Circular No. 008/SP/2026 on Payment Services within Burundi's National Electronic Commerce Ecosystem

[Logo: BRB]

BANK OF THE REPUBLIC OF BURUNDI

CIRCULAR NO. 008/SP/2026 ON PAYMENT SERVICES WITHIN BURUNDI'S NATIONAL ELECTRONIC COMMERCE ECOSYSTEM

The Governor of the Bank of the Republic of Burundi,

Considering Law No. 1/34 of December 2, 2008, on the Statutes of the Bank of the Republic of Burundi;

Considering Law No. 1/06 of March 25, 2010, on the Legal Regime of Competition;

Considering Law No. 1/01 of January 16, 2015, revising Law No. 1/07 of April 26, 2010, on the Commercial Code;

Considering Law No. 1/17 of August 22, 2017, governing Banking Activities;

Considering Law No. 1/07 of May 11, 2018, on the National Payment System;

Considering Law No. 01/10 of March 16, 2022, on the Prevention and Repression of Cybercrime in Burundi;

Considering Law No. 1/22 of August 22, 2024, on the Electronic and Postal Communications Code of Burundi;

Considering Law No. 1/08 of March 27, 2025, amending Law No. 1/02 of February 4, 2008, on the Fight against Money Laundering and Terrorist Financing;

Considering Law No. 1/03 of March 10, 2026, on the Protection of Personal Data;

Considering Regulation No. 001/2018 on Microfinance Activities;

Considering Regulation No. 001/2019 on the Protection of Consumers of Financial Products and Services;

Considering Regulation No. 002/2024 of July 30, 2024, on Payment Services and the Activities of Payment Institutions;

Considering Regulation No. 02/2026 enacted in application of Law No. 1/08 of March 27, 2025, amending Law No. 1/02 of February 4, 2008, on the Fight against Money Laundering and Terrorist Financing;

Considering Regulation No. 03/2026 governing participation in Burundi's instant payment system named "Burundipay";

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 1

Considering the Practical Guide to Burundi's National Electronic Commerce Ecosystem;

Considering the Guidelines for Burundi's National Electronic Commerce Ecosystem;

Enacts:

CHAPTER I: GENERAL PROVISIONS

Article 1: Purpose

The purpose of this circular is to define the rules applicable to payment services operating within Burundi's National Electronic Commerce Ecosystem.

It sets out the modalities relating to the approval, organization, execution, security, interoperability, traceability, and supervision of electronic payment transactions related to electronic commerce in Burundi, as well as the opening, use, and management of escrow accounts dedicated to these transactions.

Article 2: Scope of Application

This circular applies to all participants in the payment processing related to electronic commerce in Burundi, including:

1. credit institutions;
2. the National Post Office;
3. payment institutions;
4. microfinance institutions;
5. payment gateway providers;
6. merchant websites and online sales applications;
7. as well as any entity directly participating in the collection, processing, transmission, settlement, or execution of payments related to electronic commerce.

Article 3: Definitions

For the purposes of this circular, the following definitions apply:

1. Payment Aggregator: A provider of payment initiation, aggregation, or facilitation services. This is a company that offers a service allowing a natural or legal person to order payments (e.g., transfers) from an account held with another institution (bank, payment institution, etc.) than the one where their account is opened;
2. API (Application Programming Interface): A set of rules, protocols, and tools allowing systems or software to communicate and exchange data securely and automatically;
3. Online Sales Application: A software application accessible on mobile phones, tablets, or computers, allowing a merchant or service provider to offer, present, and sell goods and/or services remotely, as well as to generate, collect, and transmit the information necessary for placing orders and initiating electronic payments via a payment service provider;

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 2

4. ARCT: Telecommunications Regulatory and Control Agency;
5. Beneficiary: The person who is the recipient of funds received from the initiator of a payment operation;
6. Payment Escrow: A mechanism consisting of isolating and temporarily holding funds from payment transactions in a dedicated account, separate from the provider's own funds, until the conditions agreed upon between the parties are met, notably the confirmation of goods delivery or service execution;
7. Client: Any natural or legal person who initiates or performs an electronic payment transaction to settle the purchase of a good, a service, or any other financial obligation within an electronic commerce operation;
8. Electronic Commerce: Any activity of buying, selling, supplying, or exchanging goods or services carried out electronically;
9. Escrow Account: A dedicated account opened with and managed by an approved commercial bank, the National Post Office, or a microfinance institution of the first or third category, intended to receive, secure, and hold payments from electronic transactions until their transfer to beneficiaries;
10. Electronic Billing Data: A set of information generated, transmitted, received, processed, or stored in electronic format for the purpose of issuing, transmitting, processing, and managing an electronic invoice, including party identification, description of goods or services, billed amounts, payment references, timestamps, and any other data required to enable the e-commerce payment service provider to execute the payment transaction;
11. Burundi National Electronic Commerce Ecosystem: A structured and coordinated framework aimed at ensuring the interoperability of actors, platforms, payment systems, logistical mechanisms, and dispute resolution mechanisms related to electronic commerce in Burundi;
12. Reversal: An operation to refund funds to the client in case of error, non-execution of an order, transaction cancellation, merchandise return, or dispute;
13. Payment Service Provider: Any approved entity providing payment services in accordance with the regulations applicable to payment systems and services;
14. Escrow Account Manager: A commercial bank, the National Post Office, or a microfinance institution of the first or third category with which an escrow account is opened and which ensures the safekeeping, escrow, release, and transfer of funds in accordance with this circular;
15. Major Incident: Any event likely to significantly affect the availability, integrity, confidentiality, or continuity of payment services;
16. Interoperability: The ability of payment systems, platforms, and infrastructures to communicate, exchange, and process data in a harmonized, secure, and efficient manner;

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 3

17. KYC/KYB: All procedures for knowing and verifying the identity of clients and business partners;
18. Strong Authentication Mechanism: An authentication mechanism based on the use of at least two independent factors related to the user's knowledge, possession, or inherence;
19. OTP: A unique temporary code used to confirm or authenticate an electronic transaction;
20. Electronic Payment Gateway: A secure technological infrastructure used by a payment service provider to ensure interconnection between the different actors of an electronic payment transaction, including the collection, transmission, authentication, and secure exchange of data, as well as the generation of payment instructions within an electronic commerce transaction;
21. Cross-border Payment: Any electronic transaction involving a payer or beneficiary located outside the national territory;
22. PIN (Personal Identification Number): A confidential secret code, generally composed of digits, used to authenticate a user and secure access or validation of an electronic operation;
23. QR (Quick Response): A standardized two-dimensional barcode that allows information to be stored in a visual tag that can be read by a device with the necessary hardware and reading software;
24. Electronic Receipt: A notification, message, or document generated and transmitted in electronic format attesting to the receipt of a payment or the completion of an electronic payment transaction, and containing essential information relating to said transaction, including the identity of the parties, the amount paid, as well as the date and time of the transaction, the payment reference, and any other element required by current regulations;
25. Merchant Website: An electronic platform accessible via the internet, operated by a merchant or service provider, allowing the presentation, promotion, and sale of goods and/or services within electronic commerce, as well as the placement of orders and the generation of information necessary for initiating payments via a payment service provider;
26. Electronic Payment Transaction: Any payment operation initiated, executed, or received electronically within electronic commerce;

CHAPTER II: AUTHORIZATION AND CONDITIONS OF EXERCISE

Article 4: Approval

No one may provide payment services related to electronic commerce within Burundi's National Electronic Commerce Ecosystem without having first obtained approval issued by the Bank of the Republic of Burundi.

The Bank of the Republic of Burundi maintains and updates a register of payment service providers related to electronic commerce in Burundi authorized to operate within Burundi's National Electronic Commerce Ecosystem.

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 4

Article 5: Conditions for Obtaining Approval

Any operator applying for approval to provide payment services related to electronic commerce in the territory of the Republic of Burundi must:

1. be legally constituted in accordance with Burundian legislation;
2. have a payment gateway;
3. submit a technical and operational file;
4. establish a governance and internal control system;
5. have a risk management mechanism;
6. be connected to one or more escrow accounts dedicated to electronic commerce transactions and managed in accordance with the provisions of this circular;
7. guarantee service continuity and business recovery in case of an incident.

Article 6: Required Documents

To protect the consumer against the occurrence of fraud, the information required to constitute the application file for approval as an electronic commerce payment service provider is as follows:

1. A program of activity indicating, in particular, the type of payment services envisaged;
2. A description of the measures taken to protect user funds;
3. A description of the governance system and internal control mechanisms, including the applicant's administrative, risk management, and accounting procedures, demonstrating that this governance system, these control mechanisms, and these procedures are proportionate, adapted, sound, and adequate;
4. A description of the procedure in place to ensure the monitoring, processing, and follow-up of security incidents and client complaints related to security, including an incident reporting mechanism that takes into account the notification obligations incumbent on the payment institution;
5. A description of the process in place to record, monitor, and restrict access to sensitive payment data and to keep track of such access;
6. A description of business continuity arrangements;
7. A description of the principles and definitions applied for the collection of statistical data relating to performance, operations, and fraud;
8. A document relating to the security policy, including a detailed risk analysis with regard to the payment services offered and a description of the control and mitigation measures taken to adequately protect payment service users against identified security risks, including fraud and illicit use of sensitive or personal data;
9. A description of the internal control mechanisms put in place to comply with anti-money laundering and terrorist financing obligations;
10. The identity of persons directly or indirectly holding a participation in the applicant's capital, the size of their participation, and proof of their quality, taking into account the need to ensure sound and prudent management;

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 5

11. The identity of the directors and persons responsible for management and, where applicable, persons responsible for the management of the payment services activities of the payment institution, and proof that they possess the integrity and the required skills and experience for the provision of payment services;
12. The legal status and articles of association of the company being formed;
13. The physical address of the applicant.

Article 7: Notification of Decision

Within a period not exceeding thirty (30) working days following the receipt of the complete application file for approval, the Bank of the Republic of Burundi informs the applicant of the acceptance or refusal of the approval. The Bank of the Republic of Burundi must provide reasons for any refusal of approval.

CHAPTER III: INTEROPERABILITY AND TECHNICAL REQUIREMENTS

Article 8: Interoperability

Any provider of electronic payment services related to electronic commerce guarantees interoperability with other actors in Burundi's National Electronic Commerce Ecosystem.

APIs and technical documentation necessary for interoperability are made available to recognized actors within Burundi's National Electronic Commerce Ecosystem.

APIs made available by payment service providers must allow the exchange of data necessary for the initiation, execution, monitoring, and reconciliation of electronic transactions.

Payment service providers ensure the continuous availability of their critical interfaces and infrastructures, as well as a service level compatible with the business continuity requirements of electronic commerce.

The Bank of the Republic of Burundi imposes technical standards, API protocols, and minimum integration requirements.

CHAPTER IV: GOVERNANCE

Article 9: Governance and Internal Control

Any provider of electronic commerce payment services establishes and maintains a governance, risk management, and internal control system adapted to the nature, size, and complexity of their activities.

As such, it must notably have:

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 6

1. an appropriate governance structure;
2. an operational, financial, technological, and compliance risk management system;
3. an effective internal control system;
4. regulatory compliance procedures;
5. a business continuity and disaster recovery plan regularly tested and updated.

Article 10: User Identification

Any provider of electronic commerce payment services applies KYC/KYB procedures in accordance with current regulations. It takes reasonable measures necessary to verify the identity of users, notably by means of official documents, public registers, or identification systems recognized by competent authorities, in compliance with legislation relating to the protection of personal data.

Identification data is retained for the period necessary to comply with legal, regulatory, prudential, and anti-money laundering and terrorist financing obligations, in accordance with legislation relating to the protection of personal data.

CHAPTER V: MANAGEMENT OF ESCROW ACCOUNTS

Article 11: Opening of Escrow Accounts

Any provider of electronic commerce payment services carries out its activities through one or more escrow accounts opened with and managed by a bank, the National Post Office, or a microfinance institution of the first or third category.

These escrow accounts are exclusively allocated to the receipt, temporary safekeeping, escrow, and transfer of funds from electronic commerce transactions.

Escrow accounts can be opened in local currency or foreign currency.

Accounts opened in foreign currency are intended for the settlement of international transactions and their operation is subject to the current exchange regulations.

Escrow accounts are opened in the name of the payment service provider, with express mention of their fiduciary nature and their exclusive allocation to electronic commerce transactions.

Article 12: Separation and Protection of Funds

Funds held in escrow accounts do not generate any property rights for the benefit of the payment service provider.

Funds held in escrow accounts:

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 7

1. remain the property of the clients until their effective transfer to the beneficiaries in accordance with payment instructions validated by said clients, or until their restitution or transfer to the bank accounts or payment accounts belonging to said clients;
2. are strictly separated from the payment service provider's own funds, operational accounts, and any other assets of the payment service provider or any other entity involved in processing the transaction;
3. are unseizable and cannot be integrated into the assets of the payment service provider or any other entity involved in the transaction in case of liquidation, bankruptcy, judicial reorganization, or any other collective procedure;
4. cannot be subject to any set-off, pledge, guarantee, assignment, loan, or use for purposes other than the execution of transactions initiated by clients;
5. are subject to separate accounting allowing the identification, for each transaction, of the client's identity, the nature of the operation, the amount paid or transferred, the date and time of the transaction, the beneficiary or beneficiaries concerned, as well as the execution status of the transaction.

In case of cessation of activities, withdrawal of approval, liquidation, bankruptcy, judicial reorganization, or any other situation leading to the cessation of the payment service provider's services, the funds held in the escrow accounts remain the property of their legitimate holders and are fully returned to them by transfer to the bank accounts or payment accounts they have designated.

Article 13: Recording and Reconciliation of Escrow Account Movements

Debit and credit movements made on escrow accounts are recorded individually and traceably in the name of the clients and beneficiaries concerned.

Any provider of electronic commerce payment services is required to establish permanent accounting reconciliation and traceability mechanisms to guarantee at all times the availability and integrity of funds held in escrow accounts.

Escrow account managers perform daily reconciliation operations between:

1. collected funds;
2. executed transactions;
3. transferred amounts;
4. reversal operations.

Article 14: Payment Escrow

Funds from payment transactions are held in a dedicated escrow account until confirmation of goods delivery or effective service execution.

1, Avenue du Gouvernement - B.P. 705 BUJUMBURA - Tel: (257) 22 20 40 00/ 22 222744 - Fax : (257) 22 22 31 28-Email:brb@brb.bi 8

Except in cases of dispute, transaction cancellation, complaint, or suspicion of fraud, the duration of payment escrow in the escrow account may not exceed four (4) working days for national transactions and fourteen (14) calendar days for international transactions.

In case of dispute, force majeure, or verification procedure, the escrow period may be extended until the resolution of the dispute or the removal of the impediment.

CHAPTER VI: PAYMENT PROCESS AND FUND TRANSFER

Article 15: Validity of Billing Data

Billing data generated by a merchant website and an online sales application recognized by ARCT constitutes a payment order having the same legal value as a payment order established in physical form.

Billing data collected, transmitted, and processed via an online billing system of an electronic commerce payment service provider constitutes a payment order once the transaction is validated by the client using a secure authentication mechanism, notably by OTP code, QR code, PIN code, or any other secure validation device.

The electronic validation of the transaction by the client constitutes consent to the execution of the payment order, subject to the provisions relating to cancellations, disputes, reversals, and cases of fraud provided for by the regulation.