Circular SINAP 1-221: Rules on National Payments System - Payment Services. Update.

"AÑO DE LA DEFENSA DE LA VIDA, LA LIBERTAD Y LA PROPIEDAD" COMUNICACIÓN “A” 8114 08/10/2024 TO FINANCIAL ENTITIES, TO ELECTRONIC COMPENSATION CHAMBERS, TO ATM NETWORKS, TO PAYMENT SERVICE PROVIDERS OFFERING PAYMENT ACCOUNTS, TO ELECTRONIC FUNDS TRANSFER NETWORKS, TO PAYMENT SERVICE PROVIDERS FULFILLING THE INITIATION FUNCTION, TO ADMINISTRATORS OF ELECTRONIC FUNDS TRANSFER PAYMENT SCHEMES, PAYMENT ACCEPTORS WITH TRANSFER, CARD PAYMENT ACQUIRERS, PAYMENT INSTRUMENT AGGREGATORS:
Ref.: Circular
SINAP 1-221:
Rules on "National Payments System - Payment Services". Update.
___________________________________________________________________________ We address you in order to deliver the sheets that, in replacement of those previously provided, must be incorporated into the rules on "National Payments System – Payment Services" based on the provisions disseminated by Communications “A” 8032 and 8103 and Bulletin CIMPRA 516. Finally, we remind you that on this Institution's website www.bcra.gob.ar, by accessing “Financial System – LEGAL AND REGULATORY FRAMEWORK – Regulations and summaries – Ordered texts of general regulations”, you will find the modifications made with texts highlighted in special characters (strikethrough and bold). We salute you attentively. CENTRAL BANK OF THE ARGENTINE REPUBLIC Matías A. Gutiérrez Girault Luis A. D’Orio Manager of Payment Systems and Current Accounts Principal Manager of Payment Systems

ANNEX

-Index
Section 1. Uniform Banking Key (CBU)
1.1. Composition
1.2. Disclosure
Section 2. Uniform Virtual Key (CVU)
2.1. Characteristics
2.2. Functionalities
2.3. Composition
2.4. Other provisions
Section 3. Identification by alias
3.1. Definition
3.2. Function
3.3. Objective
3.4. General characteristics
3.5. Hourly availability
3.6. Uniqueness and portability of the alias
3.7. Processes and functions
3.8. Automatic assignment of the alias
3.9. Access to the alias database
Section 4. Quick response codes
Section 5. "Digital wallet" service
5.1. Definition
5.2. Enrolment of accounts in digital wallets
5.3. Registration in the "Registry of interoperable digital wallets"
5.4. Integration with new payment acceptors with transfer
5.5. Measures to mitigate fraud
5.6. Interoperability in credit card payments through QR codes
Section 6. Acceptance service for payments with transfer
6.1. Registration in the "Registry of payment service providers"
6.2. Integration process with new interoperable digital wallets
Section 7. Operations with debit, credit, and purchase cards
B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES Version: 4th. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 1

available during the same hours as immediate transfers: every day, during 24 hours.
3.6. Uniqueness and portability of the alias
In addition to being uniquely associated with the CBU/CVU, every alias generated must be unique and non-repetitive for the entire national financial system, allowing its linkage with another CBU/CVU, prior to disassociation from the previous one, in accordance with point 3.7.6.
3.7. Processes and functions
3.7.1. Unique and centralized correlation registry of alias-CBU and alias-CVU. It will be managed by
the CEC-BV, with the following functions:
3.7.1.1. Definition of fields and correlations.
3.7.1.2. Update (additions, deletions, and modifications, ABM) and safeguarding of information in reservoir.
3.7.1.3. Online availability for all agents of the financial system.
3.7.2. Functionality for the entry and update of aliases by clients (managed by
financial entities and PSP).
This functionality must be included in the “Account Administration for transfers” option of internet banking and mobile banking of financial entities, as well as in the interfaces provided by PSPs. Financial entities and PSPs may resolve the development of this requirement directly or through third parties. The functionality, executed when the user enters the indicated menu option, must include:
3.7.2.1. The entry of an alias for each of the client's accounts in which they wish
to receive transfers: aliases must be supported by an IT solution that ensures univocal correspondence with the CBU/CVU to which it is assigned, generating a unique value identification code for each new alias registered. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 3. Identification by alias
Version: 2nd. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 2

i. Alias composition
− Maximum number of characters: 20 (twenty)
− Minimum number of characters: 6 (six)
− Valid characters:

• Numbers: 0 1 2 3 4 5 6 7 8 9
• Uppercase letters: A B C D E F G H I J K L M N O P Q R S T U
  V W X Y Z
• Lowercase letters: a b c d e f g h i j k l m n o p q r s t u v w x y z
• Special characters: . (dot) – (hyphen)
  The rest of the characters will be considered invalid.
  The use of uppercase and lowercase letters will be indistinct (no distinction will be made between one and the other).
  ii. Content validations
  In addition to validations regarding the minimum and maximum number of characters to be used, the validity of the characters, and that the alias does not preexist in the database, there will be a list of aliases that cannot be used to avoid, for example, the use of rude or offensive language. That list will include brands that cannot be used until a methodology is determined to restrict their use to the owners of said brands.
  iii. The entry of the alias must observe authentication procedures in accordance with the rules on “Minimum requirements for the management of technology and information security risks associated with digital financial services”.
  3.7.2.2. The maintenance of aliases, adjusted to the guidelines established for
  the addition in point 3.7.2.1.
  3.7.2.3. The replication of updates in the reservoir managed by the CEC-BV.
  3.7.3. Development to allow the use of the alias in transfers and/or PCT in internet banking and mobile banking, as well as in the interfaces provided by PSPs (managed by financial entities or PSP).
  Specific developments, or modifications to existing applications, that perform transfers or PCT that allow the entry of only the alias instead of the beneficiary's data or their CBU/CVU, provided that the beneficiary client has registered the aliases of the accounts in which they wish to receive transfers. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
  Section 3. Identification by alias
  Version: 3rd. COMMUNICATION “A” 8114 Validity:
  09/10/2024 Page 3

Payment services offered from web applications, in which the client must enter payment data once for subsequent use in “online” payments, must include a functionality that allows the entry of the alias(es) previously defined by the client. In all cases, the functionalities in which the client must enter the beneficiary's alias to process immediate transfers must present the client with a confirmation screen that, at a minimum, includes the following data: type of destination account, CBU/CVU, alias, real name of the recipient, account number, financial entity or PSPCP of destination, transaction amount, and CUIT/CUIL/CDI/DNI of the recipient. The user may cancel the operation, which can only be confirmed when they effectively select the corresponding option.
3.7.4. Requirements for functionalities
The functionalities to be included in the “Account Administration for transfers” option of internet banking and mobile banking of financial entities, as well as in the interfaces provided by PSPs, must include screens that describe to the user the characteristics and implications of these facilities:
3.7.4.1. Schedule for enabling the facility.
3.7.4.2. Procedure for updating aliases.
3.7.4.3. Authentication procedure.
Similarly, the functionalities for managing transfers and/or payments must describe the procedure for entering an alias.
3.7.5. Security requirements
The processes and functions of the alias-CBU and alias-CVU facilities must:
3.7.5.1. Have an appropriate security level so that those who use them are not
exposed to the improper use of their account, guarantee the genuineness of operations, and generate the relevant record of the transaction.
3.7.5.2. Contemplate the requirements established in the rules on “Minimum requirements for the management of technology and information security risks
associated with digital financial services”.
3.7.6. Changes and reassignments of aliases
The change of alias of a CBU/CVU from one financial entity or PSPCP to another CBU/CVU in another financial entity or PSPCP must be carried out in the entity referred to last (whether financial entity or PSPCP) and through authorized channels. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 3. Identification by alias
Version: 3rd. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 4

The entity facilitating the new relationship must request confirmation from the user at the time of alias addition for the new account, after which the alias-CBU or alias-CVU relationship in the previous entity will be automatically deleted. The deletion of alias-CBU and alias-CVU relationships will be reported to the entities (financial or PSPCP) where such deletions occurred and/or to the operators designated by them. Any change in the assignment of an alias to a specific CBU/CVU can only be performed once per day and a maximum of 10 (ten) times in the calendar year. In order to ensure that historical records of transactions associated with a CBU/CVU are not altered by changes in alias-CBU and alias-CVU linkage, deletions or reassignments to another person are not permitted. The function to delete aliases, which will be available in the unique and centralized correlation registry CBU/CVU – alias managed by the CEC-BV, will be used to remove the association of an alias with a specific CBU/CVU, but the alias will remain associated with the person who created it (CUIT/CUIL) even if that person does not assign it to any CBU/CVU.
3.8. Automatic assignment of the alias
The CEC-BV will assign an alias for each of the CBU or CVU that does not have one assigned in the registry, which users can subsequently modify at any time. That alias will result from an algorithm that combines up to four simple words in the Spanish language; one of them may be replaced by a number of up to four digits. Reuse of aliases out of use or deleted that had been previously automatically assigned will not be permitted, nor will the use of identical words in a different order. Financial entities and PSPs must:
3.8.1. Replicate these updates in the respective accounts of users.
3.8.2. Inform assigned aliases via “home banking”, email, or other reliable communication means.
3.9. Access to the alias database
All access to the unique alias database must be oriented towards the platform managed by the CEC-BV. All financial entities may access the platform themselves or through third parties authorized by them that manage payments and/or transfers using internet banking and mobile banking. Connection with the CEC-BV may be:
3.9.1. direct;
3.9.2. indirect, through an enabled channel;
3.9.3. mixed (for example: additions and deletions directly; queries of the alias –
CBU/CVU association indirectly).
B.C.R.A.
NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 3. Identification by alias
Version: 1st. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 5

b. Names and surnames, position, type, and number of identity document, and electronic mail address of the top manager responsible for tasks related to information security and asset protection.
c. Location of main and alternative processing centers
(contingencies) d. List of providers offering technology services, systems, and information security. Satisfying these requirements, the Superintendence of Financial and Currency Entities (SEFyC) will issue a registration certificate and grant the applicant a number in the “Registry of interoperable digital wallets”. The receipt of this certificate is a condition for being able to provide the digital wallet service.
5.3.3. All certifications issued by administrators as stipulated in
points 5.3.1. and 5.3.2.3. must be presented to the BCRA through the corresponding application within 20 business days from when the first certification obtained was issued. After this period, the certifications will lose validity.
5.4. Integration process with new acceptors
Any financial entity or PSP registered in the interoperable digital wallets registry whose participation is required by an administrator of an electronic funds transfer payment scheme in the process of adding a new acceptor must:
− initiate the tests required by that administrator within 10 business days from the day they receive the request; and − perform all tests required of them. Within a maximum period of 60 days from the date of the first test, the administrator in question must issue in favor of the acceptor the certification required in point 5.1. of the rules on “Payment Service Providers”, identifying the providers of the digital wallet service with which the relevant integrations were completed and those with which the cited tests could not be completed. When the administrator issues a certification with digital wallets that had not satisfactorily fulfilled the integration process, they will have a period of 2 business days to notify by email to the Payment Systems Department, sdep_vigilancia_estadisticas@bcra.gob.ar and to the Supervision Coordination Department, supervision@bcra.gob.ar so that the competent area of the SEFyC evaluates whether it corresponds to initiate summary proceedings in accordance with articles 41 and 42 of Law 21.526 and concordant provisions. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 5. "Digital wallet" service
Version: 4th. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 3

5.5.3. PSI providing the digital wallet service must verify the identity of persons
requesting that service, observing for this purpose the provisions for financial entities in point 1.3. of the rules on “Savings, salary, and special accounts” (except what is required in its last paragraph, regarding the client's sworn statement) and concordant provisions – points 4.1., 4.2. and 4.16.1.–. Activities carried out in points 5.5.1.2., 5.5.1.3., 5.5.2.1. and 5.5.3. must be traceable and auditable. Integrity, protection, and safeguarding of these records must be provided.
5.5.4. When a credit card payment is initiated from an interoperable digital wallet
by reading a QR code, liability for fraud will be assumed by the wallet, except:
5.5.4.1. when the wallet processes the payment with the tokenization and authentication technical requirements and standards of the card brand;
5.5.4.2. that the transaction cannot be processed with the technical requirements and standards
made available by the card brand, when they had been implemented by all participants in the transaction except for the acquirer/aggregate. Only in this case must the acquirer/aggregate assume liability for fraud;
5.5.4.3. that there is a contrary agreement between issuers, wallets, and/or
acquirers/aggregators involved in the transaction.
Except for the case foreseen in point 5.5.4.2., acquirers cannot be debited/charged back for operations initiated from interoperable digital wallets with QR code reading that have been unauthorized or fraudulent.
5.6. Interoperability in credit card payments through QR codes
Any interoperable digital wallet that allows paying with a credit card by reading QR codes must allow making payments with any printed image, device, or terminal that is provided or facilitated by any acquirer or aggregator that allows accepting payments with said instrument by reading a QR code. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 5. "Digital wallet" service
Version: 2nd. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 5

7.3. Commissions for credit card payments initiated with QR codes
Financial entities and PSPs providing the interoperable digital wallet service from which the client initiates the payment, but have not issued the credit card used, are authorized to charge the issuer, per transaction, a commission of up to 0.07% of the transaction amount. B.C.R.A. NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
Section 7. Operations with debit, credit, and purchase cards
Version: 1st. COMMUNICATION “A” 8114 Validity:
09/10/2024 Page 2

B.C.R.A. ORIGIN OF THE PROVISIONS CONTAINED IN THE RULES ON “NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES” ORDERED TEXT ORIGINATING NORM OBSERVATIONS Sec. Point Para. Com.
Annex or
Chapter Point Para.
1.
1° “A” 2622 S/Com. “B” 8159.
1.1. “A” 2622 S/Com. “B” 8159.
1.1.1. “A” 2622
1.1.2. “A” 2622
1.2. “A” 2622
2.
2. “A” 6510 S/Com. “A” 7533.
2.1. “A” 6510 S/Com. “A” 7533.
2.1.1. “A” 6510
2.1.2. “A” 6510
2.1.3. “A” 6510
2.2. “A” 6697 S/Com. “A” 7533 and Bulletin CIMPRA
518.
2.3. “A” 6510 S/Boletín CIMPRA 518 and Com. “A”
7533.
2.3.1. “A” 7533 S/Boletín CIMPRA 518.
2.3.2. “A” 7533 S/Boletín CIMPRA 518.
2.4. “A” 6510 S/Boletín CIMPRA 518 and Com. “A”
7533.
3.
3.1. “A” 6044 Unique S/Com. “A” 6510 and 7533.
3.2. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.3. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.4 “A” 6044 “ S/Com. “A” 6510 and 7533.
3.5. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.6. “A” 6044 “ S/Com. “A” 6510, 7533 and 8114.
3.7. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.7.1 “A” 6044 “ S/Com. “A” 6510 and 7533.
3.7.2. “A” 6044 “ S/Com. “A” 6109, 6510, 7533, 7783
and 8114 and Bulletin CIMPRA 516.
3.7.3. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.7.4. “A” 6044 “ S/Com. “A” 6510 and 7533.
3.7.5. “A” 6044 “ S/Com. “A” 6510, 7533 and 7783.
3.7.6. “A” 8114 S/Boletín CIMPRA 516. Includes
normative clarification.
3.8. “A” 6215 S/Com. “A” 6510, 7533, 8103 and
8114. Includes normative clarification.
3.8.1. “A” 6215
3.8.2. “A” 6215 S/Com. “A” 7533.
3.9. “A” 8114 S/Boletín CIMPRA 516.
4.
4.1. “A” 6425 1. S/Com. “A” 6668.
4.2. “A” 7346 1. S/Com. “A” 7362.
4.3. “A” 7769 9.
4.4. “A” 7769 10.

NATIONAL PAYMENTS SYSTEM – PAYMENT SERVICES
ORDERED TEXT ORIGINATING NORM
OBSERVATIONS Sec. Point Para. Com. Annex or
Chapter Point Para.
5.
5.1. “A” 7462 1. S/Com. “A” 7514.
5.2. “A” 7363 S/Com. “B” 12223.
5.3. “A” 7462 10. S/Com. “A” 7533. Includes normative
clarification.
5.3.2.2. “A” 7613 5.
5.3.3. “A” 7769 12.
5.4. “A” 7769 5. S/Com. “A” 8114.
5.5. “A” 7328 2.
Penultimate.
S/Com. “A” 7462 and 7919.
5.5.1. “A” 7328 2.
5.5.1.1. “A” 7462 8.
5.5.1.2. “A” 7328 2.b) S/Com. “A” 7462.
5.5.1.3. “A” 7328 2.c) S/Com. “A” 7462.
5.5.1.4. “A” 7328 2.
Penultimate.
5.5.1.5. “A” 7463 1.
5.5.2. “A” 7328 2.
First
S/Com. “A” 7462.
5.5.2.1. “A” 7328 2.a)
5.5.2.2. “A” 7463 2.a)
5.5.2.3. “A” 7463 2.b)
5.5.2.4. “A” 7463 2.c)
5.5.3. “A” 7462 3.
5.5.4. “A” 8032 1.
5.6. “A” 8032 2.
6. 6.1. “A” 7919
6.2. “A” 7769 6.
7.
7.1. “A” 6212 S/Com. “A” 7919
7.2. “A” 6680 S/Com. “A” 6696, 7305 and 7850.
7.3. “A” 8032 3.