Decision on the security measures for the operational and security risks related to payment services

Pursuant to Article 47 paragraph 1 item 6 of the Law on the National Bank of the Republic of North Macedonia (Official Gazette of the Republic of North Macedonia No. 158/10, 123/12, 43/14, 153/15, 6/16, 83/18 and Official Gazette of the Republic of North Macedonia No. 110/21) and Article 123 paragraph 9 of the Law on Payment Services and Payment Systems (Official Gazette of the Republic of North Macedonia No. 90/22), the National Bank of the Republic of North Macedonia Council has adopted the following DECISION on the security measures for the operational and security risks related to payment services
I. GENERAL PROVISIONS

1. This Decision shall prescribe in more details the requirements that the payment
   service providers in accordance with the Law on Payment Services and Payment Systems (hereinafter: the Law) are obliged to meet in order:

• to establish security measures to mitigate the operational and security risks
  related to payment services, by establishing an operational and security risk management framework,
• confirmation of the effectiveness of the established security measures by
  establishing a testing framework and
• constant training and support of the payment service users, in order to
  raise the awareness about the security risks when providing payment services.
  II. DEFINITIONS

2. The terms used in this decision shall denote the following:
   2.1 “Framework for managing operating and security risks” shall denote
   a general framework for the acceptable level of operational and security risks related to payment services which covers the overall approach (strategies, policies, rules, practices, controls, processes, systems, etc.) for defining, communicating and monitoring the bank'srisk appetite.
   2.2. “Risk Appetite” shall be an aggregate level of operational and security risks
   related to payment services that the institution is prepared to take within its capacity for taking risks in accordance with the business model for the successful achievement of its strategic goals.
   2.3. “Defense-in-depth” shall be a type of defense which establishes more
   than one security protective control or a control mechanism that covers the same risk and which serves as an additional security protection of the previous mechanisms.

2.4. “Principle of ‘least privilege’” shall denote a minimal set of access
privileges granted for the purpose of carrying out the necessary activities, as well as access to the data necessary for the successful implementation of the business process.
III. SECURITY MEASURES FOR OPERATIONAL AND SECURITY RISKS
3. To establish the security measures for operational and security risks, the payment
service providers shall be obliged to establish an operational and security risk management framework, appropriate and proportionate to the nature, volume and complexity of the activities related to the provision of the payment service.
4. The framework referred to in item 3 of this Decision, shall be approved by the
management body of the payment service provider and shall be revised at least once a year, depending on the changes in the environment and the risk profile. The payment service providers shall be obliged to provide appropriate documentation of the operational and security risk management framework during its implementation.
5. The operational and security risk management framework shall at least include:

• security policy;
• risk appetite;
• the key roles and responsibilities, in accordance with item 7 of this
  Decision, necessary for implementation of the security measures, management of the security and operational risks and reporting lines;
• the processes of identification, measurement, monitoring and
  management of the risks which arise from the activities of the providers of payment services related to the payment, including ensuring business continuity;
• operational and security incident management procedures.

6. The payment service providers shall be obliged to check whether there is a need
   for change or improvement of the operational and security risk management framework, before significant changes in the infrastructure, processes or procedures, as well as after each occurred identified major operational or security incident, immediately without unnecessary delay.
7. The payment service providers shall be obliged to establish an efficient risk
   management model, to identify and adequately manage the operational and security risks by establishing three effective lines of defense (operational, risk management and internal audit). The three lines of defense referred to in paragraph 1 of this item shall be separate and mutually independent, have sufficient resources, clearly specified authorizations and defined procedures for reporting to the management or supervisory bodies.
8. The payment service providers shall be obliged to provide effectiveness of the
   security measures in the utilization of outsourcing services.
   In the contracts with the outsourcing providers, the payment service providers shall define the necessary level of quality of the required service, and include

appropriate security measures that match the criticality, significance and the characteristics of the service that the payment service provider transfers to the outsourcing provider. The payment service providers shall be obliged to monitor the level of harmonization of the outsourcing providers, with their operational and security risk management framework. Identification and recording of functions, processes and assets
9. The payment service providers shall be obliged to identify and to regularly update
their business functions, the key roles of the performers of the business functions and the processes for support of the business functions in a special registry for that purpose, for their full recording, identification of their significance and interconnectedness with the operational and security risks.
10. The payment service providers shall be obliged to identify and to regularly update
the information systems they use, the communication technology systems, the configurations, their interconnectedness with other internal and external IT systems, for their full recording in the registry and appropriate management of the key business functions and processes referred to in item 9. Classification of functions, processes and assets
11. The payment service providers shall be obliged to classify the recorded business
functions, processes for support and information assets from the registry referred to in item 9, according to their criticality. Assessment of the risks associated with functions, processes and assets
12. The payment service providers shall be obliged to constantly monitor the threats
and vulnerabilities, and to regularly revise the scenarios associated with the risks that affect the business functions, critical processes and information assets. The payment service providers shall be obliged to carry out a comprehensive assessment of the exposure to the operational and security risks associated with the payment services they provide and of the appropriateness of the implemented measures and control mechanisms for managing operational and security risks. The payment service providers shall be obliged to submit an updated and comprehensive assessment of the exposure to the operational and security risks referred to in paragraph 2 of this item, to the National Bank, at least once a year, and at request of the National Bank and in shorter time intervals. The payment service providers shall be obliged to carry out partial risk assessments before the introduction of significant changes in the infrastructure, processes or procedures that affect the security of payment services.
13. On the basis of the risk assessment referred to in item 12 of this Decision, the
payment service providers shall be obliged to determine the appropriateness of

the implemented security measures and control mechanisms, as well as the need for their improvement. Implementation of security measures
14. The payment service providers shall be obliged to establish and implement
preventive security measures, as a safeguard against the identified operational and security risks. The measures referred to in paragraph 1 of this Decision shall provide a level of security, in accordance with the identified risk appetite.
15. The payment service providers shall be obliged to establish and implement
security measures in several layers, i.e. to use the approach of the so-called “defense-in-depth”.
16. The payment service providers shall be obliged to ensure confidentiality, integrity
and availability of their critical information and communication assets, as well as of the sensitive payment data.
17. The payment service providers shall be obliged to constantly monitor the impact
of the changes in the environment on the introduced protective security measures, in order to identify the need for establishment of additional measures to mitigate the risks. In order to reduce the risks associated with the impact of the changes referred to in paragraph 1 of this item, the payment service providers shall be obliged to establish a process of management of the changes, which provides their adequate planning, testing and recording, in accordance with the granted authorizations.
18. The payment service providers shall be obliged to establish a principle of division
of the responsibilities, by separating the information systems, i.e. the system environments for development, test and production operations in the part of the provision of payment services. Measures for ensuring integrity and confidentiality of data and systems
19. The payment service providers shall be obliged to ensure accuracy and relevance
of the collection, transfer, processing, storage, archiving and the manner of presenting the sensitive payment data of the payment service users, as well as their limitation only to what is necessary to provide the payment service.
20. The payment service providers shall be obliged to carry out regular checks for
the purpose of timely implementation of the critical security upgrades of the software that is used to provide payment services, including of the user software that is related to the payment. The payment service providers shall be obliged to establish mechanisms for verification of the integrity of the software, the incorporated programs and the information related to payment services.

Physical protection measures
21. The payment service providers shall be obliged to establish security measures for
physical protection of the information systems and the communication technology systems that are used to provide payment services, and in order to protect the sensitive payment data. Access control measures
22. The access to the information systems and the communication technology
systems shall be granted only to the authorized officers with justified business needs. The authorizations shall be granted in accordance with the work tasks of the employees, according to the principle “least privilege”. The payment service providers shall be obliged to establish control over the access and records of the activities that take place on the information and communication protection systems.
23. The payment service providers shall be obliged to implement enhanced control
over the privileged access to the information and communication technology systems, through strict limitation and more detailed supervision of the activities with such access.
24. The records in accordance with item 22 paragraph 2 of this Decision shall be kept
in a period that matches the criticality of the business functions, the processes for their support and information assets, in accordance with items 9 and 10 of this Decision. The payment service providers shall be obliged to use the information referred to in paragraph 1 of this item to identify and carry out investigations into unusual activities when providing payment services.
25. The remote access to the critical information systems and the communication
technology systems is granted in accordance with the principle “least privilege” and by applying strong authentication.
26. The functioning of the products, tools and procedures related to the access
control process shall be protected against being compromised or circumvented. Measures for continuous monitoring and detection
27. The payment service providers shall be obliged to establish processes and
functions to constantly monitor the business functions, auxiliary processes and information assets for their support, for the purpose of timely detection of the unusual activities when providing payment services. The payment service providers shall be obliged to establish appropriate and efficient functionalities to detect physical and logical disturbances on the security which affect the confidentiality, integrity and availability of the information assets that are used for payment services.

28. The processes of continuousmonitoring and detection shall include:

• relevant internal and external factors, which include the business functions
  and the functions for administration of the information and communication systems;
• transaction analysis which aims to provide detection of misuses of the
  access by service providers or other entities and
• potential internal and external threats.

29. The payment service providers shall be obliged to undertake measures for
    detection of possible information leakages, presence of a malicious software, presence of vulnerabilities in the software and hardware and check for new security upgrades, as well as other security threats. Measures for operational or security incidents
30. The payment service providers shall be obliged to establish appropriate
    organizational structure and efficient processes which enable detection, classification, assessment of the significance, reporting, monitoring and management of the operational or security incidents.
31. The payment service providers shall be obliged to establish a procedure for
    reporting on the operational or security incidents and complaints from the users of payment services related to security, to their senior management. The payment service provider shall be obliged, immediately and without unnecessary delay, to inform its payment service users about the incident and about all the measures that the payment service users may take to reduce the adverse effects of the incident. Business continuity measures
32. The payment service providers shall be obliged to establish business continuity
    processes, which will ensure continuity when providing the payment service or limit the losses in case of severe disruption in the business operations.
33. For the purpose of business continuity, the payment service providers shall be
    obliged to carry out a quantitative and qualitative analysis of the exposure to severe disruption in the operations, for their potential impact by using analysis of internal or external data and analysis of applicable scenarios. On the basis of the identified critical functions, processes, systems, their interconnectedness and dependence, in accordance with items 9, 10 and 11 of this Decision, the payment service providers shall be obliged to give priority to those activities which arise from the assessment of the risk of ensuring business continuity.
34. Based on the analysis, in accordance with item 33 paragraph 1 of this Decision,
    the payment service provider shall be obliged to establish:

• business continuity plans for the purpose of taking an appropriate
  response in case of extraordinary situations and ensuring continuity of its critical business activities and

• measures that would be implemented in case of an interruption in the
  payment services, in order to reduce the adverse effect on the payment systems and to enable the payment service users to execute the payment transactions that are in progress. Planning of business continuity through analysis of applicable scenarios

35. The payment service providers shall be obliged to process various, real, including
    extreme scenarios they can be exposed to and to assess their potential impact on business continuity.
36. In accordance with the analysis referred to in item 33 paragraph 1 of this Decision
    and the scenarios referred to in item 35 of this Decision, the payment service provider shall be obliged to develop response and recovery plans which should be:

• focused on ensuring the functionality of the critical functions, processes,
  systems and their interdependence;
• documented and at the organizational units' disposal, and easily available
  in emergencies; and
• regularly updated in accordance with the experiences acquired during
  testing, the identified new risks and threats, as well as in case of a change in recovery objectives and priorities. Testing business continuity plans

37. The payment service providers shall be obliged to test their business continuity
    plans at least once a year.
    With the testing stated in paragraph 1 of this item, the payment service provider shall be obliged to check the support offered by the plans for efficient establishment of the objectives for protection, the restoration of the integrity, the availability of the business functions and the confidentiality of the information assets.
38. The plans referred to in item 34, paragraph 1, indent 1 shall be updated at least
    once a year, in accordance with the results of the conducted tests, the current threats, the new knowledge and the previous experiences, the changes in priorities during recovery, as well as on the basis of the analysis of applicable scenarios and upon changes in the systems and processes.
39. The testing of the business continuity plans of the payment service providers
    shall:

• include appropriate applicable scenarios in accordance with item 35 of this
  Decision;
• be planned in that manner, which will enable reexamination of the
  assumptions underlying the business continuity plans, especially the manner of managing, decision-making and communicating in extraordinary situations and
• include procedures to verify the training of the employees and the defined
  procedures for an appropriate response in case of the stated scenarios.

40. The payment service providers shall be obliged to periodically monitor the
    effectiveness of their business continuity plans and to document and analyze any challenges or failures resulting from the tests. Measures for communication in crisis situations
41. The payment service providers, in case of an interruption in the business activity
    or extraordinary situation and when implementing the business continuity plans, shall be obliged to provide efficient measures for communication in crisis situations, for timely and proper informing of all relevant stakeholders, including the outsourcing providers who perform operational functions. Testing of security measures
42. The payment service providers shall be obliged to establish a testing framework
    which will confirm the efficiency of the established security measures. The testing framework shall include new threats and weaknesses identified when monitoring the risks.
43. The payment service providers shall be obliged, in the framework referred to in
    item 42 of this Decision, to include tests, especially in case of significant changes in the infrastructure, processes or procedures and in case of changes that are made as a result of major operational or security incidents.
44. The testing framework referred to in item 42 of this Decision shall include testing
    of security measures for:

• the payment terminals and devices that are used when providing the
  payment service;
• the payment terminals and devices that are used for authentication of the
  payment service users and
• the devices and software for developing and receiving the authentication
  code placed at the payment service user's disposal by the payment service provider.

45. The testing framework referred to in item 42 of this Decision shall provide
    confirmation of:

• implementation of the procedure, part of the formal process of
  management of the changes in the payment service provider, to confirm the efficiency of the introduced measures;
• conduct of impartial testing by persons with necessary knowledge, skills
  and professionalism when testing the introduced security measures in the payment services and independence of the persons whereby they have not been involved in the development of the security measures for the payment services that are tested and
• involvement in the testing of the procedures for checking the existence of
  vulnerabilities and testing of the resilience of the systems that are appropriate for the identified risk level in relation to the payment services that are provided.

46. The payment service providers shall be obliged to test the security measures for
    their payment services in accordance with the following frequency:
    − for the systems that are not critical, the testing frequency depends on the risk assessment, but they should be tested at least once every three years, − for the systems that are critical to provide their payment services, as stated in the registry referred to in item 10 of this Decision, the security measures shall be tested at least once a year.
47. The payment service providers shall be obliged to monitor and analyze the results
    of the conducted tests and in accordance with them, to update their security protective measures. In case of weaknesses identified during the testing of the security measures of the systems that are identified as critical in accordance with item 10, the payment service providers shall be obliged to update the security measures without unnecessary delay. Raising awareness and continuous training
48. The payment service providers shall be obliged to establish and implement
    processes and organizational structure for identification and continuousmonitoring of the security and operational threats which can significantly affect the provision of payment services.
49. The payment service providers shall be obliged, on the basis of the analyses of
    the identified or occurred operational or security incidents, in or outside of the provider, to properly update the security measures.
50. The payment service providers shall be obliged to develop and implement a plan
    for training of all employees which will enable performance of their working tasks in accordance with the security policy and the procedures that aim to contribute to reducing the possibilities of human error, theft, fraud, misuse or loss. In accordance with the plan referred to in paragraph 1 of this item, the payment service providers shall be obliged to provide training of the employees at least once a year, and if necessary, more frequently.
51. The payment service providers shall be obliged to enable the employees who
    perform key roles, specified in accordance with item 9 of this Decision, a specialized information security training at least once a year or more frequently, if necessary. Support and informing of the payment service users
52. The payment service providers shall be obliged to establish a procedure for
    effective support of the payment service users, for all their queries and requests, notifications on unusual occurrences and problems related to the security of payment services, in order to raise the awareness about the security risks when providing payment services.

The payment service provider shall be obliged to inform the payment service users about the manner in which it will provide the necessary support.
53. The payment service provider shall be obliged to enable the payment service
user to cancel the use of certain functionalities that are related to payment services, and are placed at the user's disposal.
54. The payment service provider, who agreed with the payer to limit the amount
spent on the payment transactions that are carried out through a certain payment instrument, shall be obliged to enable the payer to adjust those limitations to the amount of the highest agreed limitation.
55. The payment service providers shall be obliged to warn the payment service
users about initiating or unsuccessful attempts to initiate payment transactions, in order to detect fraudulent or malicious use of their payment accounts.
56. The payment service providers shall be obliged to inform the payment service
users about the updates of the security measures and procedures that affect the users when providing payment services.
IV. TRANSITIONAL AND CLOSING PROVISIONS
57. The payment service providers shall be obliged to comply their operations with
the requirements of this Decision not later than 19 February 2024. The payment service providers that are founded until the day of commencement of implementation of this Decision and which have a license for founding and operating a bank, shall be obliged to properly harmonize the existing operational risk management system established in accordance with the Decision on the methodology for risk management (Official Gazette of the Republic of Macedonia No. 113/19, 69/20 and 314/20), with the provisions of this Decision.
58. This Decision shall enter into force on the date of its publication in the Official
Gazette of the Republic of North Macedonia.
D No. 02-15/XXII-8/2022 Anita Angelovska Bezhoska 28 December 2022 Governor and Chairperson of Skopje the Council of the National Bank of the Republic of North Macedonia