Chapter Eight: Rules for Licensing, Registering, Controlling, and Supervising Digital Banks

Introduction

These instructions are prepared in accordance with the provisions of the Central Bank and Organized Financial System Law No. 194 of 2020, and include rules for licensing and registration, as well as rules for license revocation and partial or full suspension of operations. It is prohibited for any publisher to use the term "Digital Bank" or any expression similar to it in any language, whether in its current name, commercial title, or advertising.

First: Definition of Digital Banks and Scope of Their Services:

Digital banks are those that provide services electronically via networks or digital platforms using modern technological tools.

Digital banks conduct their activities subject to the following controls:

1. Compliance with the provisions of the Central Bank and Organized Financial System Law issued by the Central Bank, with the exception of granting credit facilities to large companies - unless the requirements of these instructions are met.
2. Prohibition on establishing branches, with the obligation to establish a headquarters for the bank in the form of an Egyptian joint-stock company and a headquarters for the foreign digital bank branch.
3. Permitting the use of banking agents after obtaining approval from the Central Bank.

Footnote 1: Letter from the Governor of the Central Bank dated July 12, 2023.

Second: Licensing and Registration Rules

1. Licensing Conditions:

1-1 The applicant must adopt one of the following legal forms:

1-1-1 Egyptian Joint-Stock Company: All its shares must be registered and fully paid. The paid-up capital must not be less than two billion Egyptian pounds or its equivalent in foreign currencies.

1-1-2 Branch of a Foreign Bank: Its headquarters must have a specific nationality and be subject to the supervision of regulatory authorities in the country where its headquarters is located. The capital allocated for the operation of the foreign digital bank branch in the Arab Republic of Egypt must not be less than two million US dollars or its equivalent in foreign currencies.

2-1 A financial founder must be among the shareholders, with the ownership percentage of that founder being the largest among the shareholders and their related parties, and this percentage must not exceed 30% of the capital.

3-1 The financial founder may be exempted from this condition after obtaining approval from the Board of Directors of the Central Bank, provided it operates in similar activities.

4-1 The ownership structure and related parties must be sufficient to identify the ultimate beneficiary and ensure the legitimacy of the source of funds.

5-1 The license must not conflict with the general economic interest of the state.

6-1 The license must not violate competition rules or prevent anti-competitive practices.

7-1 The commercial name adopted by the digital bank must not be identical or confusingly similar to the name or establishment of another bank.

8-1 Feasibility studies must be available, including the objective of establishment, work plan, nature of activities and services to be provided, market studies demonstrating the ability to mobilize and invest savings, in addition to general plans for information technology, payment systems, and cybersecurity.

9-1 Competence, integrity, good reputation, and financial soundness must be present among those concerned (founders, ultimate beneficiaries from legal persons, Board of Directors members, and senior executives).

10-1 In addition to the above, the following conditions apply to the branch of a foreign digital bank or the Egyptian joint-stock company belonging to a foreign bank or foreign financial institution:

1-10-1 The headquarters must have a specific nationality.

2-10-1 The headquarters must be subject to the supervision of the corresponding regulatory authorities in the country where it is located, and approval from those authorities must be obtained for operations in the Arab Republic of Egypt.

3-10-1 The corresponding regulatory authorities must apply the principle of consolidated supervision and express no objection to applying the principle of joint supervision with the Central Bank of Egypt.

4-10-1 The headquarters of the foreign bank must have policies to combat corruption, bribery, fraud, money laundering, and terrorist financing.

5-10-1 In the event that the foreign bank or foreign financial institution has been classified by one of the global credit rating agencies (Moody's, S&P, Fitch Ratings), evidence of this must be provided.

2. Procedures for Obtaining Preliminary Approval:

2-1 An application is submitted to the Central Bank to obtain preliminary approval to take steps to establish a digital bank or branch of a foreign digital bank, along with the documents mentioned in item (3) below, and the fee of one million Egyptian pounds for the digital bank in the form of an Egyptian joint-stock company or fifty thousand US dollars for the branch of the foreign digital bank.

2-2 The application is presented to the Board of Directors of the Central Bank to issue a decision, and the application is decided within ninety days from the date of its submission for the digital bank in the form of an Egyptian joint-stock company. The Board of Directors may extend this period for a similar period in the case of the foreign digital bank branch. In that case, the cooperation policy agreed upon between the Central Bank and the corresponding foreign authority in the country where the headquarters of the foreign bank is located is taken into account, to coordinate between them in the field of supervision and oversight.

2-3 In case of rejection of the application, those concerned are notified within fifteen days from the date of the rejection decision.

3. Documents Required to Obtain Preliminary Approval:

1-3 For the licensing of the bank in the form of an Egyptian joint-stock company:

1-1-3 Copies of the draft articles of association, including the names, nationalities, addresses, and share percentages of shareholders, and copies of the articles of association of corporate founders.

2-1-3 Commitment from the financial founder mentioned in item 2-1 that its ownership will not exceed 30% of the capital of the entity itself.

3-1-3 A statement clarifying the ownership structure and related parties, sufficient to identify the ultimate beneficiary and ensure the legitimacy of the source of funds, and a statement of the share percentage to be offered in a public subscription.

4-1-3 A statement of the percentage of participation of the founder and its related parties in other financial institutions inside and outside the Arab Republic of Egypt.

5-1-3 Evidence that none of the founders, major shareholders, ultimate beneficiaries, or Board of Directors members are listed in the records related to corruption (local and international).

6-1-3 A certificate stating that no bankruptcy, insolvency, or any crime involving moral turpitude or fraud has been issued against any of the founders.

7-1-3 A statement of the proposed name for the digital bank in Arabic and foreign languages, attached with a certificate from the Ministry of Supply and Internal Trade (Commercial Register) confirming the absence of confusion and duplication.

8-1-3 The articles of association of the digital bank, its duration, and the address of its headquarters.

9-1-3 A financial and economic feasibility study for the digital bank for a period not exceeding five years, including at least:

1-9-1-3 The objective of establishment.

2-9-1-3 The services to be provided.

3-9-1-3 Market studies demonstrating the ability to mobilize and invest savings, as well as the target categories and number of customers.

4-9-1-3 The management budget, basis, and expectations relied upon in its preparation.

5-9-1-3 The work plan and expansion plan in activities.

6-9-1-3 The proposed organizational structure.

7-9-1-3 The human resources development plan and career path development methods.

8-9-1-3 Policies of the digital bank, including credit and investment policies at a minimum.

9-9-1-3 Policies to combat fraud, money laundering, and terrorist financing.

10-9-1-3 Information technology and cybersecurity plans, including:

1-10-1-3 The organizational structure for information technology and the plan for appointing qualified human resources.

2-10-1-3 IT governance mechanisms and their enhancement through policies, procedures, control systems, and risk management.

3-10-1-3 The basic pillars of the information infrastructure, including:

1-3-10-1-3 Main and backup data centers.

2-3-10-1-3 IT infrastructure.

3-3-10-1-3 Main IT systems and application programs.

4-3-10-1-3 Necessary technologies and cybersecurity links to secure infrastructure, systems, applications, and all information and data in different states (processing, storage, and backup) in a manner that ensures data confidentiality, availability, and compatibility with the general cybersecurity framework.

4-10-1-3 Outsourcing plans, including at least:

1-4-10-1-3 A list of outsourced services, including outsourcing cases from shareholders or related parties.

2-4-10-1-3 Uses of cloud computing, including at least:

• Type of cloud computing to be used (e.g., SaaS, PaaS, IaaS).
• Applications to be used on cloud computing, types of related data, storage locations, and processing.

3-4-10-1-3 Governance mechanisms for outsourcing operations, risk management, and control systems.

4-4-10-1-3 Measures to ensure data confidentiality in different states (processing, storage, and backup).

5-4-10-1-3 Preventive procedures to prevent service interruption or denial of service.

5-10-1-3 A statement of tasks assigned to employees responsible for cybersecurity and security links followed to control access authorized to the digital bank's systems by all its employees.

6-10-1-3 A plan for cybersecurity management, specifying the level and types of risks the digital bank can bear to achieve its strategic objectives.

7-10-1-3 A plan to implement required tests to detect vulnerabilities and intrusions, covering all systems and applications.

8-10-1-3 A plan to monitor and follow up on cybersecurity incidents, clarifying the mechanisms and procedures to be followed in this regard.

9-10-1-3 Incident response plans and policies, including procedures for detecting these incidents, rapid response methods, and mitigation to limit resulting risks.

10-10-1-3 Training program plans for system managers and cybersecurity officers.

11-10-1-3 Training program plans for all digital bank employees and plans to increase awareness and knowledge among customers to limit cyber attack risks, such as social engineering attacks.

11-1-3 A statement of the digital networks planned to be made available to customers, the services provided through them, and the related systems and security plans, including those provided via the following networks:

1-11-1-3 ATMs (cash dispensing or interactive).

2-11-1-3 Internet.

3-11-1-3 Mobile phones or tablets.

4-11-1-3 Interactive voice or digital communication centers.

12-1-3 A statement of payment tools and electronic wallets planned to be made available to customers, the related systems, and security plans, as follows:

1-12-1-3 Electronic payment cards and tools (prepaid cards - credit cards - direct debit cards).

2-12-1-3 Electronic wallets (mobile phone wallets).

3-12-1-3 Electronic payments for transactions through e-commerce platforms or electronic payment gateways or QR codes (if available).

13-1-3 Customer identification and verification procedures.

14-1-4 Internal control, risk management, and governance plans, work systems, and governance, as well as a plan to apply anti-money laundering and strategic financing rules and policies intended to be followed in managing the digital bank's affairs, including a business continuity plan to ensure the continuity of providing various services.

15-1-3 In the case of the digital bank being an Egyptian joint-stock company belonging to a bank or financial institution, local or foreign, a statement must be provided including:

1-15-1-3 The services that the bank or financial institution will provide on its behalf (if any).

2-15-1-3 Applications and systems related to checking compliance with anti-money laundering and terrorist financing rules locally and globally (transfer applications, KYC, and those related to monitoring high-risk transactions related to customers) used by the bank or financial institution.

16-1-3 Any other documents requested by the Central Bank.

2-3 For licensing the bank in the form of a branch of a foreign digital bank:

1-2-3 Approval from the headquarters of the foreign bank to establish a branch in the Arab Republic of Egypt.

2-2-3 Approval from the competent authority in the country where the headquarters is subject to opening the branch, with its acknowledgment that the bank is licensed for operations, maintains a headquarters, and commits to the standards and regulatory rules applied by that authority.

3-2-3 Evidence that none of the founders, major shareholders, ultimate beneficiaries, or Board of Directors members are listed in the records related to corruption (local and international).

4-2-3 Copies of the articles of association of the headquarters, certified by the competent authority subject to it, accompanied by an Arabic translation from one of the authorized translation offices.

5-2-3 Copies of the financial statements of the bank for the last five financial years and the auditor's report on them.

6-2-3 The documents stipulated in items 9-1-3 to 14-1-3.

7-2-3 A statement from the headquarters of the foreign bank including:

1-7-2-3 The services that will be provided on behalf of the digital branch in the Arab Republic of Egypt, if any.

2-7-2-3 Applications and systems related to checking compliance with anti-money laundering and terrorist financing rules locally and globally (transfer applications, KYC, and those related to monitoring high-risk transactions related to customers).

8-2-3 A guarantee from the headquarters of the foreign bank to cover all deposits at the branch of the foreign digital bank, the rights of creditors, and all other obligations, with the headquarters committing to compensate for any losses resulting from any financial year that may lead to the branch of the foreign digital bank failing to meet the minimum regulatory requirements related to the capital adequacy criterion, within the shortest period from the date of approval of the branch's financial statements by the auditor.

9-2-3 A commitment from the headquarters of the foreign bank that the branch of the foreign digital bank will comply with Egyptian laws, regulations, resolutions, and instructions issued by the Central Bank.

10-2-3 A power of attorney issued by the headquarters of the foreign bank in the name of the manager responsible for the branch of the foreign digital bank and his deputy, certified by the Egyptian Ministry of Foreign Affairs, and obtaining approval from the Governor of the Central Bank prior to their appointment.

11-2-3 Any other documents requested by the Central Bank.

4. Licensing Procedures

1-4 Licensing procedures for the digital bank in the form of an Egyptian joint-stock company:

1-1-4 The application for the license of the digital bank, for which preliminary approval has been issued, is submitted to the Governor of the Central Bank. The necessary steps for establishment must be taken within one year from the date of notifying those concerned of the mentioned decision; otherwise, the approval is considered void. The Board of Directors of the Central Bank may extend this period for a similar period from the date of expiration of the preliminary approval for establishment.

2-1-4 The following documents necessary for licensing and registration with the Banks Register are attached to the license application:

1-2-1-4 A bank deposit certificate confirming the deposit of the capital amount not less than that mentioned in item (1) of this section.

2-2-1-4 Copies of the tax card and commercial register.

3-2-1-4 Copies of the initial minutes and articles of association, and the newspaper in which the establishment decision was published.

4-2-1-4 A statement of shareholders, clarifying the related parties, sufficient to identify the ultimate beneficiary and ensure the legitimacy of the source of funds.

5-2-1-4 A statement of the names and data of senior executives (Board of Directors members and CEOs responsible for main and supervisory activities) on the forms prepared for this purpose, provided that they meet the conditions of competence and technical qualification required for senior executives.

6-2-1-4 A certificate from the Ministry of Justice stating that no bankruptcy, insolvency, or any crime involving moral turpitude or fraud has been issued against any of the shareholders or candidates for Board of Directors membership and senior executives who hold Egyptian nationality.

7-2-1-4 Names of auditors, who must be among those registered with the Central Bank as auditors.

8-2-1-4 Evidence of payment of an inspection fee of five hundred thousand Egyptian pounds for the headquarters.

9-2-1-4 A statement of the necessary facilities and equipment for the digital bank, taking into account the requirements mentioned in the instructions regarding security policies and procedures for the financial device issued in May 2018, and in accordance with the nature of the activities of these banks.

10-2-1-4 A certificate from a specialized, qualified, and experienced entity that certifies all components of the infrastructure, technological systems, and information security, and the degree of competence, effectiveness, and ability of these systems to support the activities and operations of the bank in accordance with the requirements of the business plans and general plans for information technology and cybersecurity issued upon preliminary approval, provided that this entity is approved by the Central Bank.

3-1-4 The license application is presented to the Board of Directors of the Central Bank to issue a decision regarding it within sixty days from the date of submission of the application with the required documents. The Board of Directors may extend this period for a similar period.

4-1-4 The license applicant is obliged to notify the Central Bank immediately in the event of any change in the data provided in the license application.

5-1-4 The license applicant is notified of the rejection or what is required of him in terms of documents or data within thirty days from the date of submission of the application. If the applicant does not fulfill the requirement within thirty days from the date of the mentioned notification, it is considered withdrawn from this application.

6-1-4 The decisions issued by the Board of Directors of the Central Bank regarding licensing are published in the Egyptian Gazette, in addition to the Central Bank's electronic website.

7-1-4 In the event of rejection of the license application by a decision of the Board of Directors of the Central Bank, the applicant is notified within fifteen days from the date of its issuance.

2-4 Licensing procedures for the branch of the foreign digital bank:

1-2-4 The application for the license of the branch of the foreign digital bank, for which preliminary approval has been issued, is submitted to the Governor of the Central Bank. The necessary steps for establishment must be taken within two years from the date of notifying those concerned of the mentioned decision; otherwise, the approval is considered void. The Board of Directors of the Central Bank may extend this period for a similar period from the date of expiration of the preliminary approval for establishment.

2-2-4 The following documents necessary for licensing and registration with the Banks Register at the Central Bank are attached to the license application:

1-2-2-4 A bank deposit certificate confirming the deposit of an amount not less than two million US dollars or its equivalent in foreign currencies for the account of the capital allocated for the branch of the foreign digital bank to conduct its activities in the Arab Republic of Egypt.

2-2-2-4 Copies of the tax card and commercial register.

3-2-2-4 A statement of shareholders of the foreign bank, clarifying the related parties, sufficient to identify the ultimate beneficiary and ensure the legitimacy of the source of funds.

4-2-2-4 A statement of the names of the manager responsible for the branch of the foreign digital bank, his deputy, and the senior executives responsible for the main and supervisory activities, on the forms prepared for this purpose, provided that they meet the conditions of competence and technical qualification required.

5-2-2-4 A certificate from the Ministry of Justice stating that no bankruptcy, insolvency, or any crime involving moral turpitude or fraud has been issued against any of the candidates for the positions of senior executives who hold Egyptian nationality.

6-2-2-4 Names of auditors, who must be among those registered with the Central Bank as auditors.

7-2-2-4 A statement of the necessary facilities and equipment, including the requirements mentioned in the instructions regarding security policies and procedures for the financial device issued in May 2018, and in accordance with the nature of the activities of these banks.

8-2-2-4 Evidence of payment of an inspection fee of twenty-five thousand US dollars for the headquarters.

9-2-2-4 A certificate from a specialized, qualified, and experienced entity that certifies all components of the infrastructure, technological systems, and information security, and the degree of competence, effectiveness, and ability of these systems to support the activities and operations of the branch of the foreign digital bank in accordance with the requirements of the business plans and general plans for information technology and cybersecurity issued upon preliminary approval, provided that this entity is approved by the Central Bank.

3-2-4 The application for obtaining the license is presented to the Board of Directors of the Central Bank to issue a decision regarding it, taking into account the cooperation policy agreed upon between the Central Bank and the competent authority in the country where the headquarters of the foreign bank to which the branch belongs is located, to coordinate between them in the field of supervision and oversight. The documents required are submitted with the application within sixty days from the date of its submission. The Board of Directors may extend this period for a similar period.

4-2-4 The license applicant is obliged to notify the Central Bank immediately in the event of any change in the data provided in the license application.

5-2-4 The license applicant is notified of the rejection or what is required of him in terms of documents or data within thirty days from the date of submission of the application. If the applicant does not fulfill the requirement within thirty days from the date of the mentioned notification, it is considered withdrawn from this application.

6-2-4 The decisions issued by the Board of Directors of the Central Bank regarding licensing are published in the Egyptian Gazette, in addition to the Central Bank's electronic website.

7-2-4 In the event of rejection of the license application by a decision of the Board of Directors of the Central Bank, the applicant is notified within fifteen days from the date of its issuance.

5. Registration of the Digital Bank or Branch of the Foreign Digital Bank:

1-5 The licensed digital bank is registered in a special register prepared for this purpose at the Central Bank.

2-5 The data to be registered in the mentioned register includes:

1-2-5 The registration number and the date of the Board of Directors' decision.

2-2-5 The full and abbreviated name of the digital bank or branch of the foreign digital bank in Arabic and foreign languages.

3-2-5 The legal form.

4-2-5 The date of establishment.

5-2-5 The date of commencement of activity.

6-2-5 The duration of the digital bank and its renewal.

7-2-5 The number and date of the issue of the Egyptian Gazette in which the decision of the Board of Directors of the Central Bank approving the license was published.

8-2-5 The paid-up and paid capital of the licensed digital bank or the capital allocated for the operation of the branch of the foreign digital bank in the Arab Republic of Egypt.

9-2-5 The statutory reserves and other bank reserves or any reserves allocated for the branch of the foreign digital bank in the Arab Republic of Egypt.

10-2-5 The documents and financing instruments of the digital bank and branch of the foreign digital bank, their issuance date, maturity, and subordinated financing and its conditions.

11-2-5 The address of the headquarters of the digital bank in the form of an Egyptian joint-stock company or the headquarters for the branch of the foreign digital bank in the Arab Republic of Egypt.

12-2-5 Financial institutions belonging to the digital bank abroad.

13-2-5 A statement of the names and data of senior executives, on the forms prepared for this purpose.

14-2-5 The names and data of the manager responsible for the management of the branch of the foreign digital bank in the Arab Republic of Egypt, his deputy, and executive senior executives, on the form prepared for this purpose.

15-2-5 Names of auditors.

3-5 An application for the registration of the bank, for which preliminary approval has been obtained, to take steps for its establishment, is submitted to the Central Bank on the form mentioned above. "Application for Registration of a Digital Bank," and the necessary documents prepared for this purpose are attached to the application.

4-5 Registration is made of any changes to the previous data on the form prepared for this purpose.

6. Modification of Registration Data:

The procedures for modifying registration data are subject to the following:

1-6 Notification to the Central Bank of any modification intended to be made to the establishment minutes or articles of association. The modification cannot be presented to the General Assembly - in cases requiring the approval of the General Assembly - unless preliminary approval is obtained from the Central Bank. This modification is not implemented unless approved by the General Assembly, ratified by the Board of Directors of the Central Bank, and noted in the Banks Register.

2-6 Notification of any modification in the data provided when requesting registration is required. The notification is submitted on the form prepared for this purpose, supported by the necessary documents. This modification is not implemented unless approved by the Central Bank and noted in the Banks Register.

3-6 It is prohibited to announce any modifications involving the requests submitted to the Central Bank before notifying the concerned digital bank of the Central Bank's approval and noting them in the Banks Register.

4-6 The Central Bank notifies the digital bank, the applicant for modification, of the approval of the modification within fifteen days from the date of the decision, by any means the Central Bank deems appropriate.

Third: Supervision and Oversight Rules and Controls:

1. All instructions and regulations issued by the Central Bank for banks apply to the digital bank or branch of the foreign digital bank, in addition to the following:

1-1 The minimum limit for deposits from a single customer and their related parties must not exceed 1% of the total deposit portfolio, with a maximum amount of 200 million Egyptian pounds.

2-1 Commitment to not granting credit facilities to large companies, except for credit customers from medium-sized companies as defined by the instruction issued by the Central Bank, until the volume of the internal business exceeds the specified limit according to the instruction, and the end of the credit facility term, provided that the total value of these exempted facilities does not exceed 20% of the total credit facility portfolio of the bank.

2. The two percentages mentioned in the previous item do not apply during the first year of activity.

3. Granting credit facilities to large companies is permitted with exemption from the regulatory requirements mentioned in items 1-1 and 2-1 of this section, provided that approval from the Central Bank is obtained and the paid-up and paid capital is increased to four billion Egyptian pounds or its equivalent in foreign currencies for the digital bank in the form of an Egyptian joint-stock company, and the capital allocated for the operation of the branch of the foreign digital bank to one hundred and twenty million US dollars or its equivalent in foreign currencies.

4. All instructions and regulations issued by the Anti-Money Laundering and Terrorist Financing Unit apply, including the rules and procedures of due diligence required for banks.

Fourth: Revocation of Licenses, Partial or Full Suspension of Operations, and Striking Off Registration:

The provisions of the instructions on rules for licensing and registration of banks and offices of foreign banks issued on November 14, 2021, regarding the revocation of licenses, partial or full suspension of operations, and striking off registration apply, with the modification of item 4-1-2 to read as follows:

If the Board of Directors of the Central Bank issues a decision approving the partial suspension of operations and proceeding with the procedures for full suspension of operations, the digital bank or branch of the foreign digital bank is obliged to publish a notice of suspension of its operations at least twice in two daily business days, with its spread in one of the cities where the headquarters of the digital bank or the headquarters for the branch of the foreign digital bank is located. The same notice is published on the electronic platforms of the digital bank or the branch of the foreign digital bank (official website and electronic applications). The notice must mention the intention of the digital bank or branch of the foreign digital bank to submit an application to the Egyptian Central Bank to suspend its operations in the Arab Republic of Egypt and the date of submission of this application. The notice must include a call to depositors and creditors of the digital bank or branch of the foreign digital bank, and anyone with the right, to submit a statement to the Egyptian Central Bank at a date not exceeding the date of submission of the suspension of operations application, stating their rights that the bank has not fulfilled, if any.