Governance and internal control instructions for payment systems and payment service providers

Instructions for governance and internal control for payment system operators and payment service providers.

Contents

1 - Definitions: ... 1

2 - Scope of application.. ... 1

• General provisions. ... 2

4 - The General Assembly of the Payment Institution... ... 3

e - Responsibilities of the Board of Directors: ... 4

6 - Formation of the Board of Directors: ... 5

Secretariat of the Council: ... 5

Board committees 6

• Internal control: ... 7

Definitions:

For the purposes of these instructions, the following words and phrases shall have the meaning set forth opposite each of them:

Payment Institutions: Companies and entities other than banks that engage in any activity that includes operating payment systems or providing payment services, whether from within the Arab Republic of Egypt or from outside it for residents in it.

Payment Service Provider Category (A): The institution licensed to provide all payment services and whose monthly average value of payment transactions executed by it exceeds EGP 750 million during the 12 months prior to the date of calculating the average.

The average.

Payment Service Provider Category (B): The institution licensed to provide all payment services - except for the service of creating payment orders and the payment account information service - whose monthly average value of payment transactions executed by it amounts to EGP 750

million Egyptian pounds or less during the 12 months prior to the date of calculating the average.

Scope of application:

These instructions apply to all payment institutions operating in the Arab Republic of Egypt, as well as to entities established pursuant to special laws and engaged in payment activities, and the provisions of these instructions constitute the minimum governance requirements

and internal control that must be adhered to, and the Central Bank has the right to direct those institutions and entities towards following

additional governance and internal control requirements, in accordance with the nature and scope of their business and the extent of the complexity of their activities.

The payment institution must ensure that all its foreign branches - if any - comply with these instructions to the extent that it does not conflict with the laws and instructions governing it in the country in which it operates, and in the event of any conflict, the institution must

obtain the approval of the Central Bank of Egypt on how to handle the matter.

Payment institutions that operate from outside Egypt for residents in it shall be bound by these instructions with respect to activities related to or affecting the provision of payment services or the operation of payment systems within the Arab Republic of Egypt, or by the

instructions applied at the institution's headquarters, whichever is more conservative, and in the event of a conflict between them, it must obtain the approval of the Central Bank of Egypt after submitting the necessary justifications.

General Provisions:

Payment institutions must comply with the following governance requirements as a minimum:

Establishing an organizational structure that is consistent with the provisions of these instructions, including the board of directors, its committees, and the senior management of the payment institution and all its departments, while specifying the lines of communication for each function in a manner that achieves good distribution

of powers and responsibilities and the raising of reports, and in a manner that ensures the separation of tasks between supervisory functions and executive functions

and various main activities, as well as avoiding conflicts of interest with regard to the implementation of operations

and their approval through the application of the principle of dual control, provided that the Central Bank is provided with the structure

referred to after its adoption by the institution's board of directors, as well as with any amendments thereto.

The organizational structure of the payment institution must reflect the independence of the risk, compliance, and audit departments from the rest of the executive departments, with the need to document the responsibilities of the board of directors and senior management, including

the powers granted to them.

Developing an effective framework for internal control that includes procedures, controls, and work systems for all activities of the payment institution, including the information systems used.

Developing a mechanism to ensure the selection and appointment of staff with the necessary skills and experience and to ensure their ability to assume the responsibilities and tasks assigned to them.

Ensuring that the necessary training is available to all employees to ensure their good performance of their work.

Payment service providers category (B) may merge the risk and compliance departments into one department, provided that they submit their reports in this case to the audit committee.

The General Assembly of the Payment Institution:

The board of directors must disclose all matters that affect the sustainability of the payment institution's business and present them to the General Assembly to express its opinion and vote on them in accordance with the mechanism agreed upon in the articles of association

of the institution, and the institution may use electronic means and various communication systems when holding meetings

of the General Assembly.

The payment institution must obtain preliminary approval from the Central Bank for any amendment to be made to the articles of association or the institution's articles of association before submitting it to the General Assembly, and no amendment shall be made

except after obtaining the approval of the General Assembly on it and its adoption by the Board of Directors of the Central Bank.

Approving allowances, bonuses and other benefits decided for members of the council, with the exception of determining the bonuses, salaries and allowances of the managing director by a decision of the board of directors.

Responsibilities of the Board of Directors:

The board of directors of the payment institution is responsible for supervising its management, as well as monitoring the implementation of its objectives by the senior management, while adhering to the following as a minimum:

Adopting the payment institution's strategy, work plan, estimated budget, policies, main goals and supervising their implementation and ensuring their dissemination among employees, while ensuring that they are reviewed and updated in a manner

devoted to duty.

Adopting the organizational structure and determining the structure of powers and responsibilities.

Effective supervision of senior management and monitoring its performance, including meeting periodically with senior management and internal audit management to review and discuss the policies in place, and follow up on the progress made in

implementing the strategic objectives.

Ensuring that the principle of dual control is applied with regard to the provision of payment services or the operation of payment systems, as well as ensuring that a periodic assessment is made of the efficiency and effectiveness of governance and internal control policies and practices

and the extent of their compliance with regulatory requirements, and updating them in line with changes in the technological environment

and market conditions.

Based on the recommendation of the Audit Committee, the Board of Directors shall nominate two auditors for payment system operators and one auditor for payment service providers from among the auditors

registered with the Central Bank, and the company's general assembly shall have the authority to approve the appointment of the auditors

and determine their fees, provided that the scope of their work includes the following as a minimum:

Reviewing the payment institution's commitment to applying the accounting standards in force.

The adequacy of the internal control system in the payment institution at all its levels.

Any regulatory standards or controls that the Central Bank deems necessary for the auditors to verify.

Informing the Central Bank directly in the following cases:

A. The existence of any information that affects the financial soundness of the payment institution.

B. Identifying any activities that affect the safety, efficiency and reputation of the payment institution.

C. The existence of a conflict of interest or any deficiency in the internal control system.

Meeting at least once every three months or whenever the need arises, and the Board may hold its meetings through secure modern technological means of communication and applications, while adhering to the establishment of

controls for the use of such means, including the number of times each member is allowed to participate remotely, with

the need to keep records of meetings - through the use of a secure recording device - within the institution's records for a period of time

appropriate in accordance with the institution's policies, legal requirements and regulatory controls in force.

No member of the Council may be absent from more than 25% of the Council's meetings during the year, otherwise the Chairman of the Council must notify the General Assembly of the payment institution in order to take whatever action it deems

appropriate in this regard.

Members of the Board of Directors may delegate each other to attend Council meetings up to a maximum of 25% of the Council's meetings during the year, and attendance through delegation is not considered actual attendance.

Managing the business of the payment institution and its activities and ensuring compliance with the laws, instructions, and regulatory requirements in force and the policies in place within it.

Establishing appropriate mechanisms to ensure that the Board of Directors obtains all the necessary information and documents to ensure the soundness of the decision-making process.

Forming committees emanating from the Board of Directors and adopting their own code of conduct.

Approving the financial statements of the payment institution after the approval of the Audit Committee.

Developing a general framework for the periodic evaluation of the Board of Directors to ensure that the members of the Board perform their duties and responsibilities efficiently and their commitment to integrity and independence when evaluating and discussing the resolutions.

Notifying the Central Bank with a copy of the statements and notices that the payment institution sends to shareholders to attend the General Assembly, and the Central Bank has the right to send a representative to attend the General Assembly in the cases that

it decides.

Formation of the Board of Directors:

When forming the Board of Directors of the payment institution, the following must be taken into consideration:

The size, nature and scope of the payment institution's business and the extent of the complexity of its activities.

The members of the Council must enjoy the various skills and expertise necessary to carry out the responsibilities entrusted to them and manage the business and activities of the payment institution efficiently.

The ability of the members of the Council to devote sufficient time to carry out their tasks, especially if a member of the Board of Directors combines his membership on the Board of Directors of the payment institution with his membership on the Board of Directors of another entity.

The Board of Directors shall be composed of an appropriate number of members in such a way that it can carry out its functions and duties, including the formation of its committees, and independent members may be included by a decision of the Board of Directors, while adhering to the presentation of the decision

on the first General Assembly for approval, and the member of the Council shall be independent if the following conditions are met:

That he be experienced in the business of the payment institution.

That he not be an employee of the payment institution or one of its affiliates during the three years prior.

That he not be related to any of the members of the Council, the senior management, or the consultants of the payment institution, or any of its affiliates up to the second degree.

That he not be a member of the Board of Directors of any of the parties affiliated with the payment institution.

That he not have any interests that conflict with his duties or affect his neutrality in discussions and decision-making.

That he not receive from the payment institution any salary or financial amount except what he receives in return for his membership on the Council or its committees.

That his ownership alone or with his affiliates of the payment institution not exceed 1% of the capital issued or voting rights.

That he not be a partner of the institution's external auditor or an employee thereof during the three years prior.

That he has not been a member for more than six consecutive years.

Secretariat of the Council:

The payment institution must appoint a qualified official to be entrusted with the responsibility of the Secretariat of the Council, provided that he assumes the following tasks as a minimum:

Preparing for Council meetings and preparing the agenda, while providing the necessary information and details and sending it to the members of the Council sufficiently in advance of the meeting.

Documenting the meetings of the Council, its committees, and the General Assembly and preparing detailed minutes of the discussions, deliberations, and the process of voting and the decisions taken, and these minutes and issued decisions are kept and classified in a manner that ensures ease

of reference to them and their availability to the Central Bank upon request.

Sending the minutes of the meetings to the members of the Board of Directors for their review and signature, whether those present in person or those participating through means of communication.

Following up on the implementation of the Council's resolutions within the framework of the mechanism established for this purpose, with this item being presented at the beginning of all Council meetings.

Submitting the minutes of the Board of Directors and its committees to the next sessions for approval.

Board committees:

The Board of Directors of the payment institution must form an audit committee and another for risks as a minimum, and providers may be exempted payment services category (B) of this in the event that it is impossible to form those committees, and the Board of Directors may form what it deems necessary of committees

other, and the Central Bank may direct the institution towards the formation of additional committees according to the nature and scope of its business and the extent of complexity of its activities.

• Audit Committee

The Audit Committee shall be formed from three non-executive members of the Board of Directors chosen by the Council, with the need to provide adequate experience and ensure the necessary balance in the capabilities, knowledge and sufficient expertise in financial matters

and areas of auditing and accounting, provided that the chairman of the committee is not a member of any other committee emanating from the Board of Directors,

and the Committee shall submit its reports to the Board of Directors, and the Council may include in its formation an external member with experience

after obtaining the approval of the Governor of the Central Bank.

The Audit Committee shall meet at least once every three months and the Committee may seek the assistance of whomever it deems appropriate in its work.

The Audit Committee shall be assigned specific responsibilities and powers, including as a minimum the following:

A. Reviewing the financial statements before submitting them to the Board of Directors, while ensuring the accuracy and soundness of the policies and procedures accounting at the payment institution.

B. Monitoring and supervising the performance of both the Internal Audit Department and the Compliance Department.

C. Conducting an annual evaluation of each of the directors of the Internal Audit and Compliance Departments, and submitting the evaluation results to the Board of Directors and linking it to wages, bonuses and annual increases, as well as submitting recommendations to the Board of Directors regarding the appointment, dismissal or acceptance of the resignation of

any of them.

D. Submitting proposals regarding the nomination, appointment or dismissal of the auditor and determining his fees.

Establishing cooperation between both the senior management and the auditor, and ensuring that the necessary information is provided to the auditor including all activities of the company.

F. Studying the observations received from the Central Bank and the auditor and following up on what has been done regarding them and informing the Board of Directors accompanied by the Committee's recommendations.

G. Ensuring that the auditor prepares a report that includes the extent of the adequacy of the internal control system in the payment institution, including supports the quality and development of the internal control system.

Ensuring that the necessary controls are in place to ensure the soundness of the accounting policies and the accuracy of the financial reports of the payment institution.

Agreeing on the scope of the audit with the auditor.

Ensuring that appropriate corrective measures are taken to address any shortcomings in the payment institution's compliance with the requirements regulatory and internal policies.

• Risk Committee