Regulation on the supervision of non-bank payment service providers

1 Note: The translation is unofficial, for information purpose only REGULATION on the supervision of non-bank payment service providers Published in the Official Monitor of the Republic of Moldova no. 405-408 on 30.07.2025, art. 616 Approved by the Decision of the Executive Board of the National Bank of Moldova No. 162 of July 17 2025 In force: from July 30 2025 Chapter I GENERAL PROVISIONS

1. The Regulation on the supervision of non-bank payment service providers (hereinafter the Regulation) establishes the rules for organizing and conducting the control procedure applied to non-bank payment service providers (payment institutions, electronic money institutions, postal service providers as payment service providers), as well as the criteria for applying remedial measures and sanctions against non-bank payment service providers, direct/indirect holders, including beneficial owners, management bodies, members of management bodies and key personnel within non-bank payment service providers.
2. The concepts and terms used in this Regulation have the meaning established by Law on the National Bank of Moldova No. 548/1995 (hereinafter – Law No. 548/1995), Law on Payment Services and Electronic Money No. 114/2012 (hereinafter – Law No. 114/2012) and the Regulation on licensing and registration of payment institutions, electronic money institutions and postal service providers acting as payment service providers and/or electronic money issuers, approved by the Decision of the Executive Board of the National Bank of Moldova No. 11/2024.
3. The main characteristics of the supervision of non-bank payment service providers carried out through the control procedure are: 3.1. supervision is based on the assessment of risks, current and/or historical indicators of the activity of non-bank payment service providers, in order to predict a potential negative impact on their activity and/or the payment systems in which they participate; 3.2. the purpose and manner of conducting the supervision process are proportionate, appropriate and adapted to the risks to which non-bank payment service providers are/may be exposed; 3.3. the results of the supervision process are oriented towards the actions and/or remedial measures to be applied by non-bank payment service providers in order to comply with the regulatory framework.
4. The purpose of the control is to verify the compliance with the provisions of Law No. 114/2012, Law on Foreign Exchange Regulation No. 62/2008 (hereinafter – Law No.

Informaţie Publică – Document creat în cadrul BNM. 62/2008) and the normative acts issued for their application, including the verification of organizational structures, procedures and mechanisms, the assessment of the efficiency of the procedures for identifying, managing, monitoring and reporting the risks to which the non-banking payment service provider is or could be exposed, the adequacy of internal control mechanisms, the assessment of the actions taken by the management bodies of the non-banking payment service provider in order to effectively manage the identified risks, the assessment of the quality of the ownership structure and the examination of the information submitted by the non-banking payment service provider to the National Bank of Moldova (hereinafter – NBM). 5. During the control, will be determined the general situation of the non-bank payment service provider, the causes and factors that affect the safety and stability of its activity and the payment systems in which it participates. 6. Within the supervision process, the notification of acts of individual character /documents shall take place through electronic means of communication, such as official e-mail accounts and/or the NBM Information systems, in accordance with the User Guides. If the act of individual character/document cannot be notified by electronic means of communication, the notification shall be made by applying, as the case may be, one of the notification forms provided for in Article 112 paragraph (1) letters a) to d) and f) of Law No. 548/1995. 7. If the notification forms applicable according to point 6 do not promise success, including if the recipient is not available/cannot be contacted, the provisions of Article 112 paragraph (10) of Law No. 548/1995 shall be applied. 8. The act of individual character /document is considered notified under the conditions provided for in Article 112 paragraph (1) letter a), paragraphs (3) to (5), (8) to (10) of Law No. 548/1995, depending on the form of notification applied. 9. Within 20 days from the date of registration in the Register of Payment Institutions /Register of Electronic Money Institutions, non-bank payment service providers shall submit information regarding their correspondence addresses, including their own e-mail addresses, as well as those of their direct and/or indirect holders and beneficial owners, as the case may be, and shall request the creation of user account(s) within the NBM Information Systems. Non-bank payment service providers shall update information regarding correspondence addresses, e-mail addresses and/or access rights to accounts within the NBM Information Systems, within 20 days from the date of its modification. 10. In order to ensure the notification of acts of individual character /documents within the supervision process, direct/indirect holders, including beneficial owners of the non-bank payment service provider who are non-residents of the Republic of Moldova, shall designate an authorized representative in the Republic of Moldova, in accordance with civil legislation. Chapter II TYPES OF CONTROLS 11. The control of non-bank payment service providers can be: 11.1 depending on the aim of control:

3 11.1.1 complex control – the non-bank payment service provider is fully subject to verification in accordance with the license held; 11.1.2 thematic control – the non-bank payment service provider is subject to verification in a specific area or areas in accordance with the license held and/or the removal of violations for which remedial measures have been prescribed and/or sanctions have been applied by the NBM, following the previously carried out control; 11.2 depending on the way it is carried out: 11.2.1 planned control – is carried out based on a control plan approved by the NBM; 11.2.2 unannounced control – not provided for in the NBM control plan, may be initiated in response to an event or incident that may have an impact on the payment system in the Republic of Moldova or the activity of the non-bank payment service provider or payment service users. 12. The purpose of the control may be, without being limited to, verification of the initiation of the activity in accordance with the license held. 13. The control plan shall be elaborated based on the assessment of the risks to which non-bank payment service providers are/may be exposed, taking into account the violations detected during previous controls, the measures taken by them to stop and/or eliminate of the violations previously detected, the results of continuous monitoring, and the notifications received by the NBM. Chapter III PERFORMING THE CONTROL 14. To perform the control, the NBM shall issue the decision regarding performing the control, in accordance with the provisions of Article 751 paragraph (3) of Law No. 548/1995. The decision regarding performing the control can be issued by the governor, the first vice-governor, the vice-governors, the head of the subdivision within the NBM with responsibilities to supervise non-bank payment service providers. 15. The decision regarding performing the control shall contain, at least, the name of the non-bank payment service provider subject to the control, the type of control, the inspectors designated to perform the control (hereinafter - inspectors), the period subject to the control, the date of initiation of the control, the position, surname, first name and signature of the person who issued the decision. 16. The decision regarding performing the control shall be notified to the non-bank payment service provider in accordance with the provisions of points 6 to 8. 17. The NBM, together with the decision regarding performing the control, shall notify the list of information/documents required to be submitted by the non-bank payment service provider on the date of the start of the control. During the control, the NBM may request additional information/documents to be submitted by the non-bank payment service provider, and the time limit for completing the control procedure shall be suspended in accordance with Article 11 paragraph (38 ) of Law No. 548/1995. 18. In the case of an unannounced control, the decision regarding performing the control and the list of information/documents required to be submitted by the non￾bank payment service provider shall be notified to the provider on the date of commencement of control.

Informaţie Publică – Document creat în cadrul BNM. 19. The decision regarding performing the control may be modified by issuing a decision by the persons indicated in point 14. 20.During the control, the NBM may conduct on-site inspections in accordance with the provisions of Article 751 paragraph (4) of Law No. 548/1995, Article 94 paragraph (1) letter b) of Law No. 114/2012 and of this Regulation. 21. The on-site inspection may be carried out on the basis of the decision regarding performing the control, issued in accordance with the provisions of points 14 to19, if it provides for the conduct of the on-site inspection and the data regarding the inspection, or on the basis of the NBM decision containing at least the information provided for in Article 751 paragraph (4) of Law No. 548/1995. 22. During the control, meetings may be organized on matters related to the control, with physical presence or by electronic means of communication, between inspectors and the management bodies, their members, direct/indirect holders, including beneficial owners of the non-bank payment service provider, key personnel and employees of the non-bank payment service provider, if necessary, other relevant persons may also participate. 23. The persons mentioned in point 22 are obliged to collaborate with the inspectors, including: 23.1 to respond in due time to requests made by inspectors and to cooperate in good faith; 23.2 to provide the inspectors with the requested information, documents and explanations, as appropriate, in electronic format, on paper, in case of providing copies or extracts from the requested documents, to confirm their originalilty/authenticity by signature; 23.3 to ensure, in the event of an on-site inspection, access for inspectors to the premises and service rooms of the non-bank payment service provider during working hours and, where appropriate, to provide inspectors with a separate secure office from the workplaces of the non-bank payment service provider's staff, unless there are operational constraints in this regard; 23.4 to give inspectors the opportunity to use/access data from the non-bank payment service provider's information systems in accordance with the aim of control, offering them the viewing access to all information systems, databases, IT tools, electronic files and necessary data used for this purpose. 24. For the purposes of facilitating collaboration within the control: 24.1 at the date of initiation of the control, the management body/the member of the management body of the non-bank payment service provider shall determine and communicate to the inspectors the contact persons responsible on behalf of the non-bank payment service provider for organizing the interaction with the inspectors in each of the areas subject to control; 24.2 Direct/indirect holders, including beneficial owners of the non-bank payment service provider who are non-residents of the Republic of Moldova, shall notify the authorized representative in the Republic of Moldova in accordance with point 10. 25. Inspectors, who carry out the control, have the right:

5 25.1 to have physical access to the premises and rooms of the non-bank payment service provider subject to control, its branches, payment agents and providers of outsourced functions, if necessary, accompanied by employees of the non-bank payment service provider subject to control; 25.2 to request and obtain all information and documents necessary for the control (in electronic form, on paper, originals or copies, extracts from them, confirmed by signature), including the bylaws, regulations and other internal documents, reports and accounts, internal documents drawn up as a result of the performed operations, accounting documents, external and internal business documents (contracts, certificates, minutes, requests, information notes), information and documents relating to direct/indirect holders, including the beneficial owners of the payment service provider, as well as to payment service users/electronic money holders, payment agents, providers of outsourced functions, counterparties of the non-banking payment service provider; 25.3 to request and obtain written explanations from the persons referred to in point 22, the payment agents and the providers of outsourced functions for the purpose of collecting the information necessary for the control; 25.4 to use technical means (audio, video, photo) for the attestation of the established facts, to use technical means belonging to the NBM or provided by the non-banking payment service provider, including computers, other devices, electronic information carriers, copying equipment, scanners, telephones, to introduce into the premises of the non-banking payment service provider and to take out from them technical means belonging to the NBM; 25.5 to have access to the resources of information systems, electronic databases and technical means used by the non-bank payment service provider for the purpose of carrying out the activity or in the event of the intention to carry out the activity in accordance with the license held and to request a demonstration and explanation of the functioning of these systems; 25.6 to contact the external auditors of the non-bank payment service provider, to interview any other person, with that person's consent, for the purpose of establishing the facts (events) and circumstances necessary in connection with the control, including for the purpose of confirming the data contained in the documents and information obtained from the non￾bank payment service provider. 26. The non-bank payment service provider subject to control has the following rights: 26.1 be informed about the start of control; 26.2 to provide explanations and comments on the areas subject to verification during the control; 26.3 to be notified of the results of the control and the NBM decisions issued on them; 26.4 to present objections and explanations regarding the preliminary act regarding the results of the control.

Informaţie Publică – Document creat în cadrul BNM. 26.5 to be notified of the facts and circumstances relevant to the unfavorable decision to be issued on the results of the control (act regarding the results of the control) and to present the opinion in this regard (written hearing). 27. The persons referred to in point 22 shall not have the right to carry out personal control over inspectors, technical means, including telephones, electronic information carriers in their possession, to pick up these means or to prevent inspectors from using these means when carrying out control. 28.In the case of carrying out an on-site inspection, the documents and paper materials requested by the inspectors shall be presented in the allocated premises to the inspectors in the manner and within the time limits established by them. 29. During the absence of inspectors in the allocated premises, the non-bank provider shall be responsible for ensuring the integrity of the documents and information presented to the inspectors. 30.Without prejudice to point 29, inspectors have the obligation to ensure the integrity and the return at the end of the on-site inspection of paper documents (originals) presented by the non-bank payment service provider. 31. For the failure to comply in due time and/or for improper compliance by the non￾bank payment service provider of the requirements submitted by the inspectors during the control, as well as for preventing the exercise of the supervisory and control duties, shall be held responsible, as the case may be, management bodies, members of management bodies of the non-bank payment service provider, as well as the key personnel within it. 32. For the purposes of Article 97 letter c) of Law No. 114/2012, obstruction of the exercise of the supervisory and control duties, means any of the following situations: 32.1 failure to give access for inspectors to the premises and service rooms of the non-bank payment service provider subject to control, to its branches; 32.2 failure to give access to the resources of information systems, electronic databases and technical means used by the non-bank payment service provider for the purpose of carrying out the activity or in the event of the intention to carry out the activity in accordance with the license held; 32.3 failure to provide the information, documents, explanations requested for the purpose of exercising the supervisory duty and carrying out the control, and/or failure to meet the time limits /improperly meet the requirements submitted by the inspectors during the control. 32.4 carrying out other actions that prevent the exercise of the inspectors' rights provided for in point 25; 33. After carrying out the control procedure, including in the event of obstruction of the exercise of the supervisory and control duties, the act regarding the results of the control is drawn up in accordance with the provisions of Article 751 paragraph (7) of Law No. 548/1995 and the provisions of Chapter IV. 34.The control procedure shall be completed within the time limit provided for in Article 751 paragraph (11) or paragraph (13) of Law No. 548/1995, as the case may be. Chapter IV DRAFTING THE ACT REGARDING THE RESULTS OF THE CONTROL

7 35. The act regarding the results of the control, including the preliminary act, shall contain at least the following information: date and number of the decision regarding performing the control; name and headquarters of the non-bank payment service provider subject to control; period of activity subject to control; information regarding the results of the control; surname, first name and signatures of the NBM inspectors who carried out the control. 36.The results of the control shall reflect (not limited to this) the aspects subject to verification; general conclusions (assessment of the general situation based on the violations found); the aspects found (both those that constitute violations within the meaning of Law No.114/2014, Law No. 62/2008 and the normative acts issued for their implementation, and those that do not represent violations, but which have or may have an impact on the activity of the non-bank payment service provider), presented based on: 36.1 analysis of information, documents, explanations received during the control, including those obtained by the NBM from public authorities and other persons, in connection with carrying out the supervisory duties; 36.2 facts and circumstances, including inactions, relating, as the case may be, to the non-bank payment service provider, its branches, payment agents; management bodies; members of management bodies; key personnel; direct/indirect holders, including its beneficial owners; 37. The presentation of information in the act regarding the results of the control, including in the preliminary act, must comply with the following principles: 37.1 objectivity and accuracy – the assertions, assessments and conclusions of inspectors must be supported by analyses, data and figures, including confirming documents; 37.2 completeness - the act must be complete, encompassing all areas, directions of activity of the non-bank payment service provider (structural subdivision of the provider) that have been subject to control; 37.3 clarity and coherence - the information must be displayed in a legible, logical and precise manner, in order to avoid excessive mistakes and repetitions. 38. The preliminary act regarding the results of the control shall be notified to the non￾bank payment service provider subject to control, in accordance with the provisions of points 6 to 8. 39. The non-bank payment service provider subject to control may, within 5 working days from the date of notification of the preliminary act regarding the results of the control, present in writing, if applicable, objections and/or explanations thereon, attaching the relevant documents in this regard, in accordance with the provisions of Article 113 of Law No. 548/1995. 40.After the examination of the objections and/or explanations presented regarding the preliminary act regarding the results of the control by the non-bank payment service provider or in the absence of their presentation, upon expiry of the term referred to in point 39, the act regarding the results of the control shall be drawn up and notified to the non-bank payment service provider and/or, as the case may be, to the persons referred to in the act, in accordance with the provisions of points 6 to 8.

Informaţie Publică – Document creat în cadrul BNM. 41. If the objections and/or explanations have been submitted regarding the preliminary act regarding the results of the control, simultaneously with the notification of the act regarding the results of the control, the NBM will notify the non-bank payment service provider and/or, as the case may be, the persons referred to in the act, regarding the acceptance/non-acceptance of the objections/explanations submitted. 42.If, based on the results of the control, an unfavorable decision is to be issued for the non-bank payment service provider subject to control and/or, as the case may be, for the persons referred to in the act, simultaneously with the notification of the act regarding the results of the control, they are proposed, for the purpose of hearing, to present their opinion in writing, to the NBM, within 10 working days from the date of notification. The written opinion shall be submitted in accordance with the provisions of Article 113 of Law No. 548/1995. In this regard, the provisions of Article 11 paragraph (34 ) to (37 ) of Law No. 548/1995 shall accordingly apply. Chapter V APPLICATION OF SANCTIONS AND REMEDIAL MEASURES 43.The sanctions and/or remedial measures against the non-bank payment service provider and/or against the persons referred to in the act regarding the results of the control shall be applied in the cases provided for in Article 162 paragraph (4), Article 22 paragraph (1) and paragraph (11 ) and Article 97 of Law No. 114/2012, in accordance with the provisions of Article 99, Article 100 of Law No. 114/2012 and of Article 75 and Article 752 of Law No. 548/1995. 44.The sanctions and/or remedial measures against the non-bank payment service provider and/or against the persons referred to in the act regarding the results of the control (as applicable: management bodies, members of management bodies, direct/indirect holders, including beneficial owners of the non-bank payment service provider, key personnel) shall be applied by the Executive Board of the NBM. The Governor, the First Deputy Governor and the Deputy Governors of the NBM may apply the sanctions and/or remedial measures provided for in Article 99 paragraph (1) letters a) and b), paragraph (2) letter g) and paragraph (3) points 1) and 2) of Law No. 114/2012. 45.If the direct/indirect holders, including the beneficial owners of non-bank payment service providers no longer meet the requirements regarding the quality of the person holding qualified holding, provided for in Article 15 paragraph (1) point 8) and Article 161 paragraph (7) of Law No. 114/2012 and do not correspond to the criteria set out in Section 5 of Regulation No. 9/2024, as well as if they have not provided the NBM with the necessary information, the NBM shall apply the provisions of Article 162 paragraph (4) of Law No. 114/2012. 46.The decision on the application of sanctions and/or remedial measures shall be taken based on the examination of the results of the control and the opinion of the non￾bank payment service provider and/or the persons concerned in the act regarding the results of the control, if it was presented in accordance with the provisions of Article 11 paragraphs (34 ) to (37 ) of Law No. 548/1995. 47. When individualizing sanctions, the following criteria shall be taken into account, insofar as they can be determined:

9 47.1 the seriousness and impact of the violation on the activity of the non-bank payment service provider, including if it has not commenced operations in accordance with the license held; 47.2 duration and frequency of the violation; 47.3 the repeated character of the violation determined according to the provisions of Article 752 paragraph (5) of Law No. 548/1995; 47.4 the actions of the non-bank payment service provider and/or, as the case may be, of the person responsible for committing the violation, including: 47.4.1 the degree of cooperation demonstrated under the control of the NBM, i.e., whether the non-bank payment service provider and/or, as the case may be, the person responsible for committing the violation has executed or failed to execute promptly and effectively any request of the NBM, or has attempted to mislead/misled the NBM by presenting false or incomplete information; 47.4.2 the effectiveness and promptness of remedial actions taken in relation to the violation. 48.The decision on the application of the sanction and/or remedial measures shall be notified to the non-bank payment service provider and/or, as the case may be, to the persons concerned by the decision, in accordance with the provisions of points 6 to 8. 49.Information regarding the applied sanctions shall be published on the official website of the NBM in accordance with the provisions of Article 753 of Law No. 548/1995. Chapter VI OTHER PROVISIONS 50.The information contained in the documents drafted by the NBM for organizing, conducting the control and concluding the control results represent a professional secret, thus determined and subject to protection in accordance with the legislation. 51. NBM inspectors and other persons who have access to the information that represents professional secret shall comply with the requirements of the legislation regarding the processing, transmission, recording, keeping of professional secret, when using such information in the control process or examination of results, as well as with regard to the technical means (including computers, electronic information carriers, printing equipment, scanners, telephones, and other equipment).