓ data and system access tools; ✓ network security; ✓ audit trails; ✓ backup; ✓ data hosting. ✓ mandatory archiving for a period of at least 5 years.
• a description of the measures put in place to detect, analyze, correct, anticipate, and prevent production incidents.

• Descriptive note of internal procedures relating to:
• the selection and evaluation of projects to be financed,
• the monitoring of the fundraising operation with contributors, and
• the monitoring of financed project activities and contributor information.

6. Activity program:

• The 5-year business plan.
• Key assumptions made for the design of the business plan and their potential impact on financial projections.
• Forward-looking financial statements over a 5-year period.
• Description of operating costs and resources.
• Evolution of activity and profitability indicators over a 5-year period.

7. Anti-money laundering (AML) and counter-terrorist financing (CFT) risk management framework: A descriptive note on the AML/CFT risk management framework to be implemented by the company, specifying in particular:

• due diligence obligations (procedures to verify the identity of contributors and project owners);
• risk analysis, alert, and monitoring mechanisms for AML/CFT risks on operations;
• document retention and updating mechanisms;
• suspicious transaction reporting, awareness, and staff training mechanisms.

8. Internal control and risk management:

• A report describing the internal control framework to be implemented: governance structures' roles, procedures, accounting and financial organization, information system, control activities.
• A report describing the framework to be implemented for risk identification, management, and monitoring (organizational framework for risk management, risk identification, risk analysis, monitoring and review of risk management, financial and accounting information, etc.).

9. Business continuity plan: A report on the business continuity plan including the following information:

• identification of essential activities, accompanied by recovery objectives including, among others, a forward-looking recovery schedule with key steps, priority assets to be safeguarded, maximum acceptable unavailability periods, and maximum acceptable data loss;
• measures to be implemented to ensure continuity in case of service interruption, such as failures in key systems, loss of key data, unavailability of premises, or loss of key personnel;
• the frequency at which the applicant will test its disaster recovery business continuity plan and how the results of these tests will be communicated and taken into account.

10. Complaint handling framework: A descriptive note on:

• policies and procedures for receiving and processing complaints from contributors and project owners;
• human, logistical resources, and the structure responsible for processing complaints from contributors and project owners.

ANNEX 2: Supplementary documents and information

• A copy of the registered articles of association.
• A copy of the minutes of the constituent general meeting.
• A comprehensive list of direct and indirect individual and corporate shareholders and the identity of the beneficial owner.
• The certificate of subscription to and release of minimum capital.
• The decision appointing a statutory auditor.
• A regulatory audit report on information system security validated by the National Cybersecurity Agency in accordance with current regulations.
• A document signed by the auditing expert who conducted the information system security audit, attesting that the security level of these systems is acceptable for their operational deployment.
• Documentation related to the electronic certification framework obtained from an electronic certification provider approved by the National Electronic Certification Agency.
• A copy of the receipt for the filing of the declaration with the National Data Protection Authority.
• A copy of the agreement concluded between the loan-based crowdfunding service company and the bank or National Office of Posts regarding the management of the special account in which contributors' funds will be held.
• The bank or postal statement of the special account in which contributors' funds will be held.
• A copy of the professional civil liability insurance contract as provided for in Article 44 of Law No. 2020-37.

ANNEX 3: Documents and data required for the prior authorization of a merger or demerger operation

1. Shareholding information:

• The impact of the merger or demerger operation on capital structure: maintenance of structure, entry of new shareholders.
• A comprehensive list of direct and indirect individual and corporate shareholders.
• Form 3 entitled "Identity of Shareholders" duly completed and signed by new shareholders.
• Form 5 "Shareholders' Commitment Letter" for participation in the capital of the company to be created, duly signed by shareholders.
• Individual and consolidated financial statements (where applicable), certified by statutory auditors, for the last three financial years of corporate shareholders who will hold 10% or more of the capital of the service provider.
• A copy of the identity card, curriculum vitae, and a criminal record extract issued within 3 months for new individual shareholders.
• A recent extract from the national business register or any other equivalent document for new foreign corporate shareholders.

2. Operation presentation:

• A report on the reasons for the operation and target strategic objectives, synergy and complementarity factors between entities involved in the merger or demerger operation.
• The envisaged development strategy of the new company: target business model, strategic objectives, description of activity areas, targeted contributors and project owners, and services to be commercialized.
• A study on the nature and extent of risks (financial and strategic risks, reputational risk, and legal risk).

3. Expected impacts on governance and organizational framework:

• A report on the implications of the merger or demerger operation on governance, organization, and internal control and risk management frameworks specifying: • The target governance model (executive management and board of directors or executive board and supervisory board). • The envisaged composition of administrative and management bodies and various committees emanating from these bodies.
• The draft articles of association reflecting the implications of the merger or demerger operation on capital structure and corporate name.
• The draft shareholders' agreement, if any.
• A file regarding members of administrative and management bodies including an updated and signed curriculum vitae indicating academic and professional background.
• Form No. 4 "Sworn Declaration of Directors and Administrators" duly signed by directors and administrators.
• The target organization, description of business processes, human and technical resources to be mobilized with the curriculum vitae of the first heads of functions:

• internal control, compliance and anti-money laundering and counter-terrorist financing control;
• risk management; and
• internal audit.

• The conflict of interest management policy.

4. Expected impacts on human and technical resources: A note on the implications of the merger or demerger operation on human and technical resources.
5. Activity program:

• Key assumptions made for the design of the business plan and their potential impact on financial projections.
• Forward-looking financial statements over a 5-year period.
• Detailed description of operating costs and resources.
• Evolution of activity and profitability indicators over a 5-year period.

6. File relating to legal, procedural, accounting, and tax aspects of the merger or demerger operation:

• A report on the terms of the merger or demerger operation.
• A report by a chartered accountant registered with the Tunisian Order of Chartered Accountants, not holding a mandate with the parties concerned by the operation, outlining accounting, financial, and tax implications.
• Valuation reports of entities and determination of share exchange ratios and operation bonus or deficit.
• The draft merger or demerger agreement.
• A note on managing the operation's implications on contractual relations with contributors and project owners, including notification procedures.

7. Strategic and operational steering: A note outlining the strategic and operational steering of the operation, its organization, schedule, and roadmap.
8. Communication policy: The communication strategy with all stakeholders for the accompaniment of the merger or demerger operation.

ANNEX 4: Documents and data required for the prior authorization of a significant asset or liability transfer operation resulting in a substantial change in financial structure

1. Operation presentation: A report on:

• the reasons, objectives, and strategic goals related to the significant asset or liability transfer operation.
• potential implications on the service provider's business model, development policy, and financial situation.

2. Expected impacts on governance and organization: A report on the implications of the transfer operation on governance, organization, internal control, and risk management frameworks of the service provider.
3. Expected impacts on human and technical resources:

• A report on the implications of the significant asset or liability transfer operation on human and technical resources.

4. Activity program:

• Key assumptions made for the design of the business plan and their potential impact on financial projections.
• Forward-looking financial statements over a 5-year period.
• Detailed description of operating costs and resources.
• Evolution of activity and profitability indicators over a 5-year period.

5. File relating to legal, procedural, accounting, and tax aspects of the significant asset or liability transfer:

• A note describing the terms of the operation and legal and regulatory procedures to be followed to carry out the significant asset or liability transfer operation of the service provider.
• A report by a chartered accountant registered with the Tunisian Order of Chartered Accountants, not holding a mandate with the company concerned by the significant asset or liability transfer operation, outlining accounting, financial, and tax implications.
• A note on managing the operation's implications on contractual relations with contributors and project owners.
• The valuation report of assets or liabilities to be transferred by the company.

6. Strategic and operational steering: A note outlining the strategic and operational steering of the significant asset or liability transfer operation, its organization, schedule, and roadmap.
7. Communication policy: The communication strategy with all stakeholders for the accompaniment of the significant asset or liability transfer operation.

ANNEX 5: Documents and data required for the prior authorization of the direct or indirect acquisition of voting rights leading to control of the loan-based crowdfunding service company

1. Applicant presentation: A report on:

• the applicant's profile: quality of the acquiring entity (individual or corporate) and affiliation group (where applicable: main group companies and capital structure).
• the applicant's financial capacity: individual and consolidated financial statements (where applicable) for the last 3 years certified by statutory auditors for corporate applicants.
• the financing terms of the operation.

2. Operation presentation:

• The reasons and strategic objectives related to the acquisition operation accompanied by a written declaration of intent describing the strategy regarding the company.
• The envisaged development strategy of the company: target business model, strategic objectives, description of activity areas, targeted contributors and project owners, and services to be commercialized.
• A study on the nature and extent of risks (financial and strategic risks, reputational risk, and legal risk).

3. Expected impacts on governance and organizational framework:

• A report on the implications of the operation on governance, organization, internal control, and risk management frameworks specifying: • The target governance model (executive management and board of directors or executive board and supervisory board). • The envisaged composition of administrative and management bodies after the acquisition operation.
• The draft shareholders' agreement, if any.
• A file regarding members of administrative and management bodies including an updated and signed curriculum vitae indicating their academic and professional background.
• Form No. 4 entitled "Sworn Declaration of Directors and Administrators" duly signed by the directors and administrators to be designated after the acquisition operation.
• The target organization, description of business processes, human and technical resources to be mobilized with the curriculum vitae of the first heads of functions:

• internal control, compliance and anti-money laundering and counter-terrorist financing control;
• risk management; and
• internal audit.

• The conflict of interest management policy.

4. Implications of new strategic orientations on the entity's human and technical resources:

• A report on the implications of the operation on human resource management policy: recruitment and target workforce, layoffs, remuneration policy, qualifications, and required expertise.
• A report describing the implications of the operation on technical resources and their adequacy with the service provider's activities.

5. Activity program:

• Key assumptions made for the design of the business plan and their potential impact on financial projections;
• Forward-looking financial statements over a 5-year period;
• Detailed description of costs and resources.