Prudential status of payment institutions and electronic money institutions

Boulevard de Beriaimont 14 - BE-1000 Brussels Phone +32 2 221 48 66 Company number: 0203, 201. 340 RPM (Trade Register) Brussels www. nbb. be mBanqueNationaleBank DEBELGIQUE VAN BELGIE Eurosystem Circular Brussels, 8 July 2020 Reference: NBB 2020 027 Contact person: Michiet Van Acoleyen Phone+32 2 221 3962 Michiel.VanAcoleyen@nbb. be Prudential status of payment institutions and electronic money institutions Scope Payment institutions as referred to in Article 2, 8° and electronic money institutions as referred to in Article 2, 73° of the Law of 11 March 2018 on the legal status and supervision of payment institutions and electronic money institutions, access to the activity of payment service provider and the activity of issuing electronic money, and access to payment systems (hereinatter referred to as "the Law"). Summary/Obiectives 77i/s Circular aims to further outline the prudential status of payment institutions and electronic money institutions (hereinafter referred to as "the institutions"). More specifically, it indicates which of the circulars of the National Bank of Belgium (hereinafter referred to as "the Bank") apply by analogy - with or without modifications - to these institutions. Structure

1. 'Fit and proper" standards;
2. Appropriate organisation;
3. Reporting by senior management;
4. Special mechanisms;
5. Prevention of money laundering and terrorist financing;
6. Duty of cooperation of accredited statutory auditors and accredited auditors
7. Inspections;
8. Professional indemnity insurance;
9. Authorisation of payment institutions
10. Incident reporting:
11. Operational and security measures;
12. Fraud reporting;
13. Periodic reporting requirements. NBB_2020_027 - 8 July 2020 Circular- Page 1/9

ri1 Dear Sir, Dear Madam, Before taking up their activities, institutions are required to obtain an authorisation or registration, For companies governed by Belgian law, the Bank is the competent authority to grant this authorisation. Upon authorisation/registration, these institutions are subject to the permanent supervision of the Bank. This Circular aims to further outline the prudential status of the institutions on the basis of the existing circulars of the Bank. More specifically, it indicates which of these circulars apply - with or without modifications - to the institutions. The relevant circulars and communications as well as future amendments can be consulted on the Bank's website or via the links included in this framework circular. It should be noted that the principles included in the circulars will always be applied on a proportional basis, taking into account the nature, size, complexity and risk profile of the institution concerned. The institutions should adopt the organisation best suited to their characteristics. The following overview outlines the scope of each circular applicable and, where necessary, highlights specificities for the institutions. This Circular replaces Circular NBB_201 5_10 on the prudential status of payment institutions and Circular NBB_2015_09 on the prudential status of electronic money institutions with immediate effect.

1. "Fit and proper" standards In accordance with Articles 20, § 1, second paragraph and 175, § 1, second paragraph of the Law, the members of the statutory governing body of the institutions, the persons tasked with the senior management of the institutions, where appropriate the members of the management committee, as well as the persons responsible for the independent control functions must at all times possess the professional integrity and appropriate expertise required for the exercise of their payment service duties. In this respect, Articles 37 and 181 of the Law impose certain reporting obligations to the Bank and require the Bank's prior approval in case of an appointment. Circular NBB 2018 25, which applies directly to the institutions, aims to explain how the Bank implements the "fit and proper" legal provisions and to provide further guidelines on how it conducts "fit and proper" assessments. This circular deals with aspects relating both to the content of the assessments and to the assessment process itself. It introduces a "fit and proper" handbook with the purpose of guiding the institutions in a user-friendly manner through the set of national and international policy documents relating to the professional suitability of the aforementioned persons.
2. Appropriate organisation In accordance with Articles 21 and 176 of the Law, the institutions should have an appropriate organisation. In particular, they should have an appropriate management structure, an appropriate administrative and accounting organisation and internal control, appropriate IT control and security measures, efficient procedures for the identification, measurement, management, monitoring and internal reporting of risks and particularly procedures for operational risk management and security and incident reporting procedures, an appropriate independent compliance function, an appropriate independent risk management function, an appropriate independent internal audit function, an appropriate integrity policy and the implementation of appropriate business continuity measures. Circular - Page 2/9 NBB_2020J)27 - 8 July 2020

m The aforementioned organisational structure should be appropriate for the nature, scale and complexity of the risks inherent to the business model and operations of the institution. Pursuant to Article 21, § 3 of the Law, the Bank may further specify how the above concepts should be interpreted. In this regard, it refers to the following circulars, which include principles relating to the sound and prudent management of financial institutions. Mutatis mutandis, references to old legislation should be replaced by references to new legislation. i) Circular NBB 2015 21 of 13 July 2015 on internal audit and internal control Part 1 of Circular NBB_2015_21 describes the scope and parts 2 and 3 contain the principles for sound banking practices in relation to internal control and internal audit. Part 4 elaborates on the relationship between the internal audit function and the supervisor. Of particular importance here is the responsibility in this area of the statutory governing body and the persons tasked with senior management, where appropriate the management committee. ii) Circular D1 97/10 of 30 December 1997 on prevention policy in the field of taxation The Bank considers that an appropriate organisation also implies that the institutions adopt a prevention policy aimed at managing their reputation in the field of taxation by operating soundly in every way from a tax point of view. The scope of such a prevention policy in the field of taxation should be much broader than the sole prevention of special mechanisms. In particular, its purpose should be to ensure that the institution operates soundly in every way from a tax point of view. The prevention of actions promoting customer tax evasion is only one aspect thereof. For the concrete implementation of the prevention policy, reference is made to Circular 01 97/10. The Bank expects the institutions to screen and more closely examine their activities, analyse risk-sensitive issues and, where appropriate, take action to address them. iii) Circular NBB 2012 14 of 4 December 2012 on the compliance function Pursuant to Article 21, §1, 5° of the Law, the institutions should have an appropriate independent compliance function to ensure that the institution, its directors, senior management, employees and agents comply with the legal rules in relation to the integrity of its activities. Circular NBB_2012_14, which applies directly to the institutions, lists a number of principles that will serve as benchmarks for assessing the organisation of the compliance function. iv) Circular PPB 2004/5 of 22 June 2004 regarding sound management practices in outsourcing by credit institutions and investment firms. Circular NBB 2018 20 of 19 June 2018 on outsourcing to cloud service providers and Circular NBB 2019 19of 19 July 2019 on the guidelines of the European Banking Authority (EBA) of 25 February 2019 on outsourcing NBB_2020_027 - 8 July 2020 Circular- Page 3/9

nt Circular NBB_2019_19 implements the EBA Guidelines on outsourcing and applies from 30 September 2019. This implies that from that date, all outsourcings entered into, renewed or amended by the institutions should comply with this Circular. For existing and current outsourcings, the institutions have until 31 December 2021 to comply with the Circular. Until that date, existing and current outsourcings remain subject to Circulars PPB_2004/5 and NBB_2018_20, Communication NBB 2012 11 and the Communication of the CBFA of 5 November 2007. From 31 December 2021, when this Circular becomes applicable to all outsourcing agreements, Circulars PPB_2004/5 and NBB 2018 20 and the aforementioned communications will no longer apply. Circular NBB_2019_19 clarifies the Bank's approach with regard to outsourcing. In accordance with Article 21 of the Law, each institution should have an appropriate structure for the organisation of the business to ensure effective and prudent management of the institution. Pursuant to Articles 38 and 195 of the Law, each institution that outsources functions, activities or operational tasks remains fully responsible. The aforementioned outsourcing may not lead to an impairment of the quality of the organisation and, in particular, of the quality of the internal control, to an undue increase in operational risk or to an impairment of the Bank's ability to monitor the institution's compliance with its obligations imposed pursuant to the Law. v) Circular PPB 2005/2 of 10 March 2005 on sound management Dractices_ajmed at ensuring the buslness_cpntinuity of financial institutions Pursuant to Articles 10, 17° and 176 of the Law, the institutions should provide a description of business continuity arrangements, clearly setting out essential business activities, as well as contingency plans and a procedure to periodically assess and review the adequacy of these plans. The Bank considers that an appropriate organisation implies that the institutions employ all reasonable means to ensure the continuity of their services and activities. They should set up their organisation, systems and procedures so that, in the case of a major, unscheduled business interruption, they can continue to fulfil their obligations arising from their supervisory status and protect their customers' interests and rights. To that end, they should develop a business continuity policy and plan (BCP). For further explanation of sound management practices aimed at ensuring business continuity, reference is made to Circular PPB 2005/2. The Bank expects the institutions to translate their specific characteristics into an appropriate and proportionate business continuity policy. vi) Circular PPB-2007-6-CPB-CPA of 30 March 2007 on the Bank's prudential expectations on financial institutions' sound governance The institutions should comply with the requirements set out in Articles 19 and 174 (qualities required of significant shareholders), 20 and 175 (direction and senior management) and 21 and 176 (appropriate organisation) of the Law. In this respect, they should make the necessary arrangements to ensure sound governance of the institution. Circular - Page 4/9 NBB_2020_027 - 8 July 2020

rft For this purpose, institutions can take inspiration from the existing thematic circular on sound governance, which is based on the aforementioned legal obligations. This circular is built around the following ten general principles: Principle I: Qualities required of significant shareholders: Principle II: Adequate governance structure: Principle III: Allocating powers and responsibilities; Principle IV: Plurality of managers, collegial decision-making, and distribution of tasks among senior managers; Principle V: Independent control functions; Princiole VI: Qualities required of the company officers: Principle VII: Remuneration policy for company officers; Principle VIII: Strategic aims, corporate values and conflicts of interest policy; Principle IX: Know your structure, know your activities; Princiole X: Publicity and disclosure; The Bank recognises that not all these principles can simply be applied to the institutions by analogy. In exercising its supervision, it will take into account the specific characteristics of the activities of the institutions concerned, with or without using the principle of proportionality. In any case, the Bank expects the concrete implementation by the institutions of the general principles of sound governance to be set out and explained in a separate document, the governance memorandum, an outline of which is annexed to the above-mentioned thematic circular. vii) Circular CBFA 2009 17of 7 April 2009 on financial services via the Internet: prudential requirements

• annex on sound practLces for managing Internet security risks When the institutions wish to offer their services through the internet, the Bank will assess the appropriateness of their organisation on the basis of a number of basic principles set out in Circular NBB_2009_17. The Bank's prudential expectations relate in particular to: policy and strategy for the provision of services via the internet (development, organisation and monitoring by senior management; assessment of the functioning and implementation by internal audit; mention of the activity in the senior management's annual reporting); legal and operational framework of this activity (prior agreement with customers, except for a purely informative website); security (a specific annex to the Circular sets out sound practices for managing internet security risks); operational aspects (availability, continuity and correct execution of transactions); involvement of external service providers or use of outsourcing (for the latter, reference is made to the previously mentioned Circular PPB 2004/5 regarding sound management practices in outsourcing); remote identification of customers (in accordance with anti-money-laundering legislation). NBB_2020_027 - 8 July 2020 Circular- Page 5/9

m Communication NBB 2012 11 of 9 October 2012 on prudential expectations regarding cloud computing This Communication aims to inform the institutions of the Bank's prudential expectations regarding cloud computing. The Bank considers cloud computing to be a form of outsourcing and hence expects it to comply with the principles of sound governance described in the circulars on outsourcing (see above). 3. Reporting by senior management In accordance with Articles 36 and 180 of the Law, the institutions' effective managers are required to annually report on the assessment of the internal control to the statutory governing body, the accredited statutory auditor and the Bank. The annual report of the senior management constitutes a sort of self￾assessment on the legally required appropriate internal organisation. For the concrete fulfilment of this reporting obligation, the Bank refers to Circular CBFA 2011 09, which applies directly to payment institutions. This Circular sets out the basic principles of the internal control method and specifies the arrangements for the senior management's reporting on the assessment of the internal control system. For instance, the reporting on the assessment of the internal control system should consist of the following three parts: description of the organisation, activities and risk management; assessment of the adequacy and functioning of the internal control system; enumeration of the measures taken. Additionally, in accordance with Articles 36 and 180 of the Law, the persons tasked with senior management should annually submit a separate report to the accredited statutory auditor and to the Bank on the measures taken pursuant to Articles 38 and 180 of the Law on the outsourcing of functions, activities or operational tasks and pursuant to Articles 42 and 194 of the Law for the protection of funds received from payment service users for the execution of payment transactions. 4. Special mechanisms Pursuant to Articles 117, § 5 and 215, § 5 of the Law, the Bank may take exceptional measures when it becomes aware of the fact that an institution or its agents has established a special mechanism with the aim or effect of promoting tax fraud by third parties. For further explanation of the concept of "special mechanism with the aim or effect of promoting tax fraud by third parties", the Bank refers to the document annexed to Circular D1 97/9 addressed to credit institutions. This document includes a non-exhaustive list of the standard practices in question. Circular - Page 6/9 NBB_2020_027 - 8 July 2020

rtt 5. Prevention of money laundering and terrorist financing The institutions are subject to the regulations on the prevention of money laundering and terrorist financing and on the restriction of the use of cash, including the Law of 18 September 2017 and the Royal Decree adopting the Regulation of the National Bank of Belgium of 21 November 2017 on the prevention of money laundering and terrorist financing. On the Bank's website, a new section has been added under the header "Combating money laundering and the financing of terrorism", which contains all relevant legal texts as well as clarifications on recommendations formulated and comments for a correct and effective implementation of the provisions of the anti-money-laundering legislation. For an overview of the main reference documents on national, European and international level, reference is made to the following link. Circular NBB_2010_09 collects and comments on the legal and regulatory provisions on the matter. It also includes recommendations from the Bank with a view to a correct and effective implementation of these provisions. Circular NBB_2018_01 contains a periodic questionnaire for financial institutions through which the Bank seeks to obtain standardised information about, on the one hand, the inherent risks of money laundering and terrorist financing which pose a threat to the institutions and, on the other, the quality of the risk management measures taken by the institutions. The purpose of this questionnaire is to enable the Bank to strengthen its risk-based approach in exercising its legal supervisory powers in the fight against money laundering and terrorist financing. 6. Duty of coooeration of accredited statutory auditors and accredited auditors The Law provides for a duty of cooperation for accredited statutory auditors of institutions governed by Belgian law and accredited auditors appointed to branches in Belgium of institutions governed by the law of another EEA Member State. Pursuant to Article 115, § 1 of the Law, they should in particular lend their assistance to the Bank's supervision at their own and sole responsibility and in accordance with the Law, following the rules of the trade and the guidelines of the Bank. The Bank has established a more detailed framework for this duty of cooperation in Circular NBB 201 7 20, which applies directly to the institutions. 7. Inspections In accordance with Articles 103 and 208 of the Law, the Bank may conduct on-site inspections of the institutions. Circular NBB 2013 15 aims to inform the institutions about the organisation of inspections as well as the inspection process in the context of the expectations for inspections, in particular the behaviour expected of the institutions, their directors and their employees. Finally, this document highlights the cooperation between authorities in the context of inspections (Chapter 5). NBB_2020_027 - 8 July 2020 Circular- Page 7/9

m 8. Professional indemnity insurance In accordance with Articles 18 (payment institutions providing payment initiation services) and 95, § 2 (payment institutions providing account aggregation services) of the Law, institutions providing the aforementioned payment services are required to hold professional indemnity insurance or a comparable guarantee. This insurance/guarantee may be used in case of liability of payment initiation service providers resulting from unauthorised payment transactions or non-execution, defective or late execution of payment transactions (in case of payment initiation services) and in case of liability of account information service providers resulting from non-authorised or fraudulent access to or non-authorised or fraudulent use of payment account information. The minimum monetary amount of this insurance/comparable guarantee is determined by criteria included in Circular NBB 2018 15. It should be noted that the holding of professional indemnity insurance or a comparable guarantee is a prerequisite for obtaining registration or authorisation. 9. Authorisation of payment institutions In accordance with Articles 9 and 167 of the Law, before providing payment services and/or issuing/distributing electronic money, institutions should apply for authorisation from the Bank or for registration, pursuant to Article 82 of the Law, if they only wish to provide account information services. This application should comply with the EBA Guidelines included in Circular NBB 2018 12, which stipulate the information required from applicants for authorisation for the provision of services 1 through 7 of Annex I to Directive 2015/2366 and from applicants for registration for the provision of only service 8 (account information services) of Annex I to Directive 2015/2366. 10. Incident reporting In accordance with Article 53 of the Law, payment service providers should maintain effective incident management procedures, including procedures for the detection and classification of major operational and security incidents. Circular NBB 2018 14 specifies the methodology to be used and the reporting requirements. It also contains a table setting out the thresholds for assessing an incident, including the corresponding decisive criteria: transactions affected, payment service users affected, service downtime, economic impact, level of internal escalation, other payment service providers or relevant infrastructures potentially affected and reputational risk. Payment service providers should carry out this assessment on a continuous basis during the lifetime of an incident. Furthermore, they should produce an incident report and submit it to the competent authority in the home Member State according to the rules described in the above-mentioned Circular and using the template available at the following link. 11. Operational and securityjneasures In accordance with Article 52 of the Law, the institutions should provide for appropriate risk-mitigating measures and control mechanisms to manage the operational and security risks in relation to the payment services provided by them. These risk-mitigating measures and control measures should be set up according to the guidelines included in Circular NBB 2020 23 implementing the EBA Guidelines on ICT and security risk management (EBA/GL/2019/04). Among other things, this Circular includes provisions on governance and strategy, ICT and security risk management, information security, ICT operations management, ICT project and change management, and business continuity management. Circular - Page 8/9 NBB_2020_027 - 8 July 2020

riR In accordance with Article 50, § 2 of the Law, the institutions are also required to provide the Bank at least annually with an updated and comprehensive assessment of the operational and security risks relating to the payment services provided by them and of the adequacy of the risk-mitigating measures and control mechanisms implemented in response to those risks. This reporting should comply with Circular NBB 2020 24, which clarifies the Bank's expectations in this regard. 12. Fraud reporting Pursuant to Article 53 of the Law, the institutions should report cases of fraud to the Bank in accordance with Circular NBB 2020 007 on the EBA Guidelines on fraud reporting. These Guidelines set out how statistical data on fraud relating to different means of payment should be submitted to the competent authorities. 13. Periodic reporting requirements In accordance with Articles 77 and 197, § 2 of the Law, the institutions should submit periodic reporting to the Bank on both their solvency and their financial situation (primarily the balance sheet, profit and loss account and information on the transactions conducted). Payment institutions governed by Belgian law should provide the Bank with a detailed financial statement and figures established according to the rules and guidelines described in Circular NBB 2018 31. This Circular includes the rules on periodic reporting which apply to the payment institutions sector. Electronic money institutions governed by Belgian law should provide the Bank with a detailed financial statement and figures established according to Circular NBB 2019 10. For the solvency reporting of payment institutions, reference is made to the Royal Decree of 27 April 2018 adopting the Regulation of the Bank on the own funds of payment institutions and to the Royal Decree of 25 April 2014 adopting the Regulation of the Bank on the own funds of credit institutions and stockbroking firms. For the solvency reporting of electronic money institutions, reference is made to the Royal Decree of 21 March 2019 on the own funds of electronic money institutions and on the investment of funds received in exchange for the electronic money issued and to the Royal Decree of 25 March 2014 adopting the Regulation of the Bank on the own funds of credit institutions and stockbroking firms. Circular NBB 2017 27 of 13 October 2017 on the Bank's expectations as regards quality of reported prudential and financial data specifies certain general expectations (principles) as regards the internal organisation of the institutions, so that they are able to provide the supervisor with the best level of information quality for the purposes of prudential supervision. The institutions should apply the principles set out in this Circular in a proportionate manner, based on their size, activities, risk profile and complexity, as well as on the complexity of the reportings themselves. A copy of this Circular will be sent to your institution's accredited statutory auditor(s). Yours faithfully, / Pierre Wuns Governor^ NBB_2020J)27 - 8 July 2020 Circular- Page 9/9