Approval of the Regulation on the Procedure for Supervision and Monitoring of Payment System Operators and Payment Institutions

Resolution of the Board of the Central Bank of the Republic of Uzbekistan, registered on May 15, 2023, registration number 3434

Entry into force date

August 17, 2023

All

View

Russian

Uzbek

O’zb

Uzbek|Russian

[OKOS:

1.07.00.00.00 Legislation on Finance and Credit. Banking Activity / 07.21.00.00 Banking Activity / 07.21.03.00 Settlements and Cash Operations (see also 03.11.17.00, 07.21.04.00)]

[TSZ:

1. Finance / Monetary System. Settlements]

Resolution of the Board of the Central Bank of the Republic of Uzbekistan

On Approval of the Regulation on the Procedure for Carrying Out Supervision and Monitoring of the Activities of Payment System Operators and Payment Institutions

[Registered by the Ministry of Justice of the Republic of Uzbekistan on May 15, 2023, registration number 3434]

In accordance with the laws of the Republic of Uzbekistan "On the Central Bank of the Republic of Uzbekistan" and "On Payments and Payment Systems," the Board of the Central Bank of the Republic of Uzbekistan resolves:

1. Approve the Regulation on the Procedure for Carrying Out Supervision and Monitoring of the Activities of Payment System Operators and Payment Institutions in accordance with the appendix.

2. This resolution is coordinated with the Representative for the Protection of the Rights and Legitimate Interests of Business Entities under the President of the Republic of Uzbekistan and the Chamber of Commerce and Industry of the Republic of Uzbekistan.

3. This resolution enters into force three months after the date of its official publication.

Chairman of the Central Bank M. NURMURATOV

Tashkent city,

April 18, 2023,

No. 8/4

Agreed:

Representative for the Protection of the Rights and Legitimate Interests of Business Entities D. KASIMOV

April 3, 2023

Chairman of the Chamber of Commerce and Industry D. VAHABOV

March 25, 2023

Resolution No. 8/4 of the Board of the Central Bank of the Republic of Uzbekistan dated April 18, 2023 resolution

APPENDIX

REGULATION

on the Procedure for Carrying Out Supervision and Monitoring of the Activities of Payment System Operators and Payment Institutions

This Regulation establishes the procedure for the Central Bank of the Republic of Uzbekistan (hereinafter referred to as the Central Bank in the text) to carry out supervision and monitoring of the activities of payment system operators and payment institutions.

Chapter 1. General Provisions

1. The following basic concepts are used in this Regulation:

payment system operator — a legal entity carrying out activities to ensure the functioning of a payment system within the territory of the Republic of Uzbekistan;

payment institution — a legal entity authorized to carry out activities providing payment services, not being a bank;

remote monitoring — a type of control based on the analysis of information provided by payment system operators and payment institutions and (or) obtained from their information systems.

2. This Regulation applies to payment system operators and payment institutions holding a license issued by the Central Bank.

3. In supervising the activities of payment system operators and payment institutions, the Central Bank:

requests information from payment system operators and payment institutions, including information related to personal data, concerning the functioning of payment systems; establishes the forms and deadlines for submitting reports on the functioning of payment systems by payment system operators and payment institutions, as well as the methodology for compiling reports; analyzes the information submitted by payment system operators and payment institutions regarding the functioning of payment systems; subject the activities of payment system operators and payment institutions to inspection audits; applies measures and sanctions against payment system operators and payment institutions in case of violation of the requirements of legislation on payments and payment systems.

4. The Central Bank publishes information on the activities of payment system operators and payment institutions at least once a year on the official website of the Central Bank.

Chapter 2. Information Submitted by Payment System Operators and Payment Institutions

5. The Central Bank collects and analyzes information specified in this chapter regarding the activities of payment system operators and payment services provided by payment institutions for the purpose of supervising and monitoring their activities.

Information is submitted to the Central Bank by payment system operators and payment institutions in electronic form and (or) transmitted automatically through information systems.

6. Information regarding the number and amount of transactions executed daily by payment system operators and payment institutions as of the end of the day is transmitted to the Central Bank automatically through information systems.

7. Payment system operators must submit the following information regarding payment system activities to the Central Bank by the 5th day of the following month without fail:

the number of personalized bank cards and programmed terminals; information on tests conducted in the course of payment system operator activities, if tests were conducted; a copy from the electronic terminal (E-POS) registry.

8. Payment institutions must submit information regarding payment services provided by the payment institution, including information on the number of users of payment services, payment agents, and payment sub-agents and their addresses, to the Central Bank by the 5th day of the following month without fail.

9. Payment system operators and payment institutions must submit the following annual information to the Central Bank by April 1 of the following year without fail:

information on tests conducted in the course of activities of payment system operators or payment institutions during the previous year, if tests were conducted; information on threats to the uninterrupted functioning of the payment system and payment institution activities, identified risks, risk assessment, measures to eliminate them, and their effectiveness.

10. If operational risks arise during the activities of a payment system operator or payment institution, disruptions are observed in their information systems, or changes are made to activities related to payment systems or payment services, the operator or institution must submit information describing these situations to the Central Bank within three business days from the date of occurrence.

The information submitted to the Central Bank regarding interruptions in activities by payment system operators or payment institutions must indicate the causes and duration of these interruptions, the extent of the impact of the interruption on payment services, participants, and (or) users, measures to restore the payment system, and deadlines for eliminating errors and shortcomings to prevent such situations from recurring in the future.

11. If payment system operators and payment institutions plan to make changes to payment systems or activities related to payment services, they must submit a plan of actions regarding these changes to the Central Bank thirty days before implementing these changes.

The Central Bank reviews the plan of actions regarding changes within thirty days, assesses risks, and may provide relevant recommendations and instructions if necessary.

12. The plan of actions regarding changes includes the changes to be made, a description of planned measures, and an assessment of their impact on risk management.

When a payment system operator makes changes to a payment system, changes and additions must also be made to the payment system rules.

Chapter 3. Monitoring the Activities of Payment System Operators

13. In monitoring the activities of payment system operators, the Central Bank generalizes, systematizes, and analyzes information regarding their activities.

14. If a payment system operator meets one of the following criteria, the Central Bank includes this payment system operator in the category of important payment system operators:

if the uninterrupted functioning of the payment system contributes to the stable operation of the payment services market of the Republic of Uzbekistan, and interruptions (downtime) in its operation could lead to the emergence of risks in the payment services market of the Republic of Uzbekistan; if there are more than two million active users of payment services (those who have credited funds to an electronic payment instrument at least once during a month) in the payment system infrastructure; if the volume of payments made through the payment system over one year accounts for more than twenty-five percent of the total volume of such payments; if the volume of payments made through the payment system over one year exceeds twelve trillion UZS.

15. In monitoring the activities of important payment systems, the Central Bank:

conducts an assessment of the conformity of the activities of important payment systems with international standards and Central Bank requirements; develops recommendations for improving the activities of important payment system operators; monitors the implementation of measures to be carried out in the information prepared by important payment system operators regarding risk assessment and measures to eliminate them; issues written instructions on eliminating interruptions if interruptions occur in the activities of important payment system operators.

Chapter 4. Remote Monitoring of the Activities of Payment System Operators and Payment Institutions

16. The Central Bank carries out remote monitoring by collecting, analyzing, and conducting control payments as a secret customer information submitted by payment system operators and payment institutions and (or) data obtained from their information systems, electronic documents, and other information.

17. If errors or violations are identified in the activities of payment system operators and payment institutions during remote monitoring, the Central Bank prepares a certificate regarding this and issues instructions for their elimination.

The Central Bank may develop and submit recommendations for improving the activities of payment system operators and payment institutions, payment systems, payment services, and processes based on the results of remote monitoring.

18. The Central Bank has the right to issue the following instructions to payment system operators and payment institutions for eliminating violations related to the violation of legislative requirements regarding payment systems identified during remote monitoring:

restricting or stopping the execution of certain categories of operations prohibited by legislative acts through electronic terminals (E-POS) of payment institutions; establishing the procedure for carrying out certain categories of operations or processes related to activities.

Instructions are submitted to payment system operators and payment institutions in writing or electronically through information systems.

Chapter 5. Inspection Audits of the Activities of Payment System Operators and Payment Institutions

19. The Central Bank has the right to subject payment system operators and payment institutions to inspection audits at most once a year.

If there are disruptions in the uninterrupted functioning of an important payment system, the Central Bank has the right to conduct an unscheduled inspection audit.

20. Inspection audits of payment system operators and payment institutions are carried out by employees of the structural division(s) of the Central Bank responsible for conducting inspection audits, appointed by the decision of the Banking Supervision Committee of the Central Bank (hereinafter referred to in the text as authorized representatives of the Central Bank).

21. Inspection audits may be conducted on specific aspects of the activities of payment system operators and payment institutions or as comprehensive audits.

22. Inspection audits on specific aspects may be conducted in the following cases:

based on the results of risk assessment by payment system operators and payment institutions; based on requests from law enforcement and regulatory bodies; based on appeals from individuals and legal entities regarding facts of violation of legislative acts.

23. The duration of an inspection audit must not exceed 30 calendar days.

24. Authorized representatives of the Central Bank have the right during the inspection audit of the activities of payment system operators and payment institutions to:

obtain and examine documents; if necessary, obtain copies of documents to attach to audit materials; obtain oral and written explanations on matters related to activities; enter premises where activities are carried out; access the organization's information systems, including obtaining information in electronic form (excluding source code of programs created for electronic computing machines).

25. If requested information and documents are prepared in another language, authorized representatives of the Central Bank have the right to demand that such information and documents be submitted in the state language.

26. Authorized representatives of the Central Bank must not disclose to third parties information constituting a commercial and service secret of payment system operators and payment institutions known to them during the audit.

27. Payment system operators and payment institutions must not hinder authorized representatives of the Central Bank from conducting audits and create all conditions for conducting inspection audits, provide practical assistance to authorized representatives of the Central Bank, including assigning employees to provide necessary explanations to their questions.

28. Based on the results of the inspection audit, authorized representatives of the Central Bank draw up an audit protocol containing general information on the activities of the payment system operator or payment institution, along with a certificate of violations identified during the audit, attaching supporting documents, in two copies.

29. Authorized representatives of the Central Bank must deliver one copy of the audit protocol to the payment system operator or payment institution where the inspection audit was conducted. The payment system operator or payment institution where the inspection audit was conducted may submit its objections within three business days from the date of accepting the audit protocol. Objections must be attached to the audit protocol.

Chapter 6. Measures and Sanctions Applied to Payment System Operators and Payment Institutions

30. If the Central Bank identifies violations of the requirements of the Law "On Payments and Payment Systems" and other legislative acts during the supervision of the activities of payment system operators and payment institutions, it has the right to apply measures and sanctions to payment system operators and payment institutions in the manner established by this Law and this Regulation.

31. The decision on applying measures and sanctions to payment system operators and payment institutions is adopted by the Banking Supervision Committee of the Central Bank.

32. The Banking Supervision Committee of the Central Bank, when applying measures and sanctions to payment system operators and payment institutions, takes into account:

the level of risk, nature, scale, and consequences of violations; the systematicity and duration of violations; the impact of violations on the uninterrupted functioning of the payment system; the opportunity to change the situation as a result of measures and sanctions applied to payment system operators or payment institutions; the causes leading to identified violations and (or) risks; cybersecurity incidents arising in payment system operators or payment institutions as a result of non-compliance with requirements established by the Central Bank for ensuring information security (cybersecurity); the effectiveness (result) of previously applied measures and sanctions.

33. If violations of legislative requirements on combating the legalization of income obtained from criminal activity, financing of terrorism, and financing of the proliferation of weapons of mass destruction, and requirements of legislation on payments and payment systems by payment system operators or payment institutions do not directly affect the uninterrupted functioning of the payment system, the Central Bank:

notifies the governing body of the payment system operator and (or) payment institution in writing about the identified violation, indicating the violation and the deadline for its elimination, provided that this deadline must not be less than ten business days; sends recommendations to the governing body of the payment system operator and (or) payment institution on eliminating the identified violation.

34. If violations of the legislative acts mentioned above by payment system operators and payment institutions negatively affect the uninterrupted functioning of the payment system, the Central Bank sends an instruction to the governing body of the payment system operator and (or) payment institution on eliminating the violation, indicating the deadline for its elimination, which must not be less than ten business days.

35. If a payment system operator and (or) payment institution fails to comply with the Central Bank's instruction on eliminating the violation, as well as violates legislative requirements on combating the legalization of income obtained from criminal activity, financing of terrorism, and financing of the proliferation of weapons of mass destruction, the Central Bank applies one of the following sanctions in accordance with the law:

imposes a fine up to five thousand times the base calculation amount; restricts the execution of certain types of payment services and (or) operations for up to six months; suspends the validity of the license for up to ten business days.

36. The Central Bank applies one of the sanctions established in Article 35 of this Regulation to payment system operators and (or) payment institutions that fail to comply with the instruction on eliminating the violation and commit the following violations:

fails to provide a document confirming the fact of providing a payment service to the user after the payment service has been provided; fails to inform the user of payment services about fees charged for using payment services before initiating a payment transaction; executes a payment transaction without grounds after receiving an order from users of payment services to execute a payment; fails to inform the user of payment services about the refusal to execute the payment; violates the requirements for maintaining the confidentiality of personal data; fails to establish procedures and rules for alternative dispute resolution of disputes related to providing payment services; fails to follow recommendations sent to the governing bodies of payment system operators and (or) payment institutions on eliminating identified violations; executes actions without obtaining documents with the nature of permission from the Central Bank, the execution of which requires permission; interferes with the performance of control functions by the Central Bank; fails to submit information to the Central Bank on time, or submits incomplete or distorted information; violates legislation on bank secrecy, as well as legislative requirements on combating the legalization of income obtained from criminal activity, financing of terrorism, and financing of the proliferation of weapons of mass destruction; fails to meet requirements for ensuring information security; provides payment services not provided for in the documents submitted when obtaining a license; fails to inform the Central Bank about changes in activities after the license granting the right to carry out activities is submitted; fails to maintain accounting records and prepare financial reports; a payment institution that has concluded agency contracts with payment agents under a payment service contract fails to submit information to the Central Bank about these services, as well as information about its payment agents and payment sub-agents; violates other requirements of legislative acts on payments and payment systems.

37. If a decision is made to suspend the validity of a payment institution's license for up to ten business days, the Central Bank sends a demand to payment system operators to remove the payment institution from the system.

38. The Central Bank has the right to make a decision on revoking the licenses of payment system operators and payment institutions for regular or single gross violations of the requirements of the Law "On Payments and Payment Systems."

Three or more violations of the requirements of the Law "On Payments and Payment Systems" within one year are considered regular violations of the requirements of the Law "On Payments and Payment Systems."

The following are considered single gross violations of the requirements of the Law "On Payments and Payment Systems":

executing unauthorized payments, including payments for goods and services whose sale and provision are prohibited by legislation, or creating conditions for executing payments; committing the same violation again within five years after measures and sanctions have been applied by the Central Bank for violating legislative requirements on combating the legalization of income obtained from criminal activity, financing of terrorism, and financing of the proliferation of weapons of mass destruction; failure to fully restore (stop) interruptions (downtime) in their activities within 12 hours as a result of unforeseen events by payment system operators and payment institutions, or failure to ensure stable operation; failure to ensure the storage of information enabling the identification of the payer and (or) beneficiary for at least five years after the provision of payment services; violation of the following license requirements and conditions established in the regulation on the licensing procedure for the activities of payment system operators and payment institutions (registration number 3431, May 5, 2023):

1. requirements for founders (participants or shareholders) of payment system operators and payment institutions;
2. requirements for the charter capital (authorized capital) of payment system operators and payment institutions;
3. technical, security, and uninterrupted operation requirements for payment system operators and payment institutions.

Chapter 7. Final Provisions

39. Persons guilty of violating the requirements of this Regulation are liable in accordance with legislative acts.

(, May 16, 2023, No. 10/23/3434/0279)