Chapter Three Controls Sending Statements Of Accounts

Continuing the establishment of the appropriate mechanism for sending statements to protect the rights of bank customers and employees on or through electronic channels - ensuring the protection of their data and maintaining its confidentiality, and in light of their accounts - whether paper-based or electronic - and with the trend towards enhancing the principle of sustainability by working to avoid negative environmental effects resulting from the bank's internal activities, including promoting electronic communication and replacing paper usage, the Board of Directors of the Central Bank has decided

1 In its session held on December 13, 2022 the following:

1-1 Banks must send account statements to customers at least every three months, while adhering to the following:

1-1-1 In the case of paper account statements: This is done via a registered letter with proof of receipt, observing the following:

1-1-1-1 Establishing the necessary policies and procedures to maintain the confidentiality of customer account statements, which include mechanisms within the bank's internal systems and insurance during the various stages of preparing the statement and sending it to the customer, whether the service is provided through the bank or through outsourcing companies, and ensuring that contracts concluded between the bank and outsourcing companies include clauses obligating them to regulate the controls for delivering these statements quickly and efficiently, as well as setting penalty conditions for non-compliance.

1-1-1-2 The bank is responsible in all cases for delays in delivering account statements and for violating the principles of protecting customer data confidentiality.

1-1-1-3 In case of returned mail, the customer must be notified using any available communication means that the account statement is available at the nearest branch for collection.

2-1 In the case of account statements using new means (electronic account statements):

1-2-1 The bank is permitted to use any electronic means to send account statements (for example, but not limited to: internet banking, the bank's mobile applications, email), and the Central Bank of Egypt's approval must be obtained for the technical solutions related to issuing and sending these statements, specifically regarding data integrity, accuracy, and encryption.

Letter from the Governor of the Central Bank of Egypt dated December 28, 2022 1

1-2-1 Establishing the terms and conditions for sending electronic account statements and obtaining customer consent to them before activating the service or upon any changes to those terms and conditions, either in writing or through one of the secure means that consider customer identity verification (for example, but not limited to: internet banking or the bank's mobile applications). The drafting of the terms and conditions must be clear and specific, and must include as a minimum:

• The steps the customer must follow to activate the service in case of initial subscription or in case of suspending or restarting the service.

• A mechanism to verify the validity of customers' email addresses and enable them to modify it.

• Procedures for handling electronic account statements that do not reach their email boxes (Failure Delivery).

• A mechanism for handling customer complaints regarding the service.

• The customer's commitment to read warning and alert notifications (such as security alerts or alerts regarding fraud attempts/social engineering, etc.).

3-2-1 Providing secure, simple, and clear systems for customers to view account statements electronically at any time and to be aware of the transactions contained therein in an easy and simplified manner.

4-2-1 The bank must securely retain (Logs) records proving the sending of account statements to the customer, and they must be retained for a time period consistent with what the bank's policies determine, in application of legal requirements and supervisory instructions issued in this regard.

5-2-1 Observing the use of various encryption means when sending electronic account statements, especially in the case of sending via email, with the password used to encrypt the account statement being strong and variable, and sent to the customer through a different electronic channel, observing the following measures when dealing with passwords:

• Using a complex password (e.g., consisting of eight characters including letters, numbers, and special symbols, etc.).

• Using appropriate technology to create the password and adopting appropriate techniques to ensure its security during delivery to the customer, either manually or electronically.

• Ensuring that passwords are not processed, sent, or stored in clear text.

• Enhancing the security of the password creation process to ensure it is not exposed and to ensure its non-repetition using appropriate methods (Multi-Factor Authentication).

6-2-1 The bank must establish the necessary policies and procedures to ensure the security of customer data from any breaches, which must be included in the annual penetration tests conducted by the bank.

7-2-1 The possibility for the customer to stop the issuance of electronic account statements at any time upon request, using the same means referred to in item (2-2-1), and the bank must, in this case, send account statements in paper form to the customer according to the periodicity referred to in item (1-1-1).

8-2-1 It is preferred to issue electronic account statements without fees, and if that is not possible, it must be considered that the fees collected from customers are less than their paper counterparts.

-2 The response of approval or objection from the customer regarding the contents of the account statement must be within thirty days from the date of notification of the balance, using the same means agreed upon between the parties (via a registered letter with proof of receipt or through electronic means), and in case the customer does not respond within this period indicating their objection, it is considered approval of the correctness of what is stated in the account statement unless the contrary is proven.

-3 In the case of considering customers with dormant accounts, the bank must stop sending account statements until customers reactivate any of their accounts according to the controls issued in this regard.

-4 The bank must educate customers on the following:

1-4 The periodicity of sending account statements to customers, the importance of reviewing the transactions recorded therein, and the procedures for objecting to them and the specified deadlines in this regard (within thirty days from the date of notifying the customer of the balance).

2-4 Customers' responsibility to update their data with the bank immediately upon change (e.g., communication means and address).

3-4 How to create passwords related to electronic account statements, mechanisms for changing them, and maintaining the confidentiality of customer data.

-5 These controls come into effect from their date, and the bank must regularize its status regarding item (2-1) within 6 months from the date of their implementation.