Order No. 96/04 of the President of the National Bank of Georgia on Approval of the Procedure for Participation in the Payment System

Order No. 96/04 of the President of the National Bank of Georgia 24 April 2026 Tbilisi

On Approval of the Procedure for Participation in the Payment System of the National Bank of Georgia

On the basis of sub-paragraph "z" of paragraph 1 of Article 15 and paragraph 1 of Article 63 of the Organic Law of Georgia "On the National Bank of Georgia", I order:

Article 1
The Procedure for Participation in the Payment System of the National Bank of Georgia, attached hereto, is approved.

Article 2
This Order shall enter into force from the moment of its publication.

President of the National Bank of Georgia
Natela Turnava

Procedure for Participation in the Payment System of the National Bank of Georgia

Article 1. General Provisions

1. The Procedure for Participation in the Payment System of the National Bank of Georgia (hereinafter – "Procedure") defines the mandatory requirements that a licensed commercial bank, microbank, registered significant payment service provider, or an entity seeking a license for banking or microbanking activities (hereinafter – "Subject") must meet to participate in the National Bank of Georgia’s monetary funds payment system (hereinafter – "Payment System"). A Subject participating in the Payment System is obliged to continuously meet the requirements defined by this Procedure.
2. This Procedure applies to the Subjects defined in paragraph 1 of this Article who wish to have direct technical integration with the Payment System for the purpose of sending and receiving messages in the Payment System without an intermediary.
3. The purpose of this Procedure is, on the one hand, to regulate the process of Subjects' participation in the Payment System, and, on the other hand, to ensure the correctness, reliability, and security of services provided by Subjects participating in the Payment System.

Article 2. Criteria for Participation in the Payment System

1. To obtain consent regarding compliance with the requirements provided for in this Procedure, the Subject must submit an application to the National Bank of Georgia (hereinafter – "National Bank"). The application must be accompanied by a qualified, independent, and recent (within the last one year) audit report confirming compliance with the criteria provided for in sub-paragraphs "a" and "b" of paragraph 2 of this Article, as well as other related documents if required by the National Bank.
2. To ensure compliance with the requirements provided for in this Procedure, the Subject must meet the following criteria:

http://www.matsne.gov.ge 22001000018011016987

a) To ensure cybersecurity:
a.a) Have formalized processes and effective control mechanisms, and employ qualified staff. Formalized processes ensuring cybersecurity must serve to protect information during storage (data-at-rest), transmission (data-in-transit), processing (data-in-use), and destruction; a.b) Have implemented cybersecurity risk management policies and procedures, which must be approved by management; a.c) Have a recent registry of cybersecurity risks with indications of effective control mechanisms, which must be approved by management; a.d) Conduct cybersecurity awareness training and simulations for employees at least once a year; a.e) Ensure effective control mechanisms for network and system security, which include the management of security configurations and the existence of intrusion detection and prevention mechanisms; a.f) Ensure effective control mechanisms for the confidentiality, integrity, and availability of information in its possession, including information reflecting users' personal data and financial transactions, including data encryption; a.g) Ensure effective management of the system development lifecycle; a.h) Ensure effective access control mechanisms in accordance with strong authentication, roles, and responsibilities; a.i) Maintain accounting records (so-called "logs") reflecting access to systems and information, and monitor them; a.j) Conduct penetration testing on all systems connected to the network. Penetration testing must be conducted by highly qualified and experienced specialists; a.k) Conduct network vulnerability scanning at least twice a year; a.l) Have implemented plans for responding to system disruptions and cyberattacks; a.m) Have implemented a cybersecurity incident management policy and procedure, which must also include the immediate sharing of information with the National Bank; b) Have policies and procedures for operational risk management approved and implemented by management, which must at least include:
b.a) The responsibilities and authorities of the structural unit/person responsible for operational risk management; b.b) Tools for the identification, recording, analysis, escalation, assessment, and mitigation of operational risks; b.c) Preventive and detective procedures and mechanisms for control and monitoring, which in turn include tools for the detection and minimization of fraudulent operations in payment systems; b.d) A policy and procedure for fraud risk management; b.e) The definition, monitoring, and response measures for risk maps and key risk indicators, which in turn include integration processes with payment systems; b.f) Business continuity management, including the recovery component from disasters. The Subject must have a developed and formalized Business Continuity Plan (BCP), which also includes the management of the continuity of the Payment System's business processes and the recovery plan for the associated information technology infrastructure (DRP). The Business Continuity Plan must use scenario analysis approaches with risk-oriented critical scenarios, appropriate assessments, and recovery procedures. Scenarios must take into account critical internal/external factors, outsourcing processes, and service providers. Scenarios must be subject to qualitative and quantitative assessment (e.g., Business Impact Analysis – BIA). Scenarios must define the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for process recovery. The testing of the Business Continuity Plan must be conducted regularly, at least once a year. The results of the testing must be recorded and formalized. The Subject must review and periodically update the Business Continuity Plan; b.g) Precision risk management, which includes ensuring the accuracy of data and reporting related to the process; b.h) Recording of manually performed processes within the Payment System and assessing their impact on operational risk; b.i) A procedure for reporting significant operational risks; b.j) Policies and procedures for the assessment and approval of new products, activities, processes, and systems; b.k) The assessment, management, and monitoring of risks associated with significant and/or critical outsourcing processes of the Payment System; b.l) Policies and procedures for the adequacy and security of information systems and technologies, which also include the independent assessment of information systems and technologies associated with payment systems on a regular basis, as well as upon significant changes, using a risk-based approach; b.m) A plan for periodic measures to raise awareness and qualification regarding operational risks; b.n) Issues regarding the regular review and update of operational risk policies and procedures; c) Have implemented policies and procedures developed to facilitate the prevention of money laundering and terrorist financing, as well as the compliance with sanctions regimes. Furthermore, participation in the Payment
System does not exempt Subjects participating in the Payment System from the obligations to comply with the legislation on the prevention of money laundering and terrorist financing and the requirements established by sanctions regimes regarding each other; d) If the Subject plans to or conducts cross-border transfers, it must have a registered and connected (connected) BIC code in the SWIFT system, otherwise, a non-connected (non-connected) BIC code is permitted.

http://www.matsne.gov.ge 22001000018011016987

3. If the Subject uses outsourcing services of the Payment System, it is obliged to extend the cybersecurity requirements defined in sub-paragraph "a" of paragraph 2 of this Article to the outsourcing service provider and submit to the National Bank a qualified, recent (within the last one year), independent audit report confirming the outsourcing service provider's compliance with these requirements.

Article 3. Decision on the Subject's Compliance with Established Requirements

1. The National Bank makes a decision on the Subject's compliance with the requirements provided for in this Procedure within 60 (sixty) calendar days from the receipt of the application and corresponding documentation/information provided for in paragraph 1 of Article 2 of this Procedure.
2. If the audit report provided for in paragraph 1 of Article 2 of this Procedure presents a critical and/or high-risk non-compliance with the requirements established by sub-paragraphs "a" and/or "b" of paragraph 2 of Article 2 of this Procedure, and/or if the penetration testing report presents a critical and/or high-risk vulnerability, the National Bank will make a negative decision on the Subject's compliance with the requirements provided for in this Procedure.
3. If the documentation/information submitted by the interested person does not meet the requirements provided for in this Procedure, except for the cases provided for in paragraph 2 of this Article, the National Bank sets a 30 (thirty) calendar day deadline for eliminating the defect and/or clarifying the submitted data. The running of this deadline begins from the date of written submission of the defects to the interested person by the National Bank. The running of the deadline provided for in paragraph 1 of this Article is suspended from the date of preparation of the letter by the National Bank regarding the detection of defects in the documentation submitted by the interested person or the request for additional information (from the date of registration of the letter). It resumes after the interested person fully submits the corrected defects or the requested additional documentation to the National Bank.
4. The National Bank is authorized to request additional documentation/information at any stage of the consideration of the application submitted by the interested person and set a deadline for the submission of such documentation/information.
5. In the event of non-fulfillment of the obligations provided for in this Procedure by the Subject within the deadlines defined by this Procedure, as well as in the presence of false information in the submitted documentation, the National Bank makes a negative decision on the Subject's compliance with the requirements provided for in this Procedure.
6. If the letter prepared by the National Bank regarding the detection of defects or the request for additional information in the Subject's application for participation in the Payment System is not delivered to the interested person despite two attempts, the National Bank is authorized to make a negative decision on the Subject's compliance with the requirements provided for in this Procedure after the expiration of a 10 (ten) calendar day deadline from the date of the second attempt to deliver the letter.
7. The National Bank notifies the Subject in writing of a positive decision on the Subject's compliance with the requirements provided for in this Procedure. In the event of a positive decision by the National Bank, the process of participation in the Payment System will proceed in accordance with the rules established by the National Bank.
8. The National Bank notifies the Subject in writing of a negative decision on the Subject's compliance with the requirements provided for in this Procedure, indicating the reason for the refusal.
9. The process of the Subject's participation in the Payment System is terminated by the decision of the National Bank if the Subject no longer meets the requirements provided for in Articles 2 and/or 4 of this Procedure, and/or if it no longer constitutes a Subject subject to the supervision of the National Bank.
10. The National Bank is authorized to suspend or terminate the Subject's right to participate in the Payment System for a specified or unspecified period if the Subject no longer meets the requirements provided for in Articles 2 and/or 4 of this Procedure, and/or if it no longer constitutes a Subject subject to the supervision of the National Bank.
11. The National Bank is authorized, at its own discretion, to set a deadline for eliminating the reasons for suspension or termination of participation in the Payment System for the Subject in the cases provided for in paragraph 10 of this Article.

Article 4. Participation in the Payment System and Obligations of the Subject

1. In the process of participation in the Payment System, the Subject is obliged to:
   a) Conduct an independent, qualified audit of the operational effectiveness of information security, including basic IT controls, at least once a year. The audit must take into account the size and complexity of the Subject. Recognized industry standards and/or frameworks (ISO, COBIT) must be used as audit criteria. This audit must be conducted by an independent and impartial audit company that has broad experience in the field of checking the operational effectiveness of information security, including basic IT controls; b) Conduct penetration testing annually, which must at least include the infrastructure and systems participating in the Payment System and associated with it. This must also be conducted in the event of significant IT changes. Penetration testing must be conducted by highly qualified and experienced specialists.
2. The Subject is obliged to meet the requirements defined in Article 2 of this Procedure, this Article, and other obligations throughout the entire period of participation in the Payment System.
3. During the period of participation in the Payment System, the Subject is obliged to submit to the National Bank once a year a qualified, independent audit report confirming compliance with the criteria provided for in sub-paragraph "a" of paragraph 2 of Article 2 of this Procedure, as well as other related documents if required by the National Bank. The National Bank is authorized, on the basis of a risk-based approach, to request a qualified, independent audit report confirming compliance with the criteria provided for in sub-paragraph "b" of paragraph 2 of Article 2 of this Procedure, as well as other related documents if necessary.

Article 5. Supervisory Measures and/or Sanctions
In the event of violation of the requirements provided for in this Procedure, the National Bank is authorized to use supervisory measures and/or sanctions (including monetary fines) defined by the legislation of Georgia.

http://www.matsne.gov.ge 22001000018011016987