Procedure for Conducting Inspections of Supervised Organizations

1 Registered with the Ministry of Justice of the Republic of Tajikistan under No. 1240 dated June 12, 2023 Approved by the Board Resolution of the National Bank of Tajikistan No. 52 dated May 6, 2023

Procedure for Conducting Inspections of Supervised Organizations

The Procedure for Conducting Inspections of Supervised Organizations (hereinafter referred to as the "Procedure") is developed in accordance with Part 5 of Article 29 of the Law of the Republic of Tajikistan "On Payment Services and the Payment System" and establishes the procedure for conducting inspections of supervised organizations, as well as the summarization and provision of their results.

1. GENERAL PROVISIONS

2. The following main concepts are used in this Procedure:

• inspection group – authorized representatives (employees) of the National Bank of Tajikistan carrying out an inspection of the activities of a supervised organization based on a mandate from the National Bank of Tajikistan;
• supervised organizations – payment system operators and payment infrastructure service operators that are not credit financial organizations.

2. Inspections of payment system operators that are credit financial organizations are conducted in accordance with the Procedure for Conducting Inspections of Credit Financial Organizations, Summarization and Documentation of Results, approved by the Board Resolution of the National Bank of Tajikistan dated January 30, 2014, No. 13, which passed state registration on March 27, 2014, No. 192 'b' at the Ministry of Justice of the Republic of Tajikistan.

3. A scheduled inspection of a supervised organization is conducted no more than once every two years by an inspection group in accordance with the requirements of this Procedure.

4. An unscheduled inspection is conducted in the event of a disruption in the uninterrupted operation of a significant payment system in accordance with the requirements of this Procedure.

5. Inspections of supervised organizations are conducted from the perspective of risk-oriented supervision within the framework of the Recommendations on Financial Market Infrastructure issued on April 16, 2012, developed by the Bank for International Settlements in collaboration with the International Organization of Securities Commissions, taking into account the analysis of the following issues:

• organizational and legal structure;
• payment system rules;
• financial condition;
• governing body of the payment system;
• risk analysis and risk exposure;
• ensuring uninterrupted operation of the payment system;
• assessment of the risk management system and internal control organization;
• security policy and information protection;
• correctness of reports and accounting;
• results of previous inspections.

6. The National Bank of Tajikistan, within its powers as a supervisory authority, conducts regular monitoring of the payment system by collecting reports from supervised organizations and payment service providers, as well as other information about the activities of payment systems in accordance with the regulatory legal acts of the National Bank of Tajikistan. Reports (information) are used to assess risks associated with the activities of the payment system, evaluate the activities of the payment system, conduct inspections, and prepare proposals for changes in the activities of supervised organizations and participants of the payment system.

7. The National Bank of Tajikistan forms an inspection group consisting of no fewer than 2 people to inspect a supervised organization and appoints its head and members. The inspection group is formed from among the employees of the structural unit of the National Bank of Tajikistan carrying out supervision of the payment system, and depending on the issues analyzed during the inspection, employees of other structural units of the National Bank of Tajikistan are also included in its composition.

8. The inspection plan for supervised organizations is compiled by the structural unit of the National Bank of Tajikistan carrying out supervision of the payment system for every two years in accordance with Appendix 1 of this Procedure and is approved by the Deputy Chairman of the National Bank of Tajikistan – curator of this structural unit.

9. OBJECTIVE OF CONDUCTING INSPECTIONS OF SUPERVISED ORGANIZATIONS

10. The main objective of conducting an inspection of the activities of a supervised organization is to verify compliance with and adherence to the requirements of the Law of the Republic of Tajikistan "On Payment Services and the Payment System" and regulatory legal acts adopted in accordance with the said Law.

11. Inspections of supervised organizations are conducted for the following purposes:

• assessment of the overall financial condition of the supervised organization;
• identification of risks associated with the functioning of payment systems that may have a negative impact on the activities of the supervised organization and its participants, and generally on the payment system of the Republic of Tajikistan;
• assessment of the effectiveness of the risk management system of the supervised organization and the organization of internal control within it;
• assessment of the correctness and reliability of reports submitted by the supervised organization to the National Bank of Tajikistan;
• preparation of recommendations for changes in the activities of the supervised organization and elimination of deficiencies identified in the activities of the supervised organization;
• assessment of the implementation of recommendations and actions aimed at eliminating deficiencies identified as a result of previous inspections.

11. The National Bank of Tajikistan, for the purpose of conducting an inspection, evaluates the activities of the supervised organization in the following areas:

• specificity and significance of the payment system and payment services provided by the supervised organization;
• number and types of payment services;
• risk management system, structure and risk management policy of the supervised organization;
• risks that may be transferred to its participants, other structures, and clients;
• number of participants and clients of the payment system;
• number and amount of transactions processed by participants and clients of the payment system;
• cooperation with other payment systems;
• proper planning to ensure uninterrupted operation of the payment system;
• reliability of managerial and operational processes of the supervised organization;
• reliability of used information technologies;
• compliance of the head of the executive body and the chief accountant of the supervised organization with qualification requirements;
• protection of the rights of consumers of payment services;
• compliance with the requirements of the legislation of the Republic of Tajikistan on combating the legalization (money laundering) of proceeds obtained by criminal means, terrorism financing, and financing of the proliferation of weapons of mass destruction;
• outsourcing of certain functions of the supervised organization, their management and control.

3. RIGHTS AND OBLIGATIONS OF THE INSPECTION GROUP

4. The inspection group has the right to demand from supervised organizations all necessary information and documentation in the field of payment system activities and the provision of payment services.

5. When conducting an inspection of a supervised organization, the inspection group has the right to:

• inspect documents of the supervised organization and, if necessary, attach copies of documents to the inspection materials;
• obtain oral and written explanations regarding the activities of the supervised organization;
• have access to places of activity of the supervised organization;
• have access to information systems of the supervised organization (in read-only mode), including for obtaining information in paper or electronic form.

14. During the inspection, the inspection group is obliged to:

• deliver the mandate for conducting the inspection to the head of the supervised organization (or the person acting in their stead);
• inform the head of the supervised organization (or the person acting in their stead) of the rights, obligations, and powers of the inspection group, its head and members, the reason and purpose of the inspection, and the rights, obligations, and responsibilities of the supervised organization and its employees;
• determine the list of documents necessary for the inspection and the deadline for their submission.

15. In performing its tasks, the inspection group is obliged to observe the procedure and deadlines established by this Procedure, ensure the protection of information known to it that constitutes official, banking, tax, commercial, and other secrets protected by law.

16. OBLIGATIONS OF SUPERVISED ORGANIZATIONS

17. The supervised organization is obliged to assist the inspection group in conducting the inspection.

18. On the same working day when the inspection begins, the head of the supervised organization (or the person acting in their stead) is obliged to:

• determine officials and employees of the relevant structural units of the supervised organization who must interact with the head and members of the inspection group, their competencies and responsibility for ensuring access to documents (information) and information systems, submission of documents (information), as well as creating favorable conditions for conducting the inspection;
• provide in writing to the head of the inspection group a list of employees of the supervised organization responsible for interacting with the head and members of the inspection group.

18. The head of the supervised organization (or the person acting in their stead) and its responsible persons, for the purpose of facilitating the inspection, are obliged to:

• ensure unimpeded access to the building and other objects of the supervised organization on the days of the inspection;
• provide the inspection group with workspaces in a separate room of the supervised organization;
• provide the inspection group with access to documents (information) and information systems of the supervised organization (in read-only mode), as well as to obtain copies of documents and other information of the supervised organization in paper and/or electronic form;
• provide oral and written explanations from the head and employees of the supervised organization to the inspection group.

19. The supervised organization is obliged to submit documents (information) within the deadline specified in the request of the head of the inspection group.

20. Copies of documents (information) of the inspected organization on paper medium, provided by the supervised organization upon request of the inspection group for the submission of documents (information), must be certified by the signature of the head (or the person acting in their stead) or responsible employees of the supervised organization.

21. The list of electronic documents (information) and the registry of sample information (consolidated records) submitted by the supervised organization upon request for the submission of documents (information) must be certified by the signature of the head of the supervised organization (or the person acting in their stead) or its responsible employees and the seal of the supervised organization (if necessary).

22. Information constituting a state secret is requested and submitted to the inspection group in accordance with the requirements established by the legislation of the Republic of Tajikistan on state secrets.

23. In the event of failure to submit documents (information) within the deadlines established by the request for the submission of documents (information) and/or the emergence of circumstances preventing their submission within the deadlines established by the request for the submission of documents (information), the head of the supervised organization (or the person acting in their stead) or its responsible employees must, before the expiration of the deadline for submission of documents (information), submit to the head of the inspection group:

• a written explanation of the reasons for non-compliance with the request for the submission of documents (information);
• a justified appeal for an extension of the deadline for submission of documents (information), if necessary.

24. The head of the supervised organization (or the person acting in their stead) and its responsible employees are not entitled to:

• inspect technical means used by the inspection group, view official documents and other documents collected during the inspection;
• deprive the inspection group of the opportunity to use requested documents during the inspection;
• demand oral and/or written explanations from the inspection group;
• enter the work premises of the supervised organization provided to the head and/or member of the inspection group in their absence.

5. PREPARATION FOR CONDUCTING THE INSPECTION

6. In preparation for conducting the inspection, the inspection group must collect, systematize, and analyze all available documents (information) about the supervised organization in which the inspection is being conducted. The level of preparation depends on the complexity of the structure of the supervised organization and the types of its services.

7. Before the start of the inspection, the inspection group must review and conduct an analysis of:

• the license issued to the supervised organization and its conditions;
• documents submitted by the supervised organization when applying for a license;
• compliance with risk management system requirements established by the legislation of the Republic of Tajikistan and regulatory legal acts of the National Bank of Tajikistan regarding the activities of the supervised organization;
• any letters/instructions/orders/restrictions/measures previously applied to the supervised organization;
• reports prepared within the framework of providing statistical information, analyses, and assessments of the activities of the supervised organization;
• significance of the payment system;
• results of previous inspections and corrective actions;
• internal correspondence documents, including inspection reports;
• auditor reports and third-party opinions.

27. Before the start of a scheduled inspection, a preliminary notice of the inspection with a list of necessary documents is sent to the supervised organization. The preliminary notice of the inspection is compiled in accordance with Appendix 2 of this Procedure.

28. The preliminary notice of the scheduled inspection by the structural unit of the National Bank of Tajikistan carrying out supervision of the payment system is provided to the head of the supervised organization (or the person acting in their stead) personally or by mail (including electronic mail) no later than 10 working days before the start of the inspection.

29. The preliminary notice of the inspection includes requirements for the supervised organization to assist in conducting the inspection, including:

• preparation of documents (information) on issues subject to inspection, including documents (information) in electronic form;
• appointment of responsible employees of the supervised organization and informing the head of the inspection group about this;
• carrying out activities related to the organizational and technical support of the inspection, including allocating a separate room for the inspection group and equipping it with organizational and technical means;
• taking appropriate actions facilitating the conduct of the inspection.

6. CONDUCTING THE INSPECTION

7. A document confirming the authority of the inspection group to conduct an inspection of the supervised organization (hereinafter referred to as the "mandate for conducting the inspection") is prepared in two copies in accordance with Appendix 3 of this Procedure and is certified by the signature of the Chairman (or the person acting in their stead) or the Deputy Chairman of the National Bank of Tajikistan – curator of the structural unit carrying out supervision of the payment system, and the seal.

8. The total duration of the inspection may not exceed 20 working days.

9. The mandate for conducting the inspection must contain information about the start date of the inspection, the end date of the inspection, issues subject to inspection, the inspection period, as well as the composition of the inspection group.

10. On the first day of the inspection, the head of the inspection group delivers the first copy of the mandate for conducting the inspection to the head of the supervised organization (or the person acting in their stead).

11. The first copy of the mandate for conducting the inspection is returned to the inspection group with a mark of the date and time of receipt, certified by the signature of the head (or the person acting in their stead) and the seal of the supervised organization; the second copy remains with the supervised organization.

12. At the beginning of the inspection, the inspection group must hold a meeting with the head of the supervised organization (or the person acting in their stead), during which the following issues must be discussed:

• discussion of the procedure for conducting the inspection;
• topics and issues that need to be inspected;
• familiarization with the members of the inspection group and the scope of their duties;
• determination of the procedure for addressing the management and responsible employees of the supervised organization.

36. On the first day of the inspection, the supervised organization is obliged to provide the inspection group with workspaces in a separate room and necessary equipment. There should be no audio/video recording equipment in the office. If there is audio/video recording equipment in the room, the supervised organization is obliged to stop audio/video recording in that room for the duration of the inspection.

37. On the first day of the inspection, the supervised organization is obliged to present to the inspection group all documents included in the preliminary notice. Evidence of the absence of one or several documents requested in the preliminary notice is оформляется (documented) as a separate act and signed by the head of the inspection group and the head of the supervised organization (or the person acting in their stead) or its responsible employee.

38. The inspection group sends a written request to the head of the supervised organization (or the person acting in their stead) for the submission of documents (information) necessary for conducting the inspection, specifying the date and deadline for the submission of the necessary documents (information).

39. Requested documents (information) necessary for conducting the inspection must include:

• organizational and legal structure;
• payment system rules;
• management structure;
• risk management system;
• procedure for uninterrupted functioning of the payment system;
• security policy and information protection;
• information and communication technology;
• types of services;
• reports and accounting;
• cases of rule violations;
• fulfillment of obligations of payment system participants and liquidity sufficiency;
• cases of operational activity disruptions of the system;
• cases of fraud and suspicious transactions;
• procedure for attracting payment infrastructure service operators and outsourcing of tasks;
• technical and operational deficiencies.

40. During the inspection, the inspection group may request additional documents (information) from the supervised organization, including:

• necessary statistical reports;
• information from operational systems;
• necessary certificates, updated certificates, and compliance reports;
• samples of information, documents, or forms;
• changes in the structure of the supervisory board and governing body of the supervised organization;
• change in address/location;
• changes in the system (i.e., changes in operational systems, devices, programs, and new applications for the system);
• changes in activities, strategy, offered products, and services;
• changes in security and information protection policy;
• updated list of payment infrastructure service operators and service providers;
• samples of contracts of the supervised organization with suppliers and clients;
• external and internal audit reports;
• corrective measures taken after the last inspection taking into account recommendations;
• issues having a negative impact on the activities of the supervised organization;
• list of services outsourced by the supervised organization;
• list of major technology service providers and critical service providers.

41. In case of refusal by the head of the supervised organization (or the person acting in their stead) to an oral request by the head or member of the inspection group for the provision of documents (information) or their copies, including in electronic form, the head of the inspection group sends a written request to the head of the supervised organization (or the person acting in their stead) for the submission of documents (information) necessary for conducting the inspection, specifying the date and deadline for their submission.

42. In justified cases, the Chairman (or the person acting in their stead) or the Deputy Chairman of the National Bank of Tajikistan – curator of the structural unit carrying out supervision of the payment system, may extend the inspection period by up to 10 working days.

43. Upon extension of the inspection period, an additional mandate is prepared in two copies in accordance with Appendix 4 of this Procedure, which is certified by the signature of the Chairman (or the person acting in their stead) or the Deputy Chairman of the National Bank of Tajikistan – curator of the structural unit carrying out supervision of the payment system, and the seal.

44. Upon completion of the inspection, the inspection group must hold a final meeting with the management of the supervised organization to discuss the conducted inspection and its results, decisions taken, and recommendations for eliminating identified deficiencies.

45. REQUIREMENTS FOR THE INSPECTION ACT

46. Upon expiration of the inspection period, the inspection group must prepare an inspection act. The inspection act must include the following:

• general overview of the activities of the supervised organization and description of its inspected areas;
• detailed information on the results of the inspection, supported by analyzed arguments (information, statistics, tables, graphs, qualitative elements, comparisons);
• information on the analysis and assessment of major risks existing in the activities of the supervised organization and participants of the payment system;
• strengths and weaknesses of the activities of the supervised organization;
• detailed list of recommended actions to correct existing deficiencies and deadlines for their implementation;
• information on evidence of resistance to the inspection.

46. The inspection act is prepared in accordance with the requirements of this Procedure in written form in two copies.

47. The inspection act consists of an introductory, analytical, and concluding parts.

48. The introductory part of the inspection act must contain the following information:

• date and place of preparation of the inspection act;
• registration number and license number of the supervised organization, registered in the registry of payment system operators;
• information on the creation and location of the supervised organization;
• general information on the activities of the supervised organization;
• specifics of conducting the inspection and documentation of the results of the inspection of the supervised organization, indicating facts of resistance to the inspection or suspension or termination of the inspection.

49. The analytical part of the inspection act must include the following information:

• on documents (information) submitted (not submitted) by the supervised organization during the period of the inspection of the supervised organization;
• on the correctness of accounting (reporting) of the supervised organization;
• on facts (cases) of deficiencies identified in the activities of the supervised organization (indicating specific provisions of legislation and regulatory legal acts of the National Bank of Tajikistan, the requirements of which were violated by the supervised organization and were not eliminated at the time of discovery) with attached confirming documents;
• on the elimination by the supervised organization of deficiencies and violations of legislation identified in its activities at the time of completion of the inspection.

50. The analytical part of the inspection act must also contain conclusions of the head and members of the inspection group on the results of the inspection of the supervised organization, as well as other information necessary for determining the financial condition, size of risks, assessment of the risk management system and internal control organization, information protection, and prospects for its activities.

51. The concluding part of the inspection act must...