Compilation of Payment System Rules - Modifications in Book VII and Creation of Book X

Compilation of Payment System Rules - Modifications in Book VII – Creation of Book X Montevideo, March 1, 2024 CIRCULAR NO. 2449 Ref: It is brought to your attention that this Central Bank adopted, on February 28, 2024, Resolution No. D/57/2024, which is attached.

DE LOS HEROS MENDEZ, ANA PAYMENT SYSTEM MANAGEMENT (Exp. No. 2023-50-1 Diagonal Fabini 777 - C.P. 11100 - Tel.: (598 2) 1967 - Montevideo, Uruguay - www.bcu.gub.uy

BOARD OF DIRECTORS - RESOLUTION Montevideo, February 28, 2024.

BOARD OF DIRECTORS

HAVING VIEWED: the definitions established in Article 80 of the Compilation of Payment System Rules and the competence of the Central Bank of Uruguay in matters of regulation and control of the interoperability of electronic payment processing terminal networks and the interconnection of said networks with issuers of electronic payment media and acquirers.

WHEREAS: I) that Article 14 of Law No. 18.910 of May 25, 2012, as amended by Article 496 of Law No. 20.075 of October 20, 2022, assigned to the Central Bank of Uruguay the competence to establish rules and technical standards that ensure the compatibility and interoperability of payment processing terminal networks and the interconnection of said networks with issuers of electronic payment media and acquirers, as well as the correct and secure functioning of said electronic payment system; II) that pursuant to the aforementioned legal norm, the Central Bank of Uruguay will also establish criteria to control the effective application of said rules and standards, promoting and defending competition, economic efficiency, and market development; III) that in the event of no agreement between parties, it is the competence of the Central Bank of Uruguay to establish the tariffs to be paid by the acquirer, taking into account the preservation of the aforementioned principles, the various cost components of the intervening actors, and considering the current tariffs for equivalent services in the local market, as well as in other comparable markets; IV) that Decree No. 306/014 of October 13, 2014 regulates the exercise of the competencies referred to in Findings I) to III) based on the legal regulations prior to the modification of competencies established by the aforementioned Article 496 of Law No. 20.075 of October 20, 2022.

CONSIDERING: I) that, with the aim of favoring a solid, efficient, innovative, and accessible payment system, symmetric, transparent, and updated regulatory rules must be issued, and the regulatory framework must attend to the principle of proportionality based on the risk that each type of entity or system generates to the National Payment System; II) that, given the implementation of the fast payment system, the definition of electronic payment media acquirers must be extended to those institutions that intervene in payment systems with national or international electronic fund transfers; III) that payments with electronic fund transfers do not imply the authorization of a brand/logo, and the risks assumed by acquirers in the case where they are national differ from those exposed by debit, credit, and prepaid card acquirers; IV) that, in this sense, it is understood to be adequate and in accordance with its object or business, that electronic money issuing institutions may provide the acquiring service exclusively for payment with electronic fund transfers located in the country, which implies the immediate extinction of the obligation with respect to the provider without any credit being involved; V) that, by virtue of the new wording of Article 14 of Law No. 18.910 of May 25, 2012, it is necessary to modify the Regulation approved by Decree No. 306/014, adjusting it to the responsibilities and competencies granted to the Central Bank of Uruguay from January 1, 2023 (as well as to the sanctioning power granted by Article 22 of Law No. 18.573 of September 13, 2009, as amended and concordant), replacing references to URSEC, electronic payment processing terminal, and the denomination of charges for network use, and incorporating the concept of brand/logo; VI) that, from what is established by Article 10 of Law No. 18.159 of July 20, 2007, as amended by Article 136 of Law No. 19.996 of November 3, 2021, the Commission for the Promotion and Defense of Competition is the competent body to intervene in cases of anti-competitive practices, discriminatory treatment, or other infringements of current regulations.

ATTENTIVE: to the above, to what is established by Law No. 16.696 of March 30, 1995, as amended by Law No. 18.401 of October 24, 2008, to Article 14 of Law No. 18.910 of May 25, 2012, as amended by Article 496 of Law No. 20.075 of October 20, 2022, to Article 10 of Law No. 18.159 of July 20, 2007, as amended by Article 136 of Law No. 19.996 of November 3, 2021, to Article 22 of Law No. 18.573 of September 13, 2009, to Law No. 19.210 of April 29, 2014, and amendments to the Legal Advisory Opinions No. 2023/0255 of June 29, 2023 and No. 2023/0453 of November 22, 2023, to what was reported by the Payment System Management on February 21, 2024, and other background information appearing in files No. 2023-50-1-1052 and No. 2023-50-1-2335,

IT IS RESOLVED:

1. Substitute the wording of literals i) and o) of Article 80 of Part One of Book VII of the Compilation of Payment System Rules, with the following:

i. Acquirer: Entity duly authorized by one or more brands/logos, which is responsible for the affiliation of merchants and other service providers that accept the electronic payment medium and which makes payments for transactions processed to said merchants and service providers. In cases where acquiring corresponds to payments with electronic fund transfers from abroad in which no brand/logo is involved, it shall suffice for the local acquirer to be authorized by the Central Bank of Uruguay under the terms of Article 81.5 of this Compilation.

o. Transaction Switching Service Provider or Switch: entity that provides interconnection between Processors, Issuers, and Acquirers.

2. Incorporate the following literals into Article 80 of Part One of Book VII of the Compilation of Payment System Rules:

v. payment with transfer: extinction of an obligation generated by the acquisition of goods or services through electronic fund transfer.

w. Acquirer of national fund transfer payments: Entity that, complying with the standards determined by a clearing operator, is responsible for affiliating merchants and other service providers in order to provide them with access to the national electronic fund transfer payment service.

x. Charges for network use or interconnection tariff: sum of money that the Acquirer agrees to pay the Administrator for the use of the electronic payment processing terminal network.

y. Provisional interconnection conditions: transitional conditions established by the Central Bank of Uruguay (BCU) when an agreement is not reached between an Administrator and an Acquirer regarding charges or the remaining interconnection conditions, with the purpose of implementing interconnection between them until the adoption of a final resolution by the Central Bank of Uruguay.

z. Interconnection Agreement: is the agreement entered into between an Acquirer and an Administrator, which establishes the charges and the remaining conditions that enable interconnection between the parties.

aa. Interconnection: is the physical and functional connection of an Acquirer with an Administrator, with the object that the electronic payment media issued can be used in the network that the Administrator makes available, provided that it verifies the requirements for interconnection established by the Acquirer.

ab. Network Interoperability: property by which electronic payment media can be used in any electronic payment processing terminal network, within the framework of an interconnection agreement.

ac. Requirements for interconnection: list of functional and technical specifications, requirements and protocols in matters of security and certifications of equipment and processes, which the Acquirer establishes generally for all Administrators, so that the payment media issued by the Issuer can be used in the Administrator's network.

ad. Electronic payment processing terminal: access channel that facilitates the initiation of an electronic payment, transmitting or generating transaction data for its authorization and subsequent processing (includes POS, QR, among others).

3. Substitute the wording of Article 93 of Title II of Part Two of Book VII of the Compilation of Payment System Rules, with the following:

ARTICLE 93 (GENERAL, SPECIAL AND MIXED ELECTRONIC MONEY ACTIVITIES). Electronic money issuing institutions (EMIIs) may carry out:

• issuance operations of electronic money instruments,
• conversion to cash,
• transfers,
• payments,
• automatic debits, and
• any other movement or operation related to the monetary value of the issued electronic money instrument, including reloads.

Additionally, they may carry out activities of:

• clearing and settlement of issued payment instruments,
• affiliation of merchants and establishments for the purpose of using the instrument,
• information processing,
• payments to merchants,
• payment and collection services,
• acquiring of merchants and commercial establishments for the purpose of providing them with access to the national electronic fund transfer payment service.

The Central Bank of Uruguay may authorize electronic money issuing institutions to carry out other activities that in its judgment are related to their object. The same must be reported at the time of processing the authorization request.

Those activities that wish to be incorporated after the granting of the authorization must be reported to the Payment System Management providing the corresponding information, who will issue a ruling within a period of 90 (ninety) business days. Said period shall be suspended when an extension of information and/or supply of documentation is necessary.

Activities developed under the supervision of the Financial Services Superintendence are excluded. This exclusion shall not apply to partner(s) or shareholder(s) of electronic money issuing institutions.

4. Incorporate Articles 81.6.1 and 81.6.2 into Title II of Part One of Book VII of the Compilation of Payment System Rules, with the following text:

ARTICLE 81.6.1 (AUTHORIZATION OF NATIONAL FUND TRANSFER PAYMENT ACQUIRERS) Acquirers of electronic payment media with national fund transfers must request authorization from the Payment System Management to develop this activity, complying with the requirements established in Article 81.6.2.

ARTICLE 81.6.2 (MINIMUM REQUIRED INFORMATION): For the purpose of obtaining the required authorization, acquirers of electronic payment media with national electronic fund transfers must present to the Payment System Management the following information and documentation:

a) Company name, indicating legal name, trade name if applicable, real and constituted domicile, registration number in the Single Tax Registry of the General Directorate of Taxation and in the corresponding security body, telephone, email address, and website.

b) Description of the Business Plan.

c) Technological specifications to be used for the provision of the service.

d) Information Security Policies and Procedures, business continuity plans, and contingency plans for critical processes, products, and services.

e) Model of agreements entered into with clients or other actors for the purpose of complying with its activity.

The Payment System Management will regulate the minimum content of information and documentation that it will require for the purpose of complying with what is established in literals a) to e), and may request any other additional information it deems necessary.

5. Create in the Compilation of Payment System Rules, BOOK X - INTEROPERABILITY IN THE PAYMENT SYSTEM.

ARTICLE 173 (OBJECT). This book refers to the interoperability of electronic payment processing terminal networks and the interconnection of their administrators with issuers of electronic payment media and acquirers, in accordance with what is established in Article 14 of Law No. 18.910 of May 25, 2012, as amended and concordant.

ARTICLE 173.1 (PURPOSE). The objective of this Book is to define and establish the principles, mechanisms, and procedures that will govern the interoperability of the various electronic payment processing terminal networks and the interconnection of their administrators with the different issuers of electronic payment media and acquirers.

ARTICLE 173.2 (SCOPE). Interconnection agreements will be freely negotiated between the parties and will be publicly accessible, without prejudice to what is established in this Book and in the current legal framework.

ARTICLE 173.3 (INTERCONNECTION PRINCIPLES). Interconnection agreements will be governed by the following principles:

Obligation: Acquirers and Administrators have the right to request interconnection and, in turn, are obligated to grant it under the terms of this Book (provided that it is technically feasible). In the case of Acquirers, the obligation to grant interconnection will be configured provided that Administrators comply with the interconnection requirements defined by the Acquirer.

Agreement between parties: Administrators and Acquirers have freedom to agree on prices, terms, and conditions of interconnection respecting the guidelines of this Book.

Non-discriminatory treatment: Administrators and Acquirers have the right to obtain, in the interconnection they request, technical and economic conditions equivalent to those that each one grants to third parties or affiliated companies. Discriminatory treatment, in this context, will constitute a sanctionable offense as provided in Article 173.9 of this Book.

ARTICLE 173.4 (INTERCONNECTION AGREEMENTS). Any Administrator or Acquirer requesting interconnection must present their request in writing to the other party, presenting a copy of said request and its receipt confirmation before the Central Bank of Uruguay.

Interconnection will be agreed upon on the following bases:

A) The parties will agree on the charges for network use and the remaining interconnection conditions that form part of the agreement. Neither the Issuer nor the Acquirer may charge any fee to the Administrator for allowing the electronic payment medium to be used in the Administrator's network.

B) The Administrator or Acquirer requesting interconnection will have the right to contractual conditions equivalent to those that the other party maintains with other Administrators or Acquirers, or their affiliated companies, under similar circumstances. This without prejudice that when interconnection is requested by the Administrator, the Acquirer to whom the request is directed will not be obligated to pay any fee to the Administrator for the interconnection requested by it.

C) Administrators or Acquirers may not suspend or interrupt interconnection, except in cases of force majeure, fortuitous event, or extra-ordinary cause not attributable to them, and in all cases must notify their counterparty and the Central Bank of Uruguay of the suspension or interruption immediately. They may also suspend or interrupt interconnection due to serious breach of the Agreement, with prior express authorization from the Central Bank of Uruguay.

ARTICLE 173.5 (BCU INTERVENTION). In the event that an agreement is not reached between the parties regarding charges or the remaining interconnection conditions and more than 30 calendar days have elapsed since the presentation of the request referred to in the previous article, the requesting party may communicate the situation to the Central Bank of Uruguay, requesting its intervention. The request must contain a well-founded presentation of its claims, indicating in detail all and each of the concepts related to the request.

The Central Bank of Uruguay will proceed, within 10 business days following, to give notice to the other involved party of the request presented and to require from it the presentation of a well-founded presentation of its claims and the grounds for which it did not grant the requested interconnection, detailing all and each of the concepts related to its denial of the request, having a maximum period of 10 business days to present such information. The Payment System Management may regulate the manner in which the aforementioned request must be presented.

The Central Bank of Uruguay may seek, within a period not exceeding 10 business days from the expiration of the previous deadline, an agreement between the parties.

If the disagreement persists, the Central Bank of Uruguay may adopt a final resolution or request, within the following 30 calendar days, the information it deems pertinent to resolve the disagreement, which must be delivered within 30 calendar days of having been requested.

In all cases, the Central Bank of Uruguay will have a period of 60 calendar days to issue a final resolution, counting from the day following the expiration of the previous deadline that had been configured.

In the event that the disagreement refers to charges, the Central Bank of Uruguay, in the exercise of its competencies, will proceed to fix them. For this purpose, the Central Bank of Uruguay may determine reference values for said charges.

Provisional interconnection conditions. At any stage of the procedure, the Central Bank of Uruguay, at the request of a party or in the event of any legal cause being configured, will adopt a resolution within a maximum period of 45 calendar days counting from the request or from the date the configuration of the cause is known, defining provisional interconnection conditions. The resolution must respect the principles of producing the least impact on the parties and guarantee the normal functioning and efficiency of the networks and the payment system of the economy, as well as the security of the information transmitted through the networks. The Central Bank of Uruguay must give prior notice of said draft resolution to the involved parties. The conditions will remain in effect until the notification of the final resolution and must take into account the terms and conditions usually agreed upon by each party with other Administrators or Acquirers, as appropriate.

At any time before the Central Bank of Uruguay issues its final resolution, the interested party may withdraw the request for regulator intervention, without prejudice to the regulator's power to continue intervention in cases that correspond according to the interest of users of payment services.

In the event that the existence of anti-competitive practices, discriminatory treatment, or other infringements of current regulations is proven, the Central Bank of Uruguay will report to the Commission for the Promotion and Defense of Competition, which functions as a decentralized body within the Ministry of Economy and Finance.

In all cases in which the Central Bank of Uruguay gives notice to one of the parties of information or documents presented by the other party, it will safeguard information that, upon well-founded request by the interested party, the Central Bank of Uruguay qualifies as confidential, secret, or reserved.

ARTICLE 173.6 (EVALUATION CRITERIA). For the purposes of what is provided in the previous article, the Central Bank of Uruguay must take into account the following criteria:

1. Equivalence in access and use conditions, avoiding discriminatory practices.
2. The adequate functioning of the payment system.
3. The reasonableness of the interconnection requirements defined by the Acquirer, so that these do not constitute a barrier to competition and must comply with industry best practices for electronic payment media.
4. The protection of the public interest, expressed in the rights of users of payment services and in the functioning of the system as a factor of national development.

ARTICLE 173.7 (BCU OBLIGATION TO INFORM AND PUBLICATION OF AGREEMENTS). Any interconnection agreement and its modifications must be presented by one of the parties to the Central Bank of Uruguay within a period of 5 business days from its celebration or modification.

The Central Bank of Uruguay will keep a register of interconnection agreements and publish their content within a maximum period of 10 business days, on its website, without prejudice to any objections or observations that the Central Bank of Uruguay may make.

The Central Bank of Uruguay may, upon well-founded request by the interested party, safeguard information that it qualifies as confidential, secret, or reserved.

The Payment System Management will define and communicate the information that will not be publicly accessible.

ARTICLE 173.8 (MINIMUM CONTENTS OF INTERCONNECTION AGREEMENTS). Without prejudice to what is established in the preceding articles, interconnection agreements must contain, at least, the following information:

1. Description of the interconnection services subject to the agreement.
2. Determination of charges, mechanisms for adjusting them, and payment conditions.

DIRECTORATE - RESOLUTION 3. Technical and operational characteristics of the interconnection, including the requirements for interconnection, the authorization and homologation systems for transactions, and the interconnection systems to be used. 4. Quality and reliability parameters of the interconnection, as well as precautions to be adopted for the operation and maintenance of the interconnection to ensure its permanent availability, and aspects of security, confidentiality, and data protection. 5. Conditions for the implementation and development of the interconnection, including, where applicable, dates or periods for compliance with assumed commitments. 6. Determination of the responsibility of each of the parties, its limitation, and the scope, if any, of indemnifications or compensations. 7. Deadlines, duration, and renegotiation of the agreement. 8. Grounds for non-compliance that enable the termination of the agreement. 9. Consents for the use of or access to information. If during the term of an interconnection agreement the Acquirer were to modify the Interconnection Requirements, it must communicate this to its counterparty and to the Central Bank of Uruguay, which shall establish the minimum adaptation period to be granted to the Administrators for compliance with the new requirements. The Central Bank of Uruguay will publish the new requirements and the adaptation period on its website, with the exception of information that qualifies as confidential, reserved, or secret, upon a well-founded request by the interested party. In cases where necessary, these contents may be clarified and adjusted in their technical and operational aspects through the issuance by the Central Bank of Uruguay of general norms and specific instructions. The Central Bank of Uruguay may regulate the technical and operational conditions of the interconnection requirements. ARTICLE 173.9 (PENALTIES). Infractions of the provisions of this Book shall be sanctioned by the Central Bank of Uruguay, under the terms established by Article 22 of Law No. 18.573 of 09/13/2009, as amended and concordant. 6) Establish that the entry into force of Book X of the Compilation of Payment System Regulations will occur at the moment the repeal of Decree No. 306/014 of October 13, 2014, takes effect. R.N°:D-57-2024 CIRCULAR NO. 2449

DIRECTORATE - RESOLUTION 7) Entrust the communication of the provisions herein, by means of Circular, to the Payment System Management. (Today's Session – Minutes No. 3696) (File No. 2023-50-1-1052) Jorge Christy General Secretary Aar/am/ds Publishable Resolution R.N°:D-57-2024 Signatory: Jorge Eduardo Christy Davies Date: 02/28/2024 18:34:52 CIRCULAR NO. 2449