REPUBLIC OF ZAMBIA

GOVERNMENT GAZETTE

Published by Authority

Price: K15.00 net
Annual Subscription: —K400.00

No. 7178] Lusaka, Friday, 30th September, 2022 [Vol. LVIII, No. 105 GAZETTE NOTICE NO. 1476 OF 2022 [0562479

The Bank of Zambia Act

(Cap. 360 of the Laws of Zambia)
Banking and Financial Services Act

The Bank of Zambia Agent Banking Directives, 2022

PART I: PRELIMINARY

IN EXERCISE of the powers contained in section one hundred and sixty-seven of the Banking and Financial Services Act, 2017 and Section forty-three of the National Payment Systems Act, 2007 the following Directives are hereby made:

1. SHORT TITLE

These Directives may be cited as the Bank of Zambia Agent Banking Directives, 2022.

2. INTERPRETATIONS

In these Directives, unless the context otherwise requires:

“Agent” means any person or entity engaged by a regulated entity to provide specific payment or financial services on its behalf;
“Agent Banking” means the provision of a financial service or payment system business, including electronic money, through an agent;
“Bank” means the Bank of Zambia established under the Constitution (Amendment) Act, 2016 as read with the Bank of Zambia Act, Chapter 360 of the Laws of Zambia;
“Electronic money” or “e-money” means an electronic store of monetary value as represented by a claim on its issuer, that is:
- (a) Issued on receipt of funds in an amount no lesser in value than the value of the e-money issued;
- (b) Stored on an electronic device;
- (c) Accepted as a means of payment by persons other than the issuer; and
- (d) Redeemable upon demand for cash denominated in Zambian Kwacha;
“Financial service” shall have the meaning assigned to it under the Banking and Financial Services Act, 2017;
“Payment system business” shall have the meaning assigned to it under the National Payment Systems Act, 2007;
“Regulated entity” means a financial service provider regulated under the Banking and Financial Services Act, 2017 or a person designated to conduct payment system or payment systems business under the National Payment Systems Act, 2007; 5

3. APPLICATION

These Directives shall apply to all regulated entities.

PART II: OBJECTIVE OF THE DIRECTIVES

4. PURPOSE OF DIRECTIVES

The purpose of these directives is to:

(a) Provide a regulatory framework for Agent Banking for the promotion of financial inclusion;
(b) Promote cost effective delivery channels for payment system, electronic money or financial services;
(c) Provide for authorized activities of agents; and
(d) Provide a set of minimum standards for data and network security, consumer protection, and risk management in the conduct of agent banking.

PART III: APPLICATION AND AUTHORISATION

5. APPLICATION FOR ENGAGEMENT IN AGENT BANKING

(1) A Regulated entity that intends to engage in Agent Banking shall apply, in writing, to the Bank.

(2) An application to engage in Agent Banking shall be supported by the following:

(a) a Risk Assessment report on Agent Banking, including measures to be adopted to mitigate risks;
(b) internal Audit report regarding the adequacy of internal controls that will apply to Agent Banking;
(c) approved internal policies and procedures;
(d) anti-Money Laundering/Combating Financing of Terrorism (AML/CFT) policies and procedures;
(e) services to be provided;
(f) a copy of the draft standard agency contract, which at a minimum shall contain:
- (i) the functions or activities to be performed;
- (ii) the respective responsibilities of the parties to the contract;
- (iii) provisions dealing with consumer protection and dispute resolution;
- (iv) the commission, fee or service charge to be paid to the Agent; and
- (v) provisions for terminating the contract.
(g) strategy for Agent Banking which shall include:
- (i) feasibility study for Agent Banking covering a period of three years from the date of the application;
- (ii) geographical and economic service areas of the proposed agents;
- (iii);
- (iv) description of the agent management structure;
- (v) projections on agent network growth, volumes/transactions; and
- (vi) security measures to be adopted for agent premises.

(3) The Bank may determine other information requirements, as deemed fit, for engagement in Agent Banking activities; and

(4) The Bank shall notify the applicant of the outcome of the application within 30 days.

6. AUTHORISATION FOR AGENT BANKING

(1) Where authorisation for Agent Banking has been granted, a regulated entity shall not be required to seek approval for the engagement of an agent.

(2) Where a regulated entity seeks to engage in an Agent Banking activity that is materially different from that authorised by the Bank, further approval shall be required.

PART IV: AGENCY RELATIONSHIP, PERMISSIBLE ACTIVITIES, AND CONTRACT

7. ESTABLISHMENT OF AGENCY RELATIONSHIP

(1) A regulated entity may provide payment systems business or electronic money or financial services through an agent:

(a) Where a regulated entity seeks to provide a payment systems business, e-money or a financial service through an agent, it shall enter into a written contract with that agent; and
(b) A contract entered into between a regulated entity and an agent shall comply with these directives and other relevant laws.

(2) The provision of e-money or financial services should not be ultra vires any statute, memorandum and articles of association or other constitutive documents or objects of the agent.

(3) A regulated entity shall not appoint another regulated entity as an agent without the prior written approval of the Bank.

8. PERMISSIBLE ACTIVITIES OF AN AGENT

A regulated entity may engage an agent to provide any of the following services:

(a) Deposit and withdrawal;
(b) Cash-in/cash-out;
(c) Disbursement/repayment of loans;
(d) Bill payment;
(e) Transfer of funds;
(f) Balance enquiry;
(g) Generation or issuance of mini statements;
(h) Collection of:
- • account opening forms,
- • loan application forms, and
- • credit and debit card application forms;
(i) Any other activity as may be approved by the Bank.

9. PROHIBITED ACTIVITIES

An agent shall not:

(a) accept to carry out any electronic transaction when there is system failure;
(b) carry out a transaction when a transactional receipt or acknowledgement cannot be generated;
(c) charge any fees directly to the consumer apart from those charged by the regulated entity;
(d) offer any type of guarantee in favour of any consumer;
(e) continue with the Agent Banking where the agent is subject of a criminal investigation or disciplinary case involving fraud, dishonesty or any other financial impropriety;
(f) continue with the Agent Banking when it has a proven criminal record or disciplinary action involving fraud, dishonesty or any other financial impropriety;
(g) provide, render or hold itself out to be providing or rendering any payment or financial service which is not specifically permitted in the contract;
(h) open accounts, grant loans or carry out any customer due diligence for purposes of opening an account or perform an appraisal for the purpose of granting a credit facility;
(i) undertake cheque deposit and encashment of cheques;
(j) transact in foreign currency;
(k) be controlled or managed by an employee or associate of a regulated entity;
(l) use customer’s funds for purposes other than for the purpose requested by the customer;
(m) undertake e-money or financial services in its own right, except as approved by the Bank; and
(n) subcontract another person or entity to carry out the Agent Banking business on its behalf without authorisation of the regulated entity.

10. MANDATORY PROVISIONS TO BE INCLUDED IN THE CONTRACT

(1) A contract between a regulated entity and an agent shall at a minimum, contain the following:

(a) a clause stating that the regulated entity is liable for all actions or omissions of the agent to the extent that they relate to e-money or financial services or matters connected therewith;
(b) specific e-money or financial services to be rendered by the agent;
(c) the rights, expectations, responsibilities, and liabilities of parties to the contract;
(d) measures to mitigate the financial risks associated with Agent Banking services, such as limits, customer transactions, cash management, cash security, security of agent premises or insurance policies;
(e) anti-Money Laundering/Combating Financing of Terrorism (AML/CFT) requirements;
(f) provisions on recording and retention of supporting documents for all transactions in line with relevant laws;
(g) a statement that all information or data that the agent collects in relation to Agent Banking services, whether from the customers, the regulated entity or from other sources, is the property of the regulated entity;
(h) provision that only the regulated entity shall set/determine the Agent Banking transaction fees;
(i) business hours of the agent;
(j) a provision on customer data confidentiality and user information;
(k) a clause on technical specifications of the device(s) used in performing the Agent Banking transactions;
(l) remuneration for the agent;
(m) a provision specifying that the agent shall at all times ensure safe-keeping of all relevant records, data, documents or files or that such records, data, documents or that files are transferred to the regulated entity at regular pre-specified intervals for the regulated entity’s safe-keeping;
(n) a clause specifying that employees of the agent are not employees of the regulated entity;
(o) a provision for amending the terms of the contract and stipulations for default and termination of the contract; and
(p) a transitional clause on the rights and obligations of the regulated entity and agent upon termination or cessation of the agency contract.

(2) The regulated entity and the agent may provide for other terms as they may consider necessary for the better carrying out of the Agent Banking business.

11. TERMINATION OF AGENCY CONTRACT

(1) A regulated entity shall terminate an agency contract if an agent:

(a) is guilty of a criminal offence involving fraud, dishonesty or other financial impropriety;
(b) signed up to the Agent Banking business by providing incorrect material statements or any other misleading information;
(c) sustains a financial loss or damage to such a degree as to make it impossible for the agent to gain its financial soundness within three months from the date of the loss or damage;

(d) is dissolved, wound up or is declared bankrupt;
(e) is a corporate body and transfers, relocates or closes its place of Agent Banking business without prior written consent of the regulated entity;
(f) fails to hold or renew a valid business license;
(g) is suspected of involvement in money laundering/financing of terrorism activities;
(h) violates any provision of these Directives;
(i) has been sanctioned by a regulator or the regulated entity for a material breach or where the regulated entity ceases to hold a valid licence;
(j) advertises, operates or otherwise acts in a manner which leads a person to believe the agent can offer e-money or financial services which are not specifically permitted in the agency contract; or
(k) in case of a sole proprietor, dies or becomes mentally incapacitated.

(2) The Bank may direct the regulated entity to terminate an agency contract with an agent where it establishes any of the grounds in subsection (1).

PART V: ROLES AND RESPONSIBILITIES OF BOARD OF DIRECTORS AND SENIOR MANAGEMENT OF REGULATED ENTITIES

12. KEY ROLES AND RESPONSIBILITIES

(1) The ultimate responsibility for Agent Banking lies with the regulated entity that engages an agent to conduct Agent Banking on its behalf;

(2) The regulated entity shall ensure effective monitoring and oversight in the provision of Agent Banking; and

(3) The regulated entity shall provide an agent requisite stationery and equipment to facilitate Agent Banking, where necessary.

13. ROLE OF BOARD OF DIRECTORS

(1) The Board of Directors shall:

(a) be responsible for approving the Agent Banking strategies and relevant policies, procedures, and guidelines;
(b) ensure that risk management policies related to safeguarding the information, communication, and technology systems, and data are in place;

(2) The Board of Directors of a regulated entity shall be responsible for ensuring compliance with these Directives.

14. ROLE OF SENIOR MANAGEMENT

Senior Management shall:

(a) be responsible for developing and implementing Agent Banking strategies and for providing effective agent oversight;
(b) identify and contract credible agents;
(c) ensure that agent oversight includes review, approval, and implementation of key aspects of the regulated entity’s security control programs;
(d) ensure effective management of risks associated with reliance on third parties;
(e) ensure that risks associated with Agent Banking are properly identified, and managed;
(f) ensure that scope and coverage of the internal audit function is proportionate to the complexity and risks inherent in Agent Banking activities;
(g) constantly monitor Agent activities to ensure compliance with the regulatory requirements and the agency contract;
(h) ensure that risk management strategies and processes cover current and/or planned Agent Banking;
(i) integrate Agent Banking applications with the core operating systems as part of the overall risk management necessary for the Agent Banking activities;
(j) provide agents with sufficient training for them to adequately perform the operations and provide the services agreed upon, including relating to the proper identification of customers, customer service, confidentiality of the information, cash security, record keeping, and financial education; and
(k) develop and institute measures to ensure that agents have sufficient liquidity to meet Agent Banking transactions.

15. ROLE OF COMPLIANCE FUNCTION

(a) A regulated entity’s Compliance Function shall ensure that controls related to the provision of Agent Banking activities are incorporated in the compliance framework and that risks are properly assessed, identified, monitored, and reported; and
(b) A regulated entity shall ensure that its agents comply with the requirements of these directives.

16. ROLE OF INTERNAL AUDIT

A regulated entity’s internal audit function shall:

(1) be responsible for ensuring the regulated entity adheres to the policies, rules, directives, and operational guidelines applicable to it;

(2) provide an independent assessment of the adequacy of, and compliance with, the regulated entity’s established policies and procedures, rules, directives, and operational guidelines;

(3) incorporate risk-based review of critical Agent Banking processes to ensure that the policies, rules, directives, and the operational guidelines are followed and should escalate significant expectations to the Board;

(4) be responsible for assessing the adequacy of controls for outsourced activities through regular audits or facilitating independent audit reviews of the Agent Banking activities; and

(5) report all significant issues related to Agent Banking activities to the Board.

17. RISK MANAGEMENT

(1) A regulated entity shall develop a framework for assessing credit worthiness of agents and for setting operational and transactional limits in a proportionate manner.

(2) A regulated entity should ensure that cyber security risk is managed in a prudent manner to reflect the risks inherent in Agent Banking activities.

(3) Where applicable, a regulated entity shall develop a Business Continuity Plan to mitigate any significant disruption, discontinuity or gap in agent’s function.

(4) A regulated entity shall provide an agent with the necessary support for it to perform its functions, including appropriate Agent Banking products and operational manuals as well as accounting procedures and systems.

18. AGENT DUE DILIGENCE

(1) A regulated entity shall have in place clear, well documented agent due diligence policy and procedures.

(2) Procedures should contain, at a minimum, selection criteria for agents, initial due diligence and regular due diligence checks to be performed at specified intervals and a list of early warning signals and corrective actions to ensure proactive agent management.

(3) Agent due diligence should clearly specify roles and responsibilities of various functions in the regulated entity with regard to agent management.

(4) A regulated entity shall monitor the integrity and reputation of their agents.

(5) A regulated entity shall put in place a framework for monitoring AML/CFT for Agent Banking.

19. OPERATIONAL AND TRANSACTIONAL LIMITS

(1) A regulated entity shall set limits for the provision of activities agreed upon with the agent.

(2) Limits shall be:

(a) set for each agent and where applicable, for each type of transaction; and
(b) prudent and commensurate with the volume of transactions and the security at the agent’s location.

PART VI: ASSESSMENT, MONITORING, AND SUPERVISION OF AGENTS

20. ASSESSMENT CRITERIA OF AN AGENT

(1) Whenever a regulated entity enters into a contract with another entity as an agent, it shall satisfy itself as to the suitability of that entity and shall establish that the entity:

(a) has a well-established commercial activity which has been operational for at least six months immediately preceding the date of the suitability assessment;
(b) does not have any delinquent facilities with any financial service provider in Zambia and is tax compliant;
(c) possesses appropriate infrastructure and staff to provide Agent Banking services; and
(d) has fit and proper directors, shareholders or senior officers, as the case may be.

(2) Notwithstanding directive (1) above, a regulated entity shall apply proportionate assessment criteria in respect of agents who are natural persons.

21. INFORMATION TO BE SUBMITTED BY AGENTS TO REGULATED ENTITY

(1) A regulated entity shall obtain the following information prior to engaging an agent:

(a) the name of the entity proposed to be an agent;
(b) the certificate of incorporation, certificate of registration or National Registration card of an entity, whichever shall be applicable;
(c) a description of the commercial activity the entity has been carrying on for the last six months immediately preceding the date of the application;

(d) valid business licenses or permits for any lawful commercial activity carried on by the entity;
(e) physical location, website, postal address, email address and contact numbers of the entity and its working hours;
(f) evidence of sufficient funds to cover agent operations, including deposits and withdrawals by customers;

(2) A regulated entity shall secure the information provided under this Part and shall furnish this information to the Bank whenever required.

(3) A regulated entity shall take reasonable steps to obtain accurate information from an agent and its officers and shall not represent to the Bank that it was misled by an agent or its officers. A regulated entity which deliberately furnishes the Bank with fraudulent or materially false information under this Part shall be disqualified from conducting Agent Banking forthwith for a period to be determined by the Bank.

(4) A regulated entity shall obtain the following information in respect of a director, proprietor, shareholder or senior officer of an entity for purposes of suitability assessment:

(a) Reference letter from a credible source and clearance from the Police of not having a criminal record;
(b) Audited financial statements for the last one year, where applicable;
(c) A duly completed appraisal form for the individual;
(d) Tax clearance certificates;
(e) Credit report from the Credit Reference System; and
(f) Any other information as the regulated entity may request in relation to Agent Banking services.

(5) In assessing the suitability of a director, shareholder, proprietor and/or senior officer of an entity or a person, a regulated entity shall have regard where applicable, to among other things:

(a) Information from the Credit Reference System;
(b) Any criminal record, disciplinary action or bankruptcy;
(c) Reputation (based on references from people of good social standing hailing from the same locality as the person who has known the agent for at least three years);
(d) Business acumen or work experience;
(e) Ability to identify and manage risks;
(f) Verifiable sources of funds;
(g) Business track record of the entity in the last one year; and
(h) Any other information relevant to the assessment.

22. SUPERVISION OF AGENTS

(1) A regulated entity shall monitor and supervise agent activities to ensure that agents operate strictly within the requirements of the law, guidelines, and the contract.

(2) A regulated entity shall maintain a record of the number and volume of transactions carried out for each type of service by each agent and monitor effective compliance with limits.

(3) A regulated entity shall implement measures to manage operational risks related to Agent Banking activities.

(4) A regulated entity shall conduct periodic physical visits, by staff or authorised persons, to ensure that agents operate strictly within the requirements of the law, directives, and contract.

(5) Notwithstanding the responsibility imposed on a regulated entity to monitor and supervise their agents, the Bank may request any data or information and carry out such inspection of an agent as it deems necessary.

23. MAINTENANCE OF REGISTER AND PUBLICATION OF LIST OF AGENTS

(1) A regulated entity shall maintain a register of all its agents and may publish a list of agents in a conspicuous place within its branches or website or such other publications as it may deem appropriate.

PART VII: AGENT OPERATIONS

24. NON-EXCLUSIVITY

(1) A contract between a regulated entity and an agent shall not be exclusive.

(2) An agent may provide services to one or more regulated entities provided that the agent has separate Agent Banking contracts with each regulated entity.

(3) It shall be the responsibility of each regulated entity to ensure that an agent has capacity to competently and safely manage transactions for different regulated entities.

25. RELOCATION, TRANSFER, AND CLOSURE OF AGENT PREMISES

(1) An agent shall not relocate, transfer or close its Agent Banking premises without the prior written consent of the regulated entity.

(2) Notice of intention to relocate, transfer or close Agent Banking premises shall be served on the regulated entity at least seven days prior to the date of relocation, transfer or closure or such other time as may be agreed upon in the agency contract.

PART VIII: SETTLEMENT OF TRANSACTIONS AND THE TECHNOLOGY REQUIREMENTS

26. REAL TIME TRANSACTIONS

All transactions involving deposit, withdrawal, payment or transfer of cash from or to an account or e-wallet shall be in real time.

27. TECHNICAL REQUIREMENTS FOR OPERATING SYSTEMS OF THE AGENT

The technology implemented by a regulated entity for Agent Banking shall comply with industry standard technology in terms of hardware and software. A regulated entity shall ensure that the technology is capable of:

(i) transmitting information in a secure manner;
(ii) processing transactions in real time;
(iii) segregating the processing of transaction under different user profiles for administration, maintenance, and operation;
(iv) having the functionality for interoperability and should have the capability to process transactions with unique codes for different regulated entities;
(v) reversing incomplete transactions due to error, system failure, power outage or other defects;
(vi) processing or generating transactional documents or receipts;
(vii) automatically logging off an agent once the agent exhausts its daily cash limit or tries to perform an illegal or unauthorized transaction; and
(viii) preserving all settlement information details for reference for a minimum of ten years.

28. GENERATING AN AUDIT TRAIL

A regulated entity shall monitor the safety, security, and efficiency of the technology infrastructure in order to prevent any tampering or manipulation by any person.

29. SECURITY OF NETWORK AND DATA

A regulated entity shall put in place systems that specifically address:

(a) physical security of infrastructure;
(b) availability of services;
(c) data confidentiality and integrity;
(d) encryption of Personal Identification Number (PIN) and electronic transactions;
(e) customer accountability and non-repudiation of transactions; and
(f) error messaging and exception handling.

30. USE OF THIRD-PARTY TECHNOLOGY SERVICE PROVIDERS

(1) A regulated entity may enter into a written contract with a third-party technology service provider for the provision of the equipment or technology platform to be used for Agent Banking.

(2) A regulated entity shall remain liable for Agent Banking activities even where a third-party technology service provider is engaged.

PART IX: ANTI-MONEY LAUNDERING/COUNTERING FINANCE OF TERRORISM AND KNOW YOUR CUSTOMER

31. AML/CFT AND KYC REQUIREMENTS

(1) A regulated entity shall have appropriate policies to ensure compliance with AML/CFT requirements.

(2) A regulated entity shall adopt and implement a risk-based approach to AML/CFT requirements.

(3) A regulated entity shall train its agents on AML/CFT requirements.

(4) A regulated entity shall ensure that agents:

(a) identify customers using any of the following: acceptable identification documents (ID), personal identification numbers (PIN), passwords, automated teller machine cards (ATM), secret code or secret message while performing any transaction requiring identification;
(b) report all suspicious activities to the regulated entity within twenty-four hours; and
(c) operate or conduct Agent Banking transactions within the prescribed limits.

32. CUSTOMER DUE DILIGENCE

(1) A regulated entity shall implement an AML/CFT risk-based approach to Customer Due Diligence (CDD) for Agent Banking activities.

(2) An AML/CFT risk-based CDD for Agent Banking activities should include:

(a) tiered Know Your Customer (KYC) requirements;
(b) specification of the transaction limits, which are proportional to the risk profile of the customer;

(c) maximum balance limits on pre-paid debit card, credit card, and e-wallets;
(d) minimum technological security requirements; and
(e) customer authentication systems, such as, two factor authentication, including the use of biometrics, national identification document (ID), Personal Identification Number (PIN) or any other secret code, secret number or message during transactions.

(3) A regulated entity shall ensure that its transaction processing system:

(a) imposes limits to avoid breaches;
(b) sends alerts to the users when they are close to the limits;
(c) sends verification alerts for transactions; and
(d) identifies irregular or suspicious transactions and generates reports.

PART X: CONSUMER PROTECTION

33. CONSUMER PROTECTION MEASURES

(1) A regulated entity shall put in place systems which provide sufficient protection and confidence to users of Agent Banking by protecting consumers against fraud, breach of confidentiality, cybercrimes, and loss of service in order to foster confidence among consumers.

(2) A regulated entity shall ensure that agents disclose key terms and conditions before conducting a transaction.

34. MINIMUM REQUIREMENTS

At a minimum, the following requirements must be complied with at all times:

(a) An agent shall issue a system generated confirmation for all transactions;
(b) Where an agent acts as a receiver and deliverer of documents, an acknowledgement should be provided for all documents received or delivered by the agent to or from the customer;
(c) A regulated entity shall ensure that an agent:
- (i) is easily identified and shall make information about the services it provides through such agents available;
- (ii) displays the complaint redress mechanism in a conspicuous place;
- (iii) shall display clearly visible signs to the public indicating that it provides Agent Banking; and
- (iv) does not hold itself out to the public as a licensed entity;
(d) A regulated entity shall:
- (i) ensure that complaints are addressed within reasonable timelines as stipulated in the BFSA, NPSA or in the Bank of Zambia Customer Complaints Handling and Resolution Directives or its equivalent; and
- (ii) put in place secure systems in order to ensure data confidentiality.

35. DISCLOSURES

A regulated entity shall ensure that an agent discloses the following to consumers:

(a) Name of the regulated entity it represents;
(b) A list of Agent Banking services offered;
(c) That no transactions shall be carried out if the electronic system is down;
(d) That transactions shall be undertaken subject to availability of liquidity;
(e) List of charges or fees payable for each service;
(f) A unique agent identification number; and
(g) A dedicated call line that is reliable through which the regulated entity can be contacted.

36. DISPLAY OF INFORMATION BY AN AGENT

A regulated entity shall ensure that an agent displays the disclosures in (35) above in a conspicuous place on agent premises.

37. PUBLICITY AND CO-BRANDING

(1) A regulated entity may choose to brand their agent network under any brand name.

(2) However, use of protected words like bank, financial institution, financial business or their derivatives or any other word suggesting that an agent is itself a financial service provider is prohibited.

38. FINANCIAL EDUCATION

A regulated entity shall provide appropriate ongoing financial education to agents, consumers, and the public.

Bank of Zambia Agent Banking Directives 2022