Instructions No. 3/2026 Regarding Operational Events

PALESTINE MONETARY AUTHORITY

Instructions No. (3) of 2026
Regarding Operational Events

Based on the provisions of Decree-Law No. (41) of 2022 regarding National Payments, especially Articles (7, 18) thereof, and based on what the Board of Directors of the Palestine Monetary Authority approved in its session No. (299) on 6/10/2026, and in accordance with the powers vested in us, and in order to achieve the public interest, we have issued the following instructions:

Article (1)
Definitions

The following words and phrases, wherever they appear in these instructions, shall have the meanings assigned to them below, unless the context indicates otherwise:
Operational Events: The probability of exposure to losses resulting from the inadequacy or failure of internal procedures, human element, technical systems, external events, or other events leading to operational failure.

Article (2)
Objective and Scope of Application

1. The provisions of these instructions aim to regulate the process of reporting operational events.
2. The provisions of these instructions apply to all companies licensed by the Palestine Monetary Authority to provide payment services.

1 www.pma.ps Ramallah & Al-Bireh Governorate - Palestine P.O. Box 452 Postal Code: P6160675 | Tel: +970 2 2415251 | Fax: +970 2 2415310 | info@pma.ps

PALESTINE MONETARY AUTHORITY

Article (3)
Reporting Operational Events

Payment service companies must adhere to the following:

1. Immediately inform the Palestine Monetary Authority via phone and email of any of the following operational events, as well as upon completion of event handling and restoration of services, and then report through official communication channels in detail within a maximum of three business days from the date of discovery or occurrence of the event:
   a. Business disruption, failure, or interference lasting more than (15) minutes on any of the following: services, systems, electronic channels of all types, systems managed by third parties such as (Visa, Mastercard), anti-money laundering systems, camera recording systems, and any other systems through which financial operations are executed. b. Human errors affecting user accounts or potentially affecting the company, such as incorrect data entry.
   c. Cyber attacks, electronic hacking, and any information security breach or data leakage/spill.
   d. Counterfeiting or forgery of cards of all types, documents, and papers... etc. e. Internal or external fraud, such as events related to embezzlement, breach of trust, and abuse of credit. f. Events related to any contracted third party that affect or are likely to affect the company's systems and services. g. Damage or losses to critical assets or buildings resulting from negligence, weak internal controls, or due to assault, intrusion, riots, natural disasters, or any similar events. h. Robbery or theft.
   i. Any other events that may affect the company and its ability to ensure business continuity.
2. The report must include, at a minimum, the following information:
   a. Nature and description of the event and its causes. b. Date of occurrence and discovery of the event.
   c. Status of the event (concluded/ongoing).
   d. Impact of the event (financial, strategic, reputational, legal, etc.), and identification of the systems affected by the event. e. Actual or potential losses, and recovered insurance amounts, if any. f. Immediate actions taken by the company to contain the event and limit its effects. g. Corrective actions to prevent recurrence of the event.

2 www.pma.ps Ramallah & Al-Bireh Governorate - Palestine P.O. Box 452 Postal Code: P6160675 | Tel: +970 2 2415251 | Fax: +970 2 2415310 | info@pma.ps

PALESTINE MONETARY AUTHORITY

3. Prepare and adopt a clear policy and work procedures for internal reporting of operational events that protect and encourage employees to report, and a documentation mechanism for all operational events, including the results of internal investigations, corrective actions taken, follow-up on their implementation, and review of control measures.

Article (4)
Repeal

Anything that contradicts the provisions of these instructions shall be repealed.

Article (5)
Penalties

Anyone who violates the provisions of these instructions shall be punished in accordance with the provisions of Decree-Law No. (41) of 2022 regarding National Payments.

Article (6)
Implementation and Enforcement

All competent authorities, each within its jurisdiction, must implement the provisions of these instructions, which shall apply from their date of issuance.

Issued in the city of Ramallah, on: 12/10/2026 AD

[Signature]
Yahya Shinar
Governor

3 www.pma.ps Ramallah & Al-Bireh Governorate - Palestine P.O. Box 452 Postal Code: P6160675 | Tel: +970 2 2415251 | Fax: +970 2 2415310 | info@pma.ps