Regulation on the Application of the Regulatory Sandbox

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri ‘Approved’ Central Bank of the Republic of Azerbaijan Resolution № 06/4 31 January 2024 Regulation on the application of the Regulatory Sandbox

1. General provisions 1.1. This Regulation has been developed in accordance with Article 50 of the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan’ and establishes a procedure for the application of the special regulatory regime in financial markets. 1.2. The objective of the Regulatory Sandbox is, to introduce innovative services and products (hereinafter – innovative products) in financial markets, to take relevant measures to improve the normative legal framework to assess those products in a test mode and, if successful, to introduce continuously. 1.3. The Regulatory Sandbox is applied based on the following principles: 1.3.1. equal participation in the Regulatory Sandbox. 1.3.2. protection of the rights and legal interests of consumers by Regulatory Sandbox participants.
2. Definitions 2.1. The definitions used in this Regulation bear the following meanings: 2.1.1. Regulatory Sandbox – a set of regulations, governing the testing of innovative products in financial markets within a limited framework and under control of the Central Bank of the Republic of Azerbaijan (hereinafter - the Central Bank). 2.1.2. innovative product – services and products that meet the requirements specified in Item 3.1 of this Regulation. 2.1.3. testing – introduction of an innovative product under the terms of the agreement between the participant and the Central Bank within the Regulatory Sandbox framework. 2.1.4. applicant – a legal entity registered in the Republic of Azerbaijan applying to the Central Bank for testing an innovative product in the territory of the Republic of Azerbaijan. 2.1.5. participant – an applicant who has entered into an agreement with the Central Bank to test an innovative product under the Regulatory Sandbox. 2.1.6. user – a customer who acquires (uses) or intends to acquire (use) an innovative product presented in the Regulatory Sandbox. 2.1.7. civil impeccability – compliance of the applicant’s beneficiary owner, persons engaged in management functions, as well as qualifying holding owners in its authorized capital, if that owner is a legal entity, the head of its executive body, with the requirements of Article 17 of the Law of the Republic of Azerbaijan ‘on Prevention of the legalization of criminally obtained property and the financing of terrorism’ (hereinafter – the Law). 2.1.8. exit strategy – a plan with measures for the exit of the participant from the market in the event of termination of the participant's participation in the Regulatory Sandbox.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 2.2. For the purposes of this Regulation the definitions ‘beneficiary owner’ and ‘qualifying holding’ bear the meanings specified in the Law. 3. Requirements for participation in the Regulatory Sandbox, application of the legislation to and supervision of regime participants 3.1. For testing within the Regulatory Sandbox, the innovative product and the applicant should meet the following requirements: 3.1.1. the innovative product should be new for the domestic market, enhance financial inclusion in the market, be safe and more accessible for financial service users. 3.1.2. the innovative product should be ready to be tested under the regime. 3.1.3. if the test result is successful, the applicant should have an intention to apply the innovative product in the Republic of Azerbaijan. 3.1.4. introduction of innovative products should not pose potential systemic risks or increase opportunities for legalization of criminally obtained property and the financing of terrorism. 3.1.5. a risk analysis of the innovative product should be conducted, and measures be taken to prevent possible risks, including violations of user data confidentiality and legal interests should be determined. 3.1.6. applicant’s beneficiary owners, persons engaged in management functions, as well as qualifying holding owners, if that owner is a legal entity, the head of its executive body should be individuals with impeccable civil records. 3.1.7. for safe introduction of the innovative product the applicant should have sufficient financial and human resources, and critical infrastructure (hardware, software). 3.2. The conditions for application of the effective legislation governing financial markets in relation to the participant and (or) the innovative product are as follows: 3.2.1. participant activities are exempt from licensing or permit requirements. 3.2.2. the legislation regulating financial markets, including existing prudential norms and requirements, are not applied, are partially applied, or are applied differently in relation to the participant and (or) the innovative product. 3.3. The Central Bank supervises activities of the participant by applying one or more of the following forms: 3.3.1. receive and analyze periodic reports on activities of the participant. 3.3.2. monitor activities of the participant. 3.3.3. buy the innovative product for testing purposes to protect users’ rights. 3.3.4. inspect activities of the participant. 3.4. Depending on the nature of violations detected in activities of the participant or circumstances that may cause the violation, the Central Bank: 3.4.1. requests a commitment letter reflecting the measures to be taken to eliminate violations or situations that may cause violations and their deadlines. 3.4.2. issues obligatory instructions to rectify violations or circumstances that may lead to violations. 3.4.3. issue an obligatory instruction on changing conditions of the agreement on participation in the Regulatory Sandbox and tailoring participant’s activities to the changes.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 3.5. The Central Bank establishes a procedure for applying sub-items 3.2.2 and 3.3.1 of this Regulation considering the nature and the field the participant operates in and the innovative product and the participant who signed an agreement with the Central Bank on participation in the Regulatory Sandbox is notified in writing. Supervisory forms specified in sub-items 3.3.2 - 3.3.4 of this Regulation are applied as per the Law of the Republic of Azerbaijan ‘on the Central Bank of the Republic of Azerbaijan,’ unless otherwise specified in this Regulation. 3.6. The request to the participant for a commitment letter in accordance with Item 3.4 of this Regulation, specifies deadline for its submission, while binding instructions specify violations or circumstances that may lead to violations and deadline for their elimination. 3.7. The Central Bank decides to inspect activities of the participant when: 3.7.1. it is required to investigate on site the fact of violation of this Regulation and/or the agreement concluded under this Regulation or the circumstances leading to it. 3.7.2. Central Bank’s enforcement measures are not adhered to fully and on time. 3.7.3. reports submitted to the Central Bank are found to be distorted. 3.7.4. it is discovered that there is a threat to the rights and legal interests of innovative product users based on information of known source. 3.7.5. there are reasonable suspicions about the risks and circumstances of the legalization of criminally obtained funds and the financing of terrorism. 3.8. The Central Bank sends a written notification to the participant at least 3 (three) workdays prior to the inspection. The notification specifies the commencement date, the scope, the period, and duration of the inspection. In the cases specified in Item 3.7 of this Regulation, the inspection may be conducted without prior notification of the participant. 3.9. Inspection findings are documented in the inspection report. The inspection report includes the number and date of the report, the name and tax identification number of the inspected participant, information on the object of inspection (name, address, description, etc.), last, first, middle names and the position of the examiner(s), the date and number of the decision on conducting the inspection, the period covered by the inspection and duration of the inspection (the start and end dates), identified violations and circumstances that may lead to violations, specific structural elements of violated legal acts and/or the agreement, the participant's explanation or objection, if any. The inspection report is signed by all inspectors involved in the inspection and participant’s authorized representative. 4. Appeal for participation in the Regulatory Sandbox 4.1. The period for accepting applications to participate in the Regulatory Sandbox is determined by the Central Bank and announced on the official website of the Central Bank at least 1 (one) month in advance. 4.2. The applicant submits a written application to the Central Bank for participation in the Regulatory Sandbox, attaching the following documents and information: 4.2.1. an application for participation in Regulatory Sandbox developed as per Annex 1 to this Regulation. 4.2.2. the ID card of the head of the applicant’s executive body either notarized or approved in accordance with Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 4.2.3. an excerpt from the state register of legal entities and the charter either notarized or approved in accordance with Article 9 of the Law of the Republic of Azerbaijan ‘on Administrative Proceedings’. 4.2.4. the list of applicant's beneficiary owners, persons engaged in management functions, as well as qualifying holding owners, if that owner is a legal entity, information on the head of its executive body (last, first, middle names, the PIN of his/her ID card, if PIN is not available, the number of the identification document), information on their civil impeccability (if those persons are foreigners, a certificate issued by relevant public authorities of their home country on whether they are criminally liable). 4.2.5. information on the applicant’s organizational structure. 4.2.6. a business plan and/or feasibility report, which includes at least the following information regarding the innovative product: 4.2.6.1. detailed explanation of the difference between the innovative product and existing products in financial markets and application schemes. 4.2.6.2. the user group targeted by the applicant during the innovative product testing. 4.2.6.3. description of expected outcome and quantitative and qualitative indicators forecasted for their assessment. 4.2.6.4. description and management of innovative product benefits, functionality, and associated risks. 4.2.6.5. substantiation of financial and human resources required for safe testing of the innovative product, as well as necessary infrastructure and information on their availability. 4.2.6.6. the technical architecture of the innovative product, description of technologies to be applied and substantiation of availability of necessary technical infrastructure. 4.2.6.7. description of measures to be taken in connection with activities related to prevention of the legalization of criminally obtained property and the financing of terrorism. 4.2.6.8. the order and methods of informing users, as well as the procedure for managing their appeals. 4.2.6.9. information on normative legal acts and regulations governing financial markets that restrict the application of the innovative product (if any). 4.2.6.10. information on the estimated duration of participation in the test mode and the transition plan from the test mode to the real environment. 4.2.6.11. the exit strategy addressing at least the following: 4.2.6.11.1. description of processes involved in notifying users of test termination and actions to be taken by users. 4.2.6.11.2. performance of any existing obligations due to users, including the process of refunding payments. 4.2.7. measures to be taken to protect users’ rights and legal interests. 4.3. If the documents and information required under this Regulation can be obtained from the respective public authority (institution) through the Electronic Government Information System, the applicant is not required to provide them. In cases where such documents or information cannot be obtained through the Electronic Government Information System, the submission is requested from the relevant public authority (institution) with the applicant's consent or is provided by the applicant. If the applicant is a supervised entity of the Central Bank operating in financial markets, the documents specified in sub-item 4.2.2-4.2.5 of this Regulation are not required to be submitted.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 4.4. The documents issued by the relevant public authority of the foreign country submitted by the applicant should be legalized or apostilled in accordance with the international treaties ratified by the Republic of Azerbaijan. 5. Review of appeals 5.1. The Central Bank reviews the submitted application and attached documents within 20 (twenty) working days from the date of receipt and makes an appropriate decision. If additional time is needed to assess the innovative product and the applicant's compliance with the criteria outlined in this Regulation, the Central Bank may extend the review period by another 20 (twenty) working days, notifying the applicant accordingly. 5.2. If the Central Bank identifies errors and deficiencies in the documents submitted for review to be rectified by the applicant, it submits or sends a written notification to the applicant within 10 (ten) working days from the date of receipt of the application and attached documents (either electronically, or by registered mail). 5.3. The applicant should rectify these errors and deficiencies and submit them to the Central Bank no later than 20 (twenty) working days from the date of receiving the written notification. The submission of a written notice by the Central Bank halts the flow of time specified for review of the appeal in Item 5.1 of this Regulation. 5.4. The Management Board of the Central Bank decides to approve or refuse the applicant's participation in the Regulatory Sandbox. 5.5. When the Central Bank decides to approve or deny the applicant's participation in the Regulatory Sandbox, the decision is presented or sent to the applicant (either electronically or by registered mail) within 3 (three) working days from the date of receipt. If the applicant is approved to participate in the Regulatory Sandbox, the agreement specified in Item 6.2 of this Regulation is concluded between the applicant and the Central Bank within 20 (twenty) working days from the date of the decision. 5.6. A decision is made to refuse applicant's participation in the Regulatory Sandbox if: 5.6.1. the presented innovative product and the applicant fail to meet the requirements specified in Item 3.1 of this Regulation. 5.6.2. the applicant fails to rectify the errors and deficiencies indicated in the written notification within the period specified in Item 5.3 of this Regulation. 5.6.3. the innovative product is deemed risky based on risk assessment findings. 5.6.4. applicant's resources and infrastructure are not sufficient to conduct this test in accordance with the business plan and/or feasibility report. 5.6.5. the information and documents submitted are incomplete or inaccurate. 5.7. The applicant who has been denied participation in the Regulatory Sandbox as per Item 5.6 of this Regulation may re-apply to the Central Bank after a minimum of 2 (two) months, addressing the identified errors and deficiencies. In this case, the application is treated as a new application, subject to review under Part 5 of this Regulation. 6. An agreement on participation in the Regulatory Sandbox 6.1. The applicant, who has been approved to participate in the Regulatory Sandbox, tests innovative products under terms of the agreement concluded with the Central Bank.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 6.2. The agreement specifies at least the following: 6.2.1. brief description of the innovative product to be assessed in Regulatory Sandbox. 6.2.2. the duration of the test, including its start and end dates. 6.2.3. rights and responsibilities of the parties. 6.2.4. a list of restrictions applied to the participant (territory, duration, number and size of transactions, number of users or other restrictions). 6.2.5. quantitative and qualitative criteria used to assess test results. 6.2.6. measures to be taken to protect the rights and legal interests of users. 6.2.7. provisions concerning the exit strategy, including procedures for safeguarding and disposing of all confidential information, including personal user data, if the test is completed or terminated prematurely before its expiration date. 6.2.8. the procedure for obtaining approval from the Central Bank to make changes during the testing period for the introduced innovative product and subsequently update the agreement accordingly. 6.2.9. liability for breach of contractual terms and conditions. 6.2.10. instances and the procedure for terminating the contract 6.2.11. confidentiality provisions. 6.3. The participant has the right to start the test from the date specified in the agreement. 6.4. The testing period specified in the agreement may not exceed 12 (twelve) months upon its conclusion. The testing period may be extended for up to 6 (six) additional months upon a reasoned written request from the participant no later than 1 (one) month before its end subject to approval by the Central Bank. Such an extension may not exceed 5 (five) years and applies to participants who have been active for at least 6 (six) months in the test mode. 7. Termination of the participation in the Regulatory Sandbox 7.1. Participation in the Regulatory Sandbox is terminated with the end of the testing period under Item 6.4 of this Regulation. 7.2. The participant's participation in the Regulatory Sandbox may be terminated before the end of the testing period: 7.2.1. at the request of the participant. 7.2.2. if the participant is liquidated as a legal entity or declared bankrupt. 7.2.3. if enforcement measures imposed by the Central Bank under Item 3.4 of this Regulation are not fully and timely complied with. 7.2.4. in case of violation of the requirements established by this Regulation or in other cases stipulated by the agreement. 7.3. The Central Bank sends a written notification to the participant whose participation in the Regulatory Sandbox has been terminated on the grounds outlined in sub-item 7.2.3 of this Regulation no later than the next working day. Upon receipt of the termination notice, or in cases where the participant's participation in the Regulatory Sandbox is terminated for other reasons specified in Item 7.2 of this Regulation, the participant should promptly cease product introduction operations and initiate the implementation of the exit strategy outlined in the agreement.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri 7.4. Termination of participation in the Regulatory Sandbox does not absolve the participant from its obligations to users and other parties that have arisen up to that point. 8. Reporting and results of testing 8.1. During the testing period, the participant should ensure proper reporting and timely submission of reports to the Central Bank as specified in Item 3.5 of this Regulation. Data regarding transactions and users during the testing period should be retained for a minimum of 5 (five) years. 8.2. Within 20 (twenty) working days upon the expiry of the participation period in the Regulatory Sandbox or premature termination of the participation, the participant submits at least the following information on test results to the Central Bank: 8.2.1. the number of the innovative product in terms of the user type (individual, legal entity), the number and size of transactions (per month), the territory of application of the innovative product. 8.2.2. description of problems faced by the participant during testing and actions taken. 8.2.3. information about user complaints, operational and cyber security incidents, as well as frauds, related to the introduction of an innovative product. 8.2.4. information on the risks that occur during testing and mitigation measures. 8.2.5. indicators on quantitative and qualitative criteria defined in the agreement. 8.3. Within 20 (twenty) working days upon receiving the report from the participant, which encompasses the provisions of Item 8.2 of this Regulation, the Central Bank makes a decision on the test result and communicates this decision to the participant within 3 (three) working days (either electronically or by registered mail). 8.4. Based on test results, if the participant fails to meet the specified quantitative and qualitative indicators outlined in the agreement and/or if potential risks for users or financial stability are identified, the test is deemed failed according to the decision of the Central Bank. 9. Transparency of the Regulatory Sandbox and dispute resolution 9.1. The Central Bank publishes the register of participants on its official website. The register includes the participant's name, website (if any), contact information (phone, e-mail address), the innovative product introduced, duration of the test, test results, and related information, in case of premature termination of the test. 9.2. The participant notifies its users in writing in advance regarding introduction of the innovative product under the Regulatory Sandbox. The participant obtains written confirmation from users that they have read and understood the information provided. 9.3. Disputes concerning decisions made by the Central Bank regarding participation in the Regulatory Sandbox are settled in court. Filing an appeal against the decision does not suspend its execution.

Azərbaycan Respublikasının Hüquqi Aktların Dövlət Reyestri Annex 1 to the ‘Regulation on the application of the Regulatory Sandbox’ To the Central Bank of the Republic of Azerbaijan APPLICATION regarding participation in the Regulatory Sandbox The _______________________________________________ is requesting a review of the (The name of the legal entity) application for participation in the Regulatory Sandbox according to the decision №________ of the __________________________________________ dated _______________ ____20. (The name of the decision-making executive body)

The number of attached documents: __________________ The applicant’s official website (if any), e-mail address and contact facilities: ______________

---

Date of application: __________________________ (Day, month, year) Signature of the legal entity’s authorized representative:

---

(Position, last, first, middle names) (signature)