Regulation on the authorization, granting preliminary approvals and governance of payment institutions and electronic money institutions and for the registration of account information service providers

Pursuant to Article 35, paragraph 1 subparagraph 1.1 and Article 65, of the Law No. 03/L-209 on Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No.77 / 16 August 2010), amended and supplemented by Law No. 05/L–150 (Official Gazette of the Republic of Kosovo / No. 10 / 03 April 2017), Article 12, paragraph 4, and Article 136 of the Law No.10/L-026 on Payment Services (Official Gazette of the Republic of Kosovo,No.10 / 14 May 2026), the Board of the Central Bank of the Republic of Kosovo, at its meeting held on June 29, 2026, approved the following:
REGULATION ON THE AUTHORIZATION, GRANTING PRELIMINARY APPROVALS AND GOVERNANCE OF PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS AND FOR THE REGISTRATION OF ACCOUNT INFORMATION SERVICE PROVIDERS
CHAPTER I
GENERAL PROVISIONS
Article 1
Purpose

The purpose of this Regulation is to determine the conditions, requirements, procedures and time
limits to be adhered for:
1.1. authorization of payment institutions and electronic money institutions;
1.2. registration of account information services providers;
1.3. the information to be provided to the Central Bank of Republic of Kosovo when applying for
authorization as a payment institution or electronic money institution and for registration as an account information service provider pursuant to Article 12 paragraph 1, Article 25 paragraph 1, and Article 29 paragraph 1 of the Law No.10/L-026 on Payment Services ("Law on Payment Services" or “LPS”);
1.4. granting preliminary approvals for transactions requiring prior approval by the CBK for
conducting payment institutions, electronic money institutions and account information services providers activity;
1.5. obligations of payment institutions, electronic money institutions and account information
services providers to notify the CBK while conducting their activities.
1.6. organization, management and administration of payment institution, electronic money
institution and account information services provider

Article 2
Scope

This Regulation shall apply to applicants:
1.1. for authorization as a payment institution or electronic money institution or for registration as
an account information service provider with the Central Bank of the Republic of Kosovo;
1.2. payment institutions, electronic money institutions authorized by Central Bank of the
Republic of Kosovo; and
1.3. account information services providers applying to or registered by the Central Bank of the
Republic of Kosovo.
Article 3
Definitions
The terms and definitions used in this Regulation shall have the same meaning as the terms defined
in Article 4 of the Law on Payment Services.
In addition to paragraph 1 of this Article, for the purpose of implementing this Regulation, the
following terms and abbreviations shall have the following meanings:
2.1. Management body – means the body, directors or persons responsible for the management
of the PIs and EMIs and, where relevant, persons responsible for the management of the payment services activities of the PIs and EMIs;
2.2. Director – shall mean any person appointed by the shareholders or the founders to serve as a
member of a PI’s or EMI’s management body;
2.3. Persons responsible for the management – means a chief executive officer, chief financial
officer, chief operating officer, and chief risk officer and any person who:
2.3.1. reports directly to the management body or participates or has authority to participate
in major policymaking functions of the PI’s or EMI’s, and/or
2.3.2. is designated as a person responsible for the management by the CBK.
2.4. AIS – means account information services as defined in the Law on Payment Services;
2.5. AISP – means an account information service provider as defined in the Law on Payment
Services;
2.6. AML/CFT – means anti-money laundering and counter terrorist financing;
2.7. ASPSP – means an account servicing payment service provider as defined in the Law on
Payment Services;
2.8. CBK – means the Central Bank of Republic of Kosovo;
2.9. EMI – means an electronic money institution as defined in the Law on Payment Services;
2.10. FATF – means the Financial Action Task Force;
2.11. ICT – means information and communication technologies;
2.12. LPS – means the Law No. 08/L-328 on Payment Services;
2.13. Law on the prevention of money laundering and combating terrorist financing – means
Law Nо. 05/L-096 On the Prevention of Money Laundering and Combating Terrorist Financing and/or the Law in force for Prevention of Money Laundering and Combating Terrorist Financing.

2.14. Law on accounting, financial reporting and auditing – means Law No. 06/l-032 on
Accounting, Financial Reporting and Auditing and / or the Law in force for accounting, financial reporting and auditing;
2.15. PI – means a payment institution as defined in the Law on Payment Services;
2.16. PISP – means a payment initiation service provider as defined in the Law on Payment
Services;
2.17. PII – means the professional indemnity insurance as defined in the Law on Payment
Services;
2.18. PIS – means payment initiation services as defined in the Law on Payment Services;
2.19. PSP – means a payment service provider as defined in the Law on Payment Services.
2.20. Bearer shares – are shares of a legal person, whose ownership is transferred to the person
that owns or holds the certificate/document of the bearer shares without the need of an agreement/contract for transferring the ownership of these shares;
2.21. Nominee shareholder – is the registered shareholder of a legal person that holds shares on
the current shareholder’s behalf (beneficiary owner), according to an agreement;
2.22. Shell bank – a bank or institution engaged in equivalent activities, established in a country
where it has no physical presence, which makes possible to exercise an actual direction and management without being affiliated with any regulated financial group;
2.23. Subsidiary – any legal entity in which another person or group of persons acting in concert
holds directly or indirectly (i) the equivalent of fifty percent or more of any class of voting shares or (ii) a significant interest that permits such person or group of persons to exercise control over the legal entity in which such shares are held;
CHAPTER II
MINIMUM INITIAL CAPITAL FOR PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS
Article 4
Minimum initial capital

The minimum amount of capital required for authorization and maintained for payment institutions
and electronic money institutions shall be in accordance with the provisions of Article 9 and 30 of the LPS and Article 4 of Regulation on own funds for payment institutions and electronic money institutions.
Each payment of minimum paid-in capital, its later increase and any change in the capital structure
of the payment institution and of the electronic money institution should be made in cash and be accompanied with the presentation of information to CBK with regard to the source of this capital, respectively a banking document which proves the payment of capital (if applicable), as it is provided for in Article 20, Article 54 and Article 63, paragraph 1 subparagraph 1.3 of this Regulation.
CBK has the right to request further information and carry out further checks relating to the
creation source/sources of contributions/funds that shall serve as a minimum initial capital or as a future increase in its structure.
CBK is entitled to request clarification and conduct further verifications regarding the source(s)
which will serve as paid-in capital or as any other subsequent addition.
Where CBK concludes, or is reasonably suspicious of the capital structure or its source being
associated to persons with criminal convictions by a final court decision, who have family relations or close personal, working or business relationship in accordance with legal stipulations, with the proposed shareholders/partners, or is related to companies registered in tax havens or offshores, it notifies and requires from the Financial Intelligence Unit whether it has information regarding the proposed shareholders/partners, and shall suspend the procedure on granting the authorization up to a response from the latter.
The sources of capital funds must be legal and must not derive from public borrowed funds, loans
and/or other funds whose origin is unknown or unlawful.
CHAPTER III
INFORMATION REQUIRED FROM APPLICANTS FOR AUTHORIZATION AS PAYMENT INSTITUTIONS
Article 5
Scope
This Chapter applies to applicants for authorization as PIs. This includes applicants that intend to
provide the services referred to in subparagraphs 1.2.1 to 1.2.7 of Article 4 of the LPS or the service in subparagraph 1.2.8 in combination with other payment services.
Applicants that intend to provide only the service referred to in subparagraph 1.2.8 of Article 4 of
the LPS are subject to the specific set of requirements for AISPs set out in Chapter IV of this Regulation.
Article 6
General principles
Entities interested to be authorized as a payment institution (PI) should meet all requirements set
out in the LPS and this regulation. The applicant may request from the CBK necessary forms of applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.
Financial institutions including Microfinance Institution and Nonbank Financial Institution that
submit the application to be authorized as a payment institutions or electronic money institutions, apply all the requirements provided in LPS and this Regulation for payment institutions, with the exception of the requirements of Articles 7, 20 and 21.
The application to obtain an authorization as a payment institution shall be submitted in writing
and signed by the founding shareholder(s) or their legal representative and shall be submitted to the CBK. The application must be submitted together with the complete documentation / information as required by the LPS and this regulation.
The information provided by applicants should be true, complete, accurate and up to date, and
applicants shall comply with all the provisions in this Regulation that apply to them. The level of information detail should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and risk level of the payment services that are intended to be

provided. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the payments institution should have good reputation and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, its internal organization and the nature, scope or complexity of its activities and the duties and responsibilities of the relevant position.
5. When submitting the information required, the applicant should avoid making references to
specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections of those documents and provide these to the CBK.
6. Should the CBK requires clarifications on the information that has been submitted, the applicant
should provide such clarification without delay.
7. All data requested under this Chapter for authorization as PI are needed for the assessment of the
application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
8. In all cases when the applicant is a foreign financial institution which applies to establish a payment
institution in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the authorization as payment institution;
9. If it considers reasonable, CBK may request additional information other than information
requested under this Chapter.
10. The required documentation according to this Chapter should be in one of the two official
languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States.
Article 7
Identification data of the entity

The identification details to be provided by the applicant for authorization as a payment institution
should contain the following information:
1.1. the applicant’s corporate name and, if different, trade name;
1.2. the applicant’s business registration certificate as a legal person, issued by the Business
Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as the unique identification number;
1.3. the applicant’s legal status, founding act (if applicable) and articles of association;
1.4. the address of the applicant’s head office;
1.5. the applicant’s electronic address and website, if available;
1.6. the name(s) of the person(s) in charge of dealing with the application file and authorization
procedure, and their contact details;
1.7. any trade association in relation to the provision of payment services that the applicant plans
to join, where applicable;
1.8. evidence of payment of the authorization application fee.

Article 8
Program of operations

In accordance with article 12, paragraph 1, subparagraph 1.1 of the LPS, the entity that applies for
authorization as a payment institution submits to the CBK, the program of operations to be provided by the applicant should contain the following information:
1.1. a step-by-step description of the type of payment services envisaged, including an explanation
of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Article 4, subparagraph
1.2 of the LPS;
1.2. a declaration of whether the applicant will enter or not into possession of funds (obtained from
the users of the payment services provided);
1.3. a description of the execution of the different payment services, detailing all parties involved,
and including for each payment service provided, the following elements:
1.3.1. a diagram of flow of funds, unless the applicant intends to provide PIS only;
1.3.2. settlement arrangements, unless the applicant intends to provide PIS only;
1.3.3. draft contracts between all the parties involved in the provision of payment services
including payment schemes with cards, if applicable;
1.3.4. processing times.
1.4. a copy of the draft framework contract, as defined in Article 4 subparagraph 1.20 of the LPS;
1.5. the estimated number of branches from which the applicant intends to provide the payment
services, and/or carry out activities related to the provision of the payment services, if applicable;
1.6. a description of any ancillary services to the payment services, if applicable;
1.7. a declaration of whether or not the applicant intends to grant credit and, if so, within which
limits;
1.8. a declaration of whether or not the applicant plans to provide payment services abroad after
the granting of the authorization;
1.9. an indication of whether or not the applicant intends, for the next 3 (three) years, to provide
or already provides other business activities as referred to in Article 20 of the LPS, including a description of the type and expected volume of the activities;
1.10. the information specified in the CBK Regulation on the criteria on how to stipulate the
minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 8, paragraph 4 of the LPS where the applicant intends to provide PIS and AIS.
1.11. information on investments in information and communication technology systems,
accompanied by a list of equipment, software, etc.

Article 9
Business plan

In accordance with article 12, paragraph 1, subparagraph 1.2 of the LPS, the entity that applies for
authorization as a payment institution submits to CBK, the business plan which should contain the following information:
1.1. a marketing plan consisting of:
1.1.1. an analysis of the entity’s competitive position in the payment market segment
concerned;
1.1.2. a description of the payment service users, marketing materials and distribution
channels;
1.2. where available for existing entity, certified annual accounts for the previous 3 (three) years,
or a summary of the financial situation for those companies that have not yet produced annual accounts;
1.3. a forecast of the financial situation calculation for the first three financial years that
demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
1.3.1. an income statement, balance-sheet forecast and explanations of their main items,
including target scenarios and stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold;
1.3.2. explanations of the main lines of income and expenses, the financial debts and the
capital assets;
1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three)
years;
1.4. information on own funds, including the amount and detailed breakdown of the composition
of initial capital as set out in Article 9 of the LPS;
1.5. information on, and calculation of, minimum own funds requirements in accordance with the
method(s) referred to in Article 10 paragraph 1 of the LPS and Article 6 of the Regulation on own funds for payment institutions and electronic money institutions, unless the applicant intends to provide PIS only, including:
1.5.1. an annual projection of the breakdown of the regulatory capital (own funds) for three
3 (years) according to the method used;
1.5.2. an annual projection of the regulatory capital (own funds) for 3 (three) years according
to the other methods.
1.6. a forecast regarding the implementation of the regulatory and supervisory framework
(indicators of prudence, reports, etc.) for the next 3 (three) years;
1.7. if the entity has carried out another activity, before applying for authorization as a payment
institution, the audited annual financial statements for the previous 3 (three) years, and in the case of a company established less than 3 (three) years ago, the audited financial statements, since its establishment.

Article 10
Organizational structure

In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, the applicant that
applies for authorization as a payment institution to CBK, should provide a description of the organizational structure of its undertaking consisting of:
1.1. a detailed organizational chart, showing each division, department or similar structural
separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by descriptions of the functions and responsibilities of each division, department or similar structural separation;
1.2. an overall forecast of the staff numbers for the next 3 (three) years;
1.3. a description of relevant operational outsourcing arrangements consisting of:
1.7.1. the identity and geographical location of the outsourcing provider;
1.7.2. the identity of the persons within the PI that are responsible for each of the outsourced
activities;
1.7.3. a clear description of the outsourced activities and their main characteristics;
1.4. a copy of draft outsourcing agreements;
1.5. a description of the use of branches and agents, where applicable, including:
1.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform, at
least annually, for branches and agents and the frequency of these inspections;
1.5.2. the ICT systems, the processes and the infrastructure that are used by the applicant’s
agents to perform activities on behalf of the applicant;
1.5.3. in the case of agents, the selection policy, monitoring procedures and agents’ training
and, where available, the draft terms of engagement;
1.5.4. an indication of the national and/or international payment system that the applicant will
access, if applicable;
1.6. information whether the applicant is a participant on the national and/or international payment
system;
1.7. a list of all natural or legal persons that have close links with the applicant, indicating their
identities and the nature of those links.
Article 11
Evidence of initial capital
For the evidence of initial capital to be provided by the applicant in accordance with Article 9 of
the LPS and Article 4 of the Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents:
1.1. for existing undertakings, an audited account statement or public register certifying the
amount of capital of the applicant;
1.2. for undertakings in the process of being incorporated, a bank statement issued by a bank
certifying that the funds are deposited in the applicant’s bank account.

Article 12
Measures to safeguard the funds of payment service users

For the entities that require to offer payment services 1.2.1 to 1.2.6 as listed in Article 4, paragraph
1, subparagraph 1.2 of LPS, where the applicant safeguards the payment service users’ funds through depositing funds in a separate account in a bank or through an investment in secured, liquid, low risk assets, the description of the safeguarding measures should contain:
1.1. a description of the investment policy to ensure the assets chosen are liquid, secured and low
risk, if applicable;
1.2. the number of persons that have access to the safeguarding account and their functions;
1.3. a description of the administration and reconciliation process to ensure that payment service
users’ funds are insulated in the interest of payment service users against the claims of other creditors of the PI, in particular in the event of insolvency;
1.4. a copy of the draft contract with the bank;
1.5. an explicit declaration by the PI of compliance with Article 11 of the LPS.
For the entities that require to offer payment services 1.2.1 to 1.2.6 as listed in Article 4, paragraph
1, subparagraph 1.2 of LPS, which will safeguard the funds of the payment service user through an insurance policy or comparable guarantee from an insurance company or a bank, the description of the safeguarding measures should contain the following:
2.1. a confirmation that the insurance policy or comparable guarantee from an insurance company
or a bank is from an entity that is not part of the same group of firms as the applicant;
2.2. details of the reconciliation process in place to ensure that the insurance policy or comparable
guarantee is sufficient to meet the applicant’s safeguarding obligations at all times;
2.3. duration and renewal of the coverage;
2.4. a copy of the (draft) insurance agreement or the (draft) comparable guarantee.
Article 13
Governance arrangements and internal control mechanisms
In accordance with Article 12, paragraph 1, subparagraph 1.5 of the LPS, the applicant that applies
for authorization as a payment institution to CBK, should provide a description of the governance arrangements and the internal control mechanisms consisting of:
1.1. a mapping of the risks identified by the applicant, including the types of risks and the
procedures the applicant will put in place to assess and prevent such risks;
1.2. the different procedures to carry out periodical and permanent controls including the
frequency and the human resources allocated;
1.3. the accounting procedures by which the applicant will record and report its financial
information;
1.4. the identity of the person(s) responsible for the internal control functions, including for
periodic, permanent and compliance control, as well as an up-to-date curriculum vitae;
1.5. the identity of any auditor that is not a statutory auditor;
1.6. the composition of the management body and, if applicable, of any other oversight body or
committee;

1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an
impairment in the quality of the PI’s internal controls;
1.8. a description of the way any agents and branches are monitored and controlled within the
framework of the applicant’s internal controls;
1.9. where the applicant is the subsidiary of a regulated entity in an EU Member State or a foreign
regulated entity, a description of the group governance.
Article 14
Procedure for monitoring, handling and following up on security incidents and securityrelated customer complaints

In accordance with Article 12, paragraph 1, subparagraph 1.6 of the LPS, the applicant that applies
for authorization as a payment institution to CBK, should provide a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
1.1. organizational measures and tools for the prevention of fraud;
1.2. details of the individual(s) and bodies responsible for assisting customers in cases of fraud,
technical issues and/or claim management;
1.3. reporting lines in cases of fraud;
1.4. the contact point for customers, including a name and email address;
1.5. the procedures for the reporting of incidents, including the communication of these reports to
internal or external bodies, including notification of major incidents to the CBK under Article 96 of the LPS and in accordance with Article 5 of the CBK Regulation, to notify the Central Bank of the Republic of Kosovo of major operational or security incidents;
1.6. monitoring tools used and the follow-up measures and procedures in place to mitigate security
risks.
Article 15
Process for filing, monitoring, tracking and restricting access to sensitive payment data
In accordance with Article 12, paragraph 1, subparagraph 1.7 of the LPS, the applicant should
provide a description of the process in place to file, monitor, track and restrict access to sensitive payment data consisting of:
1.1. a description of the flows of data classified as sensitive payment data in the context of the PI’s
business model;
1.2. the procedures in place to authorize access to sensitive payment data;
1.3. a description of the monitoring instruments;
1.4. the access right policy, detailing access to all relevant infrastructure components and systems,
including databases and back-up infrastructures;
1.5. unless the applicant intends to provide PIS only, a description of how the collected data are
filed;
1.6. unless the applicant intends to provide PIS only, the expected internal and/or external use of
the collected data, including by counterparties;

1.7. the ICT system and technical security measures that have been implemented including
encryption and/or tokenization;
1.8. identification of the individuals, bodies and/or committees with access to the sensitive
payment data;
1.9. an explanation of how breaches of confidentiality and integrity of information will be detected
and addressed;
1.10. an annual internal control program in relation to the safety of the ICT systems.
Article 16
Business continuity arrangements

In accordance with Article 12, paragraph 1, subparagraph 1.8 of the LPS, the applicant should
provide a description of the business continuity arrangements consisting of the following information:
1.1. a business impact analysis, including the business processes and recovery objectives, such as
recovery time objectives, recovery point objectives and protected assets;
1.2. the identification of the back-up site in case of activation of the business continuity plan,
access to ICT infrastructure, and the key software and data to recover from a disaster or disruption;
1.3. an explanation of how the applicant will deal with significant continuity events and
disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons;
1.4. the frequency with which the applicant intends to test the business continuity and disaster
recovery plans, including how the results of the testing will be recorded;
1.5. a description of the mitigation measures to be adopted by the applicant, in cases of the
termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts.
Article 17
The principles and definitions applicable to the collection of statistical data on performance, transactions and fraud
In accordance with Article 12, paragraph 1, subparagraph 1.9 of the LPS, the applicant should
provide a description of the principles and definitions applicable to the collection of the statistical data on performance, transactions and fraud consisting of the following information:
1.1. the type of data that is collected, in relation to customers, type of payment service, channel,
instrument, jurisdictions and currencies;
1.2. the scope of the collection, in terms of the activities and entities concerned, including branches
and agents;
1.3. the means of collection;
1.4. the purpose of collection;
1.5. the frequency of collection;
1.6. supporting documents, such as a manual, that describe how the system works.

Article 18
Security policy document

In accordance with Article 12, paragraph 1, subparagraph 1.10 of the LPS, the applicant should
provide a security policy document containing the following information:
1.1. a detailed risk assessment of the payment service(s) the applicant intends to provide, which
should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified;
1.2. a description of the ICT systems, which should include:
1.2.1. the architecture of the systems and their network elements;
1.2.2. the business ICT systems supporting the business activities provided, such as the
applicant’s website, electronic wallets, payment system, risk and fraud management system, identification and accounting;
1.2.3. the support ICT systems used for the organization and administration of the applicant,
such as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers;
1.2.4. information on whether those systems are already used by the applicant or its group,
and the estimated date of implementation, if applicable;
1.3. the type of authorized connections from outside, such as with partners, service providers,
entities of the group and employees working remotely, including the rationale for such connections;
1.4. for each of the connections listed under subparagraph 1.3 of this Article, the logical security
measures and mechanisms in place, specifying the control the applicant will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs;
1.5. the logical security measures and mechanisms that govern the internal access to ICT systems,
which should include:
1.5.1. the technical and organizational nature and frequency of each measure, such as whether
it is preventative or detective and whether or not it is carried out in real time;
1.5.2. how the issue of client environment segregation is dealt in cases where the applicant’s
ICT resources are shared;
1.6. the physical security measures and mechanisms of the premises and the data center of the
applicant, such as access controls and environmental security;
1.7. the security of the payment processes, which should include:
1.7.1. the customer authentication procedure used for both consultative and transactional
access, and for all underlying payment instruments;
1.7.2. an explanation of how safe delivery to the legitimate payment service user and the
integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;

1.7.3. a description of the systems and procedures that the applicant has in place for
transaction analysis and the identification of suspicious or unusual transactions;
1.8. a detailed risk assessment in relation to its payment services, including fraud, which is linked
to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed;
1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for
procedures that have not yet been formalized, an estimated date for their finalization.
Article 19
Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing (AML/CFT) obligations

In accordance with Article 12, paragraph 1, subparagraph 1.11 of the LPS, the applicant should
provide a description of the internal control mechanisms established in order to comply, where applicable, with those obligations. This description should contain the following information:
1.1. the applicant’s assessment of the money laundering and terrorist financing risks associated
with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographical areas of operation;
1.2. the measures the applicant has or will put in place to mitigate the risks and comply with
applicable AML/CFT obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities;
1.3. the systems and controls the applicant has or will put in place to ensure that its branches and
agents comply with AML/CFT requirements, including in cases where the agent or branch is located abroad;
1.4. arrangements the applicant has or will put in place to ensure that staff and agents are
appropriately trained in AML/CFT matters;
1.5. the identity of the person in charge of ensuring the applicant’s compliance with AML/CFT
obligations, and evidence that their AML/CFT expertise is sufficient to enable them to fulfil this role effectively;
1.6. the systems and controls the applicant has or will put in place to ensure that its AML/CFT
policies and procedures remain up to date, effective and relevant;
1.7. the systems and controls the applicant has or will put in place to ensure that the agents do not
expose the applicant to increased money laundering and terrorist financing risk;
1.8. the AML/CFT manual for the staff of the applicant.
Article 20
Identity and assessment of suitability of shareholders/partners with qualifying holdings in the applicant
In accordance with Article 12, paragraph 1, subparagraph 1.13 of the LPS, the entity that applies
for authorization as a payment institution, for the purposes of identity and evidence of the

suitability of shareholders/partners with qualifying holdings in the applicant’s (PI’s) capital, should submit the following information:
1.1. a description of the group to which the applicant belongs and an indication of the parent
undertaking, where applicable;
1.2. a chart setting out the shareholder structure of the applicant, including:
1.2.1. the name and the percentage holding (capital/voting right) of each person that has or
will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications;
1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or
will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification;
1.3. a list of the names of all persons and other entities that have or, in the case of authorization,
will have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
1.3.1. the number and type of shares or other holdings subscribed or to be subscribed;
1.3.2. the nominal value of such shares or other holdings.
2. Where a person who has or, in the case of authorization, will have a direct or indirect qualifying
holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:
2.1. the person’s name and name at birth, date and place of birth, citizenship (current and
previous), identification number (where available) and/or passport number, address and a copy of the official identity document;
2.2. a detailed curriculum vitae stating the education and training, previous professional
experience, any dismissal from employment and any professional activities or other functions currently performed;
2.3. a notarial statement, accompanied by supporting documents according to their territorial
jurisdiction, containing the following information concerning the person:
2.3.1. the disclosure of spent convictions, any criminal conviction or proceedings where the
person has been found against and which were not set aside;
2.3.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
2.3.3. any insolvency case, including where the person was not responsible for the
bankruptcy, or similar procedures of any entity exercising economic activity;
2.3.4. any pending criminal investigations;
2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI;

2.3.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether or not any of the events set out in subparagraphs 2.3.1 to 2.3.5 of this article, has occurred in respect of the relevant person;
2.3.7. any case of refusal of registration, authorization, membership or license to carry out
trade, business or a profession;
2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
2.3.9. any case of expulsion by a public authority or institution in the financial services sector
or by a professional body or association;
2.3.10. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any;
2.3.11. any dismissal from employment or a position of trust, any removal from a fiduciary
relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
2.3.13. the borrower's certificate or report from the credit registry or an equivalent document
issued by the competent authorities of the foreign state;
2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to CBK.
2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of
after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures;
2.5. where an assessment of reputation of the person has already been conducted by a competent
authority in the financial services sector, the identity of that authority and the outcome of the assessment;
2.6. the current financial position of the person, including details concerning sources of revenues,
assets and liabilities, security interests and guarantees, whether granted or received;
2.7. a declaration whether the person is a politically exposed person and whether it has of any links
to politically exposed persons, as defined in Law on AML/CFT.
3. Where a person or entity who has or, in the case of authorization, will have a direct or indirect
qualifying holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity:
3.1. name;

3.2. where the legal person or entity is registered in a central register, commercial register,
companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate;
3.3. the addresses of its registered office and, where different, of its head office, and principal
place of business;
3.4. contact details;
3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a
summary explaining the main legal features of the legal form or the entity;
3.6. decision of the decision-making body of the company on participation in the capital of the
payment institution;
3.7. whether or not the legal person or entity has ever been or is regulated by CBK or by any other
government body;
3.8. where such documents can be obtained, an official certificate or any other equivalent
document evidencing the information set out in subparagraphs 3.1 to 3.6 of this Article, issued by the relevant competent authority;
3.9. the information referred to in subparagraphs 2.3, 2.4, 2.5, 2.6 and 2.7 of this Article in relation
to the legal person or entity;
3.10. a list containing details of each person who effectively directs the business of the legal person
or entity, including their name, date and place of birth, address, their national identification number, where available, and a detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs
2.3 and 2.7 above in respect of each such person;
3.11. the shareholding structure of the legal person, including at least their name, date and place
of birth, address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or partners and beneficial owners, as defined in the Law on AML/CFT;
3.12. a description of the regulated financial group of which the applicant is a part, or may become
a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis);
3.13. annual financial statements, at the individual and, where applicable, the consolidated and
sub-consolidated group levels, for the last three financial years, where the legal person or entity has been in operation for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm in accordance with the Law on accounting, financial reporting and auditing, where applicable, including each of the following items:
3.13.1. the balance sheet;
3.13.2. the profit-and-loss accounts or income statement;
3.13.3. the annual reports and financial annexes and any other documents registered with the
relevant registry or competent authority of the legal person;

3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal
persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction);
3.15. where the legal person has not been operating for a sufficient period to be required to prepare
financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall provide the existing financial statements (if any);
3.16. where the legal person or entity has its head office abroad, general information on the
regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations);
3.17. for entities that do not have legal persons such as a collective investment undertaking, a
sovereign wealth fund or a trust, the application shall contain the following information:
3.17.1. the identity of the persons who manage assets and of the persons who are beneficiaries
or subscribers;
3.17.2. a copy of the document establishing and governing the entity including the investment
policy and any restrictions on investment applicable to the entity.
4. The application shall set out all of the following information for each natural or legal person or
entity who has or, in the case of authorization, will have a direct or indirect qualifying holding in the capital of the applicant:
4.1. details of that person’s or entity’s financial or business reasons for owning that holding and
the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future;
4.2. details of the person’s or the entity’s intentions in respect of the applicant and of the influence
the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention;
4.3. information on the person’s or the entity’s willingness to support the applicant with additional
own funds if needed for the development of its activities or in the case of financial difficulties;
4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or
members in relation to the applicant;
4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a
result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities;
4.6. the identity of each member of the management body or of senior management who will direct
the business of the applicant and will have been appointed by or following an appointment from such shareholders or members, together with, to the extent not already provided, the information set out in Article 21.
5. The application should set out a detailed explanation of the specific sources of funding for the
participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:

5.1. notary statement of shareholders or partners for the source of paid-in capital and that the
source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal.
5.2. details on the use of private financial resources, including their availability and source, to
verify that the activity from which such funds were generated is legitimate and acceptable to the CBK;
5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the
source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation:
5.3.1. evidence of the source of capital, such as the independent external auditor's report,
annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares;
5.3.2. certificate issued by the competent authorities, which provides data on the balance of
the legal person or entity and on the payment of tax obligations.
5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the
source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation:
5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank
deposits or other certificates for the source of capital creation;
5.4.2. certificates proving payment of tax obligations;
6. The information requirements established in this article are applicable to the authorization process
of payment institutions and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in Article 13, paragraphs 1 and 2 of the LPS.
Article 21
Identity and suitability assessment of directors and persons responsible for the management of the PI

In accordance with Article 12, paragraph 1, subparagraph 1.14 of the LPS, the entity that applies
for authorization as a payment institution, for the purposes of the identity and suitability assessment of directors and persons responsible for the management of the PI, should provide the following information:
1.1. personal details, including:
1.1.1. their full name and name at birth, gender, place and date of birth, address and
citizenship (current and previous), and personal identification number and/or passport number or copy of ID card or equivalent;
1.1.2. proof of university education background and documents certifying other qualifications
of the person;
1.1.3. details of the position for which the assessment is sought, whether or not the
management body position is executive or non-executive. This should also include the following details:
1.1.3.1. the competent body decision for appointment, or contract, as applicable;

1.1.3.2. the planned start date and duration of the mandate;
1.1.3.3. a description of the individual’s key duties and responsibilities;
1.2. where applicable, information on the suitability assessment carried out by the applicant, which
should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents;
1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae
containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought;
1.4. a declaration whether the person is a politically exposed person and whether it has any links
to politically exposed persons, as defined in Law on AML/CFT.
1.5. evidence of reputation, honesty and integrity, which should include:
1.5.1. the disclosure of spent convictions, any criminal conviction or proceedings where the
person has been found against and which were not set aside;
1.5.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or
similar procedures of any entity exercising economic activity;
1.5.4. any pending criminal investigations;
1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI;
1.5.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 has occurred in respect of the relevant person;
1.5.7. any refusal of registration, authorization, membership or license to carry out trade,
business or a profession;
1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
1.5.9. any expulsion by a public authority or institution in the financial services sector or by
a professional body or association;
1.5.10. any position of responsibility in an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the

alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any;
1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary
relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
1.5.12. the current financial position of the person, including details concerning sources of
revenues, assets and liabilities, security interests and guarantees, whether granted or received;
1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to CBK.
1.5.15. information concerning the following:
1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory
authority that the individual has been directly or indirectly involved in;
1.5.15.2. refusal of registration, authorization, membership or license to carry out a
trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; or expulsion by a regulatory or government body or by a professional body or association;
1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or
similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer
or a person who directs the business of an institution has already been conducted by foreign authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment;
1.5.15.5. whether or not any previous assessment of the individual, on authority
from another, non-financial sector, has already been conducted, including the identity of that authority and evidence of the outcome of such an assessment.

Article 22
Identity of statutory auditors or audit firms
In accordance with Article 12, paragraph 1, subparagraph 1.15 of the LPS, the entity that applies for authorization as a payment institution, information on the statutory auditors or audit firms should contain the names, addresses and contact details of auditors.
Article 23
Professional indemnity insurance or a comparable guarantee for payment initiation services and account information services

As evidence of a professional indemnity insurance or comparable guarantee that is compliant with
CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee and Article 8, paragraphs 2 and 3 of the LPS, the applicant for the provision of PIS or AIS should provide the following information:
1.1. an insurance contract or other equivalent document confirming the existence of professional
indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, showing the coverage of the relevant liabilities;
1.2. documentation of how the applicant has calculated the minimum amount in a way that is
compliant with Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, including all applicable components of the formula specified therein.
CHAPTER IV
INFORMATION REQUIRED FROM APPLICANTS FOR REGISTRATION AS ACCOUNT INFORMATION SERVICE PROVIDERS
Article 24
Scope
This Chapter applies to applicants for registration as AISP. This refers to applicants that intend to provide only AIS as defined in subparagraph 1.2.8 of Article 4 of the LPS. Should the applicant intend to provide additional services to those of AIS they should apply for authorization and refer to the provisions set out in Chapter III for PIs of this regulation.
Article 25
General principles
Entities interested in registration as an account information service provider should meet all
requirements pursuant to the LPS which are necessary for the application process and this regulation. The applicant may request from the CBK necessary forms for applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.
The application to obtain a registration as a AISP shall be submitted in writing and signed by the
founders or their legal representative of the entity and shall be submitted to the CBK, with the physical presence of the founders or the legal representative of the entity. The application must be submitted together with the complete documentation/information required by the LPS and this regulation.
The information provided by applicants should be true, complete, accurate and up to date. All
applicants should comply with all the provisions in the set of provisions in this Regulation that applies to them. The level of details should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the AISP/PI are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organization and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
When submitting the information required, the applicant should avoid making references to
specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the CBK.
Should the CBK require clarifications on the information that has been submitted, the applicant
should provide such clarification without delay.
All data requested under this Chapter for registration as AISP are needed for the assessment of the
application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
In all cases when the applicant is a foreign financial institution which applies to establish a AISP
in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the registration as AISP;
If it considers reasonable, CBK may request additional information other than information
requested under this Chapter.
The required documentation according to this Chapter should be in one of the two official
languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States.
Article 26
Identification data of the entity
If the applicant is a natural person, the identification details to be provided by the applicant should
contain the following information:
1.1. name, address, nationality, date and place of birth;
1.2. a copy of the identity card /passport or an official equivalent identification document;
1.3. an updated curriculum vitae;
1.4. the following certificates issued by the competent authorities, according to their territorial
jurisdiction not older than 3 (three) months:

1.4.1. that the person is not under criminal investigation;
1.4.2. that the person is not standing trial for a criminal offence;
1.4.3. that the person has not been convicted for committing a criminal offence;
1.5. the name(s) of the person(s) in charge of dealing with the application file and registration
procedure, and their contact details.
2. If the applicant is a legal person, the identification details to be provided by the applicant should
contain the following information:
2.1. the applicant’s corporate name and, if different, trade name;
2.2. the applicant’s business registration certificate as a legal person, issued by the Business
Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as unique national identification number, if applicable;
2.3. the applicant’s legal status, founding act (if applicable) and articles of association;
2.4. the address of the applicant’s head office;
2.5. the applicant’s electronic address and website, if available;
2.6. the name of the person(s) in charge of dealing with the application file and registration
procedure, and their contact details;
2.7. evidence of payment of the authorization application fees.
Article 27
Program of operations

In accordance with Article 12, paragraph 1, subparagraph 1.1 of the LPS, the entity that applies
for registration as AISP, submit to CBK the program of operations which should contain the following information:
1.1. a description of the AIS that is intended to be provided, including an explanation of how the
applicant determined that the activity fits the definition of AIS as defined in Article 4 of the LPS;
1.2. a declaration of the applicant that they will not enter at any time into possession of
customers/users of payment services funds;
1.3. a description of the provision of the AIS including:
1.3.1. draft contracts between all the parties involved, if applicable;
1.3.2. terms and conditions of the provision of the AIS;
1.3.3. processing times;
1.4. the estimated number of branches from which the applicant intends to provide the services, if
applicable;
1.5. a description of any ancillary services to the AIS, if applicable;
1.6. a declaration of whether or not the applicant intends to provide account information services
in another country once registered;
1.7. an indication of whether the applicant intends, for the next 3 (three) years, to provide, or
already provides, business activities other than AIS as referred to in Article 20 of the LPS, including a description of the type and expected volume of the activities;

1.8. the information specified in CBK Regulation on the criteria on how to stipulate the minimum
monetary amount of the professional indemnity insurance or other comparable guarantee where the applicant intends to provide only AIS.
1.9. information on investments in information and communication technology systems,
accompanied by a list of equipment, software, etc.
Article 28
Business plan

In accordance with Article 12, paragraph 1, subparagraph 1.2 of the LPS, the entity that applies
for registration as AISP, submits to CBK the business plan which should contain the following information:
1.1. a marketing plan consisting of:
1.1.1. an analysis of the company’s competitive position;
1.1.2. a description of AIS users in the account information market segment concerned
marketing materials and distribution channels;
1.2. certified annual accounts for the previous 3 (three) years, if available, or a summary of the
financial situation for those applicants that have not yet produced annual accounts;
1.3. a forecast financial situation for the first 3 (three) financial years that demonstrates that the
applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include:
1.3.1. an income statement and balance-sheet forecast, including target scenarios and stress
scenarios as well as their base assumptions, such as number of clients, pricing and expected increase in profitability threshold;
1.3.2. explanations of the main lines of income and expenses, the financial debts and the
capital assets;
1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three)
years.
Article 29
Organizational structure
In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, if the applicant is a
natural person, the description of the organizational structure of the applicant’s undertaking should contain the following information:
1.1. an overall forecast of the staff number for the next 3 (three) years;
1.2. a description of the relevant operational outsourcing arrangements consisting of:
1.2.1. the identity and geographical location of the outsourcing provider;
1.2.2. the identities of the persons within the AISP that are responsible for each of the
outsourced activities;
1.2.3. a detailed description of the outsourced activities and their main characteristics;
1.3. a copy of draft outsourcing agreements;
1.4. if applicable, a description of the use of branches and agents, including:

1.4.1. a mapping of the off-site and on-site checks that the applicant intends to perform of
branches and agents;
1.4.2. the ICT systems, processes and infrastructure that are used by the applicant’s agents to
perform activities on behalf of the applicant;
1.4.3. in the case of agents, the selection policy, monitoring procedures and agents’ training
and, where available, the draft terms of engagement;
1.5. a list of all natural or legal persons that have close links with the applicant AISP, indicating
their identity and the nature of those links.
2. In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, if the applicant is a
legal person, the description of the organizational structure of its undertaking should contain the following information:
2.1. a detailed organizational chart, showing each division, department or similar structural
separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation;
2.2. an overall forecast of the staff number for the next 3 (three) years;
2.3. a description of the relevant outsourcing arrangements consisting of:
2.3.1. the identity and geographical location of the outsourcing provider;
2.3.2. the identities of the persons within the AISP that are responsible for each of the
outsourced activities;
2.3.3. a detailed description of the outsourced activities and its main characteristics;
2.4. a copy of draft outsourcing agreements;
2.5. if applicable, a description of the use of branches and agents, including:
2.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform of
branches and agents;
2.5.2. the ICT systems, processes and infrastructures that are used by the applicant’s agents
to perform activities on behalf of the applicant;
2.5.3. in the case of agents, the selection policy, monitoring procedures and agents’ training
and, where available, the draft terms of engagement;
2.6. a list of all natural or legal persons that have close links with the applicant, indicating their
identities and the nature of those links.
Article 30
Evidence of initial capital
2. For the evidence of initial capital to be provided by the applicant in accordance with Article 9 of
the LPS and Article 4 of Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents:
2.1. for existing undertakings, an audited account statement or public register certifying the
amount of capital of the applicant;
2.2. for undertakings in the process of being incorporated, a bank statement issued by a bank
certifying that the funds are deposited in the applicant’s bank account.

Article 31
Governance arrangements and internal control mechanisms

In accordance with Article 12, paragraph 1, subparagraph 1.5 of the LPS, the entity that applies
for registration as AISP, submits to CBK, a description of the governance arrangement and internal control mechanisms consisting of:
1.1. a mapping of the risks identified by the applicant, including the type of risks and the
procedures the applicant will put in place to assess and prevent such risks;
1.2. the different procedures intended to carry out periodical and permanent controls, including
the frequency, and the human resources allocated;
1.3. the accounting procedures by which the applicant will record and report its financial
information;
1.4. the identity of the person(s) responsible for the internal control functions, including for the
periodic, permanent and compliance controls, as well as an up-to-date curriculum vitae;
1.5. the identity of any auditor that is not a statutory auditor;
1.6. the composition of the management body and, if applicable, any other oversight body or
committee;
1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an
impairment in the quality of the applicant’s internal controls;
1.8. a description of the way any agents and branches are monitored and controlled within the
framework of the applicant’s internal controls;
1.9. where the applicant is the subsidiary of a regulated entity in a foreign country, a description
of the group governance.
Article 32
Procedure for monitoring, handling and following up on security incidents and securityrelated customer complaints
In accordance with Article 12, paragraph 1, subparagraph 1.6 of the LPS, the entity that applies
for registration as AISP, submits to CBK, a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
1.1. organizational measures and tools for the prevention of fraud;
1.2. details of the individuals and bodies responsible for assisting customers in cases of fraud,
technical issues and/or claim management;
1.3. reporting lines in cases of fraud;
1.4. contact point for customers, including a name and email address;
1.5. procedures for the reporting of incidents, including the communication of these reports to
internal or external bodies, including the notification of major incidents to the CBK under
Article 96 of the LPS and in accordance with CBK rules and Article 5 of the CBK Regulation,
to notify the Central Bank of the Republic of Kosovo of major operational or security incidents.
1.6. monitoring tools used and the follow-up measures and procedures in place to mitigate security
risks.

Article 33
Process in place to file, monitor, track and restrict access to sensitive payment data

In accordance with Article 12, paragraph 1, subparagraph 1.7 of the LPS, the entity that applies
for registration as AISP, submits to CBK, a description of the process in place to file, monitor, track, and restrict access to sensitive payment data consisting of:
1.1. a description of the flow of data classified as sensitive payment data in the context of the
AISP’s business model;
1.2. the procedures in place to authorize access to the sensitive payment data;
1.3. a description of the monitoring instruments;
1.4. the access right policy, detailing access to all relevant infrastructure components and systems,
including databases and back-up infrastructures;
1.5. a description of how the collected data are filed;
1.6. the expected internal and/or external use of the collected data, including by counterparties;
1.7. the ICT systems and technical security measures that have been implemented, including
encryption and/or tokenization;
1.8. identification of the individual(s), bodies and/or committee(s) with access to the sensitive
payment data;
1.9. an explanation of how breaches of confidentiality and integrity of information will be detected
and addressed;
1.10. an annual internal control program in relation to the safety of the ICT systems.
Article 34
Business continuity arrangements
In accordance with Article 12, paragraph 1, subparagraph 1.8 of the LPS, the entity that applies
for registration as AISP, submits to CBK, a description of the business continuity arrangements consisting of the following:
1.1. a business impact analysis, including the business processes and recovery objectives, such as
recovery time objectives, recovery point objectives and protected assets;
1.2. the identification of the back-up site in case of activation of the business continuity plan,
access to ICT infrastructure, and the key software and data to recover from a disaster or disruption;
1.3. an explanation of how the applicant will deal with significant continuity events and
disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons;
1.4. the frequency with which the applicant intends to test the business continuity and disaster
recovery plans, including how the results of the testing will be recorded.

Article 35
Security policy document

In accordance with Article 12, paragraph 1, subparagraph 1.10 of the LPS, the entity that applies
for registration as AISP, submits to CBK, a security policy document containing the following information:
1.1. a detailed risk assessment of the AIS the applicant intends to provide, which should include
risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified;
1.2. a description of the ICT systems, which should include:
1.2.1. the architecture of the systems and their network elements;
1.2.2. the business ICT systems supporting the business activities provided, such as the
applicant’s website, the risk and fraud management system, and customer’s identification and accounting;
1.2.3. the support ICT systems used for the organization and administration of the AISP, such
as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers;
1.2.4. information on whether or not those systems are already used by the AISP or its group,
and the estimated date of implementation, if applicable;
1.3. the type of authorized connections from outside, such as with partners, service providers,
entities of the group and employees working remotely, including the rationale for such connections;
1.4. for each of the connections listed under subparagraph 1.3, the logical security measures and
mechanisms in place, specifying the control the AISP will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs;
1.5. the logical security measures and mechanisms that govern the internal access to ICT systems,
which should include:
1.5.1. the technical and organizational nature and frequency of each measure, such as whether
it is preventative or detective and whether or not it is carried out in real time;
1.5.2. how the issue of client environment segregation is dealt with in cases where the
applicant’s ICT resources are shared;
1.6. the physical security measures and mechanisms of the premises and the data center of the
applicant, such as access controls and environmental security;
1.7. the security of the payment service processes, which should include:
1.7.1. the customer authentication procedure used for consultative access;
1.7.2. an explanation of how safe delivery to the legitimate payment service user and the
integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;

1.7.3. a description of the systems and procedures that the applicant has in place for
transaction analysis and the identification of suspicious or unusual transactions.
1.8. a detailed risk assessment in relation to its payment services, including fraud, with a link to
the control and mitigation measures explained in the application file, demonstrating that the risks are addressed;
1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for
procedures that have not yet been formalized, an estimated date for their finalization.
Article 36
Identity and assessment of suitability of shareholders/partners with qualifying holdings in the applicant

In accordance with Article 12, paragraph 1, subparagraph 1.13 of the LPS, the entity that applies
for registration as AISP, for the purposes of the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant’s (AISP’s) capital, should submit the following information:
1.1. a description of the group to which the applicant belongs and an indication of the parent
undertaking, where applicable;
1.2. a chart setting out the shareholder structure of the applicant, including:
1.2.1. the name and the percentage holding (capital/voting right) of each person that has or
will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications;
1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or
will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification;
1.3. a list of the names of all persons and other entities that have or, in the case of registration, will
have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
1.3.1. the number and type of shares or other holdings subscribed or to be subscribed;
1.3.2. the nominal value of such shares or other holdings.
Where a person who has or, in the case of registration, will have a direct or indirect qualifying
holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:
2.1. the person’s name and name at birth, date and place of birth, citizenship (current and
previous), identification number (where available) and/or passport number, address and a copy of an official identity document;
2.2. a detailed curriculum vitae stating the education and training, previous professional
experience, any dismissal from employment and any professional activities or other functions currently performed;
2.3. a notarial statement, accompanied by supporting documents according to their territorial
jurisdiction, containing the following information concerning the person:
2.3.1. the disclosure of spent convictions, any criminal conviction or proceedings where the
person has been found responsible and which were not set aside;

2.3.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found responsible and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
2.3.3. any insolvency case and that the person has not been responsible for the bankruptcy, or
similar procedures of any entity exercising economic activity;
2.3.4. any pending criminal investigations;
2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of an AISP or to the sound and prudent management of an AISP;
2.3.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether or not any of the events / circumstances set out in subparagraphs 2.3.1 to 2.3.5 has occurred in respect of the relevant person;
2.3.7. any refusal of registration, authorization, membership or license to carry out trade,
business or a profession;
2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
2.3.9. any expulsion by an authority or public sector institution in the financial services sector
or by a professional body or association;
2.3.10. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them;
2.3.11. any dismissal from employment or a position of trust (fiduciary), any removal from
a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
2.3.13. the borrower's certificate or report from the credit registry or an equivalent document
issued by the competent authorities of the foreign state;
2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to CBK.
2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of
after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures;

2.5. where an assessment of reputation of the person has already been conducted by a competent
authority in the financial services sector, the identity of that authority and the outcome of the assessment;
2.6. the current financial position of the person, including details concerning sources of revenues,
assets and liabilities, security interests and guarantees, whether granted or received;
2.7. a declaration whether the person is a politically exposed person and whether it has of any links
to politically exposed persons, as defined in Law on AML/CFT.
3. Where a person or entity who has or, in the case of registration, will have a direct or indirect
qualifying holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity:
3.1. name;
3.2. where the legal person or entity is registered in a central register, commercial register,
companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate;
3.3. the addresses of its registered office and, where different, of its head office, and principal
place of business;
3.4. contact details;
3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a
summary explaining the main legal features of the legal form or the entity;
3.6. decision of the decision-making body of the company on participation in the capital of the
AISP;
3.7. whether or not the legal person or entity has ever been or is regulated by CBK or by any other
government body;
3.8. where such documents can be obtained, an official certificate or any other equivalent
document evidencing the information set out above in subparagraphs 3.1 to 3.6 of this article, issued by the relevant competent authority;
3.9. the information referred to in subparagraphs 2.3, 2.4, 2.5, 2.6 and 2.7 of this article in relation
to the legal person or entity;
3.10. a list containing details of each person who effectively directs the business of the legal person
or entity, including their name, date and place of birth, address, their national identification number, where available, and a detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs
2.3 and 2.7 of this article in respect of each such person;
3.11. the shareholding structure of the legal person, including at least their name, date and place
of birth, address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or partners and beneficial owners, as defined in the Law on AML/CFT;
3.12. a description of the regulated financial group of which the applicant is a part, or may become
a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of competent authorities (on an individual or consolidated basis);

3.13. annual financial statements, at the individual and, where applicable, the consolidated and
sub-consolidated group levels, for the last 3 (three) financial years, where the legal person or entity has been in operation for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm in accordance with the Law on accounting, financial reporting and auditing, where applicable, including each of the following items:
3.13.1. the balance sheet;
3.13.2. the profit-and-loss accounts or income statement;
3.13.3. the annual reports and financial annexes and any other documents registered with the
relevant registry or competent authority of the legal person;
3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal
persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction);
3.15. where the legal person has not been operating for a sufficient period to be required to prepare
financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall set out the existing financial statements (if any);
3.16. where the legal person or entity has its head office abroad, general information on the
regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations);
3.17. for entities that are not legal persons such as a collective investment undertaking, a sovereign
wealth fund or a trust, the application shall set out the following information:
3.17.1. the identity of the persons who manage assets and of the persons who are beneficiaries
or subscribers;
3.17.2. a copy of the document establishing and governing the entity including the investment
policy and any restrictions on investment applicable to the entity.
4. The application shall set out all of the following information for each natural or legal person or
entity who has or, in the case of registration, will have a direct or indirect qualifying holding in the capital of the applicant:
4.1. details of that person’s or entity’s financial or business reasons for owning that holding and
the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future;
4.2. details of the person’s or the entity’s intentions in respect of the applicant and of the influence
the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention;
4.3. information on the person’s or the entity’s willingness to support the applicant with additional
own funds if needed for the development of its activities or in the case of financial difficulties;
4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or
members in relation to the applicant;

4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a
result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities;
4.6. the identity of each member of the management body or of senior management who will direct
the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Article 37 of this Regulation.
5. The application should set out a detailed explanation of the specific sources of funding for the
participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:
5.1. notary statement of shareholders or partners for the source of paid-in capital and that the
source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal.
5.2. details on the use of private financial resources, including their availability and source, to
verify that the activity from which such funds were generated is legitimate and acceptable to CBK;
5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the
source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation:
5.3.1. proof on the source of capital made, such as the independent external auditor's report,
annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares;
5.3.2. certificate issued by the competent authorities, which provides data on the balance of
the legal person or entity and on the payment of tax obligations.
5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the
source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation:
5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank
deposits or other certificates for the source of capital creation;
5.4.2. certificates proving payment of tax obligations;
6. The information requirements established in this article are applicable to the registration process
of AISP and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in Article 13, paragraphs 1 and 2 of the LPS.
Article 37
Identity and suitability assessment of directors and persons responsible for the management of the AISP

In accordance with Article 12, paragraph 1, subparagraph 1.14 of the LPS, the entity that applies
for authorization as a payment institution, for the purposes of the identity and suitability assessment of directors and persons responsible for the management of the AISP, should provide the following information:
1.1. personal details, which should include:

1.1.1. the full name and name at birth, gender, place and date of birth, address and citizenship
(current and previous), and personal identification number and/or passport number or copy of identification card or equivalent;
1.1.2. proof of university education background and documents certifying other qualifications
of the person;
1.1.3. details of the position for which the assessment is sought, and whether or not the
management body position is executive or non-executive, this should also include the following details:
1.1.3.1. the letter of competent body decision, contract or relevant drafts, as applicable;
1.1.3.2. the planned start date and duration of the mandate;
1.1.3.3. a description of the individual’s key duties and responsibilities;
1.2. where applicable, information on the suitability assessment carried out by the applicant, which
should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents;
1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae
containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought;
1.4. a declaration whether the person is a politically exposed person and whether it has of any links
to politically exposed persons, as defined in Law on AML/CFT.
1.5. evidence of reputation, honesty and integrity, which should include:
1.5.1. the disclosure of spent convictions, any criminal conviction or proceedings where the
person has been found against and which were not set aside;
1.5.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found responsible and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or
similar procedures of any entity exercising economic activity;
1.5.4. any pending criminal investigations;
1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI;
1.5.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 of this Article, has occurred in respect of the relevant person;
1.5.7. any refusal of registration, authorization, membership or license to carry out trade,
business or a profession;

1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
1.5.9. any expulsion by an authority or public institution in the financial services sector or by
a professional body or association;
1.5.10. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them;
1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary
relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
1.5.12. the current financial position of the person, including details concerning sources of
revenues, assets and liabilities, security interests and guarantees, whether granted or received;
1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to the CBK.
1.5.15. information concerning the following:
1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory
authority that the individual has been directly or indirectly involved in;
1.5.15.2. refusal of registration, authorization, membership or license to carry out a
trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; expulsion by a regulatory or government body, by a professional body or association;
1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or
similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer
or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment;
1.5.15.5. whether or not any previous assessment of the individual, on authority from
another, non-financial institution, has already been conducted, including the identity of that authority and the evidence of the outcome of this assessment.

Article 38
Professional indemnity insurance or a comparable guarantee

The entity that applies for registration as account information service provider, as provisioned in
Article 8, paragraph 2 and 3 of the LPS and in CBK Regulation on the criteria on how to stipulate
the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, as evidence of a professional indemnity insurance or comparable guarantee that is compliant with Regulation on professional indemnity insurance, should provide the following information:
1.1. an insurance contract or other equivalent document confirming the existence of professional
indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees showing the coverage of the relevant liabilities;
1.2. documentation of how the applicant has calculated the minimum amount in a way that is
compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, including all applicable components of the formula specified therein.
CHAPTER V
ELECTRONIC MONEY INSTITUTIONS
Article 39
Scope
This Chapter shall apply to applicants for authorization as EMIs and/or applicants who intend to
provide e-money services and, where applicable, one or more of the payment services referred to in Article 4 subparagraph 1.2. of the LPS.
Applicants intending to provide only the payment services referred to in subparagraphs 1.2.1 to
1.2.7 or the service referred to in subparagraph 1.2.8 in combination with other service(s) referred
to in subparagraphs 1.2.1 to 1.2.7 of Article 4 of the LPS, without providing e-money services, should refer to the specific rules on information required from applicants for authorization as PIs set out in Chapter III.
Applicants intending to provide only AIS without providing e-money services should refer to the
rules on the information required from applicants for authorization to provide only AIS set out in
Chapter IV of this Regulation.
Article 40
General principles
Entities interested to authorize as electronic money institution should meet all requirements
pursuant to the LPS which are necessary for the application process and this regulation. The applicant may request from the CBK necessary forms of applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.
Financial Institutions including Microfinance Institution and Non-bank Financial Institution that
submit the application to be authorized as electronic money institution, shall apply all the requirements provided in LPS and this regulation for payment institutions, with the exception of the requirements of Articles 41, 54 and 55 of this Regulation.
The application to obtain an authorization as an electronic money institution shall be submitted in
writing and signed by the founding shareholder(s) or their legal representative and shall be submitted to the CBK, with the physical presence of the founding shareholder(s) or proposed representative of the founding shareholder(s). The application must be submitted together with the complete documentation/information required by the LPS and this regulation.
The information provided by applicants should be true, complete, accurate and up to date. All
applicants should comply with all the provisions in the set of provisions in this Regulation that applies to them. The level of detail should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the EMI are of good repute and possess appropriate knowledge and experience to perform e-money services and payment services, regardless of the institution’s size, internal organization and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position.
When submitting the information required, the applicant should avoid making references to
specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the CBK.
Should the CBK requires clarifications on the information that has been submitted, the applicant
should provide such clarification without delay.
All data requested under this Chapter for registration as EMIs are needed for the assessment of the
application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
In all cases when the applicant is a foreign financial institution which applies to establish an
electronic money institution in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the authorization as electronic money institution.
If it considers reasonable, CBK may request additional information other than information
requested under this Chapter.
The required documentation according to this Chapter should be in one of the two official
languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States.
Article 41
Identification data of the entity
The identification details to be provided by the applicant should contain the following information:
1.1. the applicant’s corporate name and, if different, trade name;

1.2. the applicant’s business registration certificate as a legal person, issued by the Business
Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as unique identification number;
1.3. the applicant’s legal status, founding act (if applicable) and articles of association;
1.4. the address of the applicant’s head office;
1.5. the applicant’s electronic address and website, if available;
1.6. the name(s) of the person(s) in charge of dealing with the application file and authorization
procedure, and their contact details;
1.7. any trade association(s), in relation to the provision of e-money services and/or payment
services, that the applicant plans to join, where applicable;
1.8. evidence of payment of the authorization application fees;
Article 42
Program of operations

The entity that applies for authorization as an electronic money institution submits to CBK, the
program of operations which should contain the following information:
1.1. an indication of the e-money services the applicant intends to provide: issuance, redemption,
distribution;
1.2. if applicable, a step-by-step description of the type of payment services envisaged, including
an explanation of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Article 4, subparagraph 1.2 of the LPS, and an indication of whether these payment services would be provided in addition to electronic money services or whether they are linked to the issuance of electronic money;
1.3. a declaration of whether the applicant will at any point enter or not into possession of funds
(obtained from the users of the payment services provided);
1.4. a description of the execution of the different e-money services and, if applicable, payment
services, detailing all parties involved, for each e-money service and, if applicable, each payment service provided:
1.4.1. a diagram of flow of funds;
1.4.2. settlement arrangements;
1.4.3. draft contracts between all the parties involved in the provision of payment services
including those with payment card schemes, if applicable;
1.4.4. processing times;
1.5. a copy of the draft contract between the electronic money issuer and the electronic money
holder and the draft framework contract, as defined in Article 4 subparagraph 1.20 of the LPS if the applicant pretends to provide payment services in addition to e-money services;
1.6. the estimated number of branches from which the applicant intends to provide the services, if
applicable;
1.7. a description of any ancillary services to e-money services and, if applicable, to payment
services;

1.8. when the applicant intends to provide payment services in addition to e-money services, a
declaration of whether or not the applicant intends to grant credit and, if so, within which limits;
1.9. a declaration of whether or not the applicant plans to provide e-money services and, if
applicable, payment services abroad after the granting of the authorization;
1.10. an indication of whether or not the applicant intends, for the next 3 (three) years, to provide
or already provides business activities other than e-money services and, if applicable, payment services, as referred to in Article 14 paragraph 5 of the LPS, including a description of the type and expected volume of the activities;
1.11. the information specified in Regulation on the criteria on how to stipulate the minimum
monetary amount of the professional indemnity insurance or other comparable guarantee under Article 8 paragraph 4 of the LPS, where the applicant intends to provide PIS and AIS.
1.12. information on investments in information and communication technology systems,
accompanied by a list of equipment, software, etc.
Article 43
Business plan

The entity that applies for authorization as an electronic money institution submits to CBK, the
business plan which should contain the following information:
1.1. a marketing plan consisting of:
1.1.1. an analysis of the entity’s competitive position in the e-money market and, if
applicable, payment market segment concerned;
1.1.2. a description of the payment service users and electronic money holders, marketing
materials and distribution channels;
1.2. certified annual accounts for the previous 3 (three) years, if available, or a summary of the
financial situation for those companies that have not yet produced annual accounts;
1.3. a forecast financial situation calculation for the first 3 (three) financial years that demonstrates
that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly, which should include:
1.3.1. an income statement and balance-sheet forecast and explanations of their main items,
including target scenarios and stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold;
1.3.2. explanations of the main lines of income and expenses, the financial debts and the
capital assets;
1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three)
years;
1.4. information on, and calculation of, minimum own funds requirements in accordance with the
method provided in Article 31 paragraph 3 of the LPS, if the EMI intends to provide e-money services only, or the method(s) determined by the CBK, if the applicant intends to provide payment services in addition to e-money services, including an annual projection of the breakdown of own funds for 3 (three) years according to the method used and, If applicable, an annual projection of the own funds for 3 (three) years according to the other methods used.

1.5. a forecast regarding the implementation of the regulatory and supervisory framework
(indicators of prudence, reports, etc.) for the next 3 (three) years;
1.6. if the entity has carried out another activity, before applying for authorization as electronic
money institution, the audited annual financial statements for the previous 3 (three) years, and in the case of a newer company, the audited financial statements, since its establishment.
Article 44
Organizational structure

The entity that applies for authorization as electronic money institution submits to CBK a
description of the organizational structure of its undertaking consisting of:
1.1. a detailed organizational chart, showing each division, department or similar structural
separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation;
1.2. an overall forecast of the staff numbers for the next 3 (three) years;
1.3. a description of the relevant operational outsourcing arrangements consisting of:
1.3.1. the identity and geographical location of the outsourcing provider;
1.3.2. the identity of the persons within the EMI that are responsible for each of the
outsourced activities;
1.3.3. a clear description of the outsourced activities and their main characteristics;
1.4. a copy of draft outsourcing agreements;
1.5. a description of the use of branches, agents and distributors, where applicable, including:
1.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform of
branches, agents and distributors;
1.5.2. the ICT systems, processes and infrastructure that are used by the applicant’s agents
and distributors to perform activities on behalf of the applicant;
1.5.3. in the case of agents and distributors, the selection policy, monitoring procedures,
agents’ and distributor’s training and, where available, the draft terms of engagement of agents and distributors;
1.6. an indication of the national and/or international payment system that the applicant will
access, if applicable;
1.7. a list of all natural or legal persons that have close links with the applicant, indicating their
identities and the nature of those links.
Article 45
Evidence of initial capital
For the evidence of initial capital to be provided by the applicant (of EUR 350,000) in accordance
with Article 30 of LPS and Article 4 of Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents:
1.1. for existing undertakings, an audited account statement or public register certifying the
amount of capital of the applicant;

1.2. for undertakings in the process of being incorporated, a bank statement issued by a bank
certifying that the funds are deposited in the applicant’s bank account.
Article 46
Measures to safeguard the funds of electronic money users and/or payment service users

Where the applicant safeguards the electronic money users’ and/or payment service users’ funds
through depositing funds in a separate account in a bank or through an investment in secure, liquid, low-risk assets, the description of the safeguarding measures should contain:
1.1. a description of the investment policy to ensure the assets chosen are liquid, secure and low
risk, if applicable;
1.2. the number of persons that have access to the safeguarding account and their functions;
1.3. a description of the administration and reconciliation process for electronic money users and,
if applicable, payment service users, against the claims of other creditors of the EMI, in particular in the event of insolvency;
1.4. a copy of the draft contract with the banks;
1.5. an explicit declaration by the EMI of compliance with Article 33 of the LPS.
Where the applicant safeguards the funds of the electronic money users and, if applicable, the
payment service users through an insurance policy or comparable guarantee from an insurance company or bank, and unless the applicant intends to provide PIS only, the description of the safeguarding measures, setting out the following:
2.1. a confirmation that the insurance policy or comparable guarantee from an insurance company
or bank is from an entity that is not part of the same group of firms as the applicant;
2.2. details of the reconciliation process in place to ensure that the insurance policy or comparable
guarantee is sufficient to meet the applicant’s safeguarding obligations at all times;
2.3. duration and renewal of the coverage;
2.4. a copy of the (draft) insurance agreement or (draft) comparable guarantee.
Article 47
Governance arrangements and internal control mechanisms
The entity that applies for authorization as an electronic money institution, should provide a
description of the governance arrangement and internal control mechanisms consisting of:
1.1. a mapping of the risks identified by the applicant, including the type of risks and the
procedures the applicant will put in place to assess and prevent such risks, in relation to emoney services and, if applicable, payment services;
1.2. the different procedures to carry out periodical and permanent controls, including the
frequency and the human resources allocated;
1.3. the accounting procedures by the which the applicant will record and report its financial
information;
1.4. the identity of the person(s) responsible for the internal control functions, including for
periodic, permanent and compliance control, as well as an up-to-date curriculum vitae;
1.5. the identity of any auditor that is not a statutory auditor;

1.6. the composition of the management body and, if applicable, any other oversight body or
committee;
1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an
impairment in the quality of the EMI’s internal controls;
1.8. a description of the way any agents, branches and distributors are monitored and controlled
within the framework of the applicant’s internal controls;
1.9. where the applicant is the subsidiary of a regulated entity in a foreign country, a description
of the group governance.
Article 48
Procedure for monitoring, handling and following up on security incidents and securityrelated customer complaints

The entity that applies for authorization as an electronic money institution, should provide a
description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain:
1.1. organizational measures and tools for the prevention of fraud;
1.2. details of the individuals and bodies responsible for assisting customers in cases of fraud,
technical issues and/or claim management;
1.3. reporting lines in cases of fraud;
1.4. the contact point for customers, including a name and email address;
1.5. the procedures for the reporting of incidents, including the communication of these reports to
internal or external bodies, including for applicants that intend to provide payment services in addition to e-money services, and the notification of major incidents to the CBK under Article 96 of the LPS and in accordance with the CBK rules and Article 5 of CBK Regulation, to notify the Central Bank of the Republic of Kosovo of major operational or security incidents.
1.6. monitoring tools used, the follow-up measures and procedures in place to mitigate security
risks.
Article 49
Process for filing, monitoring, tracking and restricting access to sensitive payment data
The entity that applies for authorization as an electronic money institution, should provide a
description of the process in place to file, monitor, track and restrict access to sensitive payment data consisting of:
1.1. a description of the flows of data classified as sensitive payment data in the context of the
EMI’s business model;
1.2. the procedures in place to authorize access to the sensitive payment data;
1.3. a description of the monitoring tool;
1.4. the access right policy, detailing access to all relevant infrastructure components and systems,
including databases and back-up infrastructures;
1.5. a description of how the collected data are filed;
1.6. the expected internal and/or external use of the collected data, including by counterparties;

1.7. the ICT system and technical security measures that have been implemented, including
encryption and/or tokenization;
1.8. identification of the individuals, bodies and/or committees with access to the sensitive
payment data;
1.9. an explanation of how breaches of confidentiality and integrity of information will be detected
and addressed;
1.10. an annual internal control program in relation to the safety of the ICT systems.
Article 50
Business continuity arrangements

The entity that applies for authorization as an electronic money institution, should provide a
description of the business continuity arrangements consisting of the following information:
1.1. a business impact analysis, including the business processes and recovery objectives, such as
recovery time objectives, recovery point objectives and protected assets;
1.2. the identification of the back-up site in case of activation of the business continuity plan and
access to ICT infrastructure, and the key software and data to recover from a disaster or disruption;
1.3. an explanation of how the applicant will deal with significant continuity events and
disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons;
1.4. the frequency with which the applicant intends to test the business continuity and disaster
recovery plans, including how the results of the testing will be recorded;
1.5. a description of the mitigation measures to be adopted by the applicant, in cases of the
termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts.
Article 51
Principles and definitions applicable to the collection of statistical data on performance, transactions and fraud
The entity that applies for authorization as an electronic money institution should provide a
description of the principles and definitions applicable to the collection of the statistical data on performance, transactions and fraud consisting of the following information:
1.1. the type of data that is collected, in relation to customers, type of payment service, channel,
instrument, jurisdictions and currencies;
1.2. the scope of the collection, in terms of the activities and entities concerned, including
branches, agents and distributors;
1.3. the means of collection;
1.4. the purpose of collection;
1.5. the frequency of collection;
1.6. supporting documents, such as a manual, that describe how the system works.

Article 52
Security policy document

The entity that applies for authorization as an electronic money institution should provide a
security policy document in relation to its e-money service(s) and, where applicable, payment service(s) containing the following information:
1.1. a detailed risk assessment of the e-money service(s) and, where applicable, the payment
service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect e-money service users and, where applicable, payment service users against the risks identified;
1.2. a description of the ICT systems, which should include:
1.2.1. the architecture of the systems and their network elements;
1.2.2. the business ICT systems supporting the business activities provided, such as the
applicant’s website, wallets, the payment system, the risk and fraud management system, customer’ identification and accounting;
1.2.3. the support ICT systems used for the organization and administration of the EMI, such
as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers, internal file servers;
1.2.4. information on whether those systems are already used by the EMI or its group, and
the estimated date of implementation, if applicable;
1.3. the type of authorized connections from outside, such as with partners, service providers,
entities of the group and employees working remotely, including the rationale for such connections;
1.4. for each of the connections listed under subparagraph 1.3, the logical security measures and
mechanisms in place, specifying the control the EMI will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs;
1.5. the logical security measures and mechanisms that govern the internal access to ICT systems,
which should include:
1.5.1. the technical and organizational nature and frequency of each measure, such as whether
it is preventative or detective and whether or not it is carried out in real time;
1.5.2. how the issue of client environment segregation is dealt with in cases where the
applicant’s ICT resources are shared;
1.6. the physical security measures and mechanisms of the premises and the data center of the
applicant, such as access controls and environmental security;
1.7. the security of the e-money and, where applicable, payment processes, which should include:
1.7.1. the customer authentication procedure used for both consultative and transactional
access, and for all underlying payment instruments;
1.7.2. an explanation of how safe delivery to the legitimate e-money services user and, where
applicable, payment service user and the integrity of authentication factors, such as

hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;
1.7.3. a description of the systems and procedures that the EMI has in place for transaction
analysis and the identification of suspicious or unusual transactions;
1.8. a detailed risk assessment in relation to its e-money services and, where applicable, its
payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed;
1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for
procedures that have not yet been formalized, an estimated date for their finalization.
Article 53
Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing (AML/CFT obligations)

The description of the internal control mechanisms that the entity that applies for authorization as
an electronic money institution has established in order to comply, where applicable, with those obligations, should contain the following information:
1.1. the applicant’s assessment of the money laundering and terrorist financing risks associated
with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographic areas of operation;
1.2. the measures the applicant has or will put in place to mitigate the risks and comply with
applicable AML/CFT obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities;
1.3. the systems and controls the applicant has or will put in place to ensure that its branches,
agents and distributors comply with applicable AML/CFT requirements, including, in cases where the agent, distributor or branch is located abroad;
1.4. arrangements the applicant has or will put in place to ensure that staff, agents and distributors
are appropriately trained in AML/CFT matters;
1.5. the identity of the person in charge of ensuring the applicant’s compliance with AML/CFT
obligations, and evidence that their AML/CFT expertise is sufficient to enable them to fulfil this role effectively;
1.6. the systems and controls the applicant has or will put in place to ensure their AML/CFT
policies and procedures remain up to date, effective and relevant;
1.7. the systems and controls the applicant has or will put in place to ensure that the agents and
distributors do not expose the applicant to increased money laundering and terrorist financing risk;
1.8. the AML/CFT manual for the staff of the applicant.

Article 54
Identity and suitability assessment of shareholders/partners with qualified holdings in the applicant entity EMI

The entity that applies for authorization as an electronic money institution, for the purposes of
meeting the requirements on the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant EMI’s capital, should submit to CBK the following information:
1.1. a description of the group to which the applicant belongs and an indication of the parent
undertaking, where applicable;
1.2. a chart setting out the shareholder structure of the applicant, including:
1.2.1. the name and the percentage holding (capital/voting right) of each person that has or
will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications;
1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or
will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification;
1.3. a list of the names of all persons and other entities that have or, in the case of authorization,
will have qualifying holdings in the applicant’s capital, indicating for each such person or entity:
1.3.1. the number and type of shares or other holdings subscribed or to be subscribed;
1.3.2. the nominal value of such shares or other holdings.
Where a person who has or, in the case of authorization, will have a direct or indirect qualifying
holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person:
2.1. the person’s name and name at birth, date and place of birth, citizenship (current and
previous), identification number (where available) and/or passport number, address and a copy of an official identity document;
2.2. a detailed curriculum vitae stating the education and training, previous professional
experience, any dismissal from employment and any professional activities or other functions currently performed;
2.3. a notarial statement, accompanied by supporting documents according to their territorial
jurisdiction, containing the following information concerning the person:
2.3.1. the disclosure of past convictions, any criminal conviction or proceedings where the
person has been found responsible against and which were not set aside;
2.3.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found responsible against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
2.3.3. any insolvency case and that the person has not been responsible for the bankruptcy, or
similar procedures of any entity exercising economic activity;
2.3.4. any pending criminal investigations;

2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered to be relevant to the authorization to commence the activity of an EMI or to the sound and prudent management of an EMI;
2.3.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether any of the events/circumstances set out in subparagraphs
2.3.1 to 2.3.5 of this regulation, has occurred in respect of the relevant person;
2.3.7. any refusal of registration, authorization, membership or license to carry out trade,
business or a profession;
2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
2.3.9. any expulsion by an authority or public institution in the financial services sector or by
a professional body or association;
2.3.10. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any;
2.3.11. any dismissal from employment or a position of trust, any removal from a fiduciary
relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
2.3.13. the borrower's certificate or report from the credit registry or an equivalent document
issued by the competent authorities of the foreign state
2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to CBK.
2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of
after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures;
2.5. where an assessment of reputation of the person has already been conducted by a competent
authority in the financial services sector, the identity of that authority and the outcome of the assessment;
2.6. the current financial position of the person, including details concerning sources of revenues,
assets and liabilities, security interests and guarantees, whether granted or received;
2.7. a declaration whether the person is a politically exposed person and whether it has any links
to politically exposed persons, as defined in Law on AML/CFT.
3. Where a person or entity who has or, in the case of authorization, will have a qualifying holding
in the applicant’s capital (including entities that are not a legal person and which hold or should

hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity:
3.1. name;
3.2. where the legal person or entity is registered in a central register, commercial register,
companies register or similar register that has the same purposes of those aforementioned, an evidence of its status, where applicable, or a registration certificate;
3.3. the addresses of its registered office and, where different, of its head office, and principal
place of business;
3.4. contact details;
3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a
summary explaining the main legal features of the legal form or the entity;
3.6. decision of the decision-making body of the company on participation in the capital of the
electronic money institution;
3.7. whether or not the legal person or entity has ever been or is regulated by a CBK or by any
other government body;
3.8. where such documents can be obtained, an official certificate or any other equivalent
document evidencing the information set out in subparagraphs 3.1 to 3.6 of this regulation, issued by the relevant competent authority;
3.9. the information referred to in in subparagraphs 2.3 to 2.7 of paragraph 2 of this Article in
relation to the legal person or entity;
3.10. a list containing details of each person who effectively directs the business of the legal person
or entity, including their name, date and place of birth, address, their national identification number, where available, and detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs
2.3 and 2.7 of paragraph 2 of this Article in respect of each such person;
3.11. the shareholding structure of the legal person, including at least their name, date and place
of birth, address and, where available, personal identification number or registration number and the respective share of capital and voting rights of direct or indirect shareholders or members and beneficial owners, as defined in Law on AML/CFT;
3.12. a description of the regulated financial group of which the applicant is a part, or may become
a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis);
3.13. annual financial statements, at the individual and, where applicable, the consolidated and
sub-consolidated group levels, for the last 3 (three) financial years, where the legal person or entity has been operating for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been operating and financial statements were prepared), audited by the statutory auditor or audit firm, where applicable, including each of the following subparagraphs:
3.13.1. the balance sheet;
3.13.2. the profit-and-loss accounts or income statement;
3.13.3. the annual reports and financial annexes and any other documents registered with the
relevant registry or competent authority of the legal person;

3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal
persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction);
3.15. where the legal person has not been operating for a sufficient period to be required to prepare
financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall prepare the existing financial statements (if any);
3.16. where the legal person or entity has its head office in abroad, general information on the
regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations);
3.17. for entities that are not legal persons such as a collective investment undertaking, a sovereign
wealth fund or a trust, the application shall set out the following information:
3.17.1. the identity of the persons who manage assets and of the persons who are
beneficiaries or subscribers, unit holders controlling the collective investment undertaking or having a holding enabling them to prevent the taking of decisions by the collective investment undertaking;
3.17.2. a copy of the document establishing and governing the entity including the
investment policy and any restrictions on investment applicable to the entity.
4. The application shall set out all of the following information for each natural or legal person or
entity who has or, in the case of authorization, will have a direct or indirect qualifying holding in the capital of the applicant:
4.1. details of that person’s or entity’s financial or business reasons for owning that holding and
the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future;
4.2. details of the person’s or entity’s intentions in respect of the applicant and of the influence the
person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder and the rationale for such intention;
4.3. information on the person’s or the entity’s willingness to support the applicant with additional
own funds if needed for the development of its activities or in the case of financial difficulties;
4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or
members in relation to the applicant;
4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a
result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the CBK;
4.6. the identity of each member of the management body or of senior management who will direct
the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Article 55 of this regulation.
5. The application should set out a detailed explanation of the specific sources of funding for the
participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:

5.1. notary statement of shareholders or partners for the source of paid-in capital and that the
source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal.
5.2. details on the use of private financial resources, including their availability and source to
verify that the activity from which such funds were generated is legitimate and acceptable to the CBK;;
5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the
source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation:
5.3.1. proof on the source of capital made, such as the independent external auditor's report,
annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares;
5.3.2. certificate issued by the competent authorities, which provides data on the balance of
the legal person or entity and on the payment of tax obligations.
5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the
source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation:
5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank
deposits or other certificates for the source of capital creation;
5.4.2. certificates proving payment of tax obligations;
6. The information requirements established in this article are applicable to the authorization process
of payment institutions and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in article 13, paragraphs 1 and 2 of the LPS.
Article 55
Identity and suitability assessment of directors and persons responsible for the management of the EMI

The entity that applies for authorization as an electronic money institution, for the purposes of the
identity and suitability assessment of directors and persons responsible for the management of the EMI, should submit to CBK the following information:
1.1. personal details including:
1.1.1. their full name and name at birth, gender, place and date of birth, address and
citizenship (current and previous), and personal identification number and/or passport number or copy of identification card or equivalent;
1.1.2. proof of university education background and documents certifying other qualifications
of the person;
1.1.3. details of the position for which the assessment is sought, whether or not the
management body position is executive or non-executive. This should also include the following details:
1.1.3.1. the competent body decision of appointment or contract, as applicable;
1.1.3.2. the planned start date and duration of the mandate;

1.1.3.3. a description of the individual’s key duties and responsibilities.
1.2. where applicable, information on the suitability assessment carried out by the applicant which
should include details of the result of any assessment of the suitability of the individual performed by the respective institution, such as relevant board minutes or suitability assessment reports or other documents;
1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae
containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, the nature, and duration of the functions performed, in particular highlighting any activities within the scope of the position sought;
1.4. a declaration whether the person is a politically exposed person and whether it has of any links
to politically exposed persons, as defined in Law on AML/CFT.
1.5. evidence of reputation, honesty and integrity, which should include:
1.5.1. the disclosure of past convictions, any criminal conviction or proceedings where the
person has been found against and which were not set aside;
1.5.2. any civil or administrative decisions in matters of relevance to the assessment or
authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed;
1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or
similar procedures of any entity exercising economic activity;
1.5.4. any pending criminal investigations;
1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other
enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI;
1.5.6. where such documents can be obtained, an official certificate or any other equivalent
document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 of this regulation, has occurred in respect of the relevant person;
1.5.7. any refusal of registration, authorization, membership or license to carry out trade,
business or a profession;
1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership
or license to carry out trade, business or a profession;
1.5.9. any expulsion by an authority or public sector entity in the financial services sector or
by a professional body or association;
1.5.10. any position of responsibility with an entity subject to any criminal conviction or
proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any;

1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary
relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation;
1.5.12. the current financial position of the person, including details concerning sources of
revenues, assets and liabilities, security interests and guarantees, whether granted or received;
1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities,
as certified by the Bailiff’s Office;
1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from
the date of the application submission to CBK.
1.5.15. information concerning the following:
1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory
authority that the individual has been directly or indirectly involved in;
1.5.15.2. refusal of registration, authorization, membership or license to carry out a
trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; or expulsion by a regulatory or government body or by a professional body or association;
1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or
similar situation, or having been asked to resign from employment in such a position, excluding redundancies;
1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer
or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual where required to seek such information to be able to process and use the provided information for the suitability assessment;
1.5.15.5. whether or not any previous assessment of the individual has been carried
out by any authority from another non-financial sector, including the identity of that authority and evidence of the outcome of such assessment.
Article 56
Identity of statutory auditors and audit firms The identity of statutory auditors or audit firms to be provided by the applicant, where relevant, should contain the names, addresses and contact details of auditors.
Article 57
Professional indemnity insurance or a comparable guarantee for PIS and AIS

As evidence of a professional indemnity insurance or comparable guarantee that is compliant with
CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee and Article 8 paragraphs 2 and 3 of the LPS, the applicant for authorization as EMIs that, in addition to e-money services, intends to provide PIS or AIS, should provide the following information:

1.1. an insurance contract or other equivalent document confirming the existence of the
professional indemnity insurance or comparable guarantee, with a cover amount that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee, showing the coverage of the respective liabilities;
1.2. documentation of how the applicant has calculated the minimum amount in a way that is
compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee, including all applicable components of the formula specified therein.
CHAPTER VI
AUTHORIZATINON AND REGISTRATION
Article 58
Authorization/registration procedures and conditions

CBK, for the authorization of payment institutions (PI) and electronic money institutions (EMI)
and for registration of account information services providers (AISP), shall review the documents submitted in accordance with the requirements set out in LPS and in this regulation.
1.1. CBK shall, within 90 (ninety) days from the day of receiving the application, review the
documentation submitted and inform the applicant in writing stating whether the application is completed or not;
1.2. if the documentation submitted is not completed and/or does not fulfil the requirements
determined under LPS and this regulation, CBK shall notify the applicant regarding the deficiencies or discrepancies with the legal provisions of LPS and this Regulation together with a request for additional information or documents required. The deadline for submission of additional information or documents is, according to this paragraph, not later than 90 (ninety) days from the day of notification;
1.3. if the additional information or documents required under paragraph 1.2 of this Article are
submitted within the deadline, then CBK shall inform the party that the application is complete;
1.4. The CBK shall suspend review procedures for the authorization/ registration application if the
data and/or documentation requested for authorization/ registration are not provided by the applicant within 90 (ninety) days after the notification under paragraph 1.2 of this Article. In case of suspension of procedures for reviewing the application for authorization/ registration, CBK shall inform the applicant in writing;
1.5. CBK shall issue a decision whereby approves or rejects authorization as a payment institutions
and electronic money institutions or registration as account information services providers within 90 (ninety) days from the day of informing the applicant that the authorization/registration application is complete. CBK shall immediately inform the applicant with regard to the decision reached.
1.6. during the period of reviewing the application, CBK may request additional information or
certain changes/ improvements, if reasonable.
CBK may inspect the premises/offices, where the institution shall conduct the activities for which
it requires to be authorized/registered, to verify whether the technical and security conditions are met to conduct these activities, in compliance with the by-laws issued by CBK.
The documentation provided in this regulation must be in Albanian language, in original or in
notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries, other than the Republic of Kosovo, the documentation must also be legalized by the responsible authorities.
CBK, if it deems it reasonable, may request the submission of updated certificates on the judicial
status, criminal prosecution and the status of tax liabilities issued by the competent bodies, in case the validity period of the submitted documentation expires before the date of authorizer’s approval, registration and other approvals.
CBK shall decide to grant the authorization/registration only after it is convinced that the entity
complies with the requirements set out in article 14 of LPS and in this Regulation.
5.1. The CBK shall decide to approve authorization/registration if the following conditions are
fulfilled:
5.1.1. shareholders/partners have a good reputation, legal source of capital funds, financial
capabilities for investing planned funds and financial capabilities for conducting the necessary financing for the sustainable continuation of this institution’s activity;
5.1.2. the shareholding capital committed is paid;
5.1.3. qualifications, experience and reputation of directors and persons responsible for the
management of institutions, are adequate for implementing the business plan, as provided for in Article 12 of this Regulation;
5.1.4. the business plan submitted should be real and competitive in the market, and the
expected financial state of the institution proposed should be satisfactory.
5.2. The CBK rejects the approval of the application in the following cases:
5.2.1. the conditions determined in article 14 of LPS and above under sub-paragraph 5.1,
paragraph 5 of this Article are not met;
5.2.2. jeopardizes the financial viability of the proposed institution or the system of payment
institutions, electronic money institutions or account information services providers in general;
5.2.3. one of the shareholders has been subject to insolvency filing procedures, including
official administration or bankruptcy;
5.2.4. if the origin of the invested share capital is not clear to the CBK;
5.2.5. when at least one of the shareholders/ partners owns bearer shares or is a nominee
shareholder (if applicable);
5.2.6. when at least one of the shareholders/ partners has a complex ownership and control
structure;
5.2.7. when at least one of the shareholders/ partners is a shell bank;
5.2.8. when at least one of the shareholders/ partners represents high risk, based on the
evaluations of the CBK.
5.2.9. false information is provided in the application.

5.3. CBK shall refuse the granting of authorization/registration, in any case when it judges that the
authorization/registration of the entity would infringe the public interest.
5.4. The reasons based on which the approval of authorization/registration is rejected shall be
clarified in the notice on rejection of authorization/registration.
5.5. The CBK, in order to carry out the assessments set out in this Article, in addition to reviewing
the documentation submitted, shall cooperate and may request information from peer supervisory authorities and institutions specialized in combating economic crime, prevention of money laundering; the tax authorities; Competition Authority or any other relevant local or international/foreign institution.
Article 59
Publication of decision on granting the authorization

CBK shall publish the decision on granting the authorization/registration to operate as a payment
institution, electronic money institution or account information services providers.
The decision shall be published in the official website of CBK.
CBK shall register in the authorized/registered entities’ register, the payment institution, the
electronic money institution, the account information services providers and the list of their agents (if applicable) with their data, in compliance with CBK’s by-laws.
Article 60
Applicable Fees
Payment institutions, electronic money institutions and account information services providers
applying for authorization/registration shall pay the application fee, according to the amount determined by the CBK. The fee paid shall be non-refundable in case of refusal of authorization/registration.
After authorization/registration, the payment institutions, electronic money institutions and
account information services providers shall pay other fees according to the amounts determined by the CBK.
Article 61
Registration characteristics
Authorization/Registration shall be granted for an indefinite period of time and shall be nontransferable and non-tradable.
The authorization for the payment institution encompasses the words “payment institution” in
addition to the name of the institution.
The authorization for the electronic money institution encompasses the words “electronic money
institution” in addition to the name of the institution.
The registration for the account information services providers encompasses the words “account
information services providers” in addition to the name of the institution.
After authorization/registration, the payment institutions, electronic money institutions or account
information services providers shall commence operations within 12 (twelve) months from the date of notification for authorization/registration.
If the payment institutions, electronic money institutions or account information services providers
do not commence operation within the deadlines under paragraph 5 of this Article, the authorization/registration approved by the CBK shall be revoked. The institution may re-apply for authorization/registration.
The payment institutions, electronic money institutions or account information services providers
authorization/registration certificate shall be issued in accordance with the Regulation on Issuance of Licensing or Registration Certificates of financial institutions.
The payment institutions, electronic money institutions or account information services providers
shall, before the commencement of financial activity, notify the CBK for the preparations made and its readiness to start the activity, for creating space and adequate infrastructure to carry out activities, including installing the information technology operating system.
Article 62
Revocation or suspension of authorization/registration
The payment institutions, electronic money institutions or account information services providers
authorization/registration could be revoked only upon the CBK’s decision if one or more of condition specified in article 16 of LPS.
The payment institutions, electronic money institutions or account information services providers
authorization/registration shall be revoked by a CBK decision if the payment institutions, electronic money institutions or account information services providers is deemed insolvent or it is reasonably assessed that they are likely to become insolvent.
For the purposes of this Article, “insolvent” shall mean that the payment institutions, electronic
money institutions or account information services providers is not paying its obligations or the value of the payment institutions, electronic money institutions or account information services providers obligations exceeds the value of its assets. The value of the payment institutions, electronic money institutions or account information services providers assets, liabilities and regulative capital is determined in accordance with the assessment standards and procedures set by the CBK.
The CBK may, when it deems it appropriate, decide to suspend the authorization/registration of
the payment institutions, electronic money institutions or account information services providers. In such cases the periods and other conditions relating to the suspension shall be determined by decision of the CBK.
CHAPTER VII
APPROVAL AND OBLIGATION FOR NOTIFICATION
Article 63
Prior approvals
Without the prior approval of CBK, the payment institution and the electronic money institution
may not:
1.1. change of name;
1.2. changes to the founding document and/or statute;

1.3. increase of share capital;
1.4. reduction of capital;
1.5. change in qualifying holding;
1.5.1. this subparagraph is not applicable for foreign branches of payment institution and
electronic money institutions;
1.6. appointment of directors and persons responsible for the management;
1.6.1. the requirements for the approval of directors and persons responsible for the
management according to this article are also applicable to the appointment of the internal auditor;
1.6.2. the approval process is repeated for each reappointment or extension of the mandate.
1.7. opening and relocation of offices inside the country;
1.7.1. for the purposes of this Regulation, relocation of the PI’s and EMI’s offices inside the
country means the change of location of the respective office within the territory of the same municipality;
1.8. sale or transfer (complete or partial) of the payment institutions and electronic money
institutions’ portfolio to another entity;
1.9. merger and/or acquisition;
1.10. dividend distribution.
2. The CBK shall approve or reject the transaction under paragraph 1 of this Article within 2 (two)
months of the date of completion of the request, based on the documentation specified in paragraphs 3 and 4 of this Article.
3. For approving transactions under paragraph 1 of this Article, the payment institutions and
electronic money institutions shall present a written request accompanied by the following documentation:
3.1. change of the name:
3.1.1. decision by the decision-making body; and
3.1.2. written reasoning for such change.
3.2. amendments to the founding act and/or statute:
3.2.1. decision by the decision-making body;
3.2.2. amended founding act and/or statute;
3.2.3. written reasoning for such amendment to the founding act and/or statute.
3.3. increase of share capital:
3.3.1. if the payment institutions and electronic money institutions’ share capital is increased
from internal sources:
3.3.1.1. statement on source of capital increase;
3.3.1.2. the payment institutions and electronic money institutions’ external audit
report for previous year;
3.3.1.3. financial statements of last period reported to the CBK, which prove the
sufficiency of these sources within the payment institutions and electronic money institutions’ capital structure.

3.3.2. if the payment institutions and electronic money institutions’ share capital is increased
from external sources, requirements of Article 20 and Article 54 of this Regulation shall apply.
3.4. reduction of share capital:
3.4.1. decision by the decision-making body;
3.4.2. description of the impact of such change on capital requirements under LPS, Regulation
on Own funds for payment institutions and electronic money institutions and this Regulation;
3.4.3. written reasoning for the decrease of share capital.
3.5. change in qualifying holding:
3.5.1. report of the joint stock company in the case of shareholders organized as a business
organization or CVs of individual shareholders;
3.5.2. name, nationality, place of residence and business and professional history for the last
ten (10) years of the applicant and any beneficial owner of the applicant who, as a result of the transaction, would indirectly benefit five percent (5%) or more of the payment institutions and electronic money institutions’ capital interests, as well as the information/documentation required by Article 20 and Article 54 of this Regulation;
3.5.3. list of business organizations wherein the proposed owners, including the beneficial
owners (as described above), hold shares, specifying the level of such shareholding and the registered addresses of those business organizations;
3.5.4. for each legal entity, the audited financial statements (audited if applicable) for the last
three (3) years;
3.5.5. the source and amount of funds used in the exercise of amalgamation as set forth in
Article 20 and Article 54 of this Regulation; and
3.5.6. in any case where the amalgamation of the shares would cause the payment institutions
and electronic money institutions to become a subsidiary of a foreign financial institution, a statement from the responsible supervisory authority of the home country that there are no objections to the commencement of operations in Kosovo and that it exercises global consolidated oversight on the payment institutions and electronic money institutions established in Kosovo, if applicable;
3.5.7. signed notarized agreement for change of share ownership.
3.6. appointment of directors and persons responsible for the management:
3.6.1. documentation specified in Article 21 and Article 55 of this Regulation.
3.7. opening and relocation of offices:
3.7.1. decision by decision-making body;
3.7.2. justification for office opening or relocation;
3.7.3. written notification on fulfilment of technical and safety conditions. Such notice shall
specify the steps taken to fulfil these conditions and the photographs proving this.
3.8. sale or transfer (complete or partial) of the payment institutions and electronic money
institutions’ portfolio to another entity;
3.8.1. decision by decision-making body on such transactions;

3.8.2. signed agreement or draft agreement between the payment institutions and electronic
money institutions and the other entity.
3.9. merger and/or amalgamation:
3.9.1. decision by the decision-making body of the payment institutions and electronic
money institutions and the other financial institution involved in the process for approval of their reorganization through merger;
3.9.2. agreement or draft agreement and detailed report of the merger process, signed by the
legal representatives of institutions involved in the merger process. The agreement or draft agreement and the report shall be in writing and in accordance with the applicable legislation;
3.9.3. payment institutions and electronic money institutions’ draft statute after
implementation of the merger process;
3.9.4. strategic and operational plans for implementing the merger, including required
amalgamation analyses and financial statement projections for the merged payment institutions and electronic money institutions;
3.9.5. in case of change of directors and persons responsible for management of the merged
payment institutions and electronic money institutions, documentation shall be submitted in accordance with the requirements for directors and persons responsible for management under this Regulation;
3.9.6. new structure of the payment institutions and electronic money institutions
shareholders.
3.10. dividend distribution:
3.10.1. decision by shareholders’ assembly and board of directors on dividend distribution;
3.10.2. projections related to balance, income statement and initial capital on monthly basis
for the 12 (twelve) upcoming months, reflecting the potential dividend payment;
3.10.3. audited financial statements for previous year.
4. The CBK may request additional documents other than those specified in paragraph 3 of this
Article.
5. The application for approval of the above transactions and the documentation attached to the
application shall be filed by the payment institutions and electronic money institutions and shall be in one of the two official languages of the Republic of Kosovo, either in original or in a certified copy. In the case of documentation issued by relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation shall also be certified by the responsible authorities of the respective states.
6. The CBK shall approve the applications submitted by payment institutions and electronic money
institutions for transactions under paragraph 1 of this Article only if the following criteria are met:
6.1. change of name:
6.1.1. the proposed new name of the payment institutions and electronic money institutions
shall be in accordance with the LPS, the Law on Business Organizations and the Law on the Use of Languages.
6.2. changes to the founding act and/or statute:

6.2.1. changes shall not stand in violation with the applicable legislation, depending on the
type of change concerned.
6.3. increase of share capital:
6.3.1. authorization conditions related to capital shall apply mutatis mutandis;
6.4. reduction of share capital:
6.4.1. the impact of such decrease on the payment institutions and electronic money
institutions, including but not limited to the impact that the decrease may have on the payment institutions and electronic money institutions’ financial viability, ownership structure and shareholder suitability.
6.5. change in qualifying holding;
6.5.1. the proposed amalgamation is evaluated according to the same criteria that apply to the
approval of a payment institutions and electronic money institutions authorization request with regard to shareholders, including but not limited to, the expected effects of the proposed amalgamation on the payment institutions and electronic money institutions’ financial viability and ownership structure and the impact of such amalgamation may have on the payment institutions and electronic money institutions oversight by the CBK.
6.6. appointment of directors and persons responsible for the management:
6.6.1. the criteria under Article 65 of this Regulation shall apply;
6.7. opening and relocation of offices inside the country:
6.7.1. the impact of opening or relocation on the community in which the office is or will be
located;
6.7.2. the payment institutions and electronic money institutions shall provide the CBK with
sufficient information and facts that the office is ready to conduct its business in terms of technical and security conditions including computer system, staffing, security, etc;
6.7.3. the CBK shall have the right to order the suspension of the activity in the relevant office
even after approval if it finds that the technical and security conditions for the exercise of financial activity have not been met;
6.8. sale or transfer (complete or partial) of the payment institutions and electronic money
institutions’ portfolio to another entity:
6.8.1. the impact of the sale or transfer of portfolio on payment institutions and electronic
money institutions clients;
6.8.2. the impact of the sale or transfer of the portfolio on the payment institutions and
electronic money institutions’ financial standing;
6.8.3. the sale or transfer of the portfolio shall not give rise to an anti-competitive effect;
6.9. merger and/or acquisition:
6.9.1. the merger or acquisition does not jeopardize the financial standing of the merged
payment institutions and electronic money institutions;
6.9.2. the payment institutions and electronic money institutions has a system of
organization, management, decision-making and information technology that enables the full integration of the merged or acquired payment institutions and electronic money institutions in a way that does not jeopardize its operation;

6.9.3. the merger or acquisition is economically viable;
6.9.4. the merger and/or acquisition does not give rise to an anti-competitive effect;
6.9.5. it is the responsibility of the payment institutions and electronic money institutions to
obtain approval from other authorities that may be necessary before the transaction is completed.
6.10. dividend distribution.
6.10.1. the impact of the dividend distribution on the payment institutions and electronic
money institutions, including but not limited to, the expected effects on the payment institutions and electronic money institutions’ financial viability.
7. When deciding whether to approve such transactions, the CBK shall also consider other criteria
for the purpose of achieving its goals as set forth in the applicable legislation.
Article 64
Requirements for notifying PIs, EMIs and AISPs changes

PIs shall notify the CBK within 30 (thirty) days (1 month) of occurrence of changes for the
following transactions:
1.1. any change in ownership of shareholders who possess less than ten per cent (10%) of the
capital;
1.2. resignation of directors and senior managers;
1.3. closing the offices inside the country;
1.4. changes to the organizational structure if such changes are not reflected in the PIs or EMIs
statute, the director or senior managers.
Payment institutions and electronic money institutions shall notify the CBK without delay of
operational risk events if one of the following cases occur:
2.1. financial losses resulting from theft, financial fraud or other similar cases, which represent a
loss to the payment institution and electronic money institution in an amount exceeding € 1,000 (one thousand Euros);
2.2. events that result in serious damage or loss of payment institutions and electronic money
institutions’ important data or books, interruption of operations for more than 3 (three) hours in two or more offices, or interruption of operations for more than 5 (five) hours in a single office, affecting the normal operations of the payment institutions and electronic money institutions;
2.3. in case payment institutions and electronic money institutions’ exclusive information is stolen,
sold or published without payment institutions and electronic money institutions’ permission or if information is lost that could damage payment institutions and electronic money institutions’ financial stability;
2.4. frequent breach of applicable rules by the persons responsible for management.

CHAPTER VIII
ORGANIZATION, MANAGEMENT AND ADMINISTRATION OF PAYMENT INSTITUTION, ELECTRONIC MONEY INSTITUTION AND ACCOUNT INFORMATION SERVICES PROVIDER
Article 65
Governance of PI, EMI and AISP

Payment institutions, electronic money institutions and account information service providers shall
act in accordance with the recognized principles of good governance to ensure that the business of the institution is realized in a safe and sound manner. Payment institutions, electronic money institutions and account information service providers’ governance should be in accordance with the LPS and this Regulation.
Payment institutions, electronic money institutions and account information service provider shall
have a board of directors consisting of not less than 3 (three) members, of which the majority shall be independent and non-executive directors.
Directors and persons responsible for management should fulfil the “fit and proper” criteria as
requested by the CBK.
Directors and persons responsible for management of Payment institutions, electronic money
institutions and account information service provider should at least meet the following criteria:
4.1. hold a university degree in the field of economy, jurisprudence or another relevant field, for
the position where the person is appointed;
4.2. have 3 (three) years of experience in the banking and/or financial sector or any other field
considered appropriate by the CBK;
4.3. have a high ethical and professional reputation;
4.4. have not been removed by the CBK from a position in a financial institution;
4.5. have not been convicted by a criminal court for a criminal offense with imprisonment of 1
(one) year or more, concerning which the option of fine has not been ruled;
4.6. have not been convicted of economic crimes or found guilty of economic offences under the
Criminal Code;
4.7. have not been denied, by court decision/competent authority, the exercise of activities within
the powers prescribed for directors and persons responsible for management;
4.8. have not been excluded or suspended by the competent authority from practicing the
profession on grounds of personal misconduct;
4.9. have not caused or been responsible for the bankruptcy of any entity that conducts economic
activity;
4.10. have not been subject to insolvency filing procedures including official administration or
bankruptcy and are free from paying past due liabilities.
In exceptional circumstances, after being satisfied with the qualifications, professional experience
and conduct of the person, the CBK may exempt a director or senior manager from the provisions of subparagraph 4.9 and 4.10 of paragraph 4 of this Article.
The board of directors of payment institution and electronic money institution is assisted by at
least 2 (two) committees:

6.1. the audit committee which includes and is chaired by a non-executive member of the board of
directors and at least 1 (one) member of the audit committee may be an external expert in the field of accounting or auditing; and
6.2. the risk management committee whose members must also be members of the Board of
Directors;
7. The CBK may require payment institutions and electronic money institutions to have additional
committees other than those specified in this article.
8. Payment institutions and electronic money institutions may establish additional committees other
than those specified in this article.
9. The provisions of this article relating to the Board of Directors and the Committees at the level of
the Board of Directors do not apply to branches of foreign payment institutions and electronic money institutions.
CHAPTER IX
FINAL PROVISIONS
Article 66
Enforcement, Improvement Measures and Penalties Any violation of the provisions of this Regulation shall be subject to corrective measures and administrative penalties, as set out in Article 67 of Law No. 03/L-209 on the Central Bank of the Republic of Kosovo, as amended and supplemented by Law No. 05/L-150, and Article 125 of Law No.10/L-026 on Payment Services.
Article 67
Repeal
Upon entry into force of this Regulation, provisions of the Regulation on the registration of non-bank financial institutions regarding the transferring and receiving money and payment services for payments within and outside the country (hereinafter payment service); adopted by the Board of the Central Bank of the Republic of Kosovo on 30 April 2020, shall be repealed.
Article 68
Entry into force
This Regulation shall enter into force 15 days from the date of its approval. Dr.sc. Bashkim Nurboja Chairperson of the Board of the Central Bank of the Republic of Kosovo

Regulation on the authorization, granting preliminary approvals and governance of payment institutions and electronic money institutions and for the registration of account information service providers

Lineage: In force

Similar documents from other regulators