Palestine Monetary Authority

PALESTINE MONETARY AUTHORITY

Instructions No. (17) for the Year 2024

Regarding the Licensing and Regulatory Framework for Digital Banks

Based on the provisions of Law-Decree No. (9) of 2010 concerning Banks, particularly Articles (3), (6), and (72) thereof,
In accordance with the powers delegated to us,
And in pursuit of the public interest,
We have issued the following Instructions:

Article (1)

Purpose and Scope of Application

1. The provisions of these Instructions aim to establish a general framework for licensing and regulating the operations of digital banks.
2. The provisions of these Instructions apply to all digital banks licensed by the Palestine Monetary Authority to conduct banking business in Palestine.

Article (2)

Licensing and Regulatory Framework for Digital Banks

The licensing and regulatory framework for digital banks attached hereto constitutes an integral part of these Instructions, and the digital bank must comply with the application of all its provisions.

Article (3)

Penalties

Anyone who violates the provisions of these Instructions shall be punished in accordance with the provisions of Law-Decree No. (9) of 2010 concerning Banks.

---

Article (4)

Cancellation of Conflicting Provisions

All provisions conflicting with these Instructions are hereby repealed.

Article (5)

Implementation and Enforcement

All competent authorities shall implement the provisions of these Instructions according to their respective jurisdictions, and they shall apply from the date of their issuance.

Issued in Ramallah, on: 01/12/2024 AD

Dr. Firas Malham
Governor

---

Licensing and Regulatory Framework for Digital Banks

Chapter One

Definitions and General Provisions

Article (1)

Definitions

The words and phrases appearing in this framework shall have the meanings specified below unless the context indicates otherwise:

• Person: Natural or legal person.
• Digital Bank: A bank whose business model is based on providing all banking services and products through digital channels or platforms using modern technological tools.
• Bank: Complex banking services and products through digital channels or platforms using modern technological tools.
• Digital Banking Operations: Complex banking services and products through digital channels or platforms using modern technological tools.
• Key Person: According to the definition in the prevailing Banks Law.
• Subsidiary Company: According to the definition in the prevailing Banks Law.
• Credit: According to the definition in the prevailing Banks Law.
• Credit Concentration: According to the definition in the prevailing Banks Law.
• Exposure: According to the definition in the prevailing Banks Law.
• Related Parties: According to the definition in the prevailing Banks Law.
• Capital Base: According to the definition in the prevailing Banks Law.
• Leverage Ratio (LR): The ratio established in the international standards issued by the Basel Committee on Banking Supervision (Basel III framework), which is a capital measure (numerator) divided by an exposure measure (denominator).
• Capital Measure: Tier 1 capital net as stated in Instructions No. (8) of 2018 regarding the implementation of regulatory capital requirements according to Basel (3) decisions and Instructions No. (9) of 2018 regarding the implementation of capital adequacy requirements for Islamic banks.
• Exposure Measure: Total on-balance sheet and off-balance sheet exposures, derivative positions, and securities financing operations according to the provisions of this framework.

---

Article (2)

Definitions

• Capital Adequacy Ratio: Capital base divided by risk-weighted assets.
• Risk-Weighted Assets: The financial size of assets for fraud according to their risk levels according to PMA instructions.
• Tier 2: Supplementary capital including risk reserves and general reserves for non-banking operations.
• Mandatory Reserve Ratio: The percentage determined by the PMA from customer deposits held at the bank.
• Mandatory Reserve: The reserve required from the bank in all currencies, calculated based on the product of the reserve ratio and the reserve base and outstanding balances.
• Reserve Retention Period: One calendar month starting from the 10th of the month following the reserve calculation period.
• Circulating Currencies: US Dollar, Jordanian Dinar, Israeli Shekel, and Euro.
• Other Currencies: Currencies other than circulating currencies, valued in US Dollars according to the monthly valuation rate sheet issued by the PMA at the end of each month.
• Cloud Computing: A remote service provided through the internet by a service provider to the user in a shared environment owned by the provider, enabling the user to benefit from various services anytime and anywhere, such as Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS).
• Software as a Service (SaaS): Renting software and applications from a service provider according to a pay-per-use model.
• Platform as a Service (PaaS): Providing an integrated environment to the user including an operating system, programming language execution environment, databases, and web servers, enabling the development, operation, and deployment of their applications on the cloud infrastructure and control of their settings.
• Infrastructure as a Service (IaaS): Providing the necessary hardware, servers, and technologies to enable the user to deploy, operate, and control their operating systems and applications.
• Site Leasing Service: Renting space from a service provider to host the bank's primary data center, disaster recovery site, or permanent availability data center, or part thereof, so that it operates without any intervention from the provider, with the provider supplying the space, cooling systems, power, physical protection, and necessary privacy.
• Service Provider: The entity that provides cloud computing or site leasing services.
• User: The bank that uses cloud computing or site leasing services.
• Primary Data Center: The space occupied by devices, equipment, and systems through which data is processed and stored.
• Permanent Availability Data Center: A backup data center containing a live copy of systems and data that is exactly identical.

---

Article (3)

Definitions

• Data Center High Availability: At any time it is present in the primary data center.
• Core Banking System: The system used to provide banking operations named by law, which include recording, transferring, and digitizing digital financial and banking information.
• Disaster Recovery Site (DRS): The backup site of the primary data center that the bank can use temporarily to restore its operations to normal in the event the primary data center suffers any failure or natural disaster that causes work stoppage.
• Critical Operations: Operations that cannot be completed if interrupted for a period determined based on business impact analysis.
• Recovery Time Objective (RTO): The acceptable time period to restore activities, operations, and services after an event occurs.
• Recovery Point Objective (RPO): The maximum amount of data loss allowed for the purpose of resuming critical operations when restoring the service.
• Critical Systems: Systems whose interruption or malfunction disrupts critical operations.
• Data: All information, documents, and records pertaining to a natural or legal person, regardless of form or source, including account balances, transactions, banking and financial operations, deposits, trusts, liabilities, and rented safe deposit boxes that are created or obtained by the bank.
• Data Integrity: Maintaining all data obtained by the bank, as well as financial operations and movements, and protecting them from unauthorized access and inspection.
• Data Privacy: Taking all necessary measures and procedures to ensure that no data or information is disclosed.
• Business Continuity Management: A comprehensive and ongoing business management process involving policies, procedures, and plans used to maintain operational continuity and flexibility and to restore them in a timely manner upon exposure to any emergency or threat, with the aim of reducing the level of operational, financial, and legal risks and damages.
• Business Continuity Plan: A detailed documented plan outlining the necessary procedures to guide the bank to ensure response, recovery, and restoration of systems and operations after an interruption.

---

Article (4)

Definitions

• Business Impact Analysis (BIA): Measuring and analyzing the consequences of interruption of activities and operations, with the aim of developing necessary recovery strategies by identifying priorities, resources, and requirements needed in the restoration process.
• Maximum Acceptable Outage (MAOs): The maximum time period for interruption of operations, services, or products that the bank can withstand.
• Event: The condition that can lead to a malfunction, emergency, crisis, or loss.
• Disaster Recovery Plan (DRP): An action plan that determines how to deal with a risk or threat when it occurs, and the procedures required from the bank and service providers to deal with those risks.
• Crisis Management Plan (CMP): An action plan that determines how to deal with a risk or threat when it occurs, and the procedures required from the bank and service providers to deal with those risks.

Article (5)

Purpose and Scope of Application

1. This framework aims to regulate the licensing and operation of digital banks in Palestine.
2. The provisions of this framework apply to all digital banks licensed by the Palestine Monetary Authority to conduct banking business in Palestine.

Article (6)

Use of the Term "Digital Bank"

3. It is prohibited for any person in Palestine to use the word "digital bank" or its synonyms or any other similar expression in any language in its documents, publications, trade name, name, or advertising, unless it holds a license issued by the PMA.
4. It is prohibited for any unlicensed person to present themselves to the public as licensed, directly or indirectly, or to advertise themselves as licensed by any means of various media.

---

Chapter Two

Licensing

Article (7)

Licensing

1. It is prohibited for any person to provide any digital banking services in Palestine without obtaining prior approval/license from the PMA.
2. It is prohibited for any company whose objectives include providing digital banking services in Palestine to register with the Companies Registrar unless it obtains prior approval from the PMA.
3. It is prohibited for the bank to commence any arrangements for establishing or preparing the headquarters without obtaining prior approval from the PMA, including leasing or owning real estate.
4. The trade name adopted by the bank must not be similar or confusingly similar to the name of another bank.
5. The existence of physical branches is prohibited, except for the headquarters, and the headquarters must be exclusively located in Palestine.
6. The PMA may take the necessary measures to verify the accuracy of the information contained in the license application and the applicant.
7. It is required for any person to provide any data deemed necessary or appropriate for considering the license application.
8. It is prohibited for the bank's headquarters to close or stop providing some or all of the services it provides and is permitted to provide without obtaining prior approval from the PMA.
9. It is prohibited to establish any subsidiary company for the bank without obtaining prior approval from the PMA.

Article (8)

Bank License Application

Applicants for the bank license must comply with the following:

1. Submit a license application to the PMA according to Annex No. (1).
2. Pay the bank licensing system fee.

---

Article (9)

Licensing

3. The proposed legal form of the bank must be a public joint-stock company.
4. The articles of association and proposed bylaws must comply with the requirements of the prevailing Banks Law and the regulations and instructions issued thereunder, and prior approval from the PMA must be obtained before commencing registration, and no amendments may be made to them without prior approval from the PMA.
5. The paid-up capital must not be less than twenty-five million US dollars, and the PMA may request the bank to increase it to match its business model, types of services and products, target categories, and associated risks.
6. The founders' contribution ratio must not be less than (20%) and not more than (50%), and the rest of the capital must be offered to the public for subscription.
7. The founders must meet the fitness and propriety criteria stipulated in Article (6) of this framework.
8. Evidence that none of the founders are listed in the prevailing blocking and sanctions lists in the State of Palestine.
9. Submit a strategy and business plans consistent with future years, provided they include the following:
   • a. A clarification of the bank's strategy for the next five years and mechanisms to achieve the specified objectives, as well as key opportunities and challenges.
   • b. The bank's arrangements regarding correspondent banks inside and outside Palestine.
   • c. The marketing plan, including digital communication marketing tools and channels for all target categories and their expected budget.
   • d. Financial literacy plans and programs in the digital field.
   • e. A plan for business management, crisis management, outsourcing plan, and planning of functions and activities planned to be outsourced to a third party, with an explanation of the reasons for external outsourcing, and the bank's policy and procedures to control risks that may arise from outsourcing.
   • f. Technological infrastructure requirements according to the provisions of paragraphs (1, 2, 3, 4) of Article (13) of this framework.
   • g. A clear framework for managing types of risks, internal control, and operations.
   • 10. A feasibility study demonstrating financial and economic viability, prepared by an independent external party, stating the purpose of establishment, nature of activities and services to be provided, target segment, market study regarding competitors, financing gaps, financing volume, profit margin, and expected non-performing financing ratio for the first five years, and projected financial position and monetary indicators.

---

Article (10)

Fitness and Propriety Criteria

1. Founders wishing to establish or contribute to the bank must provide the PMA with the following information and documents:
   • a. A recent certificate of non-conviction.
   • b. Clear ownership structure, which must be reasonable to the PMA – including related parties – in a manner that ensures identification of the beneficial owner and verification of the legitimacy of the source of funds intended to be used to establish or contribute to the bank or increase its capital.
   • c. Financial fitness of the founders with a future partner or shareholder.
   • d. Certificates of practical experience demonstrating proficiency in the necessary skills and professional competence to manage and ensure the success of the bank.
   • e. If one of the founders, partners, or shareholders is a legal person, the following must be provided to the PMA:
     1. A recent certificate proving registration with the competent authority and stating the purposes for which it was established, and a certified copy of the articles of association and internal regulations.
     2. Ownership structure, beneficial owner, and approved organizational structure.
     3. Audited financial statements for the last year, certified by a licensed legal auditor.
     4. A framework and rules for combating money laundering and terrorist financing.
2. The following conditions must be met by founders wishing to license the bank:
   • a. Their number must not be less than (5) members.
   • b. Those members must possess at least the experience and academic and practical qualifications in the field of financial technology and knowledge of digital banking operations, and the ability to understand the business environment, legal and regulatory environment, information security, cybersecurity, and risk-based customer due diligence.
   • c. None of them must be in violation for causing serious loss to a banking institution, specialized lending institution, or any other financial organization where they served as a key person or board member.
   • d. None of them must have been convicted by a final court judgment for crimes of theft, fraud, embezzlement, forgery, usury, bribery, credit misconduct, crimes compromising honor, trust, or public morals, or any money laundering or terrorist financing crimes.

---

Article (11)

Preliminary Approval

1. The PMA shall respond to applicants within (30) thirty days from the date of receiving the application regarding its completeness.
2. If incomplete, the response must specify the deficiencies that must be provided to the PMA to consider the application.
3. Deficiencies, if any, must be completed within a maximum period of (3) three months from the date of the response, otherwise the application shall be considered void.
4. The PMA shall issue a decision within the period stipulated by the provisions of the prevailing Banks Law, either granting preliminary approval or rejecting it, provided that the decision is reasoned in case of rejection.
5. In the event preliminary approval is granted, the PMA shall grant the applicant a time period to complete the requirements for obtaining final approval according to the provisions of the prevailing Banks Law.

Article (12)

Preparing the Headquarters

1. Prior approval from the PMA must be obtained for the intended headquarters for the bank's operations, and the PMA must be provided with the following:
   • a. Draft lease contract or title deed including (lessor/owner identity, headquarters area, lease value/property acquisition cost, generator location, emergency exit location, proposed headquarters address).
   • b. Approved detailed engineering plan.
   • c. Preliminary Civil Defense approval for the design.
2. Prepare the headquarters in accordance with the provisions of Annex No. (2).

Article (13)

Final Approval

For the purpose of obtaining final approval, the bank must comply with the following:

1. Actual payment of the paid-up capital.
2. Provide the PMA with a certified establishment report by an approved external auditor, indicating the percentage of deviation from estimated expenses according to estimated budgets.

---

Article (14)

Completing company registration procedures according to the law.

Article (15)

Contracting key personnel according to the provisions of prevailing instructions.

Article (16)

Providing the PMA with the organizational structure, job descriptions, financial and administrative authorities, work procedures, and approved policies.

Article (17)

Providing a core banking system according to the provisions of Article (12) of this framework.

Article (18)

Technological environment requirements according to the provisions of paragraph (5) of Article (13) of this framework.

Article (19)

Payment of the lump-sum fee according to the bank licensing fee system.

---

Chapter Three

Banking Obligations

Article (20)

Permitted Banking Operations

The bank may conduct the banking operations stipulated in the prevailing Banks Law, according to the provisions contained in this framework.

Article (21)

Deposits

The bank must comply with the following conditions when accepting deposits:

1. The cap on a single customer's deposits must not exceed (1%) of the bank's capital base.
2. Total customer deposits must not exceed (3) three times the equity.

Article (22)

Credit

The bank must comply with the following:

1. Adopt a credit policy.
2. Provide a methodology and tools for applying international financial reporting standards.
3. Provide an internal rating system for credit customers.
4. Issue a life insurance policy for the customer obtaining credit for a period extending up to 48 months with a coverage rate of 100% of the net exposure value, with the policy made payable to the bank.
5. The bank may, upon obtaining prior approval from the PMA:
   • a. Grant credit secured by shares of another bank.
   • b. Grant credit to non-residents.
   • c. Grant credit for the purpose of utilizing it outside Palestine.

Article (23)

Credit Concentration

The bank is prohibited from granting, renewing, or modifying credit to any person if it would result in the following:

1. Reaching an exposure or credit concentration volume of (5%) or more of the bank's capital base, without obtaining prior approval from the PMA.
2. Exceeding the total sum of exposures or credit concentrations by twice the bank's capital base.
3. Exceeding the sum of direct credit in a specific economic sector by (15%) of the total credit portfolio.
4. The PMA may require the bank to obtain adequate guarantees or increase them for any credit that constitutes an exposure or credit concentration.

Article (24)

Related Party Facilities

1. The total facilities granted to related parties must not exceed (10%) of the bank's capital base.
2. The bank must adopt a credit policy for granting banking facilities to related parties, provided that prior approval from the PMA is obtained in case of any exception to that policy.

Article (25)

Insurance Services

The bank may provide insurance services to its customers as an insurance agent, provided that prior approval is obtained from the PMA and competent authorities.

---

Article (26)

Dealing with Payment Instruments

The bank must comply with the following conditions when dealing with various payment instruments:

1. Connection to payment, settlement, and clearing systems approved by the PMA according to prevailing instructions.
2. Debit and credit payment cards must comply with global card standards (EMV).

Article (27)

Buying and Selling Foreign Currency

The bank must comply with the following:

1. Not exceed the open financial position for a single currency by (5%) of the bank's capital base, and by (20%) of the bank's capital base in total for the open financial position across all currencies.
2. Adopt internal work procedures for monitoring and controlling open financial positions.
3. The bank is prohibited from entering derivatives and margin markets, except for hedging operations against open foreign currency positions for the bank's account.

Article (28)

Investment

The bank must comply with the following:

1. Adopt an investment policy.
2. The bank is prohibited from holding any shares or stakes in a person under establishment or not listed on the Palestine Exchange, unless prior approval from the PMA is obtained.
3. The bank is prohibited from holding any stakes or shares in a person outside Palestine without obtaining prior approval from the PMA.
4. The bank, or any of its subsidiary or sister companies, or managed by it, is prohibited from holding any shares in another bank operating in Palestine without obtaining prior approval from the PMA.
5. The bank is prohibited, in the following cases, from individually or jointly with one or more persons holding stakes or shares in a specific person without obtaining prior approval from the PMA.

---

Article (29)

Exposure

1. If the value of shares or total exposure in a legal person exceeds the ratio stipulated in the prevailing Banks Law from the bank's capital base.
2. If the ownership percentage in the legal person subscribed by the bank exceeds the ratio stipulated in the prevailing Banks Law.
3. If the value of investment in shares from the nominal capital of the legal person exceeds the ratio stipulated in the prevailing Banks Law.
4. The bank is prohibited from increasing its total investments in equity from the bank's capital base beyond the ratio stipulated in the prevailing Banks Law.

Article (30)

Issuance of Debt Instruments

The bank or any of its subsidiary or sister companies is prohibited from issuing bonds or certificates before obtaining prior approval from the PMA.

Article (31)

Deployment of Funds

The bank must comply with the following:

1. Adopt a policy for the deployment of funds.
2. The bank may deploy funds with licensed banks operating in Palestine.
3. The bank may deploy funds outside Palestine provided it complies with the following:
   • a. The percentage of external deployments across all currencies must not exceed (10%) of total deposits.
   • b. The rating grade of the financial institution must not be less than (A).

Article (32)

Real Estate Ownership

The bank is prohibited from dealing in real estate, except for the following:

1. Real estate designated for managing its operations, provided that the value of this real estate does not exceed 20% of the bank's capital base.
2. Acquiring real estate to satisfy a debt, provided that:
   • a. The PMA is notified.
   • b. The real estate is sold within a maximum period of two years from the date of acquisition, and prior approval from the PMA is obtained before execution.
   • c. Exception to what was stated in paragraph (b/2) of this article, the PMA may request the bank to extend the approval for an additional (3) three years.
   • d. The acquisition period must not exceed a duration of (3) three years.

---

Chapter Four

Capital, Profits, and Reserves

Article (33)

Paid-up Capital

The bank must comply with the following:

1. The paid-up capital must not be less than twenty-five million US dollars, and the PMA may request the bank to increase it to match its business model, types of services and products, target categories, business plan, and associated risks.
2. Obtain prior approval from the PMA before increasing or decreasing the capital.

Article (34)

Capital Adequacy Ratio

The bank must comply with the following:

1. Maintain a capital adequacy ratio in no case less than 14%.
2. Provide the PMA with a capital adequacy ratio calculation model on a quarterly basis, and semi-annually certified by the external auditor.
3. The PMA may request the bank to raise the capital adequacy ratio above the minimum limit stated in this framework according to the size of its operations and risks.

Article (35)

Profit Distribution

The bank must obtain prior approval from the PMA before distributing any traditional or in-kind dividends to shareholders.
The general assembly of any bank is prohibited from deciding to distribute any dividends to shareholders below the percentage or amount specified.

Article (36)

Ownership Stakes

In addition to what is stipulated in the prevailing PMA instructions, the PMA may do the following:

1. Suspend, terminate, or cancel the subscription of any shareholders in the capital of digital banks if it deems that such subscription may affect the safety and stability of the banking system.
2. Suspend voting rights for ownership percentages exceeding the stipulated limits (according to law provisions), whether owned by the executive management or any beneficial shareholders, if this percentage is held without prior approval from the PMA.

Article (37)

Reserves

The bank must:

1. Deduct 10% of its annual net profit after tax, allocated to the legal reserve account until this reserve equals the bank's paid-up capital, and it is prohibited to dispose of it without obtaining prior approval from the PMA.
2. Maintain a risk reserve and any other reserves according to the prevailing PMA instructions.

Article (38)

Leverage Ratio

The bank must comply with the following:

1. The leverage ratio must not be less than 7% in all cases.