Central Bank of Libya Circular 10/2017: Controls and Instructions for Mobile Payment Services via E-Wallet

Central Bank of Libya P.O. Box 1103 Telegram Address: Libyabank - Tripoli - Libya

Reference: R.M/N 804 () Circular No. R.M.N (2017/10) Date: 26 Safar 1439 AH Corresponding Date: 2017/11/14 AD

To: General Managers of Banks Mr. / General Manager - Libyan Foreign Bank

Greetings,

Based on the provisions of Law No. (1) of 2005 concerning Banks and its amendments, and on the supervisory and regulatory role exercised by the Central Bank of Libya over commercial banks in accordance with the law's provisions.

We hereby forward to you a copy of the controls and instructions regarding the electronic payment service via mobile phone and related to the Electronic Wallet, for taking the necessary measures and implementing what is stated therein.

Dr. Mukhtar Al-Hadi Al-Tawil Director of Banking and Currency Control Department

Copies to: Mr. / Governor Mr. / Head of Commercial Banks' Correspondent Accounts Coverage Committee – Central Bank of Libya Mr. / Director of Information and Settlements Department – Central Bank of Libya Mr. / General Manager of Employee Funds Guarantee Fund Mr. / Director of Information Security Department – Central Bank of Libya Mr. / Director of Information Coverage Department – Central Bank of Libya Mr. / Director of Accounts Department – Central Bank of Libya Mr. / Director of Main Financial Information Unit – Central Bank of Libya Mr. / Deputy Director of Banking and Currency Control Department – Supervisory Affairs, Office Compliance and Follow-up Mobile Banking and Compliance Support Section

N. Bajad / Periodic Messages 2017/12

---

Central Bank of Libya CENTRAL BANK OF LIBYA

Controls and Instructions for Electronic Payment Service via Mobile Phone and Related to the Electronic Wallet

Draft version 1.2 *16/10/2017

Objectives: These controls and instructions aim to clarify the structure of operations, technologies, and the operational environment for the mobile payment service related to the Electronic Wallet and handling facilities. This framework includes:

• The rules and operational frameworks accompanying the service provision process, including determining the technological environment and the control and regulation process.
• The minimum technical and service requirements for all parties participating in the electronic payment system via mobile phone related to the Electronic Wallet.
• The responsibilities and duties governing the role of all participants in the electronic payment system via mobile phone and defining the relationship between service providers and their clients within the scope of this framework.
• General rules for any operation of the electronic payment system via mobile phone with the Electronic Wallet from the start to the end of the process.

Definitions: The following terms have the meanings specified below.

Number	Term (Arabic)	Term (English)
1.	Clearing Cycle	Clearing Cycle
2.	Business Day	Business Day
3.	Transaction Limits	Transaction Limits
4.	Cash Cap	Cash cap
5.	Balance	Balance
6.	Electronic Cash	Electronic Cash
7.	E-Wallet	E-Wallet

Methods of Subscription to the Service: (1) Through an electronic wallet: In this case, the electronic wallet is linked to the mobile phone number, and this method requires the following:

• Payment is made via electronic cash transferred by the service provider to customer wallets against received cash amounts or obtained therefrom, after which the client deals with that electronic cash within transaction limits.
• Ensure that all electronic wallet accounts cannot be directly affected by other systems.
• Ensure that all accounts and transactions are stored in an encrypted manner.
• Operating a special mother program at the service provider.
• The service provider must deposit the value of issued electronic cash in the mobile phone account at the Central Bank of Libya to guarantee issuing electronic cash against those deposits, where the service provider's liabilities from electronic cash issued through it do not exceed the sum of the balance of the mobile phone account at the settlement bank and the guarantee account.
• Electronic wallet accounts must not be disclosed under any circumstances.
• Electronic units in electronic wallet accounts are not subject to execution and are not accepted as guarantees against credit.

Related Parties: • Central Bank of Libya

1. Issuing regulations governing the service, ensuring the smooth running of the mobile payment service for the Electronic Wallet.
2. Issuing necessary approvals for service providers to provide the service.
3. Supervision and oversight of service providers' activities related to the mobile payment service for the Electronic Wallet.
4. Approving pricing of Electronic Wallet services provided by service providers.

• Mobile Phone Companies

1. Providing the infrastructure to build private communication networks for service providers.

• Settlement Bank

1. Organizing agreements between itself and the service provider to calculate the guarantee deposit.
2. Allocating customer deposits for charging Electronic Wallets.
3. Managing the guarantee deposit account of the service provider to cover electronic cash in customers' wallets for the service provider, and informing the Central Bank of Libya of the guarantee value.
4. Monitoring the service provider's activities to the extent that ensures conformity with the conditions of their contract.

• Service Provider The service provider of electronic payment via mobile phone must take the following measures at a minimum:

1. Verify the quality of overall standards for auditing and follow-up and keep necessary records to document all electronic payment operations via mobile phone in compliance with controls and regulations issued by the Central Bank of Libya.
2. Ensure that solutions provided (software) regarding electronic payment services via mobile phone comply with what is stated in this framework.
3. Implement international standards for financial operations (ISO8583) and (ISO 20022).
4. Put in place mechanisms in cooperation with contracting parties to educate and unify how to use mobile payment services.
5. Commit to periodically providing the Central Bank of Libya, upon request, with internal and external audits and general expertise reports related to the payment service, and the Central Bank has the right to request special audits (Specialized Audit) whose scope is determined at the expense of the service provider.
6. Ensure transparency in publishing and announcing all commissions incurred for providing the service and mechanisms for changing them.
7. Work on signing and preparing payment solutions and applications for customers.
8. Ensure that the electronic payment system via mobile phone at service providers contains means for monitoring operations and issuing reports with financial information according to relevant laws and regulations.
9. Keep log files (Log File) for all financial operations.
10. Keep audit trails (Audit Trails) for all operations carried out within the electronic payment system via mobile phone.
11. Provide a quarterly evaluated report on the performance level of service providers.
12. That all customer movements are tracked and their accuracy and reliability are ensured.
13. Adhere to customer protection reasons contained in the electronic service instructions and this framework.
14. Provide a network of branches and agents who will be parties in providing the service to customers, where cooperation with agents must be governed by conditions and procedures regarding agent selection criteria and technical requirements that must be available in the agent as an agent for the service provider.

• Service Providers 15. Commit to sending daily reports showing the decrease in wallet balance due to cash withdrawal operations. 16. To enable the settlement bank to adjust the guarantee account balance of the Electronic Wallet. At least the following risks:

• A. Taking necessary measures to conform the service with all laws and instructions issued by the Central Bank of Libya.
• B. Ensuring optimal procedures through risk identification policy and compliance procedures related to anti-money laundering and counter-terrorism financing requirements, and the service provider must adhere to specific controls defined by the Central Bank in addition to any controls defined by competent government bodies. Operational risks include at a minimum:
• C. Preparing backup infrastructure supporting the main infrastructure for dealing with disasters and risks.
• D. Providing Business Continuity Plans and a disaster emergency center, to ensure the continuity and permanence of service provision.
• E. Ensuring that systems used in mobile payment operations are available at all times and around the clock, and that all participants in service provision follow the same rules.
• F. Conducting periodic inspections to verify the validity of backup infrastructure, disaster emergency center, risk plans, and business continuity plans.

17. Service Provider Obligations Regarding Contracts Concluded with Customers The service provider must organize the relationship between itself and its customers based on written contractual agreements in simple and clear language according to Central Bank controls, and the payment service provider must provide the customer with a paper or electronic copy specifying at least the following:

• A. The role and responsibilities of the service and the aggregate benefits, rights, and responsibilities related to the customer.
• B. A written guide to introduce the customer to the mechanism of service implementation and how to submit complaints and handling procedures.
• C. Contact information with both the payment service provider's complaints unit and the competent unit of the Central Bank to receive complaints in case of dissatisfaction with the complaint process.
• D. The contract concluded between the service provider and customers must state that mobile payment operations are considered a legal means of payment.
• E. The service provider must classify contracts concluded according to the type of customer.
• F. The service provider must notify the customer before final execution of any payment operation with the following:
  1. The payer of the payment operation.
  2. The amount of the operation to be executed.
  3. Commissions incurred for this operation.
• G. The service provider must notify the customer immediately upon completion of any financial movement on his wallet with what was mentioned in paragraph (F) above, in addition to his new wallet balance and the reference number of the payment operation.

• Agents of Service Providers The service provider must assign any of the following operations to the agent network for the purpose of carrying out the operations specified in this document, and the possible operations may include:

• Accepting customer subscription requests to the Electronic Wallet to benefit from the service.
• Transferring electronic currency units to customer wallets according to specified limits.
• Liquidating customer wallets according to specified limits. If the service provider appoints agents to provide mobile payment services for the Electronic Wallet, the service provider must ensure proof of legal personality and obtaining approval through the commercial register certificate, license, articles of association, and establishment contract, in addition to practicing the activity, permission from the headquarters, and a list of branches belonging to the headquarters and their addresses. The service provider must have the ability to monitor and follow up all operations executed by the agent. The service provider must provide the agent with practical instructions on points of operations that must be performed. The service provider must rely on external parties for specific controls to monitor activities practiced by the agent regarding the service. The service provider must provide appropriate insurance systems for the agent's activities related to the service. The service provider must provide systems for agents compatible with the banking operations they provide. The service provider must organize the relationship between itself and agents based on written agreements outlining the roles and responsibilities of each party, and which must include at least a note from the service provider exercising appropriate supervision on the agent's activities related to the service. The agent may, at a minimum, through a dedicated phone number service for each service provider. The service provider and its agencies must provide the Central Bank of Libya with information according to the form specified for this purpose by the Central Bank of Libya.

• Customers Any natural or legal person who requests from the service provider, approved by the service provider according to the contract concluded between him and the service provider according to the controls specified by the Central Bank in particular.

Transaction Limits: The Central Bank of Libya sets maximum limits for the size of the balance and the size of daily and monthly operations, as well as the number of each of the daily and monthly operations, as follows: Limit of a single movement depending on its type; where levels of this application are specialized on the service provider.

Number	Type of Movement	Limit of Movement (LYD)
1	Transfer from person to person	150.000
2	Transfer from person to public service companies	200.000
3	Transfer from public service companies to person	500.000
4	Transfer from person to government entity (except government entities otherwise)	300.000
5	Transfer from government entity to person (except government entities otherwise)	500.000
6	Transfer from person to business companies and traders	300.000
7	Transfer from business companies and traders to subscriptions	300.000
8	Transfer from business companies and traders to subscriptions	1,000.000
9	Cash Feed into Wallet Account Cash In	Not exceeding the monthly limit of the Electronic Wallet
10	Cash withdrawal through ATM via mobile phone after 4 movements per day at a maximum	150.000
11	Cash withdrawal through service provider or its agents not exceeding one movement per day	100.000
12	Payment and purchase operations via Electronic Wallet for customers	Not exceeding the monthly movement limit of the Electronic Wallet

Monthly Customer Limit: Where levels of this application are specialized on the service provider.

Number	Customer Type	Monthly Limit (LYD)
1	Natural Person	1,000.000
2	Traders or Companies - Small	10,000.000
3	Traders or Companies - Medium	20,000.000
4	Traders or Companies - Large	50,000.000

Monthly Limit of Electronic Wallet Balance: Where levels of this application are specialized on the service provider.

Number	Customer Type	Monthly Limit (LYD)
1	Natural Person	3,000.000
2	Traders or Companies - Small	10,000.000
3	Traders or Companies - Medium	20,000.000
4	Traders or Companies - Large	50,000.000

Customer Registration in the Service: Registering customers to benefit from the service is the responsibility of the service provider and through its branch network or agents. And when registering customers, the following must be taken into consideration:

1. The service provider must have a system for customer registration.

2. Electronic wallet customers wishing to benefit from this service must register with the service provider or one of its agents, and care must be taken to obtain customer data whether natural or legal person, as well as observing customer identity verification procedures through other documents according to anti-money laundering and counter-terrorism financing instructions issued by the Central Bank of Libya for this purpose.

3. Upon official registration of the customer and activating the service, the service provider issues a user code and personal identification number (PIN) (customer-specific).

4. The service provider must keep records and documents ensuring the movement of information regarding due diligence procedures concerning customers for at least five years from the date of completing the transaction, or the date of ending the business relationship with the customer depending on the situation, and updating this data periodically.

5. After obtaining the customer's attention and activating him by the service provider, the registered place becomes depositing amounts in his account and paying and receiving the Balance as follows: And customer registration procedures are as follows:

Registering a Customer in the Electronic Wallet:

1. The customer visits one of the branches or agents of the service provider and fills out the subscription request for the mobile payment service via the Electronic Wallet and receives the service authorization code for the registration process at the same time.
2. The service provider enters the information if there is no record of the customer, and then enters his data.
3. In case of rejection by the service provider, the customer is informed directly by the competent employee with the reason stated.
4. If the registration process succeeds, the service provider: A. Issues and sends a user code and personal identification number (PIN) specific to the customer. B. Activates the service for the customer and informs him on the same phone number linked to the service.

Electronic Wallet Cash Feed Operation:

1. The customer visits one of the branches or agents of his service provider.
2. The service provider enters the cash feed movement data into the automatic system attached to the customer's wallet account.
3. And the movement conforms to the conditions and limits specific to it.
4. If the system rejects the feed movement, the employee or agent informs the customer of the rejection with the reason stated.
5. If the feed movement is accepted, the system records the value of the feed for the customer's wallet.
6. The service provider sends a text message to the customer confirming the success of the feed operation.

Electronic Wallet Feed Operation via Bank Transfers:

1. The service provider or agent notifies the settlement bank after verifying the customer's wallet account.
2. And the movement conforms to the specific conditions.
3. If the service provider rejects the feed movement, the employee or agent informs the customer of the rejection with the reason stated.
4. If the feed movement is accepted, the service provider sends a text message to the customer confirming the success of the feed operation.

Limited Value Cash Withdrawal Operation from Electronic Wallet:

1. The customer visits one of the branches or agents of his service provider.
2. The customer sends a withdrawal movement for its value to the service provider to verify his account with the conditions and limits specific to it.
3. In case of acceptance of the movement and success of the operation, the branch employee or agent pays the cash withdrawal value to the customer.
4. If the movement is rejected by the service provider, the customer is informed of the rejection of the operation with the reason stated.

Customer to Customer Payment Operation:

1. The customer creates a payment movement via mobile phone by filling out the requirement and sending the financial movement.
2. The service provider verifies the customer's wallet account and the sufficiency of the balance and specified limits.
3. In case of rejection, the service provider informs the customer of the rejection of the operation with the reason stated.
4. In case of success of the operation, the transfer movement is sent to the customer's wallet account.
5. The customer is informed of the successful payment by the service provider.
6. The beneficiary customer is informed of the success of the operation by the service provider.

Cash Withdrawal Operation from Electronic Wallet via ATM:

1. The customer sends a cash withdrawal movement - ATM - to the service provider to verify the customer's wallet account and conformity of the movement with the conditions and limits specific to it.
2. If the service provider rejects the service, he informs the customer of the rejection of the movement with the reason stated.

Cash Withdrawal Operation from Electronic Wallet via Cheque or Money Order:

1. The customer creates a request to obtain a financial value via cheque or money order via mobile phone by filling out the requirement and enabling it and sending the movement to the service provider.
2. The service provider receives the request and verifies the customer's wallet account and conformity of the movement with the conditions and limits specific to it.
3. In case of failure of the verification process, the service provider informs the customer of the rejection of the movement with the reason stated.
4. In case of success of the verification process, the service provider prepares a request to obtain a cheque or money order for disbursement to the settlement bank.
5. When the process is completed by the settlement bank, the service provider informs the customer of the success of the operation and comes to collect the cheque or notification of the financial movement.

Settlements:

1. Settlement within a single service provider: (1) Movements carried out within the framework of the service provider's system between accounts opened by him for his customers within the limits of his infrastructure and companies carried out within customers' accounts of the Central Bank of Libya, a contracted partner or participant of the service provider, are not settled because they take the nature of internal on-us.

Commissions:

1. Contracts concluded with customers must clarify the mechanism for deducting commissions for all movements executed via the Electronic Wallet.
2. Each service provider covers the Electronic Wallet account he has for the value of commissions that are deducted from electronic wallets.
3. For the Balance, and when transferring the service value to the Central Bank of Libya, it is sent through the service system to the settlement bank to claim the settlement that the Central Bank of Libya considers.
4. The service provider calculates commissions for movements designated from commissions.
5. The Central Bank of Libya determines the maximum limit of commissions for service providers according to the nature of movements executed on the system if they are not covered by commissions.

Rights and Responsibilities of Customers: Customer Rights

1. The service provider must provide the general conditions for benefiting from the service, and these conditions must be available to customers either in the form of booklets or published on the service provider's website, and the conditions must be written in simple and clear language and must include the following:
   • Services provided by the service provider.
   • Responsibilities and duties of the service provider and customers.
   • Details of commissions that the service provider will detail for each service.
   • How to deal with customer complaints and suggestions.
   • Procedures that customers must follow in case of losing the mobile phone.
   • Procedures related to suspending the service and withdrawing customers from the service.
2. The relationship between the service provider and customers must be built based on a formal contractual agreement specifying the conditions for benefiting from the mobile payment service.
3. The service provider must take necessary professional measures to ensure the security and confidentiality of customer information.
4. The service provider must have a customer service center including:
   • Providing assistance and guidance to customers.
   • Answering customer inquiries.
   • Giving customers adequate learning tools to enhance principles of usage, security, and confidentiality.
   • Receiving customer complaints and suggestions.
5. The service provider must have clear procedures and mechanisms for dealing with customer complaints and suggestions, which include the following:
   • Announcing the address of the complaints center, email, and phone numbers.
   • Recording complaints or suggestions upon receipt in a special file and giving them a reference number, and they must carry the signature of the customer submitting the complaint or suggestion.
   • Initiating actions regarding complaints or suggestions on the first working day following receipt.
   • Holding the subject of complaints and considering suggestions within three days at most and informing the customer of the result.
   • Recording all calls passing through complaints center telephone lines vocally and preserving these records.
   • Registering when complaints occur through the sense of duties and obligations at agents as they are responsible for the activities of their agents in case of recording intentional or unintentional errors by agents.
6. Usage duration (USSD short message lists, etc.).
7. Privacy, trust, security, and confidentiality of operations.
8. Availability anywhere, anytime.
9. Immediate access to funds balances after completing payment movement operations.
10. Immediate transfer of the value of the movement related to operation values.
11. Ease of access to dispute resolution applications.

Customer Responsibilities:

1. Protecting the personal password.
2. Verifying movement details in terms of recipient movement number and value before execution.
3. Adhering to all security and confidentiality rules as approved by the service provider.
4. Not issuing movements without sufficient funds in their accounts.

Technical and Security Requirements: Information is considered one of the main elements in providing the mobile payment service via Electronic Wallet, and therefore the technology used in providing the service must possess security, confidentiality, integrity, and reliability in general, so the mobile payment service via Electronic Wallet must include the following elements:

1. Compatibility and smooth operation with other systems.
2. Use of SECURED SMS system according to the latest international standards or use of USSD.
3. Use of secure communication channels with encrypted nature to provide mobile payment services via Electronic Wallet.
4. Ease and lack of complexity of applications that will be installed on customers' phones.
5. The user interface must be built on a Menu system.
6. The customer's entry into the menu must be governed by username and password.
7. The password used must be encrypted.

General Controls and Conditions:

1. The mobile payment system via Electronic Wallet is considered a licensed system by the Central Bank of Libya, and no other party is allowed to operate another parallel system except after obtaining approval from the Central Bank of Libya.
2. Every electronic wallet is linked to a mobile phone number for the customer.
3. Entering the mobile phone system via the Electronic Wallet requires the customer's experience in his field of work for at least three years.
4. The applicant entering the electronic payment system via mobile phone must be higher than the inputter.
5. Any transaction in the electronic payment system via mobile phone must be done with the participation of the inputter, checker, and authorized person.
6. A policy must be put in place for rotating the inputters, checkers, and authorized persons concerned, and taking necessary measures to grant these authorities to the smallest number.
7. A daily report must be raised by the supervisor of system operations to the internal audit department at the service provider.
8. The System Manager (Admin) at the service provider is not allowed to issue any electronic wallet in any form.
9. No amount is added to the electronic payment system via mobile phone except after actual collection of the financial counterpart in the bank's basic system.
10. No deduction operation from the customer's Electronic Wallet account is allowed unless it complies with the terms and conditions.
11. The service is available to customers starting from age 18 and above.