Regulation regarding on-site inspections for non-bank payment service providers and the criteria for applying remedies and sanctions, approved by the Decision of the Executive Board of the NBM, No. 326 of December 11, 2019

Note: The translation is unofficial, for information purpose only
Official Monitor of the Republic of Moldova No. 1-2, of 03 January 2020, Article 8

REGISTERED
at Ministry of Justice
of the Republic of Moldova
No.1510 of 19 December 2019
APPROVED
by the Decision of the Executive Board
of the National Bank of Moldova
no. 326 of 27 11 December 2019
Effective Date: 03 February 2020

REGULATION

regarding on-site inspections for non-bank payment service providers and the criteria for applying remedies and sanctions

Section I

GENERAL PROVISIONS

1. The regulation regarding on-site inspections for non-bank payment service providers and the criteria for applying remedies and sanctions (hereinafter - Regulation) establishes the rules for organizing, carrying out on-site inspections for non-bank payment service providers (payment institutions, electronic money institutions, postal operators as payment service providers) and criteria for applying remedies and sanctions to non-bank payment service providers.

2. The definitions and terms used in this Regulation shall have the meaning established by the Law No 114/2012 on payment services and electronic money (hereinafter - Law No 114/2012) and the Regulation on the activity of non-bank payment service providers, approved by the Decision No 217/2019 of the Executive Board of the National Bank of Moldova.

3. On-site inspections for non-bank payment service providers (hereinafter - non-bank providers) shall be carried out by the National Bank of Moldova (hereinafter - NBM) for the purpose of exercising the prudential supervision duty in compliance with the provisions of Law No 114/2012, Law No 548/1995 on the National Bank of Moldova, from this Regulation.

4. On-site inspections for non-bank providers aim to verify the compliance with the provisions of Law No 114/2012 and the regulatory acts issued for the application of the Law, including verification of organizational structures, procedures and mechanisms, evaluation of efficiency of the procedures for identifying, managing, monitoring and reporting the risks or potential risks of the non-bank provider, the suitability of the internal control mechanisms

(including administrative and accounting procedures), the evaluation of the actions undertaken by the management of the non-bank providers, in order to efficiently manage the identified risks, the examination of the information submitted by the non-bank providers to the NBM. The on-site inspections shall determine the general condition of the non-bank provider, the causes and factors affecting the safety and stability of its activity, and the payment systems in which it participates.

5. The main characteristics of on-site inspections for the non-bank provider are the following: 1) the purpose and the method of carrying out the inspections shall be proportionate, adequate and adapted to the risks to which the non-bank providers are exposed; 2) is based on risk assessment, with priority on the higher risk; 3) the perspective analysis of the current or historical indicators of the activity of the non-bank providers to predict potential negative impacts on the activity of the non-bank providers; 4) it is oriented towards the actions and/or remedies to be taken by the non-bank provider.

Section II

TYPES AND FREQUENCY OF ON-SITE INSPECTIONS

6. On-site inspections of non-bank providers may be of the following types:

1. depending on the purpose of inspection:
   a) complex inspections - the overall activity performed by the non-bank providers is subject to verification;
   b) thematic inspections - a specific domain or certain fields of activity of the non-bank providers are subject to verification;
2. depending on the mode of deployment:
   a) planned inspections - inspections performed based on annual inspection plan approved by the NBM;
   b) unannounced inspections - inspections that are not provided for in the annual plan of the NBM of inspection and which, as a rule, are initiated in response to an event or incident that can have a significant impact on the activity of non-bank providers or payment service users.

7. Thematic inspections have the aim to verify the removal of violations for which remedies have been prescribed and sanctions applied by the NBM through the Decision of the Executive Board of the NBM, following the on-site or off-site inspections carried out previously at the non-bank provider.

8. The annual inspection plan shall be elaborated based on the risk assessment of the activity of the non-bank providers, including: the violations identified in the previous inspections, the measures taken to stop or eliminate the previously identified violations, the results of the supervision, the notifications/petitions submitted to the NBM.

9. When carrying out the complex inspections for non-bank providers, the period subject to inspection shall be established from the last date covered by the previous inspection to the last date of the month preceding the date of the inspection arrangement.

Section III

DEVELOPMENT OF THE INSPECTION ACTIVITY FOR NON-BANK PROVIDERS

10. On-site inspections shall be carried out by the staff of the NBM or the accounting experts, the authorized accountants and other qualified specialists trained for this purpose by the NBM (hereinafter - inspectors).

11. The NBM shall notify non-bank providers about the decision to carry out the inspection on-site at least 5 business days before the start of inspection. The letter shall also stipulate the list of data required to be provided by the non-bank provider. During the inspection, the NBM may add in the list any data required to be submitted by the non-bank provider. The completed list shall be presented to the non-bank provider by the head of the inspection team.

12. The decision of the NBM to carry out on-site inspections shall contain at least the following information: the number and date of the decision; the name and address of the non-bank provider subject to inspection; the type of inspection; the period of the activity subject to inspection (except for the control of elimination of identified violations); start date of inspection; name and first name of the inspectors authorized to carry out the inspection, the head of the inspection team; title, surname, name, and signature of the person who issued the decision.

13. The decision regarding the on-site inspection shall be issued in two copies. A copy of the decision shall remain at the NBM, and the second copy shall be handed over to the provider's management on the day of the start of the planned inspection.

14. In the case of the unannounced inspection, the decision to carry out the on-site inspection and the list of information required to be submitted by the non-bank provider shall be handed over to the provider's management on the day of the inspection start.

15. In case of necessity to change the members of the inspection team, or to extend the inspection term, an addendum to the decision of carrying out on-site inspection shall be issued (in two copies) and the non-bank provider under inspection shall be notified without delay.

16. The on-site inspection shall start on the date indicated in the decision of the NBM to carry out inspections.

17. On the starting date of the on-site inspection, a meeting between inspectors and the management of the non-bank provider shall be held. At this meeting, the head of the inspection team shall introduce the team members, shall explain the objectives, the fields of examination, the directions, the expected term for carrying out the inspection, the period of the activity under inspection. The management of the non-bank provider is obliged to inform the inspectors about the most important events of its activity that took place during the period since the last inspection, including: introduction of new payment products and services; changes in the organizational structure, strategy, internal governance policy, processes of activity in the fields and directions targeted by the inspection. If the on-site inspection is performed for the first time at the non-bank provider, the management of the non-bank provider is obliged to inform at least about the payment services provided, the organizational structure, strategy, internal governance policy.

18. During the on-site inspection on the activity of providing payment services and issuing electronic money, the management of the non-bank provider and its staff are obliged to provide assistance to the inspection, including:
    a) to determine the contact persons of the non-bank provider in charge with the interaction of the inspection team in each of the control areas, to ensure that the inspectors' requests are handled correctly and in a timely manner;
    b) to ensure the access of inspectors in the premises and the service rooms of the non-bank provider during the working time;
    c) to provide a secure office to the inspection team, that is separate from the work places of the personnel of the non-bank provider, unless there are operational constraints in this respect and if the exercise of the inspection is not affected, including the application of paragraph 17, paragraph 18 letter b) and paragraph 19 letter a) -b), e) -f) of the Regulation hereto;

d) to provide inspectors with the information and documents requested, as the case may be, in electronic form, on paper, make photocopies of documents or give inspectors the opportunity to make these photocopies on their own and confirm these copies (by signature);
e) to give inspectors the possibility to use the data from the computer systems related to the payment services and to issue the electronic money of the non-bank provider, giving them access to see all the computer systems, databases, IT tools, electronic files and data, used for this purpose, for the period of the activity subject to inspection;
f) to solve the requests for information of the inspection team without delay and cooperate in good faith. When establishing the deadline for submitting information, the inspectors shall consider the degree of complexity of the requested data and the volume of work needed in this regard.

19. NBM inspectors carrying out the inspection are entitled:
    a) to have unrestricted physical access to the premises of the non-bank provider, to its branches, if necessary, accompanied by employees of the non-bank provider;
    b) to request and obtain all the information and documents necessary to carry out the inspection at the provider's premises (in electronic format, on paper, originals or copies, excerpts - confirmed by signature), including the documents of incorporation, regulations and other internal acts, reports, internal documents drawn up following the operations performed, accounting records, external and internal business documents (contracts, certificates, minutes, requests, information notes), including regarding shareholders (associates), beneficial owners, clients, counterparties of the non-bank provider;
    c) to request and receive verbal and written explanations from the members of the management bodies and the staff of the non-bank provider, in order to collect the information necessary for the inspection;
    d) to request the presentation of photocopies of documents and information, and take out them from the premises of the non-bank provider and attach them to the inspection materials, in electronic format and / or on paper;
    e) to use technical means belonging to the NBM or provided by the non-bank provider, including computers, other devices, electronic information carriers, printing equipment, scanners, telephones, to enter the rooms of the provider and remove the technical means that belong to the NBM;
    f) to have access, to get informed about the resources of the information systems, the electronic databases and the technical means used by the non-bank provider for payment services/issue of electronic currency and request demonstrations of the operation of these systems.

20. The non-bank provider has the following rights:
    a) be informed about the start of inspection according to paragraph 11 of this Regulation;
    b) to provide explanations and comments during the inspection, about verification;
    c) to be informed about the results of the on-site inspection, according to paragraphs 39-40 of this Regulation.

21. The employees of the non-bank provider shall not have the right to carry out the personal inspection of inspectors, of the technical means, including telephones, electronic holders of information, held in their possession, to take these means or to prevent the inspectors from being able to use these means when carrying out the inspection.

22. The documents and materials provided on paper copy and requested by inspectors shall be presented in the premises assigned to the NBM inspectors, in the manner and within the

terms established by the head of the inspection team. At the end of the inspectors' work day, the room assigned to the inspectors shall be locked and, at the request of the head of the inspection team, it shall be sealed and handed over to the security of the non-bank provider.

23. During the absence of inspectors in the assigned premises, the non-bank provider is responsible for ensuring the integrity of the documents and information presented to the inspectors by the non-bank provider.

24. Without prejudice to paragraph 23, inspectors have the obligation to ensure the integrity and the return at the end of the inspection of paper documents (originals) obtained from the non-bank provider.

25. The management of the non-bank provider shall be held responsible for the failure to conduct the inspection in due time or for the non-compliance with the legal requirements of the inspectors during the inspection.

26. During the inspection, several meetings can be organized by inspectors, the management of the provider and/or the employees of the structural subdivisions of the non-bank provider.

27. In case of obstruction of inspection by the provider's management or by an employee of the non-bank provider, the head of the inspection team shall draw up (in two copies) a note regarding the obstruction of inspection. The note shall be signed by the head of inspection team and at least one inspector.

28. In the sense of Article 97 letter c) of the Law No 114/2012, obstruction of inspection refers to the following: the refusal of the management of the non-bank provider to receive and/or the refusal to confirm the fact of receiving the decision (its addendum) regarding the inspection; refusal to perform, failure to perform or unjustified delayed performance of obligations by the non-bank provider to assist in conducting the control and carry out other actions that impede the exercise of rights by inspectors, provided by paragraph 19 of the Regulation hereto.

29. The note on the obstruction of inspection is handed over by the head of the inspection team, not later than one working day from the date of its elaboration, to the management of the non-bank provider or the person in charge with the mails of the provider. The fact of receiving the document regarding the obstruction of inspection shall be confirmed on both copies of the note by the signature of the person who received it, by indicating the surname, name and title, date and time of receipt. The person in charge with the mail of the non-bank provider who received the note shall send it to the management of the provider, no later than the next business day.

30. If the management of the non-bank provider or the person in charge with the mails of the provider refuses to receive the note on the obstruction of inspection being or to sign it, the head of the inspection team shall make a remark in the document, indicating the surname, name and title of the person who refused to receive the document, date and time of refusal.

31. A copy of the note on the obstruction of inspection shall be submitted by the head of the inspection team to the NBM.

32. Not later than 3 business days from the receipt of the note on the obstruction of inspection, the NBM shall decide on the continuation of inspection, the suspension or termination of inspection and/or the application to the non-bank provider, the management of the non-bank provider, of measures/ sanctions for obstructing the on-site inspection, in accordance with the provisions of the law.

33. At the end of the on-site inspection, a final summary meeting shall be organized at the premises of the non-bank provider subject to inspection, between inspectors and the management of the non-bank provider, where the preliminary findings of the inspection team shall be discussed.

Section IV

PREPARATION OF THE STATEMENT (REPORT) ON THE RESULTS OF THE ON-SITE INSPECTION

34. Based on the results of the inspection, shall be drawn up, in 2 copies, a Statement (report) regarding the results of the on-site inspection performed at the non-bank provider.

35. The (preliminary/final) statement shall include at least the following: the date and place it was drawn up; date and number of the decision under which the inspection was carried out; name and address of the non-bank provider subject to inspection; period (date) of the inspection; period of activity subject to inspection; information on the results of the inspection, including the identified violations and their peculiarities; surname, name and title of the head of the executive body/ representative of the non-bank provider subject to the inspection that received the statement (in case of its handing over), date of its receipt and its signature or the refusal to receive/sign the statement; surname, name and signatures of the NBM inspectors.

36. The part (preliminary/final) of the statement regarding the results of the inspection, shall contain at least the documents and materials examined within the inspection; the aspects subject to inspection, the general conclusions (the list of violations, the generated risks), the identified violations of the regulatory acts regarding the activity of the non-bank provider, including regarding the value of capital, transparency of conditions and information requirements, funds safeguarding, risk management in the internal control systems, currency operations, information security management system.

37. The presentation of information in the statement (preliminary/final) regarding the results of the on-site inspection must respect the following principles:
    a) objectivity and accuracy - the assertions, assessments, arguments and conclusions of inspectors must be supported by analyses, facts, data and figures, including confirming documents;
    b) completeness - the act must be complete, encompassing all areas, directions of activity of the non-bank provider (the structural subdivision of the lender) that have been inspected;
    c) clarity and coherence - the information must be displayed in a legible, logical and precise manner, in order to avoid excessive mistakes and repetitions.

38. The head of the inspection team or other inspector shall hand over /send by registered letter to the administrator or the authorized person of the non-bank provider subject to inspection for signing the preliminary statement regarding the results of the on-site inspection.

39. The management of the non-bank provider shall sign the statement and provide the date of its receipt, in the preliminary inspection statement, on a specially designed page.

40. In case of refusal of the management of the non-bank provider to receive and sign the preliminary statement regarding the results of the on-site inspection:
    a) the head of the inspection team or other inspector who issues the statement shall make the corresponding remark on the statement and send a copy of the statement to the person in charge with the registration of the incoming correspondence with the non-bank provider;
    b) if the statement was sent to the provider's premises, an employee of the non-bank provider shall register a copy of the statement and notify the NBM in written form on the refusal of the provider's management to sign it.

41. The management of the provider has the right to explain in writing the reasons for refusing to receive or sign the mentioned statement.

42. If the non-bank provider does not agree with the aspects indicated in the preliminary statement regarding the results of the on-site inspection, the provider has the right to submit in writing form, within up to 5 working days from the date of elaboration the preliminary statement, the reasons of disagreement and to attach the confirming documents. The date of drawing up the preliminary statement is considered the date of hand over /receipt of the statement regarding the results of the inspection.

43. After examining the objections presented by the non-bank provider regarding the findings presented by the preliminary statement, the NBM shall notify the non-bank provider regarding the acceptance/non-acceptance of the objections submitted by attaching the statement on the results of the on-site inspection.

Section V

EXAMINATION OF THE RESULTS OF THE ON-SITE INSPECTION

44. The results of the on-site inspection, the proposals regarding the application of remedies or sanctions against the non-bank providers shall be examined by the Executive Board of the NBM, according to the provisions of Law No 548/1995 regarding the National Bank of Moldova and Law No 114/2012.

45. After the approval by the Executive Board of the NBM of the decision regarding the results of the inspection performed at the non-bank provider, the non-bank provider shall be notified about the decision in the manner provided by law.

Section VI

CRITERIA FOR ESTABLISHING REMEDIES AND SANCTIONS TO NON-BANK PROVIDERS

46. The present section provides the necessary criteria for establishing the type of sanctions or remedies, and the amount of the fine to the non-bank providers, in compliance with the provisions of Article 100 paragraph (1) of the Law No 114/2012.

47. The NBM may apply remedies according to Article 99 paragraph (1) and (2) of Law No 114/2012, and sanctions according to Article 99 paragraph (3) of Law No 114/2012, for the following violations:

1. the infringement of the licensing conditions and restrictions or permits conditions and restrictions as provided for in this Law No 114/2012, including by:
   a) failure to comply with capital requirements;
   b) carrying out the activity contrary to the license obtained from the NBM;
   c) failure to inform the NBM about the data changes in the documents annexed to the license issuance statement;

2. prevention from exercising the supervisory and on-site inspection duty, non-fulfilment of the prescriptions and other remedies applied by NBM;

3. performance of fake transactions and without any actual coverage to provide inaccurate financial statement;

4. non-reporting, delayed reporting or the provision of inaccurate information;

5. failure to present the application and the documents required for the registration of branches and payment agents in the register of payment institutions, electronic money institutions;

6. hampering the safety and soundness of the payment system, payment service provider or electronic money issuer, including engagement in other business not related to the payment service provision or electronic money issuance;

7. non-compliance with the requirements regarding the activity of non-bank providers:
   a) failure to comply with the requirements regarding the safeguarding of the funds received from the users of the payment services/electronic money holders;
   b) outsourcing the operational function related to the payment services to another legal person without notifying the NBM;
   c) non-assessment of risks at all organizational levels and of the entire activity of payment services provision;
   d) infringements related to the provision of money remittance services;
   e) failure to comply with the requirements of the information retention;

8. other violations of the provisions of the Law No 114/2012 and/or the regulatory acts issued in order to enforce this law.

48. The NBM may apply sanctions and remedies simultaneously.

49. When applying individualized sanctions, one shall take into account the severity of the infringements committed, their frequency, the personal and actual circumstances. The infringement committed during 2 years from the date of finding the same type of identifying the same type of infringement shall be considered a repeated infringement.

50. For the purpose of determining the sanction and the amount of the fine, the following criteria shall be analysed (provided they can be determined):

1. the circumstances in which the violation was committed;
2. the manner and means of committing the identified infringement;
3. the purpose pursued;
4. the impact of the infringement on the activity of the non-bank provider or the payment system as a whole, including the economic benefits obtained through the infringement;
5. severity, duration and frequency of the infringement, including if the breach denotes serious deficiencies in the business model of the non-bank provider, governance, financial situation or internal control systems;
6. the degree of guilt of the non-bank provider (if the intention or negligence can be established in the exercise of the service duties);
7. the actions of the non-bank provider after the infringement has been committed, including:
   a) how promptly and effectively did the non-bank provider disclose the breach to the NBM's attention;
   b) the degree of cooperation manifested by the non-bank provider during the investigation of the violation by the NBM;
   c) the nature, degree and effectiveness of any remedial action taken by the non-bank provider regarding the violation and how promptly this action was taken;

d) if the non-bank provider has promptly and effectively complied with any request of the NBM;
e) the presentation of any inaccurate, incomplete or erroneous information by the non-bank provider and if the information was provided in an attempt to mislead the NBM;
8) the existence of remedies or previous sanctions applied to the non-bank provider in the last two years, including:
a) any warning given to the non-bank provider by the NBM;
b) any plan of measures regarding the remediation of previous violations of the non-bank provider or regarding the taking of other actions in this regard;
9) In case of a sanction for the administrator of the non-bank provider in addition to the factors mentioned above, the following considerations shall be considered:
a) the function, position, role and responsibilities of the administrator within the non-bank provider;
b) the actions of the administrator for risk management according to his responsibilities;
c) if the sanction is adequate and effective in the given case;
10) If there are more problems which, considered individually, cannot justify the application of a sanction, but when considered together, the problems can fall under the sanction.

51. The NBM may withdraw the license issued to the non-bank provider, according to Article 99 paragraph (3) letter d) of Law No 114/2012 for:
    a) prevention from exercising the supervisory and on-site inspection duty, non-fulfilment of the prescriptions and other remedies applied by NBM;
    b) performance of fake transactions and without any actual coverage to provide inaccurate financial statement;
    c) hampering the stability of the payment system where the non-bank provider participates, if it continues its activity of providing payment services;
    d) does not commence its activity within 12 months from the data of issuing the license;
    e) obtaining the license through false statements or any other irregular means;
    f) no longer fulfils the conditions for license issuance;
    g) does not hold enough regulatory capital;
    h) does not remove, within the established term, the circumstances that led to the suspension of certain activities of the non-bank provider;
    i) hampering the safety and soundness of the payment system, payment service provider or electronic money issuer, including engagement in other business not related to the payment service provision or electronic money issuance.

52. If following the receipt of the preliminary statement regarding the results of the inspection, the person charged with the violations committed recognizes the infringements, this fact shall be considered as a mitigating circumstance in the form of collaboration in the examination procedure of the results of the inspection, and the option of reducing the fine up to 30% shall be considered. In determining the percentage of reduction, the NBM shall consider, on a case-by-case basis, if the non-bank provider has acknowledged in whole or in part the violations found in the statement regarding the results of the inspection. In case of

partial recognition, the NBM may refuse to grant the reduction. In case of finding the same repeated violations, the reduction of the amount of the fine shall not be applied.

Section VII

OTHER PROVISIONS

53. Agents and providers of the non-bank provider's outsourced operational functions shall allow inspectors the access to their premises in order to examine records, accounts and transactions, providing for this purpose all documents and information regarding the administration, internal inspection and operations of payment service providers and issuers of electronic money, and shall cooperate with them within the limits of the competence conferred by law.

54. The information contained in the documents drafted by the NBM for the organization of the inspection and finding the results of the on-site inspection represents professional secret, that is subject to protection in compliance with the legislation in force.

55. NBM inspectors and other persons who have access to the information that represents professional secret shall comply with the requirements of the law regarding the processing, transmission, recording, keeping of professional secret, when using such information in the inspection process or examination of results, as well as with regard to the technical means (including computers, electronic information carriers, printing equipment, scanners, telephones, and other equipment).