Bank of Zambia ZIPSS Operating Rules April 2021

Bank of Zambia ZIPSS Rules i Bank of Zambia Banking, Currency and Payment Systems Department APRIL, 2021

ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM (ZIPSS) OPERATING RULES ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM (ZIPSS) OPERATING RULES April 2021

Bank of Zambia ZIPSS Rules ii Table of Contents

1. General Principles and Objectives ...............................................................................................1 1.1 General ...................................................................................................................................1 1.2 Roles of Bank of Zambia .........................................................................................................2
2. Access Criteria and Conditions ....................................................................................................3 2.1 Categories of Participants ......................................................................................................3 2.2 Operational Capacity..............................................................................................................3
3. Adding Participants and Changes in Participants’ Status.........................................................7 3.1 Adding or modifying a Participant .........................................................................................7 3.2 Suspension or Termination .....................................................................................................7
4. Security .........................................................................................................................................11 4.1 Data Integrity, Availability, Confidentiality & Cyber Security Management ....................... 11 4.2 Communications ...................................................................................................................13 4.3 Use of BOZ-Supplied Materials............................................................................................ 14 4.4 Password Policy Management.............................................................................................. 14
5. Establishment and Maintenance of Users..................................................................................15 5.1 General .................................................................................................................................15 5.2 Request to Create a User......................................................................................................16 5.3 Request to Modify a User......................................................................................................16 5.4 Request to Suspend or Delete a User.................................................................................... 16 5.5 Creation and Maintenance of User Profiles .........................................................................17
6. Financial Collateral Arrangements............................................................................................ 18 6.1 Establishment of Reserves Accounts..................................................................................... 18 6.2 Provision of intraday loan facility (ILF)...............................................................................18
7. Settlement of Net Settlement Instructions (NSIs) .....................................................................19
8. Payments.......................................................................................................................................20 8.1 Payments to be Processed on ZIPSS..................................................................................... 20 8.2 Payments Limits.................................................................................................................... 20 8.3 Beneficiary Identification......................................................................................................20 8.4 Payment Priorities ................................................................................................................20 8.5 Modification of Priority ........................................................................................................21 8.6 Straight-through Processing .................................................................................................21
9. Payment Message Format...........................................................................................................22 9.1 Format ..................................................................................................................................22

Bank of Zambia ZIPSS Rules iii 9.2 RTGS Payments .................................................................................................................... 22 10. Processing Procedure ..................................................................................................................24 10.1 General Issuing Conditions...................................................................................................24 10.2 Submission and Validation....................................................................................................24 10.3 Queuing.................................................................................................................................25 10.4 Processing of Payment Instructions in the Pending Queue ..................................................25 10.5 Cancellation of Queued Payment Instructions......................................................................26 10.6 Processing of NSI..................................................................................................................26 10.7 Gridlock Resolution ..............................................................................................................26 11. Irrevocability of Payment Instructions...................................................................................... 28 11.1 Moment of Entry into the System .......................................................................................... 28 11.2 Irrevocability and Finality of Payment Instructions............................................................. 28 12. Reports and Enquiry Facilities...................................................................................................29 13. Monitoring of Payment Flows and Reconciliations ..................................................................30 14. Intraday and Overnight Loan Facilities .................................................................................... 31 14.1 Primary Conditions...............................................................................................................31 14.2 Limitation, Suspension and Termination of Access to Intraday Credit.................................31 14.3 Overnight Loans.................................................................................................................... 31 15. Business days and Operating Hours .......................................................................................... 32 16. Handling Technical Failures.......................................................................................................33 16.1 General Obligations..............................................................................................................33 16.2 Telecommunication Failure ..................................................................................................33 17. Audit Rules...................................................................................................................................33 18. Pricing Rules ................................................................................................................................ 34 19. Administrative Requirements and Financial Rules..................................................................35 19.1 Audit Trails ........................................................................................................................... 35 19.2 Publication of Statistics ........................................................................................................36 19.3 Conservation and Archiving of Documents ..........................................................................36 20. Business Disruption Event ..........................................................................................................37 21. Liabilities and Responsibilities ...................................................................................................38 21.1 Force Majeure ...................................................................................................................... 38 21.2 Responsibilities of the Participants....................................................................................... 39 21.3 Responsibilities and Liabilities of BoZ..................................................................................41 21.4 Claims and Compensations...................................................................................................43 21.5 Administrative Fees...............................................................................................................43 22. Dispute Resolution ....................................................................................................................... 44

Bank of Zambia ZIPSS Rules iv 22.1 Law and Jurisdiction.............................................................................................................44 22.2 Conciliation and Arbitration Procedures .............................................................................44 23. Insolvency of a Participant..........................................................................................................45 23.1 Notification of Insolvency Events.......................................................................................... 45 23.2 Arrangements upon Notification of an Insolvency Event before the Occurrence of the Decision Marking the Commencement of the Insolvency Event......................................................... 45 23.3 Notification of the Decision Marking the Commencement of the Insolvency Proceedings...46 23.4 Arrangements in case of notification of the decision marking the commencement of insolvency proceedings during the operating day..............................................................................46 23.5 Notification of the decision marking the commencement of insolvency proceedings at the end of the operating day ........................................................................................................................... 48 23.6 Suspension or termination on grounds other than an Insolvency Event ............................... 48 24. Amendment to the Rules and complementary instructions ..................................................... 49 24.1 Amendment to the Rules........................................................................................................49 24.2 Complementary Instructions.................................................................................................49 Annex 1: Glossary ........................................................................................................................... 50 Annex 2: SWIFT BIC CODES.......................................................................................................63 Annex 3: Form for Participant Addition or Modification........................................................... 65 Annex 4: E-Token Application Form............................................................................................ 66 Annex 5: E-Token Revocation Form............................................................................................. 67 Annex 6: ASA Form........................................................................................................................ 68 Annex 7: Daily Operating Timetable ............................................................................................ 70 Annex 8: Pricing.............................................................................................................................. 72 Annex 9: Notification...................................................................................................................... 73 Annex 10: Help Desk......................................................................................................................... 74 Annex 11: Annual Audit Form ........................................................................................................75 Annex 12: Message Priorities...........................................................................................................77 Annex 13: Technical Documentation............................................................................................... 78 Annex 14: ZIPSS Webstation Configuration..................................................................................79 Annex 15: ZIPSS Validation Codes.................................................................................................80 Annex 16: RTGS Transaction Type Codes..................................................................................... 82 Annex 17: Risk Management...........................................................................................................83 Annex 18: ZIPSS Window Extension Application Form............................................................... 85

Bank of Zambia ZIPSS Rules 1

1. General Principles and Objectives The purpose of this document is to define the System Rules for the Zambia Interbank Payment and Settlement System (ZIPSS) which is the interbank payment system or the Real Time Gross Settlement (RTGS) system for Zambia. These Rules are issued in accordance with the National Payments System Act Number 1 of 2007 and define various operating aspects of ZIPSS, together with the duties and obligations of all Participants including the Bank of Zambia in its role of System Operator as well as Participant. 1.1 General ZIPSS (hereinafter “the System”) is the interbank payment and settlement or the Real Time Gross Settlement (RTGS) system for the Bank of Zambia (BoZ). ZIPSS ensures:  The final and irrevocable gross settlement in Participants’ Settlement Accounts (SAs) of RTGS Payments initiated by Participants;  The final and irrevocable settlement in Participants’ SAs of the net positions arising from the deferred net settlement (DNS) operations from existing clearing houses and any other clearing systems that may be approved from time to time by BoZ;  The settlement of the payment part of the securities transactions from the securities clearing and settlement system;  The final and irrevocable settlement of transactions involving Government securities processed through the securities registration system maintained by BoZ. These Rules shall be applicable to all Participants authorised by BoZ. The Participants of ZIPSS shall act in their own name. In order to become a Participant, an institution shall comply with the criteria on operational capacity, financial soundness, legal soundness and financial requirements as detailed below in section 2 – Access Criteria and Conditions. The “Rules” shall mean these Rules and each related Annex and attachment thereto and hereto, as supplemented by related materials, including User Manuals, system documentation and other documentation provided (the Materials). Any of these Materials may be amended from time to time. Where there is a conflict between these Rules and any Annex, the terms of the Annex shall prevail in respect of the relevant Service. Section 24 describes how these Rules may be amended from time to time.

Bank of Zambia ZIPSS Rules 2 All time indications in these rules relate to the time at the place where the head office of BoZ is located. The specific terminology of ZIPSS and the symbols used are explained in the Glossary. 1.2 Roles of Bank of Zambia BoZ shall be the System and Technical Operator of ZIPSS with the legal responsibility for controlling, managing and operating ZIPSS. In its capacity as the Central Bank of Zambia, BoZ administers the Settlement Accounts (SAs) of the Participants, provides intraday liquidity and other facilities to ensure efficient and sound payment systems. In this respect, BoZ oversees the payment systems activities in Zambia, and acts as a settlement agent in its capacity as System Operator of ZIPSS. In its capacity as System Operator, BoZ shall be responsible for:

• Authorisation of Participants in ZIPSS;
• The establishment and maintenance of these Rules and related Procedures; and
• The authorisation of operating standards and procedures of ZIPSS. BoZ shall oversee the adherence to these Rules by the Participants. As Technical Operator of ZIPSS, BoZ shall administer the operation of the daily business cycle, manage the creation of reports and charts and shall be responsible for the security of ZIPSS data, software and infrastructure, including managing backups and fall-back situations. BoZ may, at its own discretion, delegate operational tasks to third parties. This delegation will not in any way affect BoZ’s responsibilities towards the Participants.

Bank of Zambia ZIPSS Rules 3 2. Access Criteria and Conditions 2.1 Categories of Participants The following entities shall participate in ZIPSS:  Commercial Banks licensed by BoZ;  Clearing Houses authorised by BoZ;  BoZ; and  Any Other entity authorised by the Bank. 2.2 Operational Capacity 2.2.1 Equipment Participants shall procure their own equipment. BoZ shall not be obliged to supply to Participants any hardware or operating system software to enable utilisation of the Services on ZIPSS. BoZ shall provide to each Participant any necessary components such as a limited number of initial set of e-tokens as determined from time to time. Participants will install and configure the components to support the ZIPSS software in accordance with BoZ’s instructions. The Participant shall at no time have any proprietary interest in the ZIPSS software. Any supporting components provided by BoZ shall be returned to BoZ on termination in accordance with section 2.2.2 of these Rules or earlier on demand. 2.2.2 Materials The Materials provided in connection with the Services (including, for example, access to ZIPSS) are the exclusive and confidential property of BoZ. The Participants agree to keep these Materials confidential, to limit access to their employees (under a similar duty of confidentiality) who require access for the proper use of the Services, and to use all Materials in the manner designated therein and in the ordinary course of their business, and not to modify any. The Rules shall not affect the copyright status of any of the Materials and the provisions of this paragraph will apply whether or not such Materials are copyright protected.

Bank of Zambia ZIPSS Rules 4 2.2.3 Primary and Fall-back Computer Facilities Each Participant shall provide fall-back IT equipment for treasury management, accounting and access to the ZIPSS. Both primary and fall-back IT equipment shall be operated by qualified and authorised personnel who will take appropriate action on behalf of the Participant with respect to the operations of such computer facilities in accordance with these Rules. Documents describing the standards and communication protocols (and other functional requirements) for a Participant’s computer interface to ZIPSS shall be provided by BoZ to each Participant that connects to ZIPSS, as itemised in Annex 13. Each Participant shall comply with, and its computer interface must function in accordance with, such standards and protocols. A computer interface shall not be implemented unless it has been approved by BoZ. In order to ensure the stable and correct functioning of the System, BoZ may make the participation of a Participant in ZIPSS, as well as the maintenance of such participation, dependent upon the successful outcome of tests demonstrating that the Participant has the operational and technical capacity required (notably with regard to its IT systems and telecommunications). BoZ shall communicate the contents, conditions and dates of these tests to each Participant concerned. BoZ shall not be responsible for any expense incurred by a Participant in establishing any primary or fall-back facility connected to ZIPSS. Each Participant shall have a Business Identifier Code (BIC) as issued by the Society for Worldwide Interbank Financial Telecommunications (SWIFT). Where appropriate, BoZ may assign an unlisted BIC to a Participant that does not connect to the ZIPSS through the SWIFT network. The BICs of the Participants are specified in Annex 2. Each Participant shall be connected via a Webstation as specified in Annex 14, configured to exchange messages with the ZIPSS and communicating via the ZIPSS virtual private network (VPN). Participants shall use the SWIFT network to enable Straight-Through Processing (STP) of transactions between their payment-originating systems and ZIPSS.

Bank of Zambia ZIPSS Rules 5 2.2.4 Staffing at Connection and Changes to Connection The office(s) of the Participant’s primary connection shall be staffed by personnel who are qualified and authorised at all times by the Participant to take appropriate action on behalf of the Participant with respect to the connection after having signed the E-Token Application Form in Annex 4. 2.2.5 Location of Computer Facilities Any primary or fall-back connection linked to ZIPSS shall be located only in a location deemed suitable by BOZ. Any Participant wishing to change the location of its primary connection shall obtain the approval, in writing from BOZ (Note in the Glossary the definition of “In writing”). Any changes to the location of a primary or fall-back connection shall not be a valid reason for requesting any changes to the ZIPSS operating timetable. Any Participant wishing to change the location or the operational characteristics of its primary or fall-back facility must present a proposed plan describing the change and obtain approval from BOZ in advance of making the change. BOZ reserves the right to require the Participant to alter the plan if in the opinion of BoZ, the plan poses a risk to the operational integrity of ZIPSS. 2.2.6 Authorized Settlement Agent (ASA) facility All Participants shall be expected to provide adequate contingency in terms of infrastructure (software, hardware and communications) for the purpose of making payments on ZIPSS. However, in some contingent situations where a Participant is unable to generate transactions on the core banking system, the Participant may be allowed to request the BoZ to process transactions on its behalf using the Authorized Settlement Agent (ASA) facility. Prior to using the facility, the Participant shall inform BoZ through the office of the ‘Assistant Director Development & Operations – Payment Systems Department’ In writing detailing the problem being experienced. The Participant shall then fill in the ASA Form, with details of the transactions to be processed. Where a Participant need to process several transactions, the Participant is expected to fill in a separate ASA Form for each transaction being processed. BoZ shall only act on original authenticated payment instructions.

Bank of Zambia ZIPSS Rules 6 In exceptional circumstances, the Bank shall accept scanned copies of ASA instructions sent by an authorised signatory to zipss@boz.zm. A charge will be applied for each transaction that is processed on behalf of the Participant and the total amount charged will be debited from the Settlement account of the Participant (refer to Annex 8 – Pricing). In processing such transactions, the following conditions will be considered; a) BoZ will only process critical and systemically important transactions such as interbank, cash, government securities, payments to BoZ and ZRA transactions; b) BoZ reserves the right to introduce an incremental charge for using the ASA facility consecutively; and c) The deadline for submitting requests for processing ASA transactions from a Participant shall be at 15:00 hours. A Participant shall ensure that ASA instructions are received by BoZ before the stipulated time. 2.2.7 Participant Workstation Minimum Configuration Requirements Participants’ ZIPSS web stations must comply at all times with the minimum configuration requirements as detailed in Annex 14.

Bank of Zambia ZIPSS Rules 7 3. Adding Participants and Changes in Participants’ Status 3.1 Adding or modifying a Participant BOZ shall have the exclusive right to admit new Participants into ZIPSS. Each Participant shall provide the information stated in the Participant Application Form provided in Annex 3. Each Participant shall, in case of merger, split off, name change or any other change in the information required in the Participation Application Form in Annex 3, notify BOZ immediately and shall provide the information required for amending its details. 3.2 Suspension or Termination 3.2.1 Suspension BoZ may suspend access of a Participant to the ZIPSS (i.e. “Block” or “Disable” the Participant) for a specified or indefinite period of time in the following circumstances: a) the Participant is subject to prudential supervision and the relevant supervisor requests such suspension; b) by agreement with the Participant concerned; c) the Participant no longer complies with a requirement for participation set out in the Rules; d) an event occurs which affects, or may affect, the ability of the Participant to participate to the normal and usual extent in sending and receiving payments (a Constraining Event) for a period of time, but only during the continuance of that event and any subsequent period which might be necessary; e) an Insolvency Event (as defined under the relevant Act) occurs in respect of the Participant (not being an event which results in a termination pursuant to section 3.2.2 below); f) the Participant breaches its obligations under these Rules or the applicable procedures and fails to rectify the breach or to provide a satisfactory justification; or; g) the Participant fails to comply with any other relevant conditions, rules, agreements, regulations as issued by BoZ.

Bank of Zambia ZIPSS Rules 8 BoZ shall at its discretion decide on any term or grace period, taking into account the specific situation of the Participant concerned. A Participant whose access to ZIPSS is suspended under this section is not entitled to participate in ZIPSS, but it still has a right to access its data outside the system via a request to BoZ. A Participant whose access to ZIPSS is suspended is not excused from discharging its obligations under these Rules, except as expressly provided in or pursuant to these Rules. From the moment BoZ decides that the suspension becomes effective, any Payment Instruction from the respective Participant is no longer accepted until the reinstatement date. BoZ shall immediately notify all Participants (by the most expeditious means available) of any suspension. BoZ may at its discretion reinstate a suspended Participant and shall as soon as reasonably possible, notify all Participants of any decision to reinstate a suspended Participant including the re-commencement (“activation”) date for that Participant. 3.2.2 Termination A Participant shall cease to be a Participant on: a) resignation; b) becoming insolvent; c) being wound-up, dissolved or otherwise ceasing to exist; or d) BoZ terminating the participation in accordance with these Rules and/or other regulations. BoZ shall at its discretion decide on any term or grace period, taking into account the specific situation of the Participant concerned. A Participant may, by way of notice in writing to BoZ, withdraw participation with effect from a date, which is 10 business days after the date of service of notice to withdraw participation. The notice shall be irrevocable. However, all licensed banks within BoZ’s definition, shall maintain their membership in ZIPSS.

Bank of Zambia ZIPSS Rules 9 BoZ may terminate, in writing, a Participant’s access to ZIPSS with immediate effect where all of the following conditions have occurred, unless agreed otherwise or no other formalities or court intervention is required: a) a Suspension event has occurred in respect of that Participant and has not been remedied within a reasonable period; b) that Participant is subject to prudential supervisory actions; and c) BoZ has provided an opportunity for a Participant to make submissions regarding such termination. BoZ shall not be obliged to give any reasons for such decision and may revoke any such notice at any time before it becomes effective. Any termination of access to ZIPSS shall not affect any right or liability arising under these Rules prior to the time such termination takes effect or arising in respect of any act, matter or thing occurring prior to that time. A Participant whose access is terminated pursuant to this section shall continue to be bound by these Rules in respect of: a) any act, matter or thing occurring prior to the time such termination takes effect or as a result of such termination; and b) any fees, costs, charges and expenses which may be levied on, or which are to be reimbursed by Participants in accordance with these Rules in respect of periods which commence prior to the time such termination takes effect or which relate to any such act, matter or thing. BoZ shall immediately notify all Participants (by the most expeditious means available) of any termination under this section. Subject to any rights of set-off, counterclaim or combination, which are available at law, upon any termination of the access of a Participant: a) the terminating Participant shall immediately pay all sums of money (if any) owed by it to any other Participant in respect of obligations arising from the exchange of payments; and b) all sums of money (if any) owed to it by any other Participant in respect of all such payments exchanged shall be paid by that other Participant to the terminating Participant.

Bank of Zambia ZIPSS Rules 10 Any Participant whose access is terminated shall immediately cease to be entitled to effect exchanges in ZIPSS in accordance with these Rules. A Participant whose access is terminated shall not be entitled to be repaid all or part of any entrance, operating or other fee, which has been paid by it.

Bank of Zambia ZIPSS Rules 11 4. Security 4.1 Data Integrity, Availability, Confidentiality & Cyber Security Management 4.1.2 Bank of Zambia BoZ warrants that the System has been designed and implemented to a high standard of security and reliability, with the objective of maintaining the integrity, availability and confidentiality of all data handled by the system. BoZ shall maintain strict confidentiality of all information provided by Participants and/or processed through the System. The Participant hereby authorises the transfer of any information relating to the Participant to and between BoZ and third parties selected by BoZ for confidential use in connection with the provision of services to the Participants (including for data processing purposes). Further, Participants acknowledges that BoZ and any such third party shall be entitled to transfer any such information as required by any law, court, legal process or as requested by any authority in accordance with which it is required to act, as it shall determine. The Participants also acknowledge that the security procedures provided by BoZ are designed to verify the source of a communication and not to detect errors in transmission or content including discrepancies between account names and numbers. The BoZ, in its role as System Operator, may execute an instruction by reference to the account number only, even if the name on the account is also provided. BoZ has no duty to discover, and shall not be liable for, errors made by or duplicate instructions issued by a Participant. Each Participant agrees to be bound by and to settle any electronic payment instruction executed in its name in accordance with the procedures. 4.1.2 Participants The Participants shall develop and maintain adequate internal security procedures and comply with all security procedures recommended in the Materials in order to prevent unauthorised utilisation of the Services. They must comply with the applicable procedures and ensure that the payment flows in their internal systems are adequately shielded against any internal or external threat. Data integrity, availability and confidentiality must be safeguarded at all times.

Bank of Zambia ZIPSS Rules 12 4.1.3 Cyber Security Risk Management Frameworks and Measures A Participant shall at a minimum:  Cyber-Risk Management Framework Put in place a cyber-risk management framework to mitigate against cyber￾attacks on the ZIPSS. The cyber-risk management framework shall prescribe measures to be taken by a Participant to fully recover its operations where a cyber-breach affects its operations.  Restricted Physical Access Physical access to ZIPSS workstations including at the fall back sites shall be restricted and strictly controlled from being accessed by unauthorized persons.  Segregation of duties Participants shall ensure segregation of duties by creating profiles that separate business functions and duties.  Token Management Each User shall ensure that their e-token is kept safely at all times. The e-token default password should be changed when the User logs in for the first time and the new password should not be shared.  Password Management Users shall create strong and unique passwords whose complexity shall have a minimum of eight characters, a combination of upper and lowercase letters and either a number or symbol/special character. Users should ensure that the passwords are changed regularly and that they are never shared with another person.  Monitoring tools Implement monitoring tools/capabilities that are able to identify and prevent system breach.  Detection of breach Where a breach is detected, the tools/capabilities must quickly identify the breach and quarantine the threat to minimise impact, loss or damage.  Prevent Reoccurrence

Bank of Zambia ZIPSS Rules 13 Ensure that measures are put in place to prevent reoccurrence of an attempted or successful breach.  Cyber-Risk Assessment Undertake regular cyber-risk assessment, and review effectiveness of internal cyber risk controls.  Cyber security awareness Participants shall undertake cyber-risk awareness among its staff and users of the ZIPSS and any other relevant stakeholders.  Cyber Security Incident Response Guide Each participant shall have in place an incident response plan to deal with material cyber security breaches or attempts. A recovery and assurance plan shall ensure system’s integrity following the cyber security incident as well as recovery of lost or corrupted data due to the cyber security incident.  Cyber Communication and Information sharing strategy Each participant shall report major breaches to the BoZ within 24 hours of discovering the breach. The incidents shall be reported through email at zipss@boz.zm.  Appointment of Participant Security Administrators Each Participant shall designate among its staff a minimum of two Participant Security Administrators who shall be responsible for communication with BoZ and executing tasks regarding: a) The set-up of Users; b) Amendment of User profiles; c) Removal of Users from the system, and d) The management of e-token and certificate issue and delivery to end￾Users. BoZ shall maintain the list of Participant Security Administrators. 4.2 Communications Each Participant and BoZ agrees that the Services shall be provided using the communication methods described in these Rules. Electronic communication is subject to the communication and data security methods as set forth in these Rules. The Participants agree to comply with the applicable procedures and the methods designated in these Rules.

Bank of Zambia ZIPSS Rules 14 BoZ is not obliged to follow instructions unless transmitted in accordance with these Rules. Nonetheless, the Participants hereby agree that if BoZ acts upon a request from an Authorised Person to accept an instruction given without following an agreed Procedure (a “special instruction”) for whatever reason, the Participant will be bound by such special instruction and will indemnify and hold BoZ harmless from any loss, liability, claim or expense (including legal fees) attributable to executing such special instruction. If BoZ takes any action beyond those agreed in these Rules to verify the source or content of any communication, such additional action shall not be deemed to become part of the Procedures no matter how often BoZ takes such additional action. 4.3 Use of BOZ-Supplied Materials The security procedures, security devices, codes, passwords and other access methods are highly confidential and the Participants shall use and guard them with the highest care and notify BoZ immediately upon discovering or having reason to suspect that any of the foregoing is or may be compromised. Where software and/or hardware provided by BoZ to a Participant incorporates features relating to security (including IDs, e-tokens and passwords and other measures) the Participant shall be solely responsible for the use of such features. BoZ shall be entitled to assume that all use of such software and/or hardware is by persons authorised to access such facilities. 4.4 Password Policy Management All Participants shall adopt and implement password policy and management at a minimum of password validity for the ZIPSS of not more than 90 days & only three attempts for logging in the system.

Bank of Zambia ZIPSS Rules 15 5. Establishment and Maintenance of Users 5.1 General Access to ZIPSS shall only be permitted to authorised and uniquely identified personnel (Users). Each person named in the corresponding E-Token Application form (as specified in Annex 4) shall be an Authorised Person or the designee thereof duly authorised to receive, transmit and/or confirm data and instructions within the limits, if any, specified on the applicable E-Token Application form (a User). As long as BoZ acts in compliance with the communication and data security methods as set forth in these Rules, which may be amended from time to time in accordance with the Procedures in these Rules, it shall have no further duty to verify the identity or authority of the person giving or confirming, or the contents of, any instruction. Notwithstanding any other provision hereof, BoZ shall have the right, in its sole discretion, to refuse to execute any instruction, provided BoZ, acting in good faith, doubts the authenticity or authorisation thereof. BoZ shall provide prompt notice, which may be by telephone, to an Authorised Person of any such rejected instruction. BoZ shall be entitled to rely on the authorisations and User lists as set forth on a E￾Token Application form until receipt by BoZ, in normal circumstances at least two Business Days prior to the effective date thereof, of a written request for revocation or modification of such application form, dated and signed by an Authorised Person. In urgent cases such request for revocation or modification may be made by Secure Email and will be actioned by BoZ immediately on receipt. An E-Token Application form may be revised only by a written request signed by an Authorised Person and each such proposed revision is subject to BoZ’s consent in accordance with the procedure laid down in sections 5.3, 5.4, and 5.5 of these Rules. This section supersedes all prior agreements or practices in respect of instructions and the Procedures and may not be changed by an oral agreement or by course of dealing or custom. Each Participant will inform BoZ immediately if any person authorised to utilise the Services on behalf of a Participant ceases to be employed by that Participant or ceases otherwise to work for that Participant or to be under its control.

Bank of Zambia ZIPSS Rules 16 5.2 Request to Create a User Each Participant requesting the authorisation of a User shall, at least two Business Days prior to the effective date thereof, complete and provide to BoZ In writing an E-Token Application form, as provided in Annex 4, dated and signed by an Authorised Person. BoZ shall reserve the right to: a) allocate e-tokens; and b) issue a digital certificate to the User (on the e-token). Participants through their Security Administrators are responsible for the creation and maintenance of their other Users in the ZIPSS system, allocation of Usernames, User profiles and initial passwords. Before a User can be registered, Participants shall ensure that the User has been trained appropriately to perform the functions on ZIPSS. BoZ shall provide one e-token with a password to each registered User. Each e-token shall be exclusive to the user to whom it is issued, and in no circumstances shall it to be shared with or used by another. When received by the registered User, the token’s default password should immediately be changed. After the initial allocation, BoZ reserves the right to charge the cost of tokens to the Participants, e.g. for replacement tokens and expansion of the User base. 5.3 Request to Modify a User Only Participant Security Administrators can assign and amend User profiles according to User responsibilities, required by Participants or by BoZ. Such assignments and amendments will take place under dual control. 5.4 Request to Suspend or Delete a User A Participant that requires one or more of its Users to be suspended or deleted can carry out the deletion on-line, but must report to BoZ in writing that a User has been suspended or deleted. The report should be submitted on the E-Token Revocation form (see Annex 5). BoZ reserves the right to suspend or delete a User from ZIPSS.

Bank of Zambia ZIPSS Rules 17 5.5 Creation and Maintenance of User Profiles BoZ Administrators shall allocate initial User profiles to Participants User Security Administrators and may, in the name and for the account of BoZ amend information about a User, including the User profile, according to the information provided by Participant administrators. BoZ shall approve specific master templates for each Participant. Within the restrictions of this template, Participant User Security Administrators shall define profiles for their staff, consistent with the segregation of duties principles. BoZ shall set up the master template on ZIPSS.

Bank of Zambia ZIPSS Rules 18 6. Financial Collateral Arrangements 6.1 Establishment of Reserves Accounts Each ZIPSS Participant may have a number of Reserve Accounts linked to its Settlement Account (SA). Establishment of a Reserve account shall allow participants to move funds in the System from the Settlement account to a Reserve account where they can only be used by ZIPSS for designated purposes. Participants can move funds into and out of Reserve Accounts as they wish unless otherwise restricted by the BoZ. In addition to the Participants SA and Statutory Reserve Account, each Participant shall have: (i) Cash Reserve account into which it shall move funds for settling cash withdrawals; and (ii) NSI Reserve account for settling obligations arising from clearing operations. ZIPSS will lock the NSI Reserve account during each clearing session. 6.2 Provision of intraday loan facility (ILF) BoZ shall provide interest free intra-day credit to Participants during the period prescribed in Annex 7. Participants shall be able to pledge government securities on ZIPSS, using the CSD system, for use as collateral for intraday loan facility. Participants may use intraday credit to the tune of the value of securities pledged by the Participant taking into account the haircuts as shall be determined by BoZ. BoZ reserves the right to introduce a cap to the amount of intraday credit that may be accessed on ZIPSS by a participant. Such a cap, when introduced, shall be communicated in writing to all Participants. Where a Participant persistently utilizes intra-day credit, BoZ shall take supervisory action against the Participant, which may include suspending the provision of intra-day liquidity to the that Participant.

Bank of Zambia ZIPSS Rules 19 7. Settlement of Net Settlement Instructions (NSIs) NSIs generated externally from clearing operations shall settle in Participants’ SAs in ZIPSS. NSIs shall settle as “all-or-nothing” multi-part transactions, with all debits and credits settling simultaneously as a batch. It shall be the responsibility of each Participant to ensure that they have sufficient funds in their Settlement Account and/or NSI Reserve account to cover their net position in each settlement session. In the event that a Participant does not provide funds in the NSI Reserve Account prior to settlement, ZIPSS shall automatically transfer funds from the Participant’s SA to the Participant’s NSI Reserve Account to cover the gross debit position. As soon as an NSI is entered into ZIPSS for settlement, funds to the tune of the debit amount shall automatically be blocked in the SAs of Participants that have a net debit position in the NSI, to enable the immediate Settlement of the NSI. If funds are not available in the SA or the NSI Reserve account of a Participant with a debit position, the NSI shall be queued until sufficient funds become available. A Participant that causes the NSI not to settle at the designated time shall be charged a penalty. BZ reserves the Right to transfer Funds from the Participant’s Statutory Account to the SA to facilitate settlement of an NSI and the Participant shall be expected to comply with the Statutory Requirements as shall be determined by BoZ from time to time. If at Initial Cut Off, an NSI is still pending due to insufficient funds, the Participant shall be required to issue instruction to the Bank of Zambia to rediscount securities pledged under the ZECHL collateral.

Bank of Zambia ZIPSS Rules 20 8. Payments 8.1 Payments to be Processed on ZIPSS ZIPSS shall process the following types of payments: a) Gross payments in accordance with the principles of RTGS; and b) Consolidated net settlements. All payments to be processed through ZIPSS shall be transacted in Zambian Kwacha (ZMW) and any other currencies that may be introduced by BoZ. Direct Credit payments shall be processed with same-day value unless a future value date is specified. Future value dates must not be more than 10 working days ahead of the current working day. ZIPSS shall process interbank transfers carried out both on the Participants’ own behalf and on behalf of customers of Participants. 8.2 Payments Limits There is currently no minimum and/or maximum limit for the amounts that may be transferred through ZIPSS, either as Individual Payment Instructions or Deferred Net Settlement Instructions. 8.3 Beneficiary Identification Participants must follow all instructions from BOZ with regard to the presentation of agreed additional data for: a) Certain Government transactions, particularly payments to the Government of the Republic of Zambia through the Zambia Revenue Authority; and b) Ordering currency from BoZ. This information must be provided according to the message formats published by BoZ and the documentation as listed in Annex 13. 8.4 Payment Priorities ZIPSS shall allow Participants to assign priorities to Payment messages. BoZ payments and NSIs will be among the types of transactions with a high priority. The order in which payments in the waiting queue shall be settled shall depend first on the priority,

Bank of Zambia ZIPSS Rules 21 and second on the time they are validated by ZIPSS within each priority. The range of message priorities is defined in Annex 12. 8.5 Modification of Priority A Participant may change the priority of a queued payment message that it has submitted for settlement. The procedure for changing priority codes is detailed in the User Manuals. 8.6 Straight-through Processing All participants shall be required to implement straight-through processing (STP) for transactions processed for settlement on ZIPSS. Each Participant shall implement STP for outgoing transactions, in which case outgoing transactions for settlement on ZIPSS shall be generated from a participant’s core banking system. Participants shall process payment instructions for settlement on ZIPSS on behalf of customers within one (1) hour from the time such payment instructions are submitted by the customer. Each Participant shall implement STP for incoming transactions, which shall ensure that all payments that are credited to a participant’s settlement account on ZIPSS, are immediately applied to the beneficiary accounts on the core banking system. Participants shall apply incoming payment instructions on the core banking system, at a minimum, by reference to the account number. In exceptional cases where manual intervention is required for such settlements to be effected on the core banking system, such interventions shall not take more than one (1) hour after successful settlement on ZIPSS. In the case where the account number is incorrect, participants shall be required to return the funds as per provisions made in section 21.4.1 - Correction of an erroneous order. The Bank of Zambia may take supervisory action in accordance with provision of the National Payment Systems Act on participants that fail to meet these requirements.

Bank of Zambia ZIPSS Rules 22 9. Payment Message Format 9.1 Format For RTGS Payment messages, Participants must comply with SWIFT MTxxx formatting rules. 9.2 RTGS Payments The following message types shall be used in ZIPSS:  MT019 – NAK of processing for MT10x and MT2xx messages  MT103 – Single Customer Credit Transfer  MT198/298 – acknowledgments, notifications and NSIs from Clearing Houses  MT202 – General Financial Institution Transfer  MT204 – Participant Debit (BoZ use only)  MT205 – Participant Credit (BoZ use only)  MT900 – Confirmation of Debit – Optional by Participant (controllable by parameter)  MT910 – Confirmation of Credit – Optional by Participant (controllable by parameter)  MT920 – Request Message  MT940 – Statement Message – Optional by Participant (controllable by parameter)  MT941 – Balance Message – Optional by Participant (controllable by parameter)  MT942 – Interim Transaction Report – Optional by Participant (controllable by parameter)  MT950 – Statement Message – Optional by Participant (controllable by parameter)  MT999 – Free format message For more detailed information on the above message types, reference should be made to the SWIFT User Guide.

Bank of Zambia ZIPSS Rules 23

Bank of Zambia ZIPSS Rules 24 10. Processing Procedure 10.1 General Issuing Conditions Participants shall comply with the timetable in Annex 7 and shall undertake to present the different types of Payment Instructions before the cut-off times stated in this timetable. Participants wishing to apply for an extension of the cut-offs on ZIPSS shall be required to fill out the form in Annex 18. The completed application shall be signed by two (2) authorised signatories and shall be sent to zipss@boz.zm no later than 15:30 hours. The conditions under which the Bank shall consider to extend the system include the following: i. System wide challenges on the ZIPSS; ii. System wide challenges on ZECHL operated payment platforms (EFT, CIC and NFS); iii. Processing of systemically important/critical payments; iv. Challenges impacting the ZIPSS on account of integration with other critical infrastructures; v. To facilitate system maintenance; vi. Challenges with the ZIPSS infrastructures. Where all or a significant number of Participants fail to access the system via the SWIFT network or VPN. BoZ shall determine the duration of the extension and reserves the right to reject an application for extension. An approved application for extension shall attract a fee as prescribed by the Bank. Participants shall monitor the messages in the outward ZIPSS Pending Queue and take the necessary action to clear any pending transactions before the Final Cut-Off. Transactions that do not settle at final cut-off shall be cancelled and shall attract a charge as detailed in Annex 8 – Pricing. 10.2 Submission and Validation The Participants shall take all necessary measures to optimise the smooth flow of the payments, especially by adhering strictly to the timetable in Annex 7.

Bank of Zambia ZIPSS Rules 25 Payment Instructions sent by Participants shall immediately be validated by ZIPSS. If a Payment Instruction is rejected, an error message shall be sent to the issuer. A list of error codes is set out in Annex 15. The ‘handover point’ between a Participant and ZIPSS is the point of Technical Acceptance. This is when ZIPSS has received and validated a message as being a valid message and has therefore accepted it for settlement. An acknowledgement message is sent to the sending bank at this point. The accepted messages are recorded and chronologically processed by the system according to the FIFO (“First In First Out”) principle within the specified Priority. 10.3 Queuing ZIPSS payments shall be settled as follows: a) the information necessary for settling the payment shall be extracted from the detailed Payment Instruction; b) if the sender has sufficient funds available, the payment shall be settled (paying Participant debited, beneficial Participant credited) and immediately becomes final; c) if the funds are insufficient to settle the payment, ZIPSS shall put the Payment Instruction in the Pending Queue until the funds become available. d) if the funds remain insufficient at system cut-off times, the pending transaction shall be cancelled in accordance with the operating timetable. 10.4 Processing of Payment Instructions in the Pending Queue A Participant who wishes to have a ZIPSS Payment message to be treated preferentially, shall assign a higher priority code in such a message. The order in which payments in the Pending Queues are executed depends first on the priority and second on the time they are validated by ZIPSS. All payments with the same priority shall be processed on the basis of the FIFO (“First In First Out”) principle.

Bank of Zambia ZIPSS Rules 26 10.5 Cancellation of Queued Payment Instructions 10.5.1 By the Issuer Payment instructions queued by ZIPSS may be cancelled by the sending Participant in exceptional circumstances. 10.5.2 By BOZ BoZ can cancel any queued Payment Instructions in order to facilitate the smooth flow of funds through the system. In such case BoZ shall immediately inform the initiating Participant. ZIPSS shall automatically cancel any queued ZIPSS payments for current business day value that have not been settled at Final-cut-off. 10.6 Processing of NSI NSIs shall be submitted automatically to the ZIPSS settlement engine at the specified time for settlement. A Participant shall ensure that sufficient liquidity is available to settle the NSI generated at the end of each Clearing session. If the NSI is not settled it shall be queued in the normal way. 10.7 Gridlock Resolution 10.7.1 Initiation of Gridlock Resolution If the value of the ZIPSS Payment Instructions in the Pending Queue leads to saturation of the system, or if two or more Participant’s queues become blocked with Payment Instructions, Gridlock Resolution within ZIPSS shall be initiated automatically. Gridlock Resolution shall be achieved by simulating a bilateral or multilateral netting procedure. Participants shall be expected to monitor their SAs during the day and ensure that they have sufficient funds available to meet their settlement responsibilities. BoZ will monitor the position of each Participant and may advise Participants to take the necessary steps to unblock the situation. 10.7.2 Delayed Gridlock Resolution Initiation of Gridlock Resolution shall automatically be delayed by the entry of an NSI until such time as ZIPSS has attempted to settle the NSI transaction. If Gridlock

Bank of Zambia ZIPSS Rules 27 Resolution is already running when an NSI transaction is entered, it will be completed before the NSI is processed.

Bank of Zambia ZIPSS Rules 28 11. Irrevocability of Payment Instructions 11.1 Moment of Entry into the System The moment of entry into the system is the moment of the Technical Acceptance of a payment instruction by ZIPSS, i.e. after validation but before acceptance for Settlement (before passing the Available Funds test) or queuing of the Payment Instruction by ZIPSS. As from that moment, the Settlement of the Payment Instruction will be protected against claw-back in case of insolvency of the Participant concerned, in accordance with the National Payments System Act Number 1 of 2007. 11.2 Irrevocability and Finality of Payment Instructions Settlement will be final and irrevocable once settlement accounts of respective participants have been credited and debited with the amount specified in the payment instructions.

Bank of Zambia ZIPSS Rules 29 12. Reports and Enquiry Facilities ZIPSS shall provide the Participant with systematic information on: a) its Intraday Credit position at BoZ; b) the state of its SA; c) the transactions on its SA; and d) its Pending Queue with ZIPSS Payments and NSIs still to be processed. The specifications of message formats and report contents are detailed in the relevant SWIFT and ZIPSS User Manuals. Other regular or adhoc reports can be viewed and printed directly from the screen at any time.

Bank of Zambia ZIPSS Rules 30 13. Monitoring of Payment Flows and Reconciliations Each Participant shall be responsible for monitoring throughout the day the Settlement of the payments it has sent, the number and amount of payments stored in its outward Pending Queue, any queued net and gross settlement instructions, the balance of its SA, its ILF and the level of its reserves. Each Participant shall aim to avoid having unsettled payments. BoZ shall not be liable for any loss incurred by a Participant due to failure by a Participant to monitor and reconcile its payment flows. Each Participant shall hold BoZ and the other Participants harmless from and against any claim, cost or expense (including legal fees) resulting from their failure to monitor their payment flows and their failure to reconcile, pursuant to Section 22.2.1 of these Rules.

Bank of Zambia ZIPSS Rules 31 14. Intraday and Overnight Loan Facilities 14.1 Primary Conditions Intraday credit shall be provided as described in Section 6.2. 14.2 Limitation, Suspension and Termination of Access to Intraday Credit BoZ may limit, suspend or terminate the Participant’s access to Intraday Credit if: a) the Participant or one of its creditors files for cessation of payments; b) the Participant is declared bankrupt; c) its account in ZIPSS has been terminated or the acts or omissions on the part of the Participant, in BoZ’s opinion, result in systemic risk or may endanger the smooth operation of ZIPSS; d) the Participant no longer complies with the eligibility criteria for monetary policy operations; or e) the Participant does not comply or no longer complies with the conditions as referred to in Section 2 of these Rules. 14.3 Overnight Loans Any ILF that has been used during the day will mature at Final Cut-off. Each Participant shall ensure that they have sufficient funds to pay back the ILF. If a Participant does not have sufficient funds at this point, BoZ reserves the right to either: a) rediscount the securities against which the ILF shall be issued; or b) grant an overnight loan (OLF) against acceptable collateral or enter into a repurchase agreement. The system will automatically recover the principle and interest amount of the OLF at start of the next business day. The amount of the overnight loan shall be credited to the Participant’s SA by the system automatically after Final Cut-Off to enable ZIPSS to complete End of Day processing.

Bank of Zambia ZIPSS Rules 32 15. Business days and Operating Hours The ZIPSS operating timetable is as defined in Annex 7 and may be modified from time to time by BoZ in consultation with Participants.

Bank of Zambia ZIPSS Rules 33 16. Handling Technical Failures 16.1 General Obligations In case of a technical failure of a Participant which results in failure to generate or receive payments through ZIPSS for more than one hour during the day, the Participant shall immediately inform BoZ. Participant shall take necessary steps to resolve the failure as soon as possible. The informing notice shall be communicated In writing or via secure emails. 16.2 Telecommunication Failure In case the connection of a Participant’s ZIPSS link to the VPN and/or the SWIFT network breaks down, the Participant shall notify BoZ as soon as possible. The Participant should also within a reasonable period of time start a new connection via their fall-back line. If the Participant is then still unable to send messages to the system, the Participant may use ASA facility provided by BoZ (see 2.2.6 above); 17. Audit Rules Each Participant shall submit to BOZ a yearly compliance audit certificate for the preceding year by 31st March of every calendar year, in the form specified in Annex 11. The yearly compliance audit certificate must be signed by the Chief Operating Officer and the Compliance Officer. Should the provided annual reports contain material errors, the Participant shall be penalized. Also see Annex 11 for further instructions on the procedural requirements in relation to yearly compliance audit certificates. In addition, BOZ may require the submission of system audit reports and working documents on a regular basis. Participants shall provide to BoZ any information relating to their operation of ZIPSS that may be required within five (5) working days of any request. BoZ may take supervisory action in accordance with provisions of the National Payment Systems Act on a participant that fails to meet these requirements. BoZ may also assess compliance with the above-mentioned provisions and may examine Participants’ controls for adequacy and where necessary, make contact with the auditors of the Participants.

Bank of Zambia ZIPSS Rules 34 18. Pricing Rules BoZ shall set fees and other charges for the usage of the ZIPSS which shall be notified to Participants from time to time. The fees and charges shall include: a) An entry fee for new Participants on ZIPSS; b) An annual membership fee on all Participants, to be effected by BoZ at the start of each calendar year; and c) Transaction processing fee. d) Incentives: BoZ may offer a discount to encourage Participants to process transactions earlier in the day. BoZ may also charge Penalties for infringement of these Rules. General Instructions on Fees a) ZIPSS shall calculate fees on the basis of Participants’ usage, and will charge these fees to Participants’ SAs as stipulated in Annex 8 - Pricing Charges shall be collected on a daily basis, and the Participant hereby authorises BoZ to effect Participant Debits for settlement of fees and penalties by the Participant. ZIPSS will provide Participants with a report giving details of all charges and penalties. BoZ may periodically review its fees and charges and shall ensure that details of pricing are communicated to all Participants 30 days prior to implementation. BoZ reserves the right to charge a Participant for any additional services specifically rendered to that Participant.

Bank of Zambia ZIPSS Rules 35 19. Administrative Requirements and Financial Rules 19.1 Audit Trails ZIPSS generates comprehensive audit trails which participants can access on request. For Participants, access to audit trail data will be restricted by use of User profiles. Where an auditor or any other legal entity wishes to access data about a Participant, BoZ will require a written instruction from the Participant’s Authorised Person or certified copy of a board resolution of that Participant authorising the auditors, BoZ or this other legal entity to access data about that Participant. The audit trails provide information: a) at application level, showing the path of transactions through the system, the source of all changes to data in the system files and on the databases and providing proof that all transactions received have been processed. The data entry users and approvers for all actions are recorded and are visible on the relevant screens; b) at Participant level, showing details of all transactions relating to a particular Participant; c) at User level, giving a record of all accesses to the system and the actions of Users, keeping a record of actions by User and showing which Users have taken action on any particular transaction. These elements form part of the technical audit trail known as the system log; d) at technical level, providing a secure record of the technical functioning of the system, recording access to system modules and technical events in detail. This audit trail is referred to as the system log. The main audit tools, apart from standard reports, are as follows: a) facility to list all transactions for ZIPSS from on-line history files within the system for at least the previous three years, from postings on the database; b) facility to request from BoZ User defined reports for audit purposes based on statistical and other tables in the database. BoZ may levy a charge for the production of special reports.

Bank of Zambia ZIPSS Rules 36 19.2 Publication of Statistics BoZ will publish monthly and annual statistics on its website concerning the number and value of payments exchanged through ZIPSS. 19.3 Conservation and Archiving of Documents BoZ and the Participants shall comply with the laws and regulations applicable in Zambia concerning the conservation and archiving of documents as regards the support and the duration of the conservation. For this purpose, all transactions and accounting data will be stored for a period in accordance with relevant Zambian law. All current transactions and data for the previous three years are accessible on-line in real-time. Older data can be accessed by requesting BoZ to provide.

Bank of Zambia ZIPSS Rules 37 20. Business Disruption Event A Business disruption Event is any event which disrupts normal processing to the extent that contingency procedures are brought into effect. BoZ shall have the right in its sole discretion to determine and warn Participants that a Contingency Event has occurred. This may or may not include transfer of operations to the ZIPSS alternate site or running ZIPSS in stand-alone mode, without communication links to other systems. In case of a business disruption Event, BoZ shall have the right, in its sole discretion, to change the priority of any queued transaction from any Participant in order to facilitate the flow of funds through ZIPSS, subject to the correct use of priorities as set out in Annex 12. BoZ will notify the affected Participant(s) whenever such an operation is performed. Under these conditions, BoZ shall have the right, in its sole discretion, to conduct special reconciliations with Participants including Clearing Houses and to request therefore the necessary transaction and other information from Participants. As a result of reconciliations in a contingency situation, BoZ may ask Participants to perform special transactions to ensure that all systems are properly synchronised. In order to comply with Bank for International Settlements (BIS) Principles for Financial Market Infrastructures1 , these transactions must be carried out before End of Day on the day affected.

1 Available at http://www.bis.org/publ/cpss101.htm

Bank of Zambia ZIPSS Rules 38 21. Liabilities and Responsibilities 21.1 Force Majeure If by force majeure any Participant is rendered unable wholly or in part to carry out its obligations under these Rules (except payment obligations) or is delayed in its operations to be performed pursuant to these Rules (except payment obligations) such Participant may within 14 days from the date of commencement of such force majeure give written notice thereof to BoZ stating the date and extent and the nature of the force majeure causing the same. Upon giving such notice, the obligations of the Participant claiming force majeure may be suspended during the continuance of such force majeure so far as such obligations are affected by the force majeure. The Participant claiming force majeure shall use all due diligence to remove the effects thereof but nothing in this clause requires any Participant to settle any industrial dispute except in such manner as it in its absolute discretion deems fit. Any Participant the performance of whose obligations has been so suspended shall resume performance thereof as soon as reasonably possible after the circumstances preventing such performance have terminated and shall promptly thereafter so notify BoZ In writing. In the event that a Participant has invoked the provisions of this Clause and a force majeure continues for a period in excess of one (1) month, BoZ may terminate the Participant’s participation. A Participant shall notify BoZ immediately upon its becoming aware of any event known or likely to give rise to a possible suspension of its obligations pursuant to these Rules. For the purpose of these Rules the term “force majeure” includes (but is not limited to) fires, flood, storms and other damage caused by the elements, strikes, riots, explosions, governmental action or inaction, currency restrictions, acts of God, insurrection and war and any other cause whether of the kind specifically enumerated above or otherwise which is not reasonably within the control of the party claiming force majeure.

Bank of Zambia ZIPSS Rules 39 There shall be no liability for non-compliance with these Rules to the extent that, and for so long as, there is an inability to perform the obligations under these Rules due to force majeure. The foregoing shall not prejudice the responsibility on all parties to carry out the error handling procedures and other technical operational measures such as those described in section 20 - Contingency Event, in accordance with these Rules, so far as possible, despite the Force Majeure Event, and to use all reasonable efforts to mitigate the effects of any such event whilst it is continuing. 21.2 Responsibilities of the Participants 21.2.1 General Principles The Participants shall issue their Payment Instructions to ZIPSS in accordance with these Rules. If there is a transmission problem, Participants shall contact, as appropriate, BoZ’s Help Desk whose details are given in Annex 10. Participants shall monitor the proper progress of the transactions as closely as possible and report any irregularities detected to the Help Desk. Participants are individually responsible for: a) the correct fulfilment of their obligations resulting from these Rules; b) the quality of the data they send on their own behalf and on behalf of their correspondents or customers; c) the compliance of the data with the technical protocols and message formats agreed upon; d) securing the access to their Participant ZIPSS webstation (s) in accordance with the security procedure under these rules; e) ensuring that they collect all data provided to them by ZIPSS; f) controlling the processing of their Payment Instructions until ZIPSS gives these Payment Instructions the “technically accepted” status; g) strictly complying with the Procedures and the rules governing access to the system; and

Bank of Zambia ZIPSS Rules 40 h) ensuring that only duly authorized Users who have been issued with an access control e-token by BoZ are using the system. Each Participant shall be responsible for monitoring throughout the day the Settlement of the payments it has sent, the number and amount of payments stored in outward Pending Queues, any queued net and gross settlement instructions, the balance of its SA, its ILF and the level of its reserves. Each Participant shall aim to avoid having any unsettled payments during the business day. BoZ shall not be liable for any loss incurred by a Participant due to a failure by a Participant to monitor and reconcile its payment flows, and each Participant hereby agrees to hold BoZ and the other Participants harmless from and against any claim, cost or expense (including legal fees) resulting from their failure to monitor their payment flows and their failure to reconcile. 21.1.2 Access Control Participants must comply strictly with the Procedures and the rules governing access to ZIPSS. Only duly authorised Users who have been issued with an access control e￾token by BoZ may use the system. The erring Participant is liable for any damage resulting from non-compliance with the Procedures or from improper or fraudulent use thereof. 21.1.3 Review of ZIPSS User List for Active, Disabled and Removal of Dormant/ Unauthorised Users Participants must regularly review all user access and report annually on this to BoZ in the form prescribed in Annex 11. Should the provided reports contain material errors, the Participant shall be penalised. 21.2.3 Obligations for Transactions Performed by Users Participants shall be liable for any loss resulting from non-compliance with the Procedures or from improper or fraudulent use thereof and particularly fully liable for every transaction performed by their users. Each Participant shall ensure that its own systems and procedures provide appropriate protection against fraudulent activity in connection with the system.

Bank of Zambia ZIPSS Rules 41 All actual or suspected fraudulent activity in connection with ZIPSS must immediately be reported to the office of the Director - Banking, Currency and Payment Systems Department, at BoZ whether such fraud or suspected fraud is on the part of the Participant’s staff, its customer or anyone else. The report should in the first instance be by telephone, followed by written confirmation by email or letter. Each Participant shall provide as much information as possible and all reasonable assistance, whether requested by BoZ or any other Participant, to investigate and identify the source of any actual or suspected fraud or suspicious transaction. 21.2.4 Obligations in the Event of Constraining Events In case of Constraining Events (i.e. events which affect the ability of any Participant to participate to the normal and usual extent in sending and receiving payments), the Participant involved shall inform BoZ immediately and do everything possible to: a) identify the irregularity; b) resolve the problem if it is possible for the Participant to do so within its powers and make use of the fall-back resources provided, if the need arises; c) inform BoZ when the problem has been resolved and the system is functioning normally again; and d) if requested, work with BoZ to solve any problem affecting ZIPSS and to return to a normal situation once the problem has been resolved. 21.3 Responsibilities and Liabilities of BoZ To the extent consistent with applicable law, BoZ shall be liable hereunder only for its failure to act in good faith or to exercise reasonable care, which shall be determined in accordance with the reasonable commercial standards of the banking industry in Zambia. BoZ shall not be liable for delay or failure in performance by, nor the accuracy of (nor shall it be under a duty to verify the accuracy of) any data or instructions provided by the Participant or a third party. Under no circumstances shall BoZ be liable for any indirect, incidental, consequential loss (including loss of profit) even if advised of the possibility of such loss. As System Operator, BoZ: a) is responsible for checking the Payment Instructions received in accordance with these Rules and the User Manuals;

Bank of Zambia ZIPSS Rules 42 b) is responsible for, (once it has technically accepted the Payment Instruction for processing), integrity, security and confidentiality of the Payment Instruction until it is dispatched to the Receiver. c) is responsible for keeping a record of all Payment Instructions according to relevant Zambian law; d) is not responsible for damage resulting from messages containing errors or for errors which cannot be detected by the checks described in the User Manual; e) must take all necessary reasonable measures to protect its computer system and to prevent it from being out of order and endeavour to offer as quickly as possible, upon every breakdown or important Constraining Event, a solution to the problem by carrying out the appropriate fall-back procedures. If these measures have been taken, BoZ is no longer responsible for the possible breakdown or Constraining Event, even temporary, for any reason, of the computers or the programs it uses or places at the disposal of its Participants for the processing of their payments, nor for the destruction or erasing of data stored on the computers or for possible fraudulent use thereof by third parties; f) is responsible for making available to the Participants the updated information concerning their payment flows and their current account as generated by the system; g) is responsible for providing a first level Help Desk to support the operation of the system and the Participant webstation in normal circumstances. The liabilities of BoZ as Technical Operator are limited to: a) the correct operating of the system as described in its User and Technical Manuals; b) securing by means of adequate devices and procedures the system as regards the data integrity, availability and confidentiality; c) provision of adequate capacity to meet the system performance requirements of the contracts between BoZ and Participants; d) endeavouring to solve without delay, and in close co-operation with the hardware, software or service providers, any failure or dysfunction of the system. BoZ shall not be liable for any failure of ZIPSS resulting from the incorrect use of the system by the Participants or due to software errors or communication failures. Except

Bank of Zambia ZIPSS Rules 43 as provided in this section, BoZ shall have no liability whatsoever to any Participant or any other person for any loss, liability or expense suffered by such Participant or person arising from BoZ’s acts or omissions in connection with ZIPSS. 21.4 Claims and Compensations 21.4.1 Correction of an erroneous order Where an Issuing Participant makes a payment on the ZIPSS in error (such as a duplicate message, misdirected payments, incorrect amount, etc.), it shall request the receiving participant In writing to reverse the funds. However, if a Participant is aware that it has received a payment erroneously, the receiving Participant must inform the issuer immediately and make the reversal as a new instruction, using a common identifier for reconciliation purposes. Where a reversal is made, it shall be made to the remitting account. If the issuing Participant reports the error before 12:00 hours and if the erroneously credited Participant does not affect the reversal of the payment on the same day, the issuing participant may claim interest for the delay from the erroneously credited Participant. This interest is calculated on the basis of BoZ overnight lending facility (OLF) rate. 21.4.2 Fraudulent or Erroneous Transactions Any loss incurred by a customer due to a fraudulent or erroneous transfer originating from a Participant due to failure in internal controls by the Participant shall be borne by such Participant. 21.5 Administrative Fees BoZ may impose administrative fees on Participants that do not comply with the provisions of these Rules.

Bank of Zambia ZIPSS Rules 44 22. Dispute Resolution 22.1 Law and Jurisdiction These Rules are subject to Zambian law. In case of a dispute between Participants or between Participants and BoZ, the respective rights and obligations in relation to Payment Instructions processed through ZIPSS and all other matters referred to in these Rules, shall be determined according to the laws of Zambia and the provisions contained in the rules and procedures referred to in these Rules and Annexes. 22.2 Conciliation and Arbitration Procedures 22.2.1 Conciliation Procedure In case of operational error or dispute between Participants, the Participants concerned shall find an amicable settlement and take all necessary measures to that effect. If Participants fail to reach an amicable settlement within ten days of initiating dialogue, a party to the dispute shall refer, in writing, the dispute to BoZ, to start a conciliation procedure in order to find a solution concerning the error or the dispute, its consequences and damages. The Participants concerned shall communicate to BoZ all necessary information and documentation to this effect. 22.2.2 Arbitration Procedure Participants and BoZ agree to submit any dispute concerning the interpretation or the implementation of these Rules on which the parties have not been able to find an amicable settlement or a solution through a conciliation procedure within 45 days for arbitration in accordance with the Arbitration Act, No. 19 of 2000.

Bank of Zambia ZIPSS Rules 45 23. Insolvency of a Participant 23.1 Notification of Insolvency Events A Participant must notify BoZ immediately upon becoming aware of: a) any Insolvency Event in respect of itself; or b) any reasonable grounds to suspect that any other Participant is insolvent. For the purposes of a) and b), ‘insolvency’ is to be read as meaning that the relevant Participant is not able to pay all its debts as and when they become due and payable. Upon receiving any notification under a), BoZ will promptly notify all other Participants. These notifications will comply with the conditions set in Annex 9. Upon receiving any notification under b), BoZ will promptly make enquiries of the Participant in respect of which insolvency is reported to be suspected and, if the relevant Participant is prudentially supervised by an entity other than BoZ, the relevant supervisor. To the extent that an Insolvency Event is admitted by the relevant Participant and that fact is communicated to BoZ, BoZ shall promptly notify all other Participants. The provisions of section 3.2.1 (suspension) or 3.2.2 (termination) may apply as a result. 23.2 Arrangements upon Notification of an Insolvency Event before the Occurrence of the Decision Marking the Commencement of the Insolvency Event Upon being informed of the fact that a Participant has admitted an Insolvency Event pursuant to section 23.1, BoZ will make the following arrangements: 23.2.1 Payment Instructions submitted by the Insolvent Participant after reporting or admitting an Insolvency Event For Participants that still have an account with BoZ after the occurrence of an Insolvency Event, BoZ will take all reasonable steps to ensure that, except with the consent of the appointed trustee, no further Payment Instructions are presented to ZIPSS for Settlement by the insolvent Participant with BoZ, except for NSI transactions. The suspended or excluded Participant remains however bound by the obligations resulting directly or indirectly from its participation in ZIPSS.

Bank of Zambia ZIPSS Rules 46 23.2.2 Payment Instructions submitted by the Insolvent Participant that have been technically accepted by ZIPSS but have not yet been accepted for settlement at the moment ZIPSS is informed of the Insolvency Event For all Payment Instructions submitted by the insolvent Participant that have already been technically accepted by ZIPSS, but have not yet been accepted for Settlement by ZIPSS in accordance with section 11.1 of these Rules at the moment ZIPSS is informed of the Insolvency Event, BoZ shall take all reasonable steps to cancel them, except for NSI transactions. 23.2.3 Payment Instructions submitted by the insolvent Participant that have been accepted for Settlement by ZIPSS at the moment ZIPSS is informed of the Insolvency Event The Participants expressly acknowledge that the procedure for processing the Payment Instructions described in sections 10 and 11 of these Rules continues to apply despite the Insolvency Event. This means among other things that the Payment Instructions that have been accepted for Settlement by ZIPSS before the announcement of the Insolvency Event are final. 23.3 Notification of the Decision Marking the Commencement of the Insolvency Proceedings In accordance with the National Payments Systems Act, the relevant court, which, according to Zambian law, takes the decision of opening an insolvency proceeding against a Participant, shall immediately notify that decision to BoZ. Upon receipt of such notification, BoZ will immediately notify the System Operator (i.e. the Department of BoZ responsible for the ZIPSS operations) about the decision to open the insolvency proceedings in accordance with the National Payments Systems Act. 23.4 Arrangements in case of notification of the decision marking the commencement of insolvency proceedings during the operating day If the decision marking the commencement of insolvency proceedings occurs during the day, the following arrangements are made from the time of receipt thereof: a) Payment Instructions submitted by the insolvent Participant after the notification of a decision marking the commencement of insolvency proceedings with respect

Bank of Zambia ZIPSS Rules 47 to that Participant are prevented from being entered into ZIPSS by setting the insolvent Participant to blocked status first, to enable positions of that Participant that have been accepted for Settlement to be cleared up and then setting disabled status, except for NSI transactions as described under (e) below. b) Payment Instructions submitted by the insolvent Participant that have been technically accepted but have not yet been accepted for Settlement at the moment of the notification of the decision marking the commencement of insolvency proceedings with respect to that Participant are rejected, except for NSI transactions as described under (e) below. c) Payment Instructions submitted by the insolvent Participant that have been accepted for Settlement by ZIPSS at the moment of the notification of the decision marking the commencement of the insolvency proceedings with respect to that Participant are final and have to be settled by ZIPSS. d) NSIs containing Payment Instructions accepted for Settlement by DNS that have been designated by BoZ as systems included in the scope of BoZ Settlement Finality Regulations and the National Payments Systems Act and that are fully collateralised, before or during the operating day of the decision marking the commencement of insolvency proceedings or reorganisation measures but before the decision marking that commencement, that are presented to ZIPSS on the day ZIPSS is notified of a decision marking the commencement of insolvency proceedings with respect to that Participant shall be settled by ZIPSS. e) The commencement of insolvency proceedings against a Participant shall not prevent: i. funds available on the SA or securities available on the Securities Account of that Participant from being used to fulfil that Participant’s obligation in ZIPSS before or on the day of the decision marking the commencement of the insolvency proceedings; ii. funds blocked on the SA or in the relevant ZIPSS reserve and securities blocked on the Securities Account of that Participant in favour of ZIPSS from being used to fulfil that Participant’s obligation in ZIPSS before or on the day of the decision marking the commencement of the insolvency proceedings.

Bank of Zambia ZIPSS Rules 48 23.5 Notification of the decision marking the commencement of insolvency proceedings at the end of the operating day If the order or decree marking the commencement of insolvency proceedings occurs after the daily closing but before the beginning of the next Business Day, BoZ shall make the necessary adaptations in ZIPSS before the start of the next Business Day. If this concerns a Participant, BoZ shall adjust the parameters of ZIPSS so that the Participant in question can no longer issue or receive Payment Instructions (i.e. the Participant status is set as Blocked or Disabled in the system). The Participant shall be advised of the Insolvency Event before the start of the next Business Day. 23.6 Suspension or termination on grounds other than an Insolvency Event The procedure for immediate termination of a Participant’s activities on grounds other than an Insolvency Event is identical to that in the case of an Insolvency Event. As soon as the suspension has been lifted, the Participant shall resume normal operations on the ZIPSS from the beginning of the next Business Day.

Bank of Zambia ZIPSS Rules 49 24. Amendment to the Rules and complementary instructions 24.1 Amendment to the Rules BoZ shall be responsible for the amendment from time to time of these Rules or the Annexes hereto, or any additional documents containing, inter alia, technical provisions and specifications for ZIPSS, after giving Participants the opportunity to comment on them. At any time Participants may suggest amendments to BoZ which shall be considered in consultation with all other Participants, and be applied at the discretion of BoZ. Such amendments and additional documents shall become effective as an integral part of these Rules as per the date specified by BoZ, which date shall not precede communication to the Participants. BoZ will give notice to each Participant of any modification within 30 calendar days before its entry into force. 24.2 Complementary Instructions BoZ may send to the Participants complementary instructions on the organisation of the system and on the duties of the Participants, after giving Participants the opportunity to comment on them. Such complementary instructions shall be considered to form part of these Rules.

Bank of Zambia ZIPSS Rules 50 Annex 1: Glossary Short Name Full Name Explanation/Definition Acceptance (for settlement) The moment at which an RTGS Payment Instruction becomes irrevocable. This is the point at which a transaction passes the tests to determine whether there are sufficient funds for the transaction to proceed. Administrator Authorised BoZ official involved with the administration of ZIPSS and its component modules. Audit Trail A sequential record of events having occurred in a system containing detailed information to assist subsequent incident analysis. Participants can view the audit trail of individual transactions. Only BoZ can view the full audit report. Authentication The methods used to verify the origin of a message or to verify the identity of a Participant connected to a system. See also Digital Certificate & Digital Signature. Authorised Person Person duly authorised by all necessary action to access data and/or to provide instructions with respect to bank accounts, funds transfers and other financial transactions by electronic means and/or person designated to access such data and to provide instructions, on behalf of the Participant in connection with the Services and the limitations, if any, upon such authority. ASA Authorised Settlement Agent A facility to that allows the Bank of Zambia to process transactions on behalf of Participants in cases where a Participant is unable to process transactions on ZIPSS Authorising Officer Person mandated to grant authority to other individuals at the Participant’s location in relation to performing designated activities on ZIPSS.

Bank of Zambia ZIPSS Rules 51 Short Name Full Name Explanation/Definition ACH Automated Clearing House An electronic central clearing facility for transferring funds whether in real time or in batches. Available balance Or Available funds The funds available for settlement of transactions at any point in time. Calculated using pre-defined components, including opening balance, the net value of credits and debits processed, minimum reserve requirement, borrowed funds, cash reserve requirement and account limits (if any). This for forms part of a Participant’s overall Liquidity. Back-up Refers to the process of keeping off-site mirrored (i.e. real-time) copies of essential system files, including the ZIPSS database to ensure that the system can be recovered within the timeframes specified in relevant Service Level Agreements (SLA) in the event of the main production system failing or other disaster events occurring. Also used to refer to the copy files. Beneficiary The recipient of a credit transfer payment BoZ Bank of Zambia The Central Bank of Zambia established under the Bank of Zambia Act of 1996 and operator of ZIPSS. Batch The transmission or processing of a group of payment orders or securities transfer instructions as a set on an all-or-nothing basis. This implies that a batch may not be partially settled on ZIPSS

Bank of Zambia ZIPSS Rules 52 Short Name Full Name Explanation/Definition BIC Business Identifier Code A unique address that identifies precisely the financial institutions involved in international financial transactions. SWIFT BICs are used in ZIPSS. A SWIFT BIC consists of eight or eleven characters comprising the first three or all four of the following components: Bank Code (4), Country Code (2), Location Code (2) and optional Branch Code (3). SWIFT BICs are allocated and managed by SWIFT. Unlisted BICs may also be issued by BoZ for participants that do not process through the SWIFT network. Block A BoZ-only action taken via a ZIPSS menu function which prevents a specific Participant from sending and or receiving payment messages to and from the system. Business Continuity A payment system’s arrangements that aim to ensure that it meets agreed service levels even if one or more components of the system fail or if it is affected by an abnormal external event. Include both preventative measures and arrangements to deal with contingencies. Business Day A day on which ZIPSS is operating to process payments. Collateral An asset that is delivered by the collateral provider to secure an obligation to the collateral taker. Collateral arrangements may take different legal forms; collateral may be obtained using the method of title transfer or pledge of assets.

Bank of Zambia ZIPSS Rules 53 Short Name Full Name Explanation/Definition Constraining Event Processing, communications or other failure of a technical nature; Inaccessibility (total or partial) to facilities by means of which payments are sent and received; or Manifestation of industrial action, which affects, or may affect, the ability of any Participant to participate to the normal and usual extent in sending and receiving payments. Contingency Event Any Constraining Event or any other event or circumstance specified by BoZ. Cut-off A designated time beyond which certain ZIPSS functions cannot be performed, as specified in Annex 7. DNS Deferred Net Settlement A bilateral or multilateral settlement mechanism where settlement takes place on a net basis and there is a time lag between the transmission of payments from Participants to ZIPSS, their acceptance for settlement and the actual settlement. DvP Delivery versus Payment Mechanism used in securities transfer transactions, which ensure that the final transfer of ownership of the securities (the delivery) can be considered completed only if the actual payment for the transaction has been made. Digital Certificate An encrypted text, which enables devices such as electronic tokens to be authenticated by the system and system components to authenticate each other, using Public Key Infrastructure (PKI) methods (see PKI). Digital Signature A string of data generated by a cryptographic method that is attached to a message to ensure its authenticity as well as to protect the recipient against repudiation by the sender.

Bank of Zambia ZIPSS Rules 54 Short Name Full Name Explanation/Definition Disable A BoZ-only action taken via a ZIPSS menu function, which prevents a specific Participant from being able to send transactions or to access the system. e-token A Universal Serial Bus (USB) token which carries an embedded chip with memory and/or processor functions in which is contained a Digital Certificate allocated to a specific User. EOD End-of-day End of the Business Day for ZIPSS (see Annex 7). Fall-back Documented contingency arrangements to be initiated in the event of a failure or disruption to service. FCO Final-Cut-off Time at which ZIPSS cuts off processing of ZIPSS transactions and cancels any queued ZIPSS Payment transactions for same day value (see Annex 7). Force Majeure Event French for "Superior Force". A clause used in contracts that frees all signatories from liability due to a "chance occurrence or unavoidable accident". This includes, inter alia, acts of war, terrorism, natural disaster, or political intervention. FX Foreign Exchange Any currency other than Zambian Kwacha (ZMW), also used for the process of buying and selling currencies. Gateway An element of the ZIPSS software for the integration of ZIPSS with Participant banks’ existing back-office and client services. It links the bank’s internal systems with ZIPSS via Java Messaging Service (JMS) and the Virtual Private Network (VPN). GL General Ledger BoZ’s General ledger in which BoZ’s accounts, including those it holds for the banks, are held.

Bank of Zambia ZIPSS Rules 55 Short Name Full Name Explanation/Definition GRZ Government of the Republic of Zambia An elected body of representatives empowered under the Constitution of Zambia to legislate and enforce the laws of the country; to tax, apply Customs' duties and fees; and appropriate monies for public goods and services on behalf of the citizens and other inhabitants of Zambia Gridlock A situation that can arise in a funds or securities transfer system in which the failure of some transfer instructions to be executed (due to insufficient funds or securities balances) prevents fulfilment of a substantial number of instructions given by other Participants. Gridlock Resolution Resolution of the gridlock condition without overdrawing the accounts involved. Gross Settlement The Settlement of funds and securities transfer, which is effected individually on an order-by-order basis, i.e. without netting debit against credit payment transfers. Government Securities Securities issued by the Government of the Republic of Zambia. Initial-cut-off Time at which ZIPSS cuts off processing of ZIPSS transactions other than inter-bank transactions as indicated in Annex 7. IR Initial Report The blueprint for the project, describing the localisation requirements, functional details for special functions, the project plan and the operational management of the project.

Bank of Zambia ZIPSS Rules 56 Short Name Full Name Explanation/Definition Insolvency Event Any collective measure provided for in the law of Zambia or a third country, either to wind up the Participant or to reorganise it, when such measure involves the suspension of, or the imposition of limitations on, transfers or payments, such as an adjudication order, a request for composition, extension or suspension of payment, moratorium, liquidation and other similar judicial procedures. Interface The common boundary between two functional elements, two layers of system architecture, or between two physical devices that is defined by its functional characteristics, common physical characteristics of the link between them, signal or other characteristics. ILF Intraday Loan Facility Credit extended for a period of time that is less than one Business Day. The credit is provided by BoZ for the purpose of providing liquidity for a Participant in ZIPSS. ISO International Organisation for Standardisation A worldwide federation of national standards bodies from some 140 countries. The mission of ISO is to promote the development of standardisation in order to facilitate the international exchange of goods and services. In writing (i) On paper, signed by an authorised person of the sender; or (ii) by e-mail containing a document signed by an authorised person JMS Java Messaging Service A software function for the exchange of messages between computers. LAN Local Area Network A computer network that spans a relatively small area, generally confined to a single building or group of buildings.

Bank of Zambia ZIPSS Rules 57 Short Name Full Name Explanation/Definition Liquidity The measure of a Participant’s ability to meet its current obligations in respect of funds and/or securities transfer. In the context of Automated Transfer Systems, this is measured in the system by four components: available funds (balance) on the SA, queued payment transfers from other Participants to its account, credits extended by the central bank and funds from interbank money market transactions. LuSE Lusaka Stock Exchange The securities exchange in Zambia, that deals in corporate shares, Government bonds and other bonds Materials These Rules and each related Annex and attachment thereto and hereto, supplemented by User Manuals, data, processes and other documentation provided by BoZ. NPSA National Payment Systems Act Number 1 of2007 The Act thot governs the management and regulation of the National Payment Systems in Zambia NSI Net Settlement Instruction The settlement of funds transfers between or among counterparties on a net basis. An NSI contains debits and credit for banks which sum to zero. The NSI is passed to ZIPSS where the banks’ SAs are debited and credited accordingly. Netting An agreed offsetting of obligations between two or more parties or Participants. Operational hours The system day of ZIPSS, which is defined through a number of operating ‘windows’ as detailed in Annex 7. Participant An organization authorised to access and participate on the ZIPSS by BoZ. Payment The payer’s transfer to the payee against a payee’s monetary claim in a manner acceptable to the payee.

Bank of Zambia ZIPSS Rules 58 Short Name Full Name Explanation/Definition Payment Instruction See – Payment Order. Payment Message A set of data transferred via an electronic mechanism which specifies the Sender and Beneficiary of the transaction, the amount to transfer and the value date, and which enables the settlement of the transaction between Participants in a Payment System. Payment Order An order (instruction) or message requesting the transfer of funds. . PO Payment Originator Part of the ZIPSS software, which is a web-based application that enables authorised users at a Participant/BoZ to enter transactions. Payment System A settlement system operating under the authority of BoZ designated to facilitate secure and reliable transfer of financial transactions between two or more parties. Pending Queue A queue within ZIPSS that holds Payments awaiting settlement that cannot be immediately settled due to insufficient funds in the SA of a Participant Pledge A delivery of property to secure the performance of an obligation owned by one party (debtor/pledger) to another (secured party/pledgee). A pledge creates a security interest in the property so delivered. Profile A list of functions that can be accessed in ZIPSS that are assigned to a particular User or group of Users thereby limiting access to only those functions for that User or group of Users.

Bank of Zambia ZIPSS Rules 59 Short Name Full Name Explanation/Definition PKI Public Key Infrastructure A highly secure method for securing access and information transfer based on the use of Public and Private keys. Allows for data encryption, server authentication, message integrity, and client authentication for connections between the user’s browser and the application server. Can be used to achieve non-repudiation of transactions. Primary Site The ZIPSS principal operating site. Procedures The activities and the methods designated in these Rules. RABB Record of Arrangements Between Banks The document which regulates the manner in which items “for value” and “not for value” are to be exchanged, payments made, settlements effected and cash handled between banks. Repo Repurchase of Securities An agreement in which money is advanced against securities with a change in beneficial ownership of the securities, on the basis that they will be bought back at an agreed later time. RTGS Real-Time Gross Settlement An electronic form of funds transfer, where the transmission and settlement take place in real time and on an individual basis. Reserve account Accounts within ZIPSS SAs which enable Participants to set aside funds for specific purposes. Funds in reserves may only be used to settle transactions with specific Transaction Type Codes (TTC) – e.g. NSI transactions for specific Clearing Houses. RTGS Payment Instruction A credit payment instruction submitted as an individual transaction to the RTGS element of ZIPSS for immediate settlement.

Bank of Zambia ZIPSS Rules 60 Short Name Full Name Explanation/Definition Security Administrator An authorised person at BoZ or a Participant who has access to ZIPSS for the purpose of maintaining User details and the Profiles of User in ZIPSS. A Security Administrator cannot have access to ZIPSS payment entry, management and enquiry functions. Sender The originator of a payment instruction Settlement The process of debiting and crediting Participants’ SAs such that the payment is final and unconditional at the time that the SAs of the relevant Participants have been credited and debited. SA Settlement Account The account held by each Participant with Bo, used to hold funds and settle transactions between Participants. SLA Service Level Agreement A contractual document signed between BoZ, and Participants; and BoZ and other Service Providers defining the operational ZIPSS service levels. SRR Statutory Reserve Requirements The amount of reserve funds that a Participant is required to deposit with BoZ. It is calculated as a percentage of the total Kwacha deposit liability. Services Means all functions provided or to be provided by BoZ to Participants pursuant to these rules. STP Straight Through Processing The connection of one computer system to another to enable automatic exchange of transactions Substitution Recalling the securities pledged, under repo or lent from a borrower and replacing them with other securities of equivalent market value during the life of the transaction concerned.

Bank of Zambia ZIPSS Rules 61 Short Name Full Name Explanation/Definition SWIFT Society for Worldwide Interbank Financial Telecommunication International institution owned by banks which enables electronic messages to be sent securely between banks and financial institutions. System Administrator The person appointed by BoZ to supervise the operation of ZIPSS. System Operator The organisation that owns and has legal responsibility for operating a payment system and lays down operating rules. Technical Acceptance The point at which ZIPSS has validated the format of a message or batch. Technical Operator The organisation that has technical responsibility for running a system. TTC Transaction Type Code A Code to identify certain types of payment messages and how they should be processed. TTCs are listed in Annex 16. User An Authorised Person who has access to ZIPSS. User Manual/ Guides Documentation defining how to use ZIPSS. Value date/Value day The Business Day on which the amount of a successful Payment Instruction will be at the disposal of the receiving bank (payee) or its client. VPN Virtual Private Network Dedicated telecommunications networks connecting all Participants to BoZ.

Bank of Zambia ZIPSS Rules 62 Short Name Full Name Explanation/Definition ZIPSS Zambia Interbank Payment and Settlement System The real-time gross settlement system or any other settlement system adopted and operated by BoZ that facilitates electronic transfer funds among Participants. ZMW Zambian Kwacha The currency of the Republic of Zambia, issued and managed by the Bank of Zambia. ZRA Zambia Revenue Authority The institution authorised by the Government of the Republic of Zambia to collect tax revenue on its behalf.

Bank of Zambia ZIPSS Rules 63 Annex 2: SWIFT BIC CODES Bank SWIFT BIC Test BIC BANK OF ZAMBIA (ZIPSS) BAZAZMLA ZYABZML0 BANK OF ZAMBIA (SETTLEMENT BANK) BAZAZMLU BAZAZML0 AB BANK ZAMBIA ABBAZMLU ABBAZML0 ACCESS BANK AZAMZMLU AZAMZML0 ATLASMARA ZAMBIA FMBZZMLX FMBZZML0 BANK OF CHINA BKCHZMLU BKCHZML0 ABSA BANK ZAMBIA BARCZMLX BARCZML0 CAVMONT CAPITAL BANK CVMTZMLU CVMTZML0 CITIBANK CITIZMLU CITIZML0 ECOBANK ECOCZMLU ECOCZML0 FIRST ALLIANCE FALLZMLU FALLZML0 FIRST CAPITAL BANK ICZAZMLU ICZAZML0 FIRST NAT BANK FIRNZMLU FIRNZML0 INDO ZAMBIA INZAZMLX INZAZML0 INVESTRUST VSTRZMLU VSTRZML0 STANBIC BANK SBICZMLX SBICZML0 STANDARD CHARTERED BANK SCBLZMLX SCBLZML0 UNITED BANK FOR AFRICA UNAFZMLU UNAFZML0 ZAMBIA INDUSTRIAL COMMERCIAL BANK ZICBZMLU ZICBZML0 ZANACO ZNCOZMLU ZNCOZML0

Bank of Zambia ZIPSS Rules 64

Bank of Zambia ZIPSS Rules 65 Annex 3: Form for Participant Addition or Modification Application to Add or Change a Participant in ZIPSS To: The Director – Banking, Currency and Payment Systems Banking, Currency and Payment Systems Department Bank of Zambia Bank Square - Cairo Road P. O Box 30080 Lusaka From: Name of ZIPSS Participant: Place of Incorporation Company Registration Number: Registered Office Address/ Principal Place of Business in Zambia: Complete the following details about the way you want your organization's details held in ZIPSS (strike out whatever is not appropriate) Requested action: Add / Change Participant Name: Participant address: SWIFT BIC: Telephone no: Fax no: Debit advice MT900 required: Yes / No Credit advice MT910 required: Yes / No Statement MT950 required: Yes / No Billing statements to be sent: None / Daily / Weekly / Monthly

Bank of Zambia ZIPSS Rules 66 Approving officer’s title: Signature: Dated: EXECUTED by THE APPLICANT or in the presence of: (Signature of Secretary/Director) (Signature of Director) (Full name of signatory) (Full name of signatory) Annex 4: E-Token Application Form For the E-Token Application Form kindly refer to the Certificate Authority Rules.

Bank of Zambia ZIPSS Rules 67 Annex 5: E-Token Revocation Form For the E-Token Revocation Form kindly refer to the Certificate Authority Rules.

Bank of Zambia ZIPSS Rules 68 Annex 6: ASA Form (BANK LETTER HEAD) ASA FORM Ref: ASA / ……..…../…………. Date………/……………/……….. The Assistant Director Banking Division Bank of Zambia LUSAKA Dear Sir Request to access Authorised Settlement Agent (ASA) facilities We hereby request you to process the under listed transaction(s) on our behalf by debiting our account number This request is necessitated by ……….. The following are the details: Single FSI Send* Beneficiary Bank Beneficiary Bank Account Number Beneficiary Customer Name Beneficiary Customer Account Number Amount UNIQUE Reference Number to be used for this transactions (maximum of 13 additional characters); [ A ][ S ][ A ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ][ ] Related customer payment information

Bank of Zambia ZIPSS Rules 69 Amount in words: Yours faithfully Authorised Signatory Authorised Signatory

• Delete as appropriate

Bank of Zambia ZIPSS Rules 70 Annex 7: Daily Operating Timetable Time Event Activities by Participants and Available Transactions 08.00 Start of Day  ZIPSS Start-of-Day  BoZ Housekeeping period  Only BoZ may submit transactions 08.15 Open for Business  ZIPSS is open for business and can process all transactions from all participants. Additionally;

• ZIPSS shall process Net Settlement Instructions (NSIs) from the clearing house as per times set in clearing house rules for various clearing sessions
• ZIPSS shall process Net Settlement Instructions (NSIs) for other clearing institutions such as the Lusaka Stock Exchange and VISA  ZIPSS transactions shall be charged differently at different times of the day as per pricing advised to all Participants by BoZ 16:00 Cut-off for Customer Payments (Initial Cut-off)  ZIPSS shall no longer accept MT103 payments  MT202 payments shall continue to be accepted 16:15 Cut-off for Interbank Transfers (Final Cut-off)  ZIPSS will repay all ILF drawings made by Participants. Participants must ensure sufficient funds on the SA to allow automatic repayment of ILF at Final Cut-off.  Only BoZ can submit ZIPSS transactions for value today.  Session closed, queue/settlement processing will cease and any ZIPSS transactions still in queues will be rejected.  Final Cut-off reports are generated. 16.30 End of Day  ZIPSS End of Day reports available for downloading After End of Day until next Start-of-Day  Update and Reconciliation with files sent from ZIPSS.  Participants can continue to inquire reports from the system

Bank of Zambia ZIPSS Rules 71

Bank of Zambia ZIPSS Rules 72 Annex 8: Pricing The Bank of Zambia shall charge ZIPSS administrative fees, transaction processing fees and penalties which shall be debited from the participants’ settlement account. The Bank of Zambia shall advise the fees and penalties to the participants In writing. The Bank of Zambia reserves the right to revise the fees and penalties from time to time.

Bank of Zambia ZIPSS Rules 73 Annex 9: Notification Any notice pursuant to these Rules shall (unless otherwise specified) be conveyed by mail, e￾mail, fax or delivery by messenger, and shall be effective only upon receipt. Any such notice shall be:

1. Mailed or delivered to: The Director Payment Systems Department Bank of Zambia Bank Square Cairo Road P. O Box 30080 Lusaka
2. Or emailed to: zipss@BoZ.zm
3. Or faxed to: +260-211-399300 BoZ may notify the Participants in writing of any changed or additional addresses.

Bank of Zambia ZIPSS Rules 74 Annex 10: Help Desk Contact details for the ZIPSS help desk are: Telephone: +260-211-399320 Email: zipss@BoZ.zm Postal address: The Director Payment Systems Department Bank of Zambia Bank Square Cairo Road P. O Box 30080 Lusaka

Bank of Zambia ZIPSS Rules 75 Annex 11: Annual Audit Form Annual Audit Certificate for the preceding year to be submitted by 31st March of every Calendar year Participant: ___________________________________________ Self-Assessment for Period______________________________________ Please respond to the following questions A. Review of User access

1. Have you reviewed the access levels and rights (User Profiles) of all your ZIPSS users?
2. Are you satisfied that all users continue to have the correct access levels and rights?
3. Have you reviewed the ZIPSS user list for active, disabled and removed dormant/ unauthorised users
4. Have you reviewed the ZIPSS user list report? Attach a list of active ZIPSS users signed by two (2) authorized signatories. B. ZIPSS-related fraud
5. Has your organization experienced any ZIPSS-related actual or attempted fraud during the year?
6. If so, was this reported to BoZ in accordance with the ZIPSS Terms and Conditions?
7. Was the means of the fraud identified and rectified?
8. Did the fraud result in any financial loss to your organization or to its customers?
9. If so, is recovery still being sought? C. Cyber -Attacks to the ZIPSS /ZIPSS Interfaces
10. Does your organisation have a cyber-security management framework?
11. Are you satisfied that the cyber-security risks have been analysed and addressed?

Bank of Zambia ZIPSS Rules 76 3) Has your organization experienced any ZIPSS-related cyber-attacks or attempted attacks during the year? 4) If so was this information shared with stakeholders including BoZ? 5) Was the means of the cyber- attack identified and rectified? 6) Did the attack result in any financial loss to the organization or its customers? If so, is recovery still being sought. D. Contingency planning and contingency facilities

1. Does your organization have a documented contingency plan for its ZIPSS operations?
2. Does the plan satisfactorily cover significant potential contingency scenarios?
3. Does your organization maintain fall-back computer facilities and/or communications for the SWIFT interface used for ZIPSS communications?
4. If your organization does maintain a fall-back computer facility, is it at a separate site to your main SWIFT computer facility?
5. Are you satisfied that potential business risks have been analysed and addressed? E. System down time and resilience
6. Have your ZIPSS operations been subject to significant or recurring downtime or disruption?
7. If so, were these reported to BoZ and recorded in a Contingency Event log in accordance with the ZIPSS procedures?
8. Are you satisfied that your ZIPSS-related systems have sufficient capacity and resilience to service your ZIPSS payment traffic in a timely and safe manner?

Bank of Zambia ZIPSS Rules 77 Annex 12: Message Priorities Message Type TTC Types TTC Priority Default Range MT298 SMT 201 ZECHL TTC, LuSE TTC and VISA TTC 35 31 to 40 MT103 103 Default TTC 80 71 to 80 MT103 to BoZ MT103 Bank to BoZ TTC 45 45 MT202 202 Default TTC 65 61 to 70 MT202 to BoZ MT202 Bank to BoZ TTC 41 41 MT204 204 Default TTC 55 41 to 59 MT205 205 Default TTC 55 41 to 59 MT204 for Billing Billing TTC 45 41 to 50 MT298 SMT 220 CSD Transfer Default TTC 45 41 to 50 MT298 SMT 220 CSD Collateral Setup Default TTC 25 21 to 30 MT298 SMT 220 CSD 220 Transfer 40 40 MT298 SMT 220 CSD Redemptions 35 31 to 35 ILF Drawdown Default TTC 35 20 to 45 ILF Reversal Default TTC 15 11 to 20 Reserve Operation Default TTC 15 11 to 20 MT202 Cash Reserve TTC 55 51 to 60

Bank of Zambia ZIPSS Rules 78 Annex 13: Technical Documentation As part of the technical documentation, the documentation listed below will be provided as a separate set in addition to these rules.  The STP Message Format Specification Document  Participant Security User Guide  Participant Technical Requirements  Participant User Manual

Bank of Zambia ZIPSS Rules 79 Annex 14: ZIPSS Webstation Configuration Each Participant will have at least one Webstation for connection to ZIPSS:

1. Hardware Configuration for Webstations  eToken USB Minimum:  Any PC capable of running the supported browser  1 USB port Recommended:  2 GB RAM (Windows 7 or Windows 8) or above  Screen with 1024x768 resolution or above  1 USB port
2. Software Configuration for Webstations  Windows 7 [recommended Windows 7/8/8.1] or above  Internet Explorer 7 or above; Firefox 3 or above [recommended Internet Explorer 10/11 or above; Google Chrome]  Antivirus software  eToken PKI client drivers/software

Bank of Zambia ZIPSS Rules 80 Annex 15: ZIPSS Validation Codes ZIPSS-generated RTGS Error Codes are: Code Description 50 Default message validation (error not specified below) 51 Date validation 52 Credit institution error 53 Debit institution error 54 Invalid sender 55 Invalid receiver 56 Invalid message destination 57 Invalid business party 58 Invalid currency 59 Invalid amount 60 Invalid reference 61 Invalid business date 62 Invalid business date, End-of-Day already performed 63 Invalid business date, Initial-Cutoff already performed 64 Invalid business date, Final-Cutoff already performed 65 Invalid business date, holiday 66 Invalid future business date 67 Invalid message type 68 Invalid signature 71 Invalid default TTC 72 Transaction type mismatch

Bank of Zambia ZIPSS Rules 81 73 Reserve owner mismatch 74 Transaction processing error, user cancelled 75 Transaction processing error, deferred payment cancelled 76 Transaction processing error, pending time exceeded 77 Transaction processing error, payment automatically cancelled by Final-Cutoff 78 Invalid debtor 79 Invalid creditor 80 Invalid account 81 Blocked debtor 82 Blocked creditor 83 Invalid TTC

Bank of Zambia ZIPSS Rules 82 Annex 16: RTGS Transaction Type Codes TTC Type TTC Code TTC Priority Default Range ZECHL TTC 0010 35 31 to 40 LUSE TTC 0020 35 31 to 40 VISA TTC 0030 35 31 to 40 103 Default TTC 1030 80 71 to 80 MT103 Bank to BoZ TTC 1031 45 45 202 Default TTC 2020 65 61 to 70 MT202 Bank to BoZ TTC 2021 41 41 204 Default TTC 2040 55 41 to 59 205 Default TTC 2050 55 41 to 59 Billing TTC 2140 45 41 to 50 CSD Transfer Default TTC 3010 45 41 to 50 CSD Collateral Setup Default TTC 3020 25 21 to 30 CSD 220 Transfer 3030 40 40 ILF Drawdown Default TTC 4000 35 20 to 45 ILF Reversal Default TTC 4010 15 11 to 20 Reserve Operation Default TTC 5000 15 11 to 20 Cash Reserve TTC 5010 55 51 to 60 Emergency Funds Transfer 9999 30 30

Bank of Zambia ZIPSS Rules 83 Annex 17: Risk Management 1.0 Risk Management The parties will conduct their affairs and their relationship with one another and with the other participants in the utmost good faith and integrity in such manner as to minimise any risk of loss inherent in participation in the inter-bank clearing and settlement arena, whether such risk arises before, during or after the clearing and settlement processes. To this end, each party will:- i. manage its business in such a manner as to avoid creating or increasing risk to the parties, and to avoid settlement failure; ii. manage its liquidity in such a manner that will not adversely affect the liquidity of other participants by ensuring prompt settlement of all its settlement obligations; iii. promptly and diligently adhere to and implement risk reduction measures as required by BoZ from time to time iv. ensure the integrity, compliance and functionality of all of its systems, including hardware, software, human resources and data received and transmitted into ZIPSS, and in particular ensure that such modifications and improvements are made to its systems as may be required to enable compliance with new developments in risk management and risk containment as and when they become available and are adopted by the Bank. 2.0 Business Continuity Planning Each party will ensure and herewith undertakes that it will develop, introduce and maintain an effective and practical business continuity plan, relevant to systems and procedures, records, audit trails, recovery procedures and human resources, in order to ensure the effective continuity of its participation in ZIPSS notwithstanding any fact, matter or thing which might, but for such continuity plan, have jeopardised such party’s continued participation in ZIPSS and/or its ability to honour its obligations pursuant to such participation. 3.0 Disaster Recovery Each party warrants and undertakes that: - i. its systems and facilities are adequate to operate the transactions as required by the BoZ

Bank of Zambia ZIPSS Rules 84 ii. its backup systems and facilities are adequate alternatives to the systems and facilities require by the participant to efficiently and effectively fulfil its obligation on ZIPSS; and iii. it will procure an audit, by its own independent external auditors and at its own expense, of its systems and facilities as well as backup systems and facilities relevant to the settlement transactions on an annual basis as part of its annual audit, and will allow such auditors to make their report available to the Settlement Provider and to answer such reasonable requests for additional information as the Settlement Provider and/or its auditors may require.

Bank of Zambia ZIPSS Rules 85 Annex 18: ZIPSS Window Extension Application Form ZAMBIA INTERBANK PAYMENT AND SETTLEMENT SYSTEM (ZIPSS) WINDOW EXTENSION APPLICATION FORM Part A To be completed by applying participant Applying Institution : Date of Application : Time of Application : Duration of Extension : Reason for Application : Participant authorised Signatories:

1. Name: Signature:
2. Name: Signature: Part B For Bank of Zambia use Risk assessment and recommendation.

Bank of Zambia ZIPSS Rules 86 Processing Department Approval

---

Director –Payment Systems Executive Approval Approved NOT Approved

---

Governor