Proposed Regulatory Framework for Third Party Financial Technology Services in ADGM

CONSULTATION PAPER
NO. 7 OF 2020
PROPOSED REGULATORY
FRAMEWORK FOR PROVIDING THIRD
PARTY FINANCIAL TECHNOLOGY
SERVICES IN ADGM
25 November 2020

Consultation Paper No. 7 of 2020
Contents
Introduction........................................................................................................................... 3
Who should read this paper?................................................................................................ 3
How to provide comments.................................................................................................... 3
What happens next?............................................................................................................ 4
Comments to be addressed to:............................................................................................. 4
Background ......................................................................................................................... 5
Legislative Framework ......................................................................................................... 5
Definition of new Regulated Activity...................................................................................... 5
General Regulatory Obligations............................................................................................ 6
Managing Operational Risk.................................................................................................. 6
Prudential Requirements...................................................................................................... 8
Professional indemnity insurance......................................................................................... 9
Wind down......................................................................................................................... 10
Conduct of Business.......................................................................................................... 10
Data Protection.................................................................................................................. 12
Anti-Money Laundering/Countering the Financing of Terrorism (“AML/CFT”)....................... 12
Authorisation and Supervision Fees ................................................................................... 13
Transitional Arrangements ................................................................................................. 13
Proposed Amendments...................................................................................................... 13

Consultation Paper No. 7 of 2020
Why are we issuing this paper?

1. The Financial Services Regulatory Authority (“FSRA“) of Abu Dhabi Global Market
   (“ADGM“) has issued this consultation paper to seek views on the proposed regulatory framework for the new Regulated Activity of Providing Third Party Services (“PTPS”).
2. This paper sets out a regulatory framework that facilitates FinTech firms working
   collaboratively with other financial institutions. Such Third Party Service Providers (“TPPs”) do not hold their customers’ assets but instead help assists the access, processing and transfer of customers’ information held at those other financial institutions. The framework also defines requirements for TPPs to manage their prudential and conduct risks.
3. In other jurisdictions, the growth of TPPs has been facilitated by the introduction of Open
   Finance frameworks. Under such frameworks, customers have more control over how their data is accessed, processed and transferred by financial institutions. For example, Open Banking as set out under PSD2 lets customers access their payment account information and initiate payments through TPPs’ services. Such control lets customers better exploit the value of their data.
4. While Open Finance will play an important role in the future of financial services, it is
   currently in a nascent stage and there is no generally agreed global model on how to implement it. The proposed regulatory framework lays a strong foundation on which to build an Open Finance strategy to support business growth and financial innovation in the digital economy.
5. Unless otherwise defined, capitalised terms used in this paper have the meanings
   attributed to them in the Financial Services and Markets Regulations 2015 (“FSMR”) or the Glossary (“GLO”). Who should read this paper?
6. This Consultation Paper should be of particular interest to all entities aspiring to undertake
   the Regulated Activity of Providing Third Party Services, their potential customers, financial institutions that may interface with TPPs and professional advisers. How to provide comments
7. All comments should be made in writing and sent to the address or the email address
   specified below. If sending your comments by email, please use the Consultation Paper number in the subject line. If relevant, please identify the organisation you represent when providing your comments. Introduction Introduction

Consultation Paper No. 7 of 2020
8. The FSRA reserves the right to publish, including on its website, the comments you
provide, unless you expressly request otherwise at the time of submitting those comments. Comments supported by reasoning and evidence will be given more weight by the FSRA. What happens next?
9. The deadline for providing comments on the proposed framework is 7 January 2021.
After receiving your comments, we shall consider whether any modifications are required to the proposals and the Board of ADGM and the FSRA will then proceed to enact the proposals in their final form.
10. You should not act on these proposals until final rules and guidance are issued by the
FSRA. We shall issue a notice on our website when this happens.
Comments to be addressed to:
Consultation Paper No. 7 of 2020
Financial Services Regulatory Authority
Abu Dhabi Global Market Square
Al Maryah Island
PO Box 111999
Abu Dhabi, UAE
Email: consultation@adgm.com

Consultation Paper No. 7 of 2020

1. ADGM’s strong emphasis on the sound regulatory supervision of FinTech developments
   has led to firms expressing interest in working with financial institutions in the UAE and the broader region to provide additional services to the customers of those financial institutions. These firms do not hold or control client funds, but instead provide services to help those customers manage their funds held at the financial institutions, using technology to access, process and transfer information.
2. Firms providing such services are referred to as TPPs because they act as a third party
   intermediary between their customers and their customers’ financial institutions. This third party relationship is separate from and does not affect customers’ existing relationship with their financial institutions.
3. The FSRA is taking definitive steps to put in place a regulatory framework in ADGM for
   TPPs, as the demand and take-up of the services provided by TPPs will increase. In particular, TPPs are likely to play an increasingly important role in the provision of payment services. This approach is intended to provide the industry with a common set of baseline requirements, and to prescribe additional requirements that are calibrated to and commensurate with the nature, scale and risks of the specific type of services provided.
4. In doing so, the FSRA has had regard to comparable regulatory frameworks and
   developments in other jurisdictions, including the European Union (“EU”), Australia and Singapore. Definition of new Regulated Activity
5. We propose defining the Regulated Activity of Providing Third Party Services (“PTPS”) in
   FSMR (see Annex A) as “accessing, processing and transferring Specified Information at the request of a customer” in order to encompass the provision of all types of third party services. Specified Information would be set out in a Schedule, so that it may be expanded straightforwardly to cover any new types of information should the need arise. Initially, and based on current demand, the types of Specified Information handled by TPPs would be:
    information relating to a Payment Account held by the customer at another financial institution; and  information required to initiate a Payment Transaction on behalf of the customer with respect to a Payment Account held by the customer at another financial institution. Background Legislative Framework

Consultation Paper No. 7 of 2020
Exclusions
6. The scope of the Regulated Activity would exclude services traditionally considered as
participation in collaborative networks or those provided via an outsourcing arrangement, including the following.  The access, processing and transfer of Specified Information as part of participation in a multilateral payment and securities settlement systems (e.g. the UAE Funds Transfer System, ADX’s clearing, settlement and depository systems)  Providing technical services that allow for access, processing and transfer of Specified Information in the absence of a relationship with the customer to whom the Specified Information relates (e.g. vendors of banking systems and platforms)  The access, processing and transfer of Specified Information in physical form (e.g. printing of account statements by a third party printer) Client Assets/Relevant Money
7. Importantly, the Regulated Activity will prohibit TPPs from holding Client Assets or
Relevant Money. A TPP with a business model that requires holding Client Assets or Relevant Money should seek authorisation to engage in the appropriate Regulated Activity. Q1. THE FSRA INVITES COMMENTS ON THE PROPOSED DEFINITION OF THE REGULATED ACTIVITY OF PROVIDING THIRD PARTY SERVICES AND ASSOCIATED EXCLUDED ACTIVITIES. General Regulatory Obligations
8. As Authorised Persons, TPPs would be required to comply with all existing, relevant
requirements in the Rulebooks and all new requirements that would also be put in place to address the specific risks posed by TPPs. An overview of those new requirements is found in Appendices 1 to 5. Managing Operational Risk
9. The largest risks facing TPPs and their customers are operational risks, primarily arising
from the incorrect execution of payment instructions and the loss of customer data through poor systems, procedures and handling. TPPs could also pose contagion risk if in the course of their operations, their systems unexpectedly cause damage to the systems of other financial institutions (e.g. as a vector for a cyber-attack). Most of these risks are technological, given the nature of TPPs’ business models. The identification, management and mitigation of operational risks is critical to guarantee confidence in and the security of TPPs’ ongoing operations. Interfacing systems – the Digital Lab
10. A key operational risk for TPPs lies in their systems that connect to customers and to
other financial institutions, i.e. their “interfacing systems”. Failures in interfacing systems could have a serious impact because they could compromise other financial institutions systems or customers’ data.

Consultation Paper No. 7 of 2020
11. In order to address and mitigate this risk, we propose that TPPs be required to connect
to ADGM Digital Lab 1. The connection will be designed in such a way that only those Application Programming Interfaces (“APIs”) 2 that are compliant with the standards set out in Annex F of the FSRA’s Guidance – APIs in ADGM (“API Guidance”) 3 would be able to connect. Applicants to become authorised as TPPs may receive an in-principle approval without establishing such a connection, but connecting to the Digital Lab would be a necessary condition for the granting of a Financial Services Permission (“FSP”) for appropriate authorisation. This would ensure that applicants have met minimum technical standards for competency before they are authorised and allowed to serve customers.
12. On an ongoing basis, an authorised TPP would be required to maintain a connection to
the Digital Lab and to provide an annual independent review of their interfacing systems. These requirements would ensure that the interfacing system is performing appropriately and would let the TPPs’ compliance be monitored as part of ongoing supervision. The TPP would be required to test any changes it makes to its interfacing systems in the Digital Lab for compliance before putting them into production.
13. In addition to connecting to the Digital Lab, we propose that TPPs would have to attest
that their interfacing systems are secure both prior to commencing operations and on an annual basis. This attestation would be accompanied by a report by a qualified independent third party 4 that audits the personnel, procedural and technical controls put in place by the TPP and provides an assessment of these controls’ adequacy. This is similar to the existing requirements for Authorised Persons conducting a Regulated Activity in relation to virtual assets, who must conduct an annual verification/audit of their core systems. Interfacing systems - standards and testing
14. We intend to develop the appropriate technical standards and automated processes for
testing interfacing systems in collaboration with industry participants to ensure they are fit for purpose. Such standards will be necessary to ensure that the process of testing those systems is clear and appropriate.
15. We propose establishing a coordinating committee led by the FSRA and comprising TPPs
and financial institutions to develop an acceptable set of technical standards for interfacing systems. The standards would cover, amongst other things:
 how TPPs would connect to each other;
 the information that can be exchanged;
 how such information would be secured;
 the service levels that would be acceptable for TPPs and financial institutions; and  how to automate the process for conducting such tests.

The Digital Lab is a digital platform that allows financial institutions, FinTechsand the FSRA to collaborate on new digital innovations. As part of the Digital Lab, firms can list their technological solutions and expose them for testing from a business model and technology risk point of view. 2 APIs allow different systems to interface with each other through a pre-defined protocol that sets out allowable actions and expected responses. The FSRA has issued guidance to firms to encourage a standardized approach to creating, maintaining and governing APIs. https://www.adgm.com/documents/legal-framework/guidance-and-policy/fsra/adgm-fsra-guidance-on-api-14102019.pdf 4 Such a third party would need to have an appropriate track record in providing similar audits in either the UAE or a comparable jurisdiction

Consultation Paper No. 7 of 2020
Management of technology and data risk
16. Beyond interfacing systems, other TPP systems could also pose operational risks. For
example, TPPs would need to ensure strong user access controls are in place to prevent sensitive customer data from being extracted by a malicious insider threat (e.g. a rogue systems administrator). Such risks cannot be addressed through the Digital Lab, as each TPP will have different internal systems and processes.
17. We propose providing further guidance to TPPs on the management of technology and
data risks. The guidance would set out the FSRA’s expectations on how TPPs should meet the obligations in the General Rulebook (“GEN”), primarily those under GEN 3.3, to put systems and controls in place to ensure that its affairs are managed effectively and responsibly. Compliance with the guidance would be taken into account as part of the ongoing supervisory process when assessing the risk profile of a TPP. This guidance would be issued separately, following the launch of the framework. Q2. THE FSRA INVITES COMMENTS ON THE PROPOSED MEASURES TO ADDRESS OPERATIONAL RISKS BY REQUIRING CONNECTIONS TO THE DIGITAL LAB, REGULAR ATTESTATIONS OF THE SECURITY OF INTERFACING SYSTEMS AND THE ESTABLISHMENT OF AN INDUSTRY COORDINATING COMMITTEE. Prudential Requirements Categorisation of TPPs
18. We propose treating TPPs as Category 4 firms in terms of the Prudential – Investment,
Insurance Intermediation and Banking Rules (“PRU”) as they would be prohibited from holding Client Assets and Relevant Money and therefore pose less risk from a prudential perspective. As such, TPPs would be required to meet only the requirements in PRU for capital resources, operational risk and group risk purposes and would not be subject to other requirements such as those for liquidity risk, supervisory review and evaluation and disclosure. Capital Requirements
19. We propose requiring a base capital requirement (“BCR”) for TPPs only where the TPP
accesses, processes or transfers information that leads to a transaction. Such TPPs would be required to meet a BCR of $50k.
20. Furthermore, we are proposing not to impose ongoing Expenditure Based Capital
Minimum (“EBCM”) requirements on TPPs as the risks and any associated unexpected losses that such capital requirements are intended to address 5 may be mitigated through other means, including the use of professional indemnity insurance (“PII”). Unexpected losses could arise from the need to reimburse customers following a dispute or from unexpected system behaviour and these can be addressed through PII, which would provide the TPP with sufficient funds to address potential disputes.

5 Capital requirements are imposed on financial institutions for three reasons:
(i) Commitment to entry: to deter applicants who cannot commit adequate resources to support their business model; (ii) Buffer: to absorb unexpected losses and allow the firm to continue as a going concern; and (iii) Liquidation: to provide for an orderly winding down if the firm ceases operations

Consultation Paper No. 7 of 2020
21. In proposing the appropriate capital requirements for TPPs, we have had regard to other
international jurisdictions’ approaches, including in particular the approach in the EU. Q3. THE FSRA INVITES COMMENTS ON THE PROPOSED CAPITAL REQUIREMENTS FOR TPPS. Professional indemnity insurance
22. We are proposing additional requirements on PII coverage for TPPs, beyond the
requirements placed on other Category 4 Authorised Persons. PII is an important component of the proposed regulatory framework for TPPs that protects TPPs against unexpected operational risk events that lead to losses for customers. In turn, the TPP would be expected to use its PII coverage to obtain funds to reimburse the customer, should reimbursement be expected. Cyber and Data Security Coverage
23. TPPs are strongly encouraged to include cyber and data security in their PII coverage.
Cyber-attacks, software failures and data leaks are the most likely types of unexpected operational events that a TPP will face. At this time we note that there are a limited number of PII underwriters in the UAE and not all of those offer such coverage so we are not proposing that such coverage be mandatory at this point. As the TPP sector grows we shall continue to monitor the state of development of the PII market and shall consider periodically whether cyber and data security coverage should be made mandatory. Transaction limits
24. We propose requiring TPPs to put limits in place on their customers’ transactions that are
in line with their PII coverage, subject to a minimum PII level of $150k. Such limits will ensure that the TPP has sufficient coverage to reimburse their customers in the event of disputes. Additionally, the minimum PII level would ensure that TPPs have sufficient funds to deal with rapidly increasing volumes of customers and transactions when they start operations. TPPs would be responsible for managing their customer transactions within this coverage, e.g. through imposing limits on the number or value of transactions or both.
25. TPPs will be required to ensure that the total value of the transactions they process in a
rolling 30-day window does not exceed their remaining PII coverage, subject to a minimum PII level of $150k. The value of a transaction would be determined by the transaction type. If the transaction leads to a payment being initiated, the value of the transaction would be the same as the value of the payment, while all other transactions would be treated as a nominal value of $1. This rolling window would give customers a reasonable period to bring the matter to the attention of the TPP where an operational risk event occurs that leads to losses for them. Remaining PII coverage would be calculated by subtracting total outstanding claims from total PII coverage.

Consultation Paper No. 7 of 2020
Comparable Guarantees
26. Given the relative nascence of the PII market for TPPs in the UAE, it may be challenging
for TPPs to obtain PII coverage. We would like to solicit views on whether the use of comparable guarantees such as bank guarantees would be a viable alternative to PII. Wind down
27. In the event that a TPP were to cease operations, whether in short order or over an
extended period, we believe that the relationships of TPP customers with their financial institutions would be unaffected, given the supporting role that TPPs play in the arrangement between the other two parties. We acknowledge that this might inconvenience customers, but we believe that it would not cause serious disruption as they could continue to use their financial institutions’ services directly and, if desired, establish a new relationship with another TPP. Q4. THE FSRA INVITES COMMENTS ON THE PROPOSED REQUIREMENTS FOR PII AND THE AVAILABILITY AND SUITABILITY OF COMPARABLE GUARANTEES AS AN ALTERNATIVE OR SUPPLEMENT TO PII. Conduct of Business Conduct of Business Rulebook (“COBS”)
28. We propose requiring that TPPs meet certain, appropriate obligations analogous to those
set out in COBS that pertain to the revised Money Services regulatory framework in
Chapter 19 (“COBS 19”). However, as TPPs fall outside that framework, it could be
confusing to reference the proposals in COBS 19. In order to aid TPPs we propose adding a new Chapter 20 (“COBS 20”) to house these obligations, building on and complementing COBS 19. The most significant proposed obligations are:
 Record keeping - TPPs would be obliged to record all information requested by or transferred on behalf of customers
6. This would facilitate investigations should
there be incorrect or unauthorised payments (e.g. arising from neglect or fraud) by ensuring accurate records are kept;  Client agreements - TPPs would have to include key information in their client agreements, such as the information will be provided by the TPP to other parties, how the TPP will require consent and any redress the customer would have in the event of a failed transaction or inappropriate transfer of information. This would ensure that customers are accurately informed of the risks involved and their rights of redress before signing up for the TPP’s services  Consent - where TPPs must ensure that they only access, process or transfer information where they have obtained consent from their customers or if it is necessary for compliance with any regulatory or legal obligation 7. Such consent could be obtained directly from the customer or via a third party mechanism such

These record keeping requirements would encompass all the requirements set out in the proposed COBS 19.8.1 and impose further ones, taking into account that TPPs may need to keep track of information. This is more restrictive than the ADGM Data Protection Regulations, which allow for additional bases under which data can be shared (e.g. for contractual obligations or for protecting the vital interests of the client).

Consultation Paper No. 7 of 2020 as the UAEPass or another TPP. The TPP would need to specify how it intends to obtain consent, as several different models for obtaining consent exist 8. Liability and dispute resolution
29. The actions of TPPs may, in some instances, give rise to a dispute between their
customers and those customers’ financial institutions. For example, a customer may claim that a Payment Transaction initiated by a TPP was done so without appropriate authorisation; a prolonged dispute between the TPP, the customer and the customer’s financial institution could leave the customer and the intended recipient of the payment potentially suffering losses as they would not have certainty over the state of the payment of the funds available to the customer.
30. Providing clarity to all parties on dispute resolution would improve the outcomes for all,
with the guiding principle being to ensure that customers are reassured that they will not be left worse off should an unauthorised or fraudulent transaction occur. As part of this, customers need to know who they should approach in the event of a dispute and who would reimburse them if that should be appropriate. In turn, TPPs and the customers’ financial institutions would need to know who should investigate the dispute and who should be liable for reimbursing customers for any related losses suffered.
31. We propose therefore requiring TPPs to incorporate a dispute resolution mechanism into
the contracts they have with their customers. Such clarifications would ensure that customers know who to approach should a dispute occur and, after investigation, where responsibility lies for making the customer whole should the TPP be found to be at fault. The following are the key terms that would be included in the relevant contractual provisions.  For customers - the customer’s financial institution should be primarily responsible for dispute resolution. A customer should contact its financial institution in the event of a dispute and TPPs would be required to forward on any such disputes to the relevant financial institution for further investigation. If the TPP were to be found to be at fault (e.g. by submitting materially incorrect information for the payment), it would be required to reimburse the customer.  For TPPs and customers’ financial institutions - the customer’s financial institution should be responsible for investigating the dispute. In turn, a TPP must be able to prove to the customer’s financial institution that its actions were authenticated, accurate and in accordance with its policies for providing TPP services. If the TPP were to be unable to prove this, it would be required to reimburse the customer. If the customer’s financial institution has already reimbursed the customer, the TPP would be required to reimburse the customer’s financial institution. Q5. THE FSRA INVITES COMMENTS ON THE PROPOSED CHANGES TO COBS. Q6. THE FSRA INVITES COMMENTS ON THE PROPOSED DISPUTE RESOLUTION PROCESS.

This could range from a per-request model, where the customer affirmseach request individually, to an omnibus model, where the customer would only need to provide consent once at the start of its relationship with the TPP.

Consultation Paper No. 7 of 2020
Data Protection
32. TPPs control a large amount of personal data and so must ensure that such data is
protected. As entities registered in ADGM, TPPs would be subject to the Data Protection Regulations 2015 (“DPR”) 9, which set out obligations for data controllers to follow when processing personal data. However, TPP’s customers and their financial institutions may be based outside ADGM and so would be subject to different data protection regulations. This could lead to a potential mismatch between how TPPs treat their customers’ data and how the customers’ financial institutions treat their customers’ data.
33. The FSRA proposes to provide TPPs with guidance that TPPs are expected to comply
with the relevant data protection regulations in other jurisdictions when dealing with customers based outside ADGM. This is particularly important as recent data protection￾related legislation has increasingly had an extra-territorial dimension that may cause significant challenges for any firms processing data, including TPPs. Such guidance would ensure that TPPs’ customers based outside ADGM would be afforded the same protection as other persons in that jurisdiction. . Anti-Money Laundering/Countering the Financing of Terrorism (“AML/CFT”) Applicability of AML Rulebook
34. We will require TPPs to comply with all requirements set out in the Anti-Money Laundering
and Sanctions Rules and Guidance Rulebook (“AML”). While TPPs may pose lower AML/CFT risks than other financial institutions because they do not hold Client Assets or Relevant Money, they are an important player in monitoring for AML/CFT activities. By the nature of the services they provide, TPPs should be able to detect potentially suspicious behaviour that might involve other financial institutions.
35. The FSRA considers that TPPs would generally be able to rely on the Customer Due
Diligence (“CDD”) performed by the financial institutions with which their customers have relationships. However, as TPPs may be serving customers from multiple jurisdictions, the depth and intensity of both CDD and AML/CFT supervision more generally for financial institutions in those jurisdictions could be less robust than would be acceptable to the FSRA. As such, a TPP should only place reliance on the CDD performed by financial institutions in a jurisdiction where the TPP has assessed that the standard of AML/CFT supervision in that jurisdiction is at least comparable to that in ADGM. The TPP would be required to seek the FSRA’s agreement with their assessment of comparability prior to accepting customers from those jurisdictions. CDD data portability
36. We propose placing a general obligation on Authorised Persons and Recognised Bodies
operating in or from ADGM to share their CDD information with other Authorised Persons and Recognised Bodies at the request of the latter group, i.e. “data portability”, with any such request being limited to customers that have business relationships with both the provider and the recipient of that information and being subject to the explicit consent in writing of those customers. A request could only be made for the purpose of conducting CDD and, in order to prevent additional confidential and proprietary information from

The DPR is currently being updated. The consultation document can be found at https://www.adgm.com/legal-framework/public￾consultations#consultation-paper-no.-20201219

Consultation Paper No. 7 of 2020 being transferred, this obligation would be restricted to CDD information that has been provided to the Authorised Person or Recognised Body by the person subject to CDD. An Authorised Person or Recognised Body making such a request would only be allowed to request such data once every twelve months. This will reduce the cost and time taken by authorised entities to conduct CDD and so make the financial sector in ADGM more efficient. Q7. THE FSRA INVITES COMMENTS ON TPPS BEING OBLIGED TO COMPLY WITH ALL REQUIREMENTS IN AML AND ON THE PROPOSAL TO ALLOW FOR CDD DATA PORTABILITY Authorisation and Supervision Fees
37. We propose that TPPs would be subject to authorisation and supervision fees as set out
in FEES 2.2, i.e. an initial authorisation fee of $5k and an annual supervision fee of $5k thereafter, the latter pro-rated for the first part of the calendar year of operation. Transitional Arrangements
38. Certain firms that provide Third Party Services in ADGM may be operating in the
RegLab 10 at the time that the regulatory framework for TPPs is implemented. Such firms would be given a grace period of up to twelve months to put in place the necessary systems, controls and processes to comply with the TPP regulatory framework from the point in time at which the TPP regulatory framework is implemented. When a firm is judged to be compliant with the requirements in those areas it would automatically leave the RegLab and take up an FSP for PTPS.
39. In the period leading up to the implementation of the TPP regulatory framework we shall
continue to allow new firms that offer TPP services to enter the RegLab, subject to them applying and meeting the admission criteria. However, once the TPP regulatory framework has been finalised, new firms would generally not be allowed to provide TPP services through the RegLab and would ultimately have to seek authorisation under the TPP regulatory framework to provide those services. Q8. THE FSRA INVITES COMMENTS ON THE PROPOSAL FOR A TRANSITIONAL PERIOD FOR FIRMS OPERATING IN THE REGLAB.

10 The RegLab is a tailored regulatory regime for FinTech participants. It is designed to foster innovation within the UAE financial services markets by taking into account the unique business model and risks of the FinTech participant and customising the te st boundaries and regulatory requirements accordingly. This lets the participant develop and test its FinTech proposition in a safe environment without facing undue regulatory burden.

Consultation Paper No. 7 of 2020
RO
SED AMENDMENTS AND REGULATIONS
 Annex A Financial Services and Markets Regulations 2015 (FSMR)  Appendix 1 Prudential – Investment, Insurance Intermediation and Banking Rules (PRU)  Appendix 2 Conduct of Business Rulebook (COBS)  Appendix 3 Glossary (GLO)  Appendix 4 Anti-Money Laundering and Sanctions Rules and Guidance (AML) PROPOSED AMENDMENTS PROPOSED AMENDMENTS AND REGULATIONS PROPOSED AMENDMENTS AND REGULATIONS PROPOSED AMENDMENTS AND REGULATIONS

---

Annex A
FINANCIAL SERVICES AND MARKETS
(AMENDMENT No X) REGULATIONS 2021

Annex A
FINANCIAL SERVICES AND MARKETS (AMENDMENT NO X) REGULATIONS 2021 Regulations to amend the Financial Services and Markets Regulations 2015. Date of Enactment: [] 2021 The Board of Directors of the Abu Dhabi Global Market, in exercise of its powers under Article 6(1) of Law No. 4 of 2013 concerning the Abu Dhabi Global Market issued by His Highness the Ruler of the Emirate of Abu Dhabi, hereby enactsthe following Regulations–
1. Amendments to the Financial Services and Markets Regulations 2015
…
196. The record of Authorised Persons etc.
(1) The Regulator must publish and maintain a record of every— (a) Security admitted to the Official List; (b) Authorised Person; (c) Public Fund; (d) Approved Prospectus; (e) Recognised Investment Exchange or Recognised Clearing House; (f) Remote Investment Exchange or Remote Clearing House; (g) individual to whom a Prohibition Order relates; (h) Trade Repository; (i) Remote Member; (j) Approved Person; (k) Passported Fund; and (l) Specified Information; and (l)(m) any person falling within such other class (if any) as the Regulator may determine. (2) The record must include such information as the Regulator considers appropriate. (3) The Regulator shall make a reasonably current version of the records available for viewing by the public during the normal business hours of the Regulator. …
258. Definitions
(1) In these Regulations, unless the context otherwise requires—

Annex A
Providing Third Party Services means the Regulated Activity specified in paragraph 73F of the First Schedule. Specified Information means, in relation to the Regulated Activity of Providing Third Party Services, such information as may be prescribed by the Regulator. Third Party Provider means an Authorised Person which holds a Financial Services Permission to carry on the Regulated Activity of Providing Third Party Services. Third Party Transaction means the access to, processing or transfer of Specified Information by the Third Party Provider that is executed at the request of a Customer. …
Schedule 1
Regulated Activities
…
Chapter 17D Providing Third Party Services
The activity
73F. Providing Third Party Services
(1) Providing Third Party Services is a specified kind of activity.
(2) Providing Third Party Services is an activity that means the accessing, processing and transfer of Specified Information. 73G. Prohibition on Holding Client Assets or Relevant Money An Authorised Person that Provides Third Party Services must not hold Client Assets or Relevant Money unless they hold a Financial Services Permission for other Regulated Activities that allows them to hold Client Assets or Relevant Money. Exclusions 73H. Connected Services An Authorised Person does not Provide Third Party Services if it does so in relation to the carrying on of another Regulated Activity where Providing Third Party Services is in connection with and a necessary part of that other Regulated Activity. 73I. Other exclusions The following do not constitute Third Party Services— (a) payment or securities settlement systems that require the accessing, processing or transfer of Specified Information;

Annex A
(b) technical services that access, process or transfer Specified Information without having a relationship with the Person to whom the Specified Information relates; and (c) services that access, process or transfer Specified Information that is contained in physical form. …

Annex A
2. Short title, extent and commencement
(1) These Regulations may be cited as the Financial Services and Markets (Amendment No X) Regulations 2021. (2) These Regulations shall apply in the Abu Dhabi Global Market. (3) These Regulations come into force on the date of their publication.

---

Appendix 1
Prudential – Investment, Insurance Intermediationand Banking Rules(PRU) *In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 1
…
1 APPLICATION, INTERPRETATION AND CATEGORISATION …
1.3 Categories of Authorised Persons
…
Category 4
1.3.6 An Authorised Person is in Category 4 if:
(a) its Financial Services Permission authorises it to carry on one or more of the Regulated Activities of Arranging Credit, Arranging Deals in Investments, Advising on Investments or Credit, Arranging Custody, Insurance Intermediation, Providing Trust Services (where it is not acting as trustee in respect of an express trust), Insurance Management, Acting as the Administrator of a Collective Investment Fund, or Operating a Multilateral Trading Facility or Organised Trading Facility, or Operating a Private Financing Platform or Providing Third Party Services; and (b) it does not meet the criteria of Categories 1, 2, 3A, 3B, 3C or 5. … CAPITAL AND LEVERAGE …
3.3 Base Capital Requirement
…
3.3.2 The table below sets out the Base Capital Requirement for each Category of
Authorised Persons.
Category Base Capital Requirement (US $)
… …
10,000, except where an Authorised Person has a Financial Services Permission:
a) to carry out the Regulated Activity of Operating a Private Financing Platform and holds Client Assets, in which case the Base Capital Requirement is 150,000; or b) to carry out the Regulated Activity of Providing Third Party Services, in which case the Base Capital Requirement will be 50,000 if the Authorised Person

Appendix 1
Category Base Capital Requirement (US $) intends to provide Third Party Transactions that lead to Payment Transactions, orzero otherwise. …
3.7 Expenditure Based Capital Minimum
3.7.1 An Authorised Person, other than one that has a Financial Services Permission to
carry out the Regulated Activity of Providing Third Party Services, must calculate its Expenditure Based Capital Minimum as:
(a) in the case of an Authorised Person which holds Client Assets or Relevant Money or Insurance Money, 18/52nds; (b) in the case of an Authorised Person in Category 3B or 3C which does not hold Client Assets or Relevant Money or Insurance Money, 13/52nds; or (c) in the case of an Authorised Person in Category 4, which does not hold Insurance Money, 6/52nds; of the Annual Audited Expenditure, calculated in accordance with Rule 3.7.2. …. 6 OPERATIONAL RISK …
6.12 Professional indemnity insurance
…
6.12.2 An Authorised Person must:
(a) subject to Rule 6.12A, take out and maintain professional indemnity insurance cover appropriate to the nature, size, complexity and risk profile of the Authorised Person's business; (b) at least annually, provide the Regulator with a copy of the professional indemnity insurance cover in (a) covering the following 12month period and be able to demonstrate its adequacy in relation to the nature, size, complexity and risk profile of the Authorised Person’s business; and (c) notify the Regulator of any material changes to the cover in (a), including the level of cover, its renewal or termination. …

Appendix 1
6.12A Professional indemnity insurance for Third Party Providers Minimum Coverage for Third Party Providers 6.12A.1 A Third Party Provider mustmaintain at all times a minimum professional indemnity insurance coverage of at least US$150,000. Transaction Limits 6.12A.2 A Third Party Provider must ensure that the total value of all Third Party Transactions in the previous 30 calendar days does not exceed its remaining professional indemnity insurance cover. 6.12A.3 The value of a Third Party Transaction must be calculated as:
(a) where the Third Party Transaction leads to a Payment Transaction, the value of the Payment Transaction; or (b) US$1. 6.12A.4 A Third Party Provider must calculate the value of its remaining professional indemnity insurance coverage by subtracting the value of any unsettled claims made against its professional indemnity insurance from the total value of its professional indemnity insurance. Guidance

1. A Third Party Provider’s risk profile is that of a financial services firm and not
   of a software development firm, notwithstanding that software is a key component of a Third Party Provider’s business model.
2. A Third Party Provider is expected to manage the size and volume of its Third
   Party Transactions within its remaining professional indemnity insurance cover. Such management could take place through imposing limits on the number or value of transactions.
3. A Third Party Provider should review the adequacy of its professional
   indemnity insurance cover from time to time to determine whether, based on its projected number or value of transactions, its should increase the value of its professional indemnity insurance cover. …

Appendix 1
A3.2 Capital Requirements
Guidance

1. This table summarises the Capital Requirement that an Authorised Person is subject to and an Authorised Person musthold sufficient Capital Resources at all
   times to meet the Capital Requirement.
   Capital Requirement(USD)
   Category
   <-----------------------------------------------------------------------------------------maximum of------------------------------------------------------------------------------------------------ -> Base Capital Requirement 2 Expenditure Based Capital Minimum 3 Risk Capital Requirement Holding Clie 5 nt Assets or Relevant Money 4 or Insurance Money? No Yes 1 10mn Credit, Market, Operational and CVA (plus, where appropriate, Displaced Commercial) 2 2mn Credit, Market, Operational and CVA 3A 500k See guidance note 8 for Money Remitters and Payment Service Providers 3B 6 4mn 13/52nds of Annual Expenditure 18/52nds of Annual Expenditure 3C 6 250k except where an Authorised Person has a Financial Services Permission only to carry out the Regulated Activity of Managing a Collective Investment Fund, in which case the Base Capital Requirement is the higher of:
   a) 150,000 if the Authorised Person manages a Public Fund or any other type of fund that is available to retail customers; or b) 50,000 otherwise. 6, 7 10k 6/52nds of Annual Expenditure except where an Authorised Person has a Financial Services Permission:
   a) to carry out the Regulated Activity of Operating a Private Financing Platform and holds Client Assets, in which case the Base Capital Requirement is 150,000; or

Appendix 1
b) to carry out the Regulated Activity of Providing Third Party Services, in which case the Base Capital Requirement will be 50,000 if the Third Party Transactions executed by the Authorised Person lead to a Payment Transaction or zero otherwise. 5 10mn Credit, Market, Operational, CVA and Displaced Commercial …

---

Appendix 2
i
Conduct of BusinessRulebook (COBS)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 2
…
2. CLIENT CLASSIFICATION
2.1 Application
2.1.1 This chapter applies to an Authorised Person carrying on or intending to carry on any
Regulated Activity with or for a Person.
2.1.2 For the purposes of this chapter, a Person includes any organisation (including outside of the
Abu Dhabi Global Market) whether or not it has a separate legal personality.
2.1.3 This chapter does not apply to:
(a) a Credit Rating Agency in so far as it carries on, or intends to carry on, the Regulated Activity of Operating a Credit Rating Agency; (b) an Authorised ISPV; or (c) an Authorised Person in so far as it carries on, or intends to carry on, the Regulated Activity of Providing Money Services.; or (d) an Authorised Person in so far as it carries on, or intends to carry on, the Regulated Activity of Providing Third Party Services. Guidance

1. The activity described in section 67 of Chapter 14 of Schedule 1 of FSMR refers to the
   marketing of Regulated Activities and Specified Investments which are offered in a jurisdiction outside the Abu Dhabi Global Market. Such marketing activities can be conducted by an Authorised Person that holds a Representative Office Financial Services Permission, provided the Regulated Activities or Specified Investments marketed by it are those offered by its head office, or a member of its Group.
2. As a Representative Office conducting marketing activities of the kind described in
   section 67 of Chapter 14 of Schedule 1 of FSMR does not have a client relationship
   with a Person to whom it markets a Specified Investment or engages with in relation to carrying on a Regulated Activity, the client classification requirements in this
   chapter do not apply to the Authorised Person with regard to its engagement with
   that Person.
3. Other Authorised Persons can also conduct marketing activities of the kind described
   in section 67 of Chapter 14 of Schedule 1 of FSMR under the exclusion in section 67(5) of Chapter 14 of Schedule 1 of FSMR.
4. An Authorised Person undertaking the Regulated Activity of Providing Money Services,
   as described in Chapter 8 of Schedule 1 of FSMR does not have a client relationship with a Person to whom it Provides Money Services, either as Payer or Payee, so the client classification requirements in this chapter do not apply to that Authorised Person. …

Appendix 2
20. THIRD PARTY PROVIDERS
20.1 Application
20.1.1 Chapter 20 of these Rules applies to Third Party Providers.
Guidance
Third Party Providers intermediate the relationship between their Customers and their Customers’ Financial Institutions. The relationship between Third Party Providers and their Customers is separate from and does not affect Customers’ existing relationships with their Financial Institutions.
20.2 Contractual Arrangements
Guidance
A Governing Contract sets out the terms governing the operation of Third Party Services and the rights and obligations of the Third Party Provider and their Customer. This section sets out Third Party Providers’ obligations to include and disclose information in the Governing Contract. Need for Governing Contract
20.2.1 Third Party Providers must establish a Governing Contract between themselves and their
Customers before providing Third Party Services.
General information
20.2.2 Unless otherwise agreed in writing between a Third Party Provider and their Customer, the
Governing Contract between the Third Party Provider and their Customers must contain the following information – (a) about the Third Party Provider:
(i) the name of the Third Party Provider;
(ii) the address and contact details of the Third Party Provider’s office in ADGM; (iii) the name of the Regulator of the Third Party Provider, and details of the Third PartyProvider’s Financial Service Permission; (b) about the Third Party Services:
(i) a description of the main characteristics of the Third Party Services to be provided; (ii) the information or unique identifier that must be provided by the Customer in order for a Third Party Transaction to occur; (iii) the form and procedure for giving consent to a Third Party Transaction; (iv) the time of receipt of a Third Party Transaction;

Appendix 2
(v) the maximum time taken for the Third Party Services to be provided; and (vi) any limits for the use of the Third Party Services; (c) about charges and exchange rates:
(i) details of all charges payable by the Customer to the Third Party Provider, including those connected to information which is provided or made available and, where applicable, a breakdown of the amounts of all charges; (ii) where relevant, details of the exchange rates to be applied or, if Reference Exchange Rates are to be used, the method of calculating the relevant date for determining such Reference Exchange Rates; (iii) where relevant and if agreed, the application of changes in Reference Exchange Rates and information requirements relating to any such changes; (d) about communication:
(i) the means of communication agreed between the parties for the transmission of information or notifications including, where relevant, any technical requirements for the Customer’s equipment and software for receipt of the information or notifications; (ii) the manner in which and frequency with which information under Chapter 20 is to be provided or made available; (iii) what information relating to the Customer will be transferred to the Customer’s Financial Institution as part of a Third Party Transaction; (iv) the Customer’s right to receive the revised terms of the Governing Contract and any other information in accordance with Rule 20.2.5; (e) about safeguards and corrective measures:
(i) how and within what period of time the Customer must notify the Third Party Provider of any unauthorised or incorrectly executed Third Party Transaction; (ii) the secure procedure by which the Third Party Provider will contact the Customer in the event of suspected or actual fraud or security threats; (iii) where relevant, the conditions under which the Third Party Provider proposes to reserve the right to stop or prevent a Third Party Transaction from being executed; (iv) the Customer’s liability under Rule 20.12.6 including details of any limits on such liability; (v) the Third Party Provider’s liability for unauthorised Third Party Transactions under Rule 20.12.5; (vi) the conditions for the payment of any refund to the Customer under this
Chapter

Appendix 2
(f) about changes to and termination of the contractual arrangement:
(i) where relevant, the proposed terms under which the Customer will be deemed to have accepted changes to the Governing Contract in accordance with Rule 20.2.6, unless they notify the Third Party Provider that they do not accept such changes before the proposed date of their entry into force; (ii) the duration of the Governing Contract; (iii) where relevant, the right of the Customer to terminate the Governing Contract and any agreements relating to termination in accordance with Rule 20.2.6. (g) about redress:
(i) any contractual clauses on the law applicable to the Governing Contract and the competent courts; and (ii) the availability of any alternative dispute resolution procedures, if applicable, for the Customer and the methods for having access to them.
20.2.3 A Third Party Provider must provide a Customer the information specified in Rule 20.2.2
before the Customer is bound by the Governing Contract.
Information provision during period of the Governing Contract
20.2.4 If the Customer so requests at any time during the term of the Governing Contract, the Third
PartyProvider must provide the information specified in Rule 20.2.2 as well as any otherterms of the Governing Contract. Changes in contractual information
20.2.5 Subject to Rule 20.2.7, any proposed changes to:
(a) the existing terms of the Governing Contract; or (b) the information specified in Rule 20.2.2, must be provided by the Third PartyProvider to the Customer no later than two months before the date on which they are to take effect.
20.2.6 If the Third Party Provider is allowed to make unilateral changes to the Governing Contract
and proposes to make such changes, the Third Party Provider must inform the Customer that:
(a) unless the Customer notifies the Third Party Provider to the contrary before the proposed date of entry into force of the changes, the Customer will be deemed to have accepted the changes comunicated to it under Rule 20.2.5; and (b) the Customer has the right to terminate the Governing Contract without charge at any time before the proposed date of entry into force of the changes.
20.2.7 Changes in exchange rates may be applied immediately and without notice where:

Appendix 2
(a) such a right is agreed under the Governing Contract and any such changes in exchange rates are based on the Reference Exchange Rate information which has been provided to the Customer in accordance with Rule 20.2.2; or (b) the changes are more favourable to the Customer.
20.2.8 Any change in the exchange rate used in Third Party Transactions must be implemented and
calculated in a neutral manner that does not discriminate collectively against Customers. Termination of a Governing Contract
20.2.9 The Customer may terminate the Governing Contract at any time unless the parties have
agreed on a period of notice not exceeding one month.
20.2.10 Any charges for the termination of the Governing Contract must not exceed the actual costs
to the Third Party Provider of termination.
20.2.11The Third Party Provider may not charge the Customer for the termination of a Governing Contract after the Governing Contract has been in force for six months.
20.2.12 The Third Party Provider may terminate a Governing Contract concluded for an indefinite
period by giving at least two months’ notice, if the Governing Contract so provides. Information prior to execution of individual Third Party Transaction 20.2.13Where a Third Party Transaction is initiated by the Customer, at the Customer’s request the Third Party Provider must provide the Customer with a breakdown of all charges payable by the Customer in respect of the Third Party Transaction. Information for the Customer on individual Third Party Transactions 20.2.14The Third Party Provider must provide to the Customer the following information in respect of each Third Party Transaction at least once per month free of charge:
(a) a reference enabling the Customer to identify the Third Party Transaction; (b) if the Third Party Transaction leads to a Payment Transaction, the amount of the Payment Transaction in the currency in which the Customer’s Payment Account is debited or in the currency used for the Payment Order; (c) the amount of any charges for the Third Party Transaction and, where applicable, a breakdown of the amounts of such charges, or the interest payable by the Customer; (d) where applicable, the exchange rate used in the Third Party Transaction by the Third Party Provider; (e) the date of receipt of the Third Party Transaction; and (f) the date of execution of the Third Party Transaction. Charges for information under a Framework Contract

Appendix 2
20.2.15A Third Party Provider may not charge for providing or making available information which is required to be provided or made available under the provisions of Section 20.2. 20.2.16The Third Party Provider and the Customer may agree on charges for any information which is provided at the request of the Customer where such information is:
(a) additional to the information required to be provided or made available by Section 20.2; (b) provided more frequently than is specified in Section 20.2; or (c) transmitted by means of communication other than those specified in the Governing Contract. 20.2.17Any charges imposed under Rule 20.2.16 must not exceed the Third Party Provider’s actual costs of providing such information. Common provisions: communication of information 20.2.18Any information provided or made available by a Third Party Provider in accordance with
Section 20.2 must be provided or made available in English, using easily understandable
language, and in a clear and comprehensible form.
20.3 Information requirementsrequired after the initiation of a Third Party Transaction
20.3.1 A Third Party Provider must provide or make available to the Customer, immediately after the
initiation of a Third Party Transaction:
(a) confirmation of the receipt and successful initiation of the Third Party Transaction; (b) a reference enabling the Customer to identify the Third Party Transaction, and, where appropriate, any information transferred with the Third Party Transaction; (c) if the Third Party Transaction leads to a Payment Transaction, the amount of the Payment Transaction, in the currency used in the Payment Order; (d) the amount of any charges payable in relation to the Third Party Transaction and, where applicable, a breakdown of the amounts of such charges expressed; (e) where an exchange rate is used in the Third Party Transaction, the actual rate used or a reference to it, and, where the Third Party Transaction leads to a Payment Transaction, the amount of the Payment Transaction after that currency conversion; and (f) the date and time on which the Third Party Provider received the Payment Transaction.
20.3.2 Where a Third Party Transaction is initiated by another Third Party Provider, the Third Party
Provider must obtain and disclose the reference for the Third Party Transaction from the other Third Party Provider.
20.4 Disapplication of requirements for non-Natural Persons

Appendix 2
20.4.1 Where the Customer is not a Natural Person, the Customer and the Third Party Provider may
agree in writing that the following Rules do not apply:
(a) Rules 20.2.15 and 20.2.16 (charges for information); (b) Rule 20.7.3 and 20.7.4 (withdrawal of consent); (c) Rule 20.8.2 (revocation of a Payment Order); (d) Rules 20.10.1 and 20.10.2 (requests for refund); (e) Rule 20.11.1 (evidence on authentication and execution); (f) Rule 20.12.5 (liability for charges); and the parties may agree that a different time period applies concerning unauthorised or incorrectly executed Payment Transactions for the purposes of Rule 20.10.1.
20.5 Record keeping
20.5.1 A Third Party Provider must maintain relevant records of all transactions and agreements with
Customers and keep them for at least six years from the date on which the record was created.
20.5.2 The records maintained by a Third Party Provider must include:
(a) what Specified Information has been requested by the Customer; (b) what Specified Information has been accessed, processed and transferred by the Third Party Provider; and (c) what information about the Customer the Third Party Provider has obtained as part of its customer onboarding process. Guidance

1. As entities registered in the ADGM, Third Party Providers are subject to the Data
   Protection Regulations 2015. The Data Protection Regulations 2015 set out obligations for Third Party Providers to follow with regard to Customers’ personal data, regardless of where the Customer is domiciled.
2. Where a Third Party Provider deals with Customers based outside the ADGM, the
   Regulator expects that the Third Party Provider will be in compliance with the relevant data protection regulations that apply to those Customers’ personal data.
   20.6 Outsourcing of Operational Functions
   20.6.1 Where a Third Party Provider relies on a third party for the performance of operational
   functions it must take all reasonable steps to ensure that the Rules that are applicable to those operational functions are complied with. Guidance

Appendix 2
GEN 3.3.31 and 3.3.32 and PRU 6.8 also govern outsourcing of functions and activities by an Authorised Person. A Third Party Provider is required to comply with those Rules.
20.7 Authorisation of Third Party Transactions
Consent and withdrawal of consent
20.7.1 A Third Party Transaction is to be regarded as having been authorised by the Customer for the
purposes of this Rule only if the Customer has given its consent to:
(a) the execution of the Third Party Transaction; or (b) the execution of a series of Third Party Transactions of which that Third Party Transaction forms a part.
20.7.2 Consent for the execution of the Third Party Provider:
(a) may be given before or, if agreed between the Customer and its Third Party Provider, after the execution of the Third Party Transaction; (b) must be given in the form, and in accordance with the procedure, agreed between the Customer and its Third Party Provider; and (c) may be given via another party as designated by the Customer in writing, including another Third Party Provider.
20.7.3 The Customer may withdraw its consent to an individual Third Party Transaction at any time
before the point at which the Third Party Transaction can no longer be revoked as set out in Rule 20.8.2.
20.7.4 Subject to Rule 20.8.2, the Customer may withdraw consent to a series of Third Party
Transactions at any time. All Third Party Transactions which have been previously consented to but not yet executed at the time that consent has been withdrawn will no longer be regarded as authorised.
20.8 Execution of Third Party Transactions
Refusal of Third Party Transactions
20.8.1 (1) Where a Third Party Provider refuses to execute a Third Party Transaction, it must
notify the Customer of the refusal at the earliest opportunity.
(2) The Third Party Provider must provide the notification in the agreed manner of the refusal as set out in Rule 20.2.2. (3) Where possible, the Third Party Provider shall include the reasons for such refusal in the notification as well as the procedure that the Customer must take for rectifying any issues or factual errors that led to the refusal. Revocation of a Third Party Transaction
20.8.2 (1) A Customer may not revoke a Third Party Transaction after the Third Party Provider
has confirmed receipt of the Third Party Transaction.

Appendix 2
(2) The Customer may not revoke a Third Party Transaction that it has initiated through another Third Party Provider. (3) A Third Party Transaction may only be revoked if the revocation is agreed between the Customer and the relevant Third Party Provider(s).
20.9 Authentication
Personalised Security Credentials
20.9.1 A Third Party Provider must maintain adequate security measures to protect the
confidentiality and integrity of Customers’ Personalised Security Credentials.
20.9.2 A Third Party Provider must ensure that appropriate means are available at all times to enable
a Customer to notify the Third Party Provider of the loss, theft, misappropriation or unauthorised use of the Customer’s Personalised Security Credentials Strong Customer Authentication
20.9.3 A Third Party Provider must employ Strong Customer Authentication where a Customer
accesses, processes or transfers Specified Information through the Third Party Provider
20.10 Notification of unauthorised or incorrectly executed Third Party Transactions
20.10.1Subject to Rule 20.10.2, a Customer is only entitled to redress if it notifies its Third Party Provider without undue delay, and in any event no later than twelve months after the date of execution, on becoming aware of any unauthorised or incorrectly executed Third Party Transaction. 20.10.2Where the Third Party Provider has failed to provide or make available information concerning the Third Party Transaction in accordance with Section 20.3, the Customer is entitled to redress even if the Customer has failed to notify the Third Party Provider within the time period set out in Rule 20.10.1. 20.10.3Where a Customer has notified the Third Party Provider that a Third Party Transaction involving the Primary Financial Institution is unauthorised or incorrectly executed, the Third Party Provider must inform the Primary Financial Institution of the Customer’s notification. 20.10.4Where an unauthorised or incorrectly executed Third Party Transaction leads to a Payment Transaction, the Payment Transaction will be deemed to be unauthorised or incorrectly executed.
20.11 Evidence on authentication and execution of Third Party Transactions
20.11.1Where a Customer:
(a) denies having authorised an executed Third Party Transaction; or (b) claims that a Third Party Transaction has not been correctly executed; it is for the Third Party Provider to prove that the Third Party Transaction was authenticated, accurately recorded, processed in line with the Third Party Provider’s procedures for executing Third Party Transactions and not affected by a technical breakdown or some other deficiency

Appendix 2
in the service provided by the Third Party Provider or any third party it relies upon for the performance of operational functions. 20.11.2If a Third Party Provider alleges that a Customer acted fraudulently or failed with intent or gross negligence to take all reasonable steps to keep safe Personalized Security Credentials, the Third PartyProvider must provide supporting evidence to the Customer and to the Primary Financial Institution. 20.11.3Upon request by the Primary Financial Institution, the Third Party Provider shall provide supporting evidence to demonstrate that the Third Party Transaction was authenticated, accurately recorded and executed in accordance with the Third Party Provider’s policies for providing Third Party Services.
20.12 Liability
Third Party Provider’s liability for unauthorised Third Party Transactions
20.12.1 Subject to Rules 20.10 and 20.11, where an executed Third Party Transaction was not
authorised in accordance with Rule 20.7 and the Third Party Transaction leads to an unauthorised Payment Transaction, the Third Party Provider must:
(a) refund the Primary Financial Institution for the amount that the Primary Financial Institution may have already refunded to the Customer; and (b) refund the Customer for the amount of the unauthorised Payment Transaction, less any amount that the Third Party Provider has refunded to the Primary Financial Institution. 20.12.2The Third Party Provider must provide a refund under Rule 20.12.1 as soon as practicable, and in any event no later than the end of the Business Day following the day on which it has confirmed that the Third Party Transaction was unauthorised or incorrectly executed. 20.12.3The requirement to provide a refund within the timeframe prescribed in Rule 20.12.2 does not apply where the Third Party Provider has reasonable grounds to suspect fraudulent behaviour by the Customer. 20.12.4The Third Party Provider is not liable for any losses incurred by the Customer in respect of an unauthorised Third Party Transaction where the Customer:
(a) has acted fraudulently; or
(b) has with intent or gross negligence failed to ensure that the Personalised Security Credentials are not accessible to persons other than the Customer. 20.12.5A Third Party Provider is liable to its Customer for any charges for which the Customer is responsible and any interest which the Customer must pay as a consequence of the non￾execution, defective or late execution of a Third Party Transaction by the Third Party Provider. Customer’sliability for unauthorised Third Party Transactions 20.12.6Except where the Customer has acted fraudulently or has with intent or gross negligence failed to ensure that its Personalised Security Credentials are not accessible to persons other than

Appendix 2
the Customer, the Customer is not liable for any losses incurred in respect of an unauthorised Third Party Transaction:
(a) arising after notification to the Third Party Provider in the agreed manner on becoming aware of the loss, theft, misappropriation or unauthorised use of the Customer’s Personalised Security Credentials; (b) where the Third Party Provider has failed at any time to provide, in accordance with Rule 20.9.2, appropriate means for notification; or (c) where the Third Party Provider has failed to apply Strong Customer Authentication.
20.13 Dispute resolution
20.13.1A Third Party Provider must put in place and utilise adequate and effective complaint resolution procedures for the settlement of complaints from Customers about the rights and obligations arising under this Chapter. 20.13.2All complaints must be recorded, investigated and resolved within an adequate timeframe and at the latest fifteen Business Days after the day on which the Third PartyProvider received the complaint. 20.13.3A Third Party Provider must make available to the Customer the details of the dispute resolution services able to deal with disputes concerning the rights and obligations arising under this Chapter in a clear, comprehensive and easily accessible form. 20.13.4The information to be made available under Rule 20.13.3must be made available:
(a) on the website of the Third Party Provider; (b) at the main office and any branches of the Third Party Provider; and (c) in the general terms and conditions of the Governing Contract.
20.14 Reporting and Risk mitigation
Management of operational and security risks
20.14.1(1) A Third Party Provider must establish a framework with appropriate mitigation measures and control mechanisms to manage the operational and security risks relating to the Third Party Services it provides. (2) As part of that framework, the Third Party Provider must establish and maintain effective incident management procedures, including for the detection and classification of major operational and security incidents. (3) A comprehensive assessment of operational and security risks must be undertaken by the Third Party Provider relating to the Third Party Services it provides, at least annually or more frequently if requested by the Regulator, and provided to the Regulator on request.

Appendix 2
(4) The assessment must address the adequacy of the mitigation measures and control mechanisms implemented in response to those risks in such form and manner, and contain such information, as the Regulator may direct. Guidance The Regulator may provide further guidance to Third Party Providers on their management of technology and data risks that sets out the Regulator’s expectations on how Third Party Providers should meet their obligations under this section and other applicable Rules. A Third Party Provider’s use of such guidance will be taken into account as part of the ongoing supervisory process of assessing Third Party Providers’ risk profile Incident reporting 20.14.2(1) A Third Party Provider must notify the Regulator without undue delay if it becomes aware of a major operational or security incident. (2) A notification under (1) must be in such form and manner, and contain such information, as the Regulator may direct. (3) The Third Party Provider must inform its Customers without undue delay of the incident and the measures that it will take to mitigate the incident if the incident has or may have an impact on the financial interests of its Customers. Guidance

1. Upon receipt of the notification referred to in 20.14.2(1), the Regulator may notify any
   other relevant authorities in the U.A.E.
2. If the Regulator receives notification of an incident from any relevant regulatorin the
   U.A.E. or internationally, it may direct the Third Party Provider to take appropriate measures to protect the immediate safety of their Customers and the financial system. Safety and Integrity of Interfacing Systems 20.14.3(1) A Third Party Provider must take such steps as directed by the Regulator to demonstrate the safety and integrity of their Interfacing Systems. (2) Prior to commencing operations, the Senior Executive Officer of a Third Party Provider must provide the Regulator with an attestation that the Third Party Provider has taken all reasonable steps to ensure the security and integrity of their Interfacing Systems. (3) On an annual basis or more frequently if requested by the Regulator, the Senior Executive Officer of a Third Party Provider must provide the Regulator with an attestation that the Third Party Provider hastaken all reasonable steps to ensure the security and integrity of their Interfacing Systems. (4) An attestation under (2) or (3) must be in such form and manner, and contain such information, as the Regulator may direct. (5) For each attestation provided to the Regulator, the Third Party Provider must provide a report by a qualified independent third party that assesses the adequacy of the personnel, procedural and technical controls put in place by the Third Party Provider

Appendix 2
or any other parties to whom the Third Party Provider may have outsourced operational functions. Guidance

1. The Regulator may require Third Party Providers to demonstrate the safety and
   integrity of their Interfacing Systems by, inter alia, connecting to systems operated by the Regulator or by conducting such tests on the Interfacing Systems as the Regulator may specify.
2. An attestation provided under Rule 20.14.3 is not a legally binding instrument. It
   places personal responsibility on the Senior Executive Officer of the Third Party Provider to ensure that all reasonable steps have been taken. Should operational or security incidents occur, the Regulator will consider whether the Senior Executive Officer had misled the Regulator in line with Article 221 of the Financial Services and Markets Regulations on Misleading the Regulator.
3. In considering whether a person meets the criteria of the qualified independent third
   party referred to in Rule 20.14.3(5), the Regulator will have regard to, inter alia, the experience and expertise of the person in conducting such assessments whether in the U.A.E. or internationally. Technical Standardsfor Interfacing Systems 20.14.4(1) A Third Party Provider shall ensure that their Interfacing Systems comply with technical standards that the Regulator may prescribe Guidance From time to time, the Regulator may issue technical standards for Interfacing Systems. Such standards may be created taking in inputs from Third Party Providers as well as other industry parties.

---

Appendix 3
Glossary (GLO)
*In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 3
1.2 Defined Terms
1.2.1 In the Rulebooks:
(1) a word or phrase which is defined in this module GLOis a defined term and has the meaning given in GLO; and (2) a word or phrase which relates to a defined term must be interpreted accordingly. Guidance

1. Defined terms are identified throughout the Rulebook by the capitalisation of the
   initial letter of a word or of each word in a phrase. Unless the context otherwise requires, where capitalisation of the initial letter or letters of a word of phrase is not used, the word or phrase has its natural meaning.
2. Many of the defined expressions terms in GLO are used or defined in the relevant
   ADGM Regulations or Rules made under such Regulations. In these cases, GLO may refer to the provision in the Regulations and Rules which are the source of the Rulebook such a definition.
3. Each module of the Rulebook has a reference code of three or four letters, usually a
   contraction or abbreviation of its title (for example, COBS stands for the Conduct of Business moduleRulebook). The meaning of each of these codes is given in GLO. … Defined Terms Definitions Customer In relation to:
   (a) MKT, means:
   (i) a Person where, in relation to a business relationship between the a Person and a Relevant Person, there is a firm intention or commitment by each party to enter into a contractual relationship or where there is a firm commitment by each party to enter into a Transaction, in connection with a product or service provided by the Relevant Person; (ii) a Client of an Authorised Person; (iii) a Member or prospective Member of, or an applicant for admission of Financial Instruments to trading on, a Recognised Investment Exchange or Recognised Clearing House; or (iv) a Person with whom a Relevant Person is otherwise establishing or has established a business relationship; and

Appendix 3
(b) GENotherwise, means a person who is using, or who is or may be contemplating using, any of the services provided by the an Authorised Person or Approved Person or Recognised Person. Governing Contract Means a contract between a Customer and a Third Party Provider for the provision of Third Party Services. Interfacing Systems Means the systems used by a Third Party Provider that connect to Customers and to Primary Financial Institutions. Personalised Security Credentials Means personalised features provided by:
(a) a Payment Service Provider to a Payment Service User for the purposes of authentication of the identity of the Payment Service User.; or (b) a Third Party Provider to a Customer for the purposes of authentication of the identity of the Customer. Primary Financial Institution Means the Financial Institution that holds Specified Information relating to the Customer of a Third Party Provider. Providing Third Party Services Has the meaning given in paragraph 73F of Schedule 1 of FSMR. Specified Information Has the meaning given in section 258 of FSMR. Strong Customer Authentication Means authentication based on the use of two or more elements that are independent, in that the breach of one element does not compromise the reliability of any other element, and designed in such a way as to protect the confidentiality of the authentication data, with the elements falling into two or more of the following categories:
(a) something known only by the Payment Service User or Customer (“knowledge”); (b) something held only by the Payment Service User or Customer (“possession”); (c) something inherent to the Payment Service User or Customer (“inherence”). Third Party Provider Has the meaning given in section 258 of FSMR. Third Party Transaction Has the meaning given in section 258 of FSMR.

---

Appendix 4
Anti-Money Laundering and SanctionsRules and Guidance (AML) *In this attachment underlining indicates new text and striking through indicates deleted text.

Appendix 4
TABLE OF CONTENTS
The contents of the AML Rulebook are divided into the following Chapters and sections:
…
8. CUSTOMER DUE DILIGENCE……………………………………………………………………………………….34
…
8.7 Failure to conduct or complete Customer Due Diligence …
8.8 Portability of Customer Due Diligence information …
…
8.8 Portability of Customer Due Diligence information
8.8.1 (1) A Relevant Person “A” that is an Authorised Person or a Recognised Body must provide
another Relevant Person, “B”, that is an Authorised Person or a Recognised Body, at the request of B, with the Customer Due Diligence information for customersthat has been collected by A under Rules 8.3 and 8.4,subject to:
(a) those customers being customers of both A and B at the time that the request is made; (b) B obtaining the written consent of the customersto whom the requestrelates and providing A with that consent for the release of such information by A; (c) the request being made solely for the purposes of conducting Customer Due Diligence on the customersto whom the request relates; and (d) in the preceding twelve months B not having requested Customer Due Diligence information from A for the same customers to whom the request relates. (2) A must also provide B with any other information relevant to CDD that has been provided to it by those customers.
8.8.2 Following a request made under Rule 8.8.1, A must transfer to B without undue delay all
Customer Due Diligence information in its possession for those customers.
8.8.3 A must not charge B a fee for the provision of Customer Due Diligence information provided
under Rule 8.8.1.
…