Instructions for Conducting Banks' Activities via Electronic Means

No. 10/12630 Date: 26/7/2001 Instructions for Conducting Banks’ Activities via Electronic Means Circular No. (8/2001) Issued by the Central Bank of Jordan Pursuant to the Provisions of Article 99/b of the Banking Law No. (28) For year 2000 The Central Bank of Jordan's interest in maintaining the soundness of the e-banking system, and in protecting the security of their own system and information and to guarantee the rights of costumers, results in the Central Bank of Jordan issuing the following listed provisions for the banks to adhere to. Article 1: Banks should commit to existing legislations and adhere to banking norms and necessary precautionary measures in exercising all or some of their "licensed activities" via electronic means such as the Internet, telephone and electronic cards and other modern electronic techniques. Article 2: A) The bank which desires to conduct any of its activities through electronic means should take the following into account:

1. Studying, evaluating and identifying each one of the activities to be conducted via electronic means, in addition to studying, evaluating and identifying the applications, necessary protection systems including their costs, associated risks, prevention procedures as well as phases and mechanisms of implementation.
2. Incorporating the electronic activities, which the bank desires to conduct, with the bank's strategy, which is approved by the Board of Directors. B) Notifying the Central Bank on the fulfillment of the requirements specified in clause (A) of this article.

Article 3: The bank that conducts any of its activities through electronic means should be committed to the following: A) Securing qualified technical staff to manage and execute these activities. B) Listing the instructions, standards and procedures required to regulate the executed activities, listing the needed security and protection procedures and to follow-up and develop further. C) Providing the required applications, including hardware, software, networks and adequate protection systems, along with licensing, testing and editing documents. D) Fulfilling the technical requirements necessary to execute these activities, such as registration of the website, electronic endorsement, authentication, encryption and others. Article 4: A) Regular review of systems, equipment, networks, protection methods, and adopted procedures in executing operations within a clear policy to ensure their integrity, improve their performance and update them continuously by qualified technical staff. B) Developing emergency and recovery plans, which clarify all possible procedures and alternatives, and reviewing them periodically. Article 5: The need to identify and clarify the associated responsibilities of the execution of activities through electronic means, taking into account the dual control principle concerning the bank’s role in these activities. Article 6: A) The need to regulate the contractual relationship between the bank and the client which should include a statement of their responsibilities in a clear and balanced manner, in addition to setting ceilings consistent with the kind of service, the customer's credit status, and the client risk size.

B) The banks should be committed to transparency, raising awareness of clients and familiarizing them with the nature of the electronic operations, including the associated risks and obligations, as well as putting clear instructions for such operations. Article 7: Regulating the agreements between the bank and any of the serving, providing and supporting companies, without any contradiction to the banking confidentiality provisions. These regulations should be carried out in a way, which ensures the security of the systems and information. Article 8: Insuring the risks associated with the activities executed through electronic means such as data, regulations and any other acts that the bank or the Central Bank find necessary to be insured. Article 9: A) Executed transactions through electronic means should be subjected to auditing, supervision and internal review in accordance with a policy, which is in compliance with laws, instructions and necessary precautionary measures. B) Providing periodical monitoring reports to be evaluated and followed up on. Article 10: The bank is directly responsible for any equipment, systems, contracts or services provided by a third party regarding the execution of the bank’s activities through electronic means. Article 11: A) Along with the annual and semi annual financial statements provided to the Central Bank of Jordan, the bank should supplement a statistical report on the transactions executed through electronic means in accordance with the attached form. B) The bank should immediately provide the Central Bank of Jordan with detailed information on any internal or external hacking to its

information systems, including the impacts of such hacking and responses taken to handle them. C) The bank must facilitate the functions of the technical on-site examination by the Central Bank of Jordan and cooperate with the examiners so that they can carry out their work completely. D) The bank should provide the Central Bank of Jordan with copies of the internal audit and examination reports as well as external audit reports, which include details on auditing and reviewing the computer centers and information systems. Governor Dr. Umayyah Toukan