ATM Instructions No. (2018/6)

[Central Bank of Jordan Logo]

Number: 1/26/5578
Date: 27 Rajab, 1439
Corresponding to: April 11, 2018

ATM Instructions
No. (2018/6)

Issued pursuant to the provisions of Article (4/b/5) of Central Bank Law No. (23) of 1971 and its amendments, and paragraphs (3) and (4) of Article (37) of Banking Law No. (28) of 2000, and Article (55) of the Electronic Payment and Money Transfer System No. (111) of 2017.

Article (1):
These Instructions shall be known as the "ATM Instructions" and shall be effective from the date of their approval.

Article (2): a) The words and phrases listed below shall carry the meanings assigned to them wherever they appear in these Instructions, unless the context indicates otherwise.

• Payment Service Provider: A bank, Islamic bank, or company licensed by the Central Bank to conduct the activity of managing electronic cash deposits and withdrawals through ATMs.
• ATM: Electromechanical machines that allow users to conduct financial and/or non-financial transactions on their accounts using payment instruments or any other means.
• User: Any person who conducts financial or non-financial transactions through an ATM, whether they are customers or non-customers of the Payment Service Provider.
• Payment Instrument Issuer: The entity licensed by the Central Bank to conduct the activity of issuing and managing payment instruments.
• Customer: A natural or legal person for whom the Payment Instrument Issuer issues any payment instruments.
• System Manager: The company licensed by the Central Bank to conduct the activity of managing and operating ATM payment clearing systems.

b) The definitions contained in the Banking Law and the effective Electronic Payment and Money Transfer System shall apply wherever referenced in these Instructions, unless the context indicates otherwise.

General Scope

Article (3):
The provisions of these Instructions shall apply to the following entities:
a) Companies operating in the Kingdom, including branches of foreign companies, licensed by the Central Bank to conduct the activity of managing electronic cash deposits and withdrawals and/or issuing and managing payment instruments and/or managing and operating ATM clearing systems. b) Banks operating in the Kingdom, insofar as they do not conflict with the Banking Law and the regulations and instructions issued thereunder.

Conditions for Installing ATMs

Article (4): a) The Payment Service Provider must observe the following procedures and controls when installing an ATM:

1. Install the ATM in a manner that prevents its removal if the ATM is located inside and/or outside buildings. This exception does not apply to ATMs located in public places, such as airports, shops, and commercial complexes, by way of example and not limitation.
2. Conceal all electrical connections, communication cables, and ports specific to ATMs, ensuring they are protected in a secure manner that is difficult to access except by authorized personnel, regardless of their location, especially those in public places like airports, shops, and commercial complexes.
3. Provide two network lines for the ATM from different providers.
4. Avoid installing and/or placing ATMs in unprotected areas.
5. When installing ATMs in public places, all necessary security standards at the ATM site must be observed.
6. Install a satellite tracking chip inside ATMs installed in public places and outside branch buildings, enabling the device's location to be determined in case of removal. The tracker must be installed in a secure location inside the ATM that is difficult to access.
7. Ensure the presence of surveillance cameras for the ATM that capture both the ATM body and the user, and the license plate of the vehicle if the ATM provides cash withdrawal services to users from inside the vehicle without exposing the ATM keypad.
8. Store images captured by ATM surveillance cameras for an appropriate period, not less than one year.
9. The user has the right to view images captured by surveillance cameras if necessary, according to the policies followed by the Payment Service Provider.
10. ATMs must be equipped with an alarm system directly connected to the central alarm system of the Payment Service Provider and the persons responsible for these devices, as well as a detector for vibrations, abnormal frequencies, and heat. The detector's function is to detect any attempts to tamper with ATMs, including theft and emergencies such as fire. The Payment Service Provider's communication network must be linked with the Police operations room network or alarm stations licensed by security authorities.
11. Provide a keypad cover (Pin Shield) that prevents the PIN from being visible when entered by the user. The cover must be of a type that provides privacy and protection, covering the sides and top of the keypad.

b) The Payment Service Provider is committed to supplying and installing ATMs that comply with all security and protection standards issued by the Payment Card Industry Security Standards Council (PCI-SSC) regarding software and hardware, and in accordance with the conditions and requirements set forth in these Instructions as a minimum.

Technical and Security Conditions Required for ATMs

Article (5):
The Payment Service Provider must comply with the following security and supervisory controls as a minimum:
a) Laminating the card reader to protect it from any external intrusion. b) Defining the permissions of authorized personnel to access ATMs and their supporting systems according to procedures specified by the Payment Service Provider, and reviewing and updating those permissions continuously. c) No part of the ATM may be opened except under dual supervision by persons authorized by the Payment Service Provider. d) Ensuring the security of the cash dispensing part of the ATM to prevent the insertion of any foreign objects for purposes of theft or fraud. e) Documenting all developments and changes made to the hardware and software components of ATMs to prevent any unauthorized activities on these devices. f) It is necessary to stop the operation of the ATM if any skimming device connected to the ATM is discovered or if tampering is detected, until the problem is resolved. g) Logging events occurring on the ATM operating system through event logs, monitoring them, and preventing unauthorized persons from modifying or deleting these logs, and documenting this. h) When disposing of any ATM, sensitive information and components must be deleted in a manner that cannot be retrieved later. Devices destined for destruction must be stored in a secure place designated for this purpose until destruction. i) Meeting the specifications of ATM cash dispensers so that they comply at a minimum with the (CEN1) standard. The Payment Service Provider is committed to aligning its status to comply with this clause within a period of three years from the date of issuance of these Instructions.

Article (6):
The Payment Service Provider must comply with the following as a minimum regarding the protection of ATM networks:
a) The Payment Service Provider's ATM network must be protected by isolating (segmenting) it from the network of its own systems. b) The communication mechanism used inside the ATM, between the ATM network, the Payment Service Provider's systems, and the System Manager must be secure and encrypted using highly reliable algorithms that are not easily decipherable.

Article (7):
The Payment Service Provider must comply with the following as a minimum regarding the protection of payment instrument data and data used to conduct transactions on the ATM:
a) The card reader in the ATM must contain appropriate tools to prevent copying card data, such as using an Anti-Skimming Card Reader which uses a Jamming Signal/Noise Disruption mechanism, and the software installed for this purpose must be updated continuously. b) Data entered through the ATM keypad and transmitted inside the ATM, between ATMs, and between ATMs and the Payment Service Provider's systems must be encrypted using highly reliable algorithms that are not easily decipherable. c) The hard drive in ATMs must be fully encrypted using highly reliable algorithms that are not easily decipherable, ensuring the integrity of stored data and programs from any intrusion and protecting the ATM system from any malicious software it may be exposed to. d) The transaction authorization number executed through ATMs must be printed on the receipts issued from them. e) Card data, including the card number, expiration date, and cardholder name, must not be printed on receipts issued from ATMs.

Article (8):
The Payment Service Provider must comply with the following as a minimum regarding the protection of systems and software installed on the ATM:
a) Ensure that antivirus (Anti-Virus) and anti-spyware (Anti-Spyware) programs and any other protective applications suitable for the purpose are loaded on ATMs and updated continuously. b) Ensure that operating systems and software installed on ATMs are updated continuously. c) Under no circumstances should software and applications be updated or installed on ATMs remotely via the Remote Desktop Protocol (RDP). d) Configure the Basic Input Output System (BIOS) software installed on the ATM so that the ATM boots only from the hard drive, prevent any automatic updates to the BIOS program, and require a password to access the settings of this program. e) Apply a strict password policy for accessing the BIOS program and for user accounts of the ATM operating systems, preventing others from breaking them. This includes specifying, for example, password length, nature of symbols used, continuous updates, and non-reuse. f) Delete any unnecessary and unused applications and software on the ATM to reduce the likelihood of any intrusion or cyber attack on those applications and software. g) Disable the Auto-play feature on the ATM operating system, which automatically runs programs installed on any storage media such as CD, DVD, or USB flash drives when inserted into the ATM, to prevent the automatic execution of malicious programs through them. h) Use a mechanism to execute only defined commands specific to the ATM operating systems (White listing) and update those commands continuously to protect against the execution of commands belonging to malicious software. Additionally, provide a feature to send automatic alerts to the system if the program stops or objects to executing an undefined command.

Management and Monitoring of ATMs

Article (9):
The Payment Service Provider must commit to providing a specialized unit within its organization to manage and monitor all ATMs, with duties including at a minimum:
a) Coordinating with all branches of the Payment Service Provider, its organizational units, and any other relevant parties regarding the management and monitoring of ATMs and their operations. b) Ensuring the operation of ATMs and their supporting systems 24/7 and verifying their continuous operation, except in cases where ATMs suffer from technical failures or network communication outages that cannot be resolved instantly. c) Working to address the causes of service interruptions to ATMs, excluding scheduled maintenance, refueling, or any force majeure or technical faults that could not be resolved by the Payment Service Provider or the supplier within 48 hours at the latest from the moment the service interruption was discovered. d) Inspecting ATMs and their supporting components, such as network devices and communication cables, at least every 3 days, and ensuring the absence of any foreign or suspicious devices or equipment on the ATM, such as card skimmers, card information readers, PIN detection cameras, or attempts at illegal tampering. e) Conducting penetration tests to examine security vulnerabilities in ATMs and the Payment Service Provider's ATM network by a specialized entity at least once a year and whenever major modifications are made.

User Protection

Article (10):
The Payment Instrument Issuer must commit to the following as a minimum:
a) Informing the customer immediately of financial transactions executed on their accounts using ATMs, using an effective and clear communication method in both Arabic and English, such as Short Message Service (SMS), which must include at least the location, date, time of execution, value, and currency type of the transaction. b) Immediately suspending payment instruments in the event the customer reports the loss or compromise of their payment instrument. c) Ejecting the user's card and alerting them to take it more than once for a certain period. If the user does not take the card, the ATM will withdraw and confiscate the card as a precautionary security measure. d) Rejecting the card used on the ATM if the card is expired, reported lost, frozen, canceled, does not meet security specifications, or for any other reason, and informing the user via the ATM screen of the reason for rejection. e) Ensuring the registration and updating of the customer's mobile phone number to facilitate immediate notification of any financial transaction executed on the ATM.

Article (11):
The Payment Instrument Issuer and the Payment Service Provider must continuously educate users/customers on best practices for using ATMs to avoid falling victim to fraud and to maintain the confidentiality of payment instrument data and related secret codes. This education must include at a minimum:
a) Conducting transactions on ATMs with complete privacy. b) Not lending payment instruments to anyone. c) Not writing the PIN on the payment instrument used on the ATM. d) Not disclosing the PIN to anyone. e) Not allowing anyone to see the PIN when entering it on the ATM. f) Ensuring receipt of the payment instrument from the ATM after completing any transaction on it. g) Informing the Payment Instrument Issuer if the customer loses their payment instrument or discovers that financial transactions on their accounts have been executed by someone else. h) The user has the right to dispute transactions executed on their accounts through the ATM within a period of (60) days from the date of notification of the transaction details by the Payment Instrument Issuer or its delegate.

Obligations of the System Manager

Article (12):
The System Manager must commit to linking the ATM payment clearing system with the Real-Time Gross Settlement - Jordan (RTGS-JO) system at the Central Bank to settle the net financial positions of all payment transactions executed on ATMs locally through bank accounts. The System Manager must also provide specific guarantees within the deadlines, arrangements, and procedures specified and announced by the Central Bank at a later date.

General Provisions

Article (13): a) The Payment Service Provider is committed to notifying the Central Bank of any instances of intrusion or fraud that may occur on ATMs within 72 hours at the latest from the moment the incident is discovered. b) The Payment Service Provider must take the following actions immediately upon discovering an intrusion on ATMs:

1. Suspend all payment instruments issued by it and used on the ATM where the intrusion or fraud occurred, and during the estimated period of the intrusion.
2. Contact the System Manager to inform it of intrusion or fraud incidents that occurred on the ATMs so that it can contact the issuers of payment instruments used on those devices to suspend them.
   c) Payment Service Providers and Payment Instrument Issuers are committed to following all circulars issued by the Central Bank regarding the latest fraud incidents that have occurred on ATMs and the procedures they must follow to avoid such incidents.

Article (14):
Payment Service Providers are committed to providing the Central Bank with statistics showing the number of ATMs, their locations, the services they provide, the number and value of transactions executed through them, and fraud incidents they have been exposed to, according to the dedicated forms and according to the frequency determined by the Central Bank as appropriate.

Article (15):
Payment Service Providers are committed to aligning the status of their ATMs within one year from the date of issuance of these Instructions, taking into account Article (5/i) of these Instructions.

Article (16):
Payment Service Providers, Payment Instrument Issuers, and System Managers are committed to applying all security and protection standards issued by the Payment Card Industry Security Standards Council (PCI-SSC).

Article (17):
In the event of violation of the provisions of these Central Bank Instructions, the penalties stipulated in the legislation regulating the entities subject to the provisions of these Instructions shall be applied according to the circumstances.

[Signature]
Governor
Dr. Ziad Friez