Regulations Concerning Licensing and Operations of Electronic Payment Services in Liberia

THE LIBERIA OFFICIAL GAZETTE PUBLISHED BY AUTHORITY VOL. XX                             Wednesday, January 8, 2020                           NO.05 E X T R A O R D I N A R Y The Government of the Republic of Liberia announces that the Central Bank of Liberia (CBL), pursuant to its mandate under the Central Bank of Liberia Act of 1999 and its authority under the Financial Institutions Act of 1999, and specifically consistent with Section 55 of the said Central Bank of Liberia Act of 1999 and Section 39 of the Financial Institutions Act of 1999, has issued on January 8, 2020, its Prudential Regulations No. CBL/RSD/003/2020 herein under: REGULATIONS CONCERNING LICENSING & OPERATIONS OF ELECTRONIC PAYMENT (E-Payment) SERVICES IN LIBERIA BY ORDER OF THE PRESIDENT

GBEHZONGAR MILTON FINDLEY MINISTER OF FOREIGN AFFAIRS MINISTRY OF FOREIGN AFFAIRS MONROVIA, LIBERIA

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 2  Contents  PART I PRELIMINARY ............................................................................................................................... 4  1.0 INTRODUCTION ................................................................................................................................... 4  2.0 SCOPE ........................................................................................................................................................ 4  3.0 TITLE .......................................................................................................................................................... 4  4.0 OBJECTIVES ........................................................................................................................................... 4  5.0 DEFINITION ........................................................................................................................................... 5  PART II. REGULATORY REQUIREMENTS FOR PAYMENT SERVICE PROVIDERS ..... 7  6.0 MINIMUM REQUIREMENTS FOR PROVIDING PAYMENT SERVICES ...................... 7  7.0 MINIMUM REQUIREMENTS FOR OTHER ENTITIES WILLING TO PROVIDE PAYMENT SERVICES .......................................................................................................................... 8  8.0 FEES AND ANNUAL OPERATING LEVY .................................................................................... 9  8.1 Capital Requirement…………………………………………………………………………………....9 9.0 INFORMATION TECHNOLOGY (IT) SYSTEMS, SECURITY AND CONTROLS ..... 10  9.1 Information Systems and Cyber Security .......................................................................... 10  9.2 Backup, recovery & business continuity: ........................................................................... 11  10.0 OPERATIONAL REQUIREMENTS ............................................................................................... 11  11.0 OUTSOURCING ............................................................................................................................... 12  12.0 CLEARING & SETTLEMENT ....................................................................................................... 13  13.0 EXCLUSIVITY AGREEMENTS .................................................................................................... 13  14.0 FEES AND CHARGES .................................................................................................................... 13  15.0 MERGER & ACQUISITION ........................................................................................................ 13  16.0 RISK MANAGEMENT .................................................................................................................... 13  17.0 COMPLIANCE/AML/CFT ........................................................................................................... 14  18.0 CONSUMER PROTECTION ........................................................................................................ 14  19.0 DATA PROTECTION ..................................................................................................................... 15  PART III. THIRD-PARTY SERVICE PROVIDERS AND OPERATORS .................................. 15 

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 3  20.0 ROLE OF THE NATIONAL ELECTRONIC PAYMENT SWITCH .................................. 15  21.0 SWITCHES (SWITCHING COMPANIES) ........................................................................... 15  22.0 ELECTRONIC PAYMENT CHANNELS .................................................................................... 16  IV. OVERSIGHT .............................................................................................................................................. 16  23.0 CBL POWERS .................................................................................................................................... 16  24.0     REPORTING........................................................................................................................................ 16  PART V. STANDARDS ON APPLICATION AND SYSTEM SOFTWARE ............................ 17  25.0 STANDARDS FOR ELECTRONIC CHANNELS .................................................................... 17  PART VI – REMEDIAL MEASURES AND ADMINISTRATIVE SANCTIONS ....................... 17  26.0 PENALTIES ............................................................................................................................................. 17  27.0 AMENDMENTS ...................................................................................................................................... 18  APPENDIX 1: CENTRAL BANK OF LIBERIA POS SCHEMES MONTHLY RETURN ........ 19  APPENDIX 2: CENTRAL BANK OF LIBERIA ATM SCHEMES MONTHLY RETURN ........ 20  APPENDIX 3: CENTRAL BANK OF LIBERIA e-PAYMENTS QUARTERLY RETURN ...... 21  APPENDIX 3A: CENTRAL BANK OF LIBERIA -POS QUARTERLY RETURN ..................... 21  APPENDIX 4: APPLICATION FOR A PAYMENT SERVICE LICENCE .................................... 22 

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 4  PART I PRELIMINARY 1.0 INTRODUCTION These Regulations have been issued by the Central Bank of Liberia (CBL) pursuant to the Payment System Act of Liberia and Part II, section 4 of the CBL Act 1999, which empowers the CBL to regulate, monitor and supervise the payment, clearing and settlement system including all products and services thereof issued by any bank, non-bank financial institutions. The Central Bank of Liberia has the duty to promote and facilitate the development of a safe, efficient systems and create an enabling environment for large value and retail payments mechanism in the national payment system and ensure that high standards are maintained in the conduct and management of the risk in the operations of electronic payment schemes and products. 2.0 SCOPE These regulations shall apply to all banks and non-bank financial institutions and to any other entities duly authorized by the Central Bank and intending to provide electronic payment services, including by the issuance of e￾payment products or schemes. These regulations shall also establish standards for third-party e-payment service providers or operators of e-payment systems. 3.0 TITLE These Regulations may be cited as Regulations No. CBL/RSD/xxx/2019 Regulations Concerning the Licensing and Operations of Electronic Payment (e-Payment) Services. 4.0 OBJECTIVES These Regulations are set out by the Central Bank of Liberia to achieve the following objectives: i. Provide guidance to licensed institutions on recommended principles and sound practices for managing risks in their provision of e-payment services, including the management of e-payment products or schemes, as well as to provide guidance to third party service providers and operators to provide services and operate electronic channels in accordance with such principles. II. Promote financial inclusion without risking the safety and soundness of the financial system; and address issues that, though peculiar to

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 5  payment systems in general, may be amplified by the use of electronic media. III. Promote safe and efficient delivery of quality payments services by ensuring transparency, fairness and effective recourse. IV. That any technology employed to deliver any e-payment solution is of industry standard, resilient, scalable, and hardened against cybercrime and void of unauthorized access. 5.0 DEFINITION In these Regulations, unless the context otherwise requires: - Authentication means the techniques, procedures and processes used to verify the identity and authorization of prospective and established customers; “Bank” means a company which carries on, or proposes to carry on, banking business in Liberia but does not include the Central Bank; Central Bank means the Central Bank of Liberia; Data integrity means the assurance that information that is in-transit or in storage is not altered without authorization; Electronic payment service means the issuance and management of any electronic instrument or device, or the implementation of a scheme used for the purposes of facilitating payment transfers, through internet and/or wireless communication networks, and by use of service delivery products such as electronic cards, electronic payment transfers systems, mobile apps, internet banking, automated teller machines, point of sales terminals, payment switches and any other type of electronic payment transfer system; Electronic payment channel means the medium by which any electronic instrument, device or scheme can be used for the purposes of facilitating payment transfers, through internet and/or wireless communication networks; Licensed Institution as prescribed in these regulations means banks and non-bank financial institutions and other entities duly licensed by the CBL. Third-party Service Providers and Operators - are institutions licensed by the Central Bank that are engaged in operating and/or providing services related to e-payment products, schemes or systems, as well as the management of channels like electronic payment gateway, ATM Switch, POS Gateway, E-Commerce Gateway etc., usually acting as an intermediary for multilateral routing, switching and processing of payment transactions;

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 6  Interoperability means any situation in which payment instruments belonging to a given electronic payment channel or system may be used in another electronic payment channel or system installed by another Institution; Interconnectivity means ability for reciprocal exchange of transactions/messages between two or more switching networks; NEPS – National Electronic Payment Switch Non-bank financial institution means any person or institution whose activities and transactions are in the form of non-bank financial services rendered without accepting from the general public deposits payable upon demand or after a fixed period; Non-repudiation involves creating proof of the origin or delivery of electronic information to protect the sender against false denial by the recipient that the data has been received or to protect the recipient against false denial by the sender that the data has been sent; Payment Gateway the term refers to the platform or system that is responsible for ensuring security of the interchange data related to the payment instrument possessed from an acquiring network to an issuing network. Settlement means the act of discharging obligations by transferring funds or securities between two or more parties. Switching Companies means companies that put in place infrastructures to capture electronic financial transactions from touch￾points, apply rules, determine destinations, deliver the transactions and give appropriate feedback.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 7  PART II. REGULATORY REQUIREMENTS FOR PAYMENT SERVICE PROVIDERS 6.0 MINIMUM REQUIREMENTS FOR PROVIDING PAYMENT SERVICES a. All bank and non-bank financial institutions wishing to engage in electronic payment service(s) shall seek approval from the CBL. b. All bank and non-bank financial institutions shall adhere to the CBL Directive Concerning the Introduction of Financial Products and Services CBL/ SD/001/2009. c. All bank and non-bank financial institutions shall ensure that dispute resolution/consumer protection systems have been established. d. All bank and non-bank financial institutions have a designated unit for e-payment services at its head office and branches; e. Bank and non-bank financial institutions wishing to provide and/or enhance their existing electronic payment services shall describe in their application, the services to be offered and how it fits into their overall strategy. This shall be accompanied with the following minimum pre￾conditions: i. An adequate risk management process shall be in place to assess, control, monitor and respond to potential risks arising from the proposed electronic payment activities [services]; ii. A report from a recognized Information Communication & Technology (ICT) certification agency, confirming that corporate security policy and procedures that address all security issues affecting its electronic payments system, particularly the following, exist:  Authentication  Non-repudiation  Authorization  Integrity  Confidentiality f. A Backup or redundant platform exits or a minimum period for service restoration is articulated in its operational procedures or SLA. g. Ensure that the bank or non-bank’s overall financial conditions can adequately support its electronic payment activities and that it meets the prudential requirements such as, but not limited to, the following: i. Minimum capital adequacy ratio

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 8  ii. Minimum Liquidity ratio iii. Satisfactory solvency, liquidity and profitability positions; iv. Satisfactory CAMEL composite rating v. Has a sufficient capital to undertake the required investment in the electronic payment infrastructure (Hardware, Software, Communications etc.) 7.0 MINIMUM REQUIREMENTS FOR OTHER ENTITIES WILLING TO PROVIDE PAYMENT SERVICES a) Entities which are not bank or non-bank financial institutions seeking to provide payment services, are required to submit to the Executive Governor of the Central Bank of Liberia an application signed by its managing director or chief executive officer for license to conduct such activities and a completed copy of the form attached as Appendix 4. b) Additionally, entities whose principal line of business is different from offering electronic payments services shall establish and register a subsidiary solely for becoming a Payment Service Provider. The application shall be accompanied with the following: - i. List of owners which should include beneficial owners and corporate affiliates and the respective values of their holdings; ii. Physical address of Head Office, telephone number, fax Number, Website Address and Email Address; iii. Registered Office and Address if different from (ii) above; iv. A copy of board resolution authorizing the establishment of a subsidiary company for the provision or operations of e-payment services, if applicable; v. Articles of Incorporation; vi. The name, curriculum vitae and police clearance of the directors and executive officers; vii. Latest audited financial statement of Parent company, if any; viii. Product or trading name; ix. A certification or license issued by a recognized Information Communication Technology (ICT) Certi fica tion Authority or other regulatory agencies, if applicable; x. Draft Agreements entered with third parties including service level agreement; xi. Details information on accounts held in banks in Liberia for the purpose of settlement of transactions, only. xii. Measures to ensure confidentially of transaction of customers data. xiii. Business plan for the provision of e-payments indicating, at least:

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 9  a. The services to be offered b. Geographical areas that will be covered c. Information Technology to be used d. Payment flows and settlement/reconciliation arrangements. e. Information on capital and source(s) of funds f. Target market g. Financial projections and sensitivity analysis of the projections for the first three year h. Agent and merchant rollout plan i. Outsourcing arrangement 8.0 FEES AND ANNUAL OPERATING LEVY a) The applicant is required to pay a non-refundable application fee of US$500.00 or its equivalent in Liberian dollars, providing proof of the payment with the application. b) The Central Bank of Liberia shall grant the license if the requirements set forth in these Regulations are met. The application shall be rejected if the requirements are not met or for other reasons such as the safety of the payment systems or public interest. c) The e-payment provider or operator shall pay a license fee of US$5,000.00 or its equivalent in Liberian dollars, no later than 30 days after receiving notice of approval of the application. d) An Annual Operating Levy of US$3,000.00 or its equivalent in Liberian dollars shall be paid on or before January 15 of each year. These fees may be reviewed and amended by the Central Bank of Liberia from time to time. 8.1 Capital Requirement 8.1.1 An entity wishing to engage in providing e-payment services shall be required to deposit in an escrow account at any licensed bank in Liberia, a minimum paid up capital of US$100,000.00 or its equivalent in Liberian Dollars at the prevailing market rate. This amount shall be deposited during the licensing period with copy of deposit slip being submitted to the Payment & Systems Department. The e-payment provider/operator shall at all times maintain the minimum core capital. 8.1.2 The CBL reserves the right to change the minimum capital as and when necessary.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 10  9.0 INFORMATION TECHNOLOGY (IT) SYSTEMS, SECURITY AND CONTROLS For all e-payment service providers, the integrity and adequacy of IT and Security Systems should at minimum cover the following: a) Architecture of Information Technology to be deployed; b) Security of IT systems: i. Appropriate security policies and measures intended to safeguard the integrity, authenticity, confidentiality of data operating systems; ii. Physical and Logical Access Controls iii. Backup infrastructure iv. Business continuity and disaster recovery plan v. Effective audit function to provide a review of the security control environment and critical systems; vi. IT systems vulnerability assessment report; vii. A satisfactory report from an ICT Certification Authority in respect of Information Security in accordance with the Payment Systems Act; c) The system should be hosted locally to provide ease of support and guarantee data ownership; however, if the system is hosted in another jurisdiction, licensed institutions shall ensure that the information requested are provide promptly and that the CBL has unfettered access to reports generated by the system. d) For business continuity, the system should have online synchronization to a backup location that assumes operations in case the primary site is down; e) Where the system is usually integrating with other systems a schema security level should be discussed with CBL technical team; f) Put in place a system capable of immediately informing their support team as well as customers when the system goes offline. 9.1 Information Systems and Cyber Security a) All e-payment service providers shall ensure that personal information of customers obtained during the course of operations is used, disclosed, retained and protected as agreed. b) They shall ensure the security, Integrity, Confidentiality and Availability of data and services by adopting prevailing international standard(s) as well as those prescribed by Central Bank of Liberia from time to time. c) They shall implement a cyber-security policy that conforms with international standards and any other cyber-security standards that the Central Bank will issue from time to time;

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 11  d) All computer accesses, including messages received and security violations (suspected or attempted) shall be reported to the Central Bank of Liberia and follow up action taken promptly. e) All e-payment service providers shall ensure that the information technology systems maintain a complete audit log of all users’ activities. 9.2 Backup, recovery & business continuity: a) All e-payment service providers shall be required to ensure adequate back up of data for their operations. Licensed Institutions shall have, well documented and tested business continuity plans that address all aspects of the financial institution’s business. b) All e-payment service providers shall put systems in place to test the effectiveness of the backup infrastructure and business continuity plan at least on a semi-annual basis. 10.0 OPERATIONAL REQUIREMENTS 10.1 Minimum administrative procedures including the following shall be in place: a) Operational plans and policies approved by the Board b) Business operating manuals c) Accounting procedural manuals and the required IT systems d) Competent and well-trained staff e) Dispute resolution/Consumer protection systems f) Any other conditions specified by the Central Bank of Liberia 10.2 All e-payment service providers shall also ensure that: a. There are appropriate security measures in place, both physical and logical together with other requisite risk management controls and a strategy has been developed and documented. The strategy shall clearly outline the policies, practices and procedures that address and control all of the risks associated with electronic payment systems and that it shall be updated periodically to be in tandem with technological changes; b. All e-payment service providers should deploy a security appliance (i.e. firewall) and a solution to prevent a direct connection between the Licensed Institution back end system and the Internet; c. External devices such as Automated Teller Machines (ATMs), Personal Computers (PCs), installed at remote sites and/or branches, etc. that are permanently connected to the entity’s

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 12  internal network and having network traffic passing through the entity’s firewall or gateway appliance, shall at the minimum address issues relating to security, non-repudiation, data integrity and confidentiality. d. the electronic payment channels shall provide an accurate and fully accessible audit trail of transactions from the origin of the payment instruction to its finality; e. the electronic payment channels have the potential of providing services to a wider country outreach; f. the participants to the electronic payment schemes are provided certainty of finality of their payments; g. An enforceable legal framework for the provision of the services is available which covers all parties in the transaction. The legal framework shall be transparent and shall provide efficient dispute resolution mechanisms; h. the pricing policies take into account cost and affordability of the services to a wider market reach; i. that e-payment services are transparent; j. a cost-benefit analysis has been conducted of the provision of the electronic payment services; k. it has considered legal developments (including compliance) and the business environment including external and internal threats; l. the participants to electronic payment schemes are provided certainty of finality of their payments; m. a electronic payment schemes shall be available to its participants at all times, to protect the users of the services; 11.0 OUTSOURCING 11.1 Any e-payment service provider deciding to use third parties to provide electronic payment services, must exercise appropriate due diligence in evaluating their reputation, financial status, and viability. 11.2 All e-payment service providers must ensure that such third parties can perform as promised and that they are capable of keeping abreast of new or changing technology. 11.3 All e-payment service providers must ensure that adequate controls are in place to monitor performance levels and to swiftly respond to any problem or emergency, by providing specific performance benchmarks to the service provider.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 13  12.0 CLEARING & SETTLEMENT 12.1 The roles and responsibilities of the concerned parties (licensed institutions) pertaining to the processing, clearing and settlement of transactions must be governed under relevant contracts/agreements signed by each party and submitted to the CBL for review. 12.2 Transactions processed by all e-payment service providers outside their own network or through other institution’s system shall be processed by the National Electronic Payment Switch (NEPS) and settled through the Real Time Gross Settlement System (RTGS) held at the CBL. 13.0 EXCLUSIVITY AGREEMENTS 13.1 There shall be no form of exclusivity in any area of payment service including but not limited to issuing, acquiring, processing, and sale and maintenance of hardware and software. Any payment service provider that contravenes this policy may be suspended 14.0 FEES AND CHARGES 14.1 The Central Bank shall be notified and shall approve of fees and charges as well as changes to all fees and charges concerning electronic payment products and services. 14.2 These fees may be reviewed and amended by the Central Bank of Liberia from time to time. 15.0 MERGER & ACQUISITION 15.1 No e-payment service provider or e-payment service operator shall be acquired or form merger without written notification and approval of the Central Bank of Liberia. 16.0 RISK MANAGEMENT 16.1 In addition to the recommended risk management measures set forth herein, each e-payments service provider shall implement the relevant risk management controls that commensurate with the risk appetite associated with the electronic payment product or scheme it adopted. 16.2 All e-payment service providers shall institute adequate risk control measures to manage risks of liability to customers on account of breach of secrecy, denial of service because of hacking/other technological failures. 16.3 All e-payment service providers are required to on an ongoing basis conduct risk assessment of their existing and new customers.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 14  17.0 COMPLIANCE/AML/CFT 17.1 All e-payment service providers are required to fully comply with the Central Bank’s Regulation No. CBL/RSD/004/2017, concerning AML/CFT Regulations for Financial Institutions in Liberia. 17.2 All e-payment service providers shall identify an ICT compliance officer whose responsibilities shall include compliance with standards contained in these regulations as well as the Financial Institutions’ policies on ICT. 17.3 All e-payment service providers should adopt a risk-based ML/TF compliance and internal audit programs. 18.0 CONSUMER PROTECTION 18.1 All e-payment service providers shall adhere to the revised Consumer Protection and Market Conduct Regulation, Regulations No. CBL/RSD/004/2017; 18.2 All e-payment service providers shall ensure that customers using the various-payment channels have understood the general features of the p r o d u c t o r schemes and the charges and fees; 18.3 Customers applying for all E-products must acknowledge their understanding and acceptance of the terms of the product with their signature or alternative unique identifier such as a fingerprint; 18.4 The contract shall clearly identify the Customer and the Authorized Institution that is providing the Service and state the sanctions and penalties to be applied to clients that may violate the terms and conditions of the contract; 18.5 All e-payment service providers shall maintain a functional dispute and complaints resolution desk which shall be equipped to receive complaints and clearly provide speedy resolution of complaints and disputes that may arise between clients and clients, or the providers and clients; 18.6 The complainants shall have recourse to the Customer Protection Unit, Central Bank of Liberia if they are dissatisfied with the resolution of the decision; 18.7 All e-payment service providers shall provide customer education/awareness programs which should include messages, alerts, warnings on their platforms as well as other social media platforms as the case maybe.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 15  19.0 DATA PROTECTION 19.1 All e-payment service providers shall maintain privacy and confidentiality of customer information and data, unless sharing customer information and data is authorized by the customer or on a court order or in keeping with the AML/CFT Regulations for Financial Institutions in Liberia. 19.2 The conditions under which c ustomer information and data will be kept shall be disclosed before the customer enters into agreement with the Authorized Institution. 19.3 Provisions of data protection including confidentiality shall be in tandem with all relevant laws. PART III. THIRD-PARTY SERVICE PROVIDERS AND OPERATORS 20.0 ROLE OF THE NATIONAL ELECTRONIC PAYMENT SWITCH 20.1 Transactions processed by third party payment service operators (PSO) serving as intermediaries body (Switch) will be processed by the National Electronic Payment Switch and settled by the CBL amongst their participants. The CBL shall settle PSOs through their designated licensed commercial banks. 20.2 At no point in time should the PSOs have access to or hold the consumer’s or participant’s funds. 20.3 The National Electronic Payment Switch (NEPS) shall act as the National Payment Gateway for the retail sector of the financial industry. 20.4 As the Payments Gateway for the industry, NEPS shall establish communication network for reliable data traffic that shall satisfy the service and availability standards and expectations of the industry on a cost-effective basis. 20.5 All interoperable payment transactions shall be routed through the National Electronic Payment Switch (NEPS) and shall not under any condition be routed outside Liberia except in the case of transactions not supported by the NEPS. 21.0 SWITCHES (SWITCHING COMPANIES) 21.1 To achieve the interconnectivity and interoperability of switching companies and, all switching companies shall open their networks for reciprocal exchange of transactions/messages with the National Electronic Payment Switch (NEPS).

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 16  21.2 All commercial switching companies in Liberia shall ensure full and secure connection to the National Electronic Payment Switch, and all transactions (card or non-card) that the switch is licensed to process shall be routed through the NEPS to a licensed switch (Issuing Switch) for the purpose of processing such transaction. 22.0 ELECTRONIC PAYMENT CHANNELS 22.1 Proper service level agreement must be put in place for all third-party service arrangements and at a minimum define the rights, expectations and responsibilities of both parties. 22.2 The electronic payment channels shall provide an accurate and fully accessible audit trail of transactions from the origin of the payment instruction to its finality; 22.3 The electronic payment channels have the potential of providing services to a wider country outreach; IV. OVERSIGHT 23.0 CBL POWERS 23.1 The Central Bank of Liberia shall have the right to do the following to all e-payment service providers: a. Access information in the possession or custody of all e-payment service providers; b. Deploy/facilitate the deployment of an ICT solution for visibility as pertains to real-time data collection, decision support, and real￾time reporting; c. Inspect and monitor the premises of all e-payment service providers; d. Carry on on-site or off-site examination by requesting any information relating to e-payments; e. Request for frequent risk assessment of e-products and inspection of technology systems and security; f. Require all e-payment service providers to put in place remedial measures after examination or inspection that the Central Bank may deem necessary. 24.0 REPORTING 24.1 All e-payment service providers are required to submit separate monthly and quarterly returns on their electronic activities to the Central Bank of Liberia as prescribed in the appendices below. 24.2 Cases of frauds and forgeries relating to electronic payments should be highlighted in the returns on frauds and forgeries.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 17  24.3 All e-payment service providers shall submit an annual audit report including audited financials. The annual report shall be done by an external auditor that has to be approved by the CBL. PART V. STANDARDS ON APPLICATION AND SYSTEM SOFTWARE 25.0 STANDARDS FOR ELECTRONIC CHANNELS 25.1 The approved standards for compliance for all ATMs in Liberia shall be the Payment Card Industry Data Security Standards (PCI DSS). All e￾payment service providers are to comply with this standard. 25.2 All e-payment service providers shall also adhere to the standards set forth in the Guidelines on the Operations of Electronic Payment Channels in Liberia; 25.3 All e-payment service providers shall ensure that their platforms interface and are interoperable; 25.4 All e-payment service providers shall ensure continued support for their applications in the event the supplier goes out of business or is unable to provide service. This provision shall be made in the purchase agreement. 25.5 All e-payment service providers operating electronic products and services shall ensure proper connectivity of their platforms to the National Electronic Payments Switch (NEPS). PART VI – REMEDIAL MEASURES AND ADMINISTRATIVE SANCTIONS 26.0 PENALTIES 26.1 The CBL may impose a range of supervisory and administrative sanctions upon any financial institution as an entity as well as individual persons who violate any provisions of this Regulation. These may include:  Warning letter;  CBL Directive to take specified corrective action;  Administrative penalties, including monetary penalties of up to L$200,000.00;  Civil penalties;  Order to remove employee, officer, director or manager from position in the licensed institution;  Full or partial suspension of financial activities until the violation or deficiency is rectified; and/or  Permanent revocation of license.

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 18  27.0 AMENDMENTS The Central Bank of Liberia has authority to amend or revise these regulations from time to time as it may be deemed. These Regulations shall take effect upon publication in Official Gazette. Republic of Liberia CENTRAL BANK OF LIBERIA MONROVIA, LIBERIA

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 19  APPENDIX 1: CENTRAL BANK OF LIBERIA POS SCHEMES MONTHLY RETURN Financial Institution/ E-Payments Service Providers QTY Comment Total Number of POS installed Total Number of Active POS Total Number inactive POS Total Number of Active Users

Locations of POS: Locations (Counties) QTY Active In-active 1. 2. 3. 4. 5. 6. 7. 8. Total

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 20  APPENDIX 2: CENTRAL BANK OF LIBERIA ATM SCHEMES MONTHLY RETURN Financial Institution/ E-Payments Service Providers QTY Comment Total Number of ATM Installed Total Number of Active ATMs Total Number of Active Users Locations of ATMs: Locations (Counties) QTY Active In-active 1. 2. 3. 4. 5. 6. 7. 8. QTY USD LD Total number of Prepaid Cards issued per currency Total number of Debit cards issued per currency Grand Total

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 21  APPENDIX 3: CENTRAL BANK OF LIBERIA e-PAYMENTS QUARTERLY RETURN Name of Licensed Institution: _______________________ e-Banking Product(s) Total number per Gender transaction Agent by Gender Distributi on by County Volume of Transactions Value of Transactions Male Female LRD USD LRD USD

APPENDIX 3A: CENTRAL BANK OF LIBERIA -POS QUARTERLY RETURN Name of Licensed Institution: _________________ NO. AGENTS LOCATION BUSINESS CATEGORY Volume of Transaction s Value of Transactions

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 22  APPENDIX 4: APPLICATION FOR A PAYMENT SERVICE LICENCE NOTE: This application shall be filled in capital letters 1. NAME OF APPLICANT (as it appears in the registration certificate): M/S:

2. TYPE OF LICENSE BEING APPLIED FOR:

Category of payment system services

3. APPLICANT’S CONTACTS

Physical Address:

Town/City: Building: Mobile No. Email Address:

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 23  4. PARTICULARS OF SHAREHOLDERS % OF S/N NAME NATIONALITY TELEPHONE OCCUPATION SHAREHOLDING NUMBERS & EMAIL 1.

4. PARTICULARS OF DIRECTORS AND SENIOR MANAGERS IN ORDER OF SENIORITY: S/N NAME NATIONALITY DESIGNATION EDUCATIONAL QUALIFICATION

8. OTHER INFORMATION S/N

9. State whether any of the partners/ directors/ shareholders have a beneficial interest in any other business licensed to provide payment services

10. Has any previous application by you been rejected or cancelled by the CBL? (If so give details)

Regulations Concerning the Licensing and Operations of Electronic Payment Services in Liberia 24  7. SUPPORTING DOCUMENTS S/N Documents 1. 2. Covering letter All documents listed for a bank or non-bank applicant respectively. 8. DECLARATION (by Shareholders) I/We, the undersigned, hereby declare: 1.THAT the particulars set out herein are true and correct to the best of my/our knowledge and belief; 2.THAT I am/we are not undischarged bankrupt and that I/we have never been convicted of fraud or dishonesty; Name: Signature:

Name: Signature: Name: Signature:

BEFORE ME: NAME:………………………………………………………………………… SIGNATURE:………………………………………………………………… DATE:…………………………………………………………………………. ADDRESS:……………………………………………………………………