Bank of Albania Regulation 48/2024 on Minimum Security Requirements for Banking Premises and Monetary Value Transportation

R E P U B L I C O F A L B A N I A BANK OF ALBANIA SUPERVISORY COUNCIL DECISION No. 48, dated 2.10.2024 ON APPROVAL OF REGULATION “ON MINIMUM SECURITY REQUIREMENTS REGARDING PREMISES WHERE BANKING AND FINANCIAL ACTIVITIES ARE CONDUCTED AND TRANSPORTATION OF MONETARY VALUES” Pursuant to article 43, letter “c” of the Law No. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended, having regard to the proposal from the Supervision Department, and from the Security and Protection Department, the Supervisory Council of the Bank of Albania; DECIDED:

1. To approve the regulation “On minimum security requirements regarding premises where banking and financial activities are conducted and transportation of monetary values”, in accordance with the text attached to this decision.
2. The Bank of Albania's Supervision Department and Security and Protection Department are responsible for the implementation of this Decision.
3. The Governor's Office and the Research Department shall be responsible for the publication of this Decision, in the Official Journal of the Republic of Albania and in the Official Bulletin of the Bank of Albania, respectively.
4. Upon entry into force of this decision, the regulation “On minimum security requirements where banking and financial activities are conducted”, approved by Bank of Albania's Supervisory Council decision No. 67, dated 1.6.2016, as amended, shall be abrogated. This decision shall enter into force 15 days after its publication in the Official Journal. SECRETARY CHAIR Elvis ÇIBUKU Gent SEJKO

CHAPTER I General provisions Article 1 Subject matter This regulation shall set out the minimum security requirements regarding the premises where banking and/or financial activities are conducted and the transportation of monetary values, for the normal and safe performance of these activities. Article 2 Legal grounds This regulation is issued pursuant to article 1, paragraph 4, letter “b”, article 12, letter “a”, and article 70, paragraph 1 of the Law No. 8269, dated 23.12.1997 “On the Bank of Albania”, as amended; articles 57, paragraph 2, 58 and 126 of the Law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended; Law No. 55/2020, dated 30.4.2020 “On payment services”; Law No. 19/2016 “On additional measures for public security”; Law No.152/2015 “On fire protection and rescue service”; as well as to article 61, letter “b”, and article 65, paragraph 4, of Law No. 52/2016, dated 19.5.2016, “On savings and loan associations and their unions”. Article 3 Scope of application This regulation shall apply on banks, branches of foreign banks, payment institutions, electronic money institutions, foreign exchange bureaus, savings and loan associations and their unions and non-bank financial institutions that conduct financial activities with physical money (cash) and/or through agents. Article 4 Definitions

1. The terms used in this regulation shall have the same meaning as those defined under: article 4 of the Law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”; article 5 of the Law No. 55/2020, dated 30.4.2020 “On payment services”; Law No. 19/2016 “On additional measures for public security”; and article 3 of Law No. 52/2016, dated 19.5.2016, “On savings and loan associations and their unions”.
2. In addition to paragraph 1 of this article, for the purpose of implementing this regulation, the following terms shall mean: a) “Agent” – shall have the same meaning with the term “agent” as set forth in the law “On payment services” and with the term “agent of electronic money institution” as set forth in the regulation “On the licensing of payment institutions and electronic money institutions and the registration of payment service providers”;

b) “Counter” – is the section which provides a security distance between the tellers’ area and the customers’ area; c) “Tellers’ area” - is the entity’s area, which serves as a work place for tellers; d) “Storage and management area of monetary values” – is the area inside the premises, where the vault is placed; e) “Safety” - shall imply the set of measures taken to protect the personnel, customers, monetary values, premises and assets of the subjects of this regulation; f) “Electronic security systems” - are electronic systems of fire protection, alarm, access control, monitoring, scanning, communication, etc.; g) “External security” - is the service provided by security personnel, which is conducted outside the premises of the bank or foreign bank branch; h) “Internal security” – is the service provided by security personnel, which is conducted within the premises of the bank or foreign bank branch to ensure the bank's security; i) “ATM - (Automated Teller Machine)” - shall have the same meaning with the term set forth in the law “On payment services”; j) “PPSS” - Private Physical Security Service is the company established, licensed and operating under the provisions of Law no. 75/2014 “On private physical security service”, as amended; k) “FPR” - is the service of Fire Protection and Rescue, regulated under the Law No. 152, dated 12.21.2015 “On fire protection and rescue”; l) “Security certification” – is the administrative act issued by the State Police, which certifies the fulfillment of the security measures taken by the entities, according to the requirements set forth in Law No. 19/2016 “On additional measures for public security”; m) “Banks” - are banks and branches of foreign banks licensed by the Bank of Albania under the law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”, as amended; n) “Entities that carry out financial activities with physical money (cash)” – are payment institutions, electronic money institutions, foreign exchange bureaus, savings and loan associations and their unions, non-bank financial entities that engage in financial activities and/or with agents, and other payment services providers.

Chapter II Minimum requirements for the security and transportation of monetary values in Banks Article 5 Safety policy and structures

1. The bank shall draft and approve policies for the safety of its employees, customers, monetary values and assets.
2. The bank shall have in its organisational structure a special unit for the security, which is in charge of: a) planning, drafting, coordination, implementation and monitoring of security procedures and measures; b) periodic training of employees on the implementation of procedures and security measures; c) implementation of laws and by-laws pertaining to security, in the regulatory acts of the bank/branch of a foreign bank; d) coordination with competent authorities on security, transport of monetary values and civil emergency issues; e) assessment of physical security risks for the bank's objects.
3. An employee shall be assigned in each branch and agency of the bank, who, in addition to his duties, is responsible for the implementation of security procedures and measures.
4. The bank shall periodically review and update the security procedures and measures. Article 6 General requirements for safety in bank premises
5. The bank carries out the activities within the premises, which meet the following requirements: a) provide the needed space and adequate conditions for the maintaining of the documentation and the monetary values; b) have received the approval granted from relevant FPR on the adopted measures against fire; c) are easily accessible by specialised units of security and transportation of monetary values; d) have clearly separated areas, as following: i. customers’ area, ii. tellers’ area,

iii. area for storing physical monetary values, iv. area where the information technology systems are installed; e) are equipped with a second source and continuing electric power supply. 2. Branches/agencies of banks, which do not engage in financial activities with physical money, are exempted from the provisions of paragraph 1, letter “d”, subparagraph “ii” and “iii” of this article. 3. The bank shall sign an insurance contract for physical monetary values with an insurance company licensed by the Financial Supervisory Authority. 4. The banks shall inform the relevant structures of the Local Police on the address where its branch and/or agency shall be opened or transferred. 5. It shall be provided with the “Security certification”, issued by the Local Police Directorates. 6. The bank shall sign a contract with PPSS, with regard to: a) receiving and verification of an alarm signal (License for Sub-category “I.3.A”) b) external and/or internal security (Licence for Sub-category “I.3.A”); c) transportation of monetary values (Licence for Sub-category "I.3.B") d) ATM cash replenishment outside the bank's premises. 7. Contracts under paragraph 6 of this article shall specify the bank, branch or agency for which this contract is signed. 8. Banks, solely in capacity of a payment service provider that operate with agents, as set forth in the law “On payment services”, are responsible for the implementation and periodic verification of the requirements laid down in this regulation by the agents. Article 7 Requirements for the tellers’ area

1. The tellers’ area should meet the following security requirements: a) shall be installed in a special premise and separated from the other areas through the “counter”; b) shall be monitored by cameras for each work station of the tellers; c) shall contain alarm buttons in each work station of the tellers; d) shall have mini-vaults or special drawers for holding physical monetary values.

Article 8 Requirements for the storage and management area of monetary values

1. The storage and management area of the monetary values should meet the following security requirements: a) shall be in a safe place, completely separated from the other areas; b) shall have approved procedures for access in this area; c) shall have in place electronic protection with: i. access-control system, ii. seismic detection sensors, iii. motion sensors, iv. smoke detection sensors; d) shall have in place monitoring system by cameras for: i. access to this area, ii. internal premises. Article 9 Requirements for the area where information technology systems are placed
2. The information technology systems shall be placed in a special area and within the bank premises.
3. The area where the information technology systems are installed to, shall meet the following security conditions: a) shall be a completely separated area from the other premises; b) have approved procedures for access in this area; c) have in place electronic protection with: i. access-control system, ii. motion sensors, iii. smoke detection sensors, iv. humidity sensors; d) shall have in place monitoring system by cameras for: i. access to this area, ii. its internal premises.

Article 10 Requirements for protection via electronic systems

1. The bank shall take measures on the protection via electronic systems of the premises where they conduct their activity.
2. The bank, for the security of the premises via electronic systems, in addition to the provisions of articles 7, 8 and 9, shall meet also the following conditions: a) shall have in place cameras which record uninterruptedly, the following areas: i. external facade of the bank at the entrance to the internal premises, ii. customers’ area, iii. bank counter, iv. ATM transactions, v. the second and uninterrupted source of electricity, depending on technical conditions and infrastructure, vi. passageways and internal premises of the bank where the procedures of receiving and delivering monetary values are carried out; b) shall have in place special digital devices for image recording, which: i. shall be installed within a safe premise, excluding the area where monetary values are stored, ii. keep video records for not less than one month; c) shall monitor the bank areas, when there are no direct views, at the office of security officer; d) shall have in place electronic protection provided by: i. motion detection sensors, ii. smoke detection sensors, iii. humidity sensors, iv. alarm buttons installed in security officer’s office, v. internal or external alarm siren; e) shall have in place systems for the transmission of the alarm signal to the control centres at: i. relevant structures of the State Police, ii. PPSS, with which it has signed a contract, iii. and/or security unit of the bank.
3. The implementation, processing, management and storage of data obtained from electronic security systems is made in accordance with the law “On personal data protection” and the respective by-laws issued for its implementation.
4. The procedures for implementation, management and operation of security systems are continuously monitored by the security unit at the bank, in accordance to the provisions of article 5, paragraph 2 of this regulation.

Article 11 Requirements for protection through security personnel

1. The banks shall take measures for the internal security during the working hours, of the premises wherein they conduct their activity, with personnel certified in accordance to the law No. 75/2014 “On private physical security service”, as amended.

2. Bank agencies are excluded from the provisions of paragraph 1 of this article, whose measures are assessed by the bank itself, in relation to the perceived risk.

3. Bank, in their assessment, may also take measures for the external security of premises where they conduct their activity, during and after working hours, in relation to the perceived risk. Even in this case, security measures are carried out by personnel certified in accordance to law No. 75/2014 “On private physical security service”, as amended. Article 12 Requirements for the transportation of monetary values

4. The banks shall take necessary measures for the secured transportation of the monetary values.

5. The transportation of monetary values shall be carried out according to the requirements set forth in the Law No. 75/2014, dated 10.07.2014 “On private physical security service”, and the by-laws issued for its implementation.

6. The transportation of monetary values shall be carried out by employees of the PPSS service, equipped with a licence of category “I.3.B”.

7. Armored vehicles, which will be presented at the counters of the Bank of Albania to carry out transactions with monetary values, shall be equipped with authorization issued by the State Police for the use of the armored vehicle.

8. Each year, and whenever there are changes, the bank submits to the Bank of Albania (to the Security and Protection Department) a copy of the documentation for: a) the list of employees authorized by the banks who will communicate with the Security and Protection Department, regarding transactions with monetary values. This list shall include the employees’ data, email address, landline phone number and mobile phone number, and shall specify the regions according to the branches of the Bank of Albania. b) the list of employees authorized to perform monetary transactions at the counters of the Bank of Albania.

9. Notification in case of performing monetary transactions at the counters of the Bank of Albania shall, in all cases, be made 24 hours prior to the transaction, by the authorized employees of the banks, to the relevant address for this purpose.

10. Emergency cases are exempted from this paragraph, where notification may be made within the same day when the transaction shall be carried out.

11. The dedicated address and the format for the notification are provided to the banks by the Security and Protection Department. Chapter III Minimum security conditions in the premises of entities that carry out the financial activity through physical money (cash) Article 13 Requirements for the premises’ security

12. Entities that carry out financial activities with physical money (cash) shall carry out the activity within the premises which meet the following requirements: a) are easily accessible from specialised security units; b) shall have the needed spaces and adequate conditions for storing the documentation and the monetary values; c) shall have clearly separated the following areas: i. customers’ area, ii. tellers’ area; d) the tellers’ area shall meet the following conditions: i. it is located in a separated and restricted area from the other areas with a “counter”, ii. the monetary values are placed within mini-vaults, iii. it is monitored by cameras.

13. Entities that carry out financial activity with physical money (cash), which conduct financial activity in business/shopping centres, shall be excluded from the implementation of subparagraph “i” of letter “c” of paragraph 1 of this article.

14. Entities that carry out financial activity with physical money (cash), in the premises where they conduct their financial activity, shall have in place a monitoring system, which consists of: a) cameras, which record uninterruptedly all the institution’s premises; b) digital devices for image recording, which:

i. are installed within the tellers’ area, and ii. the time for record storing shall be at least 1 month. 4. The implementation, processing, management and storage of data obtained from electronic security systems is made in accordance with the law “On personal data protection” and the by-laws issued for its implementation. 5. Entities that carry out financial activity with physical money (cash) shall inform the relevant structures of the Local Police for the districts where the new branches and/or agencies shall be opened or transferred. 6. Entities that carry out financial activity with physical money (cash) shall be equipped with a “Security certification”, issued by the Local Police Directorates, for the premises where they conduct their activities. 7. Entities that carry out financial activity with physical money (cash) are responsible for the implementation and the periodic verification of the requirements of this regulation, by their agents. Chapter IV Final provisions Article 14 Supervision

1. The subjects of this regulation shall inform the Bank of Albania's Supervision Department, in case of opening or changing the place of the premises where they conduct their activity.
2. The Supervision Department of the Bank of Albania, upon notification in accordance with paragraph 1 of this article, shall require the Security and Protection Department of the Bank of Albania to inspect the premises for compliance with the requirements set forth in this regulation.
3. The Supervision Department of the Bank of the Albania, for the implementation of requirements of this regulation, at any time, may ask the Security and Protection Department of the Bank of Albania to conduct inspections in the subjects of this regulation. Article 15 Supervisory and penalising measures Bank of Albania, in case of failure of compliance with the requirements of this regulation, shall implement the supervisory and/or penalizing measures stipulated in the law No. 9662, dated 18.12.2006 “On banks in the Republic of Albania”; in the Law No. 55/2020, dated 30.4.2020 “On payment services”; and in Law No. 52/2016, dated 19.5.2016 “On savings and loan associations and their unions”.

Article 16 Entry into force This regulation shall enter into force 15 days after its publication in the Official Journal of the Republic of Albania. CHAIRMAN OF THE SUPERVISORY COUNCIL

GENT SEJKO