Regulation on the authorization, granting preliminary approvals and governance of payment institutions and electronic money institutions and for the registration of account information service providers

1 of 63 Pursuant to Article 35, paragraph 1 subparagraph 1.1 and Article 65, of the Law No. 03/L-209 on Central Bank of the Republic of Kosovo (Official Gazette of the Republic of Kosovo, No.77 / 16 August 2010), amended and supplemented by Law No. 05/L–150 (Official Gazette of the Republic of Kosovo / No. 10 / 03 April 2017), Article 12, paragraph 4, and Article 136 of the Law No.10/L-026 on Payment Services (Official Gazette of the Republic of Kosovo,No.10 / 14 May 2026), the Board of the Central Bank of the Republic of Kosovo, at its meeting held on June 29, 2026, approved the following: REGULATION ON THE AUTHORIZATION, GRANTING PRELIMINARY APPROVALS AND GOVERNANCE OF PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS AND FOR THE REGISTRATION OF ACCOUNT INFORMATION SERVICE PROVIDERS CHAPTER I GENERAL PROVISIONS Article 1 Purpose

1. The purpose of this Regulation is to determine the conditions, requirements, procedures and time limits to be adhered for: 1.1. authorization of payment institutions and electronic money institutions; 1.2. registration of account information services providers; 1.3. the information to be provided to the Central Bank of Republic of Kosovo when applying for authorization as a payment institution or electronic money institution and for registration as an account information service provider pursuant to Article 12 paragraph 1, Article 25 paragraph 1, and Article 29 paragraph 1 of the Law No.10/L-026 on Payment Services ("Law on Payment Services" or “LPS”); 1.4. granting preliminary approvals for transactions requiring prior approval by the CBK for conducting payment institutions, electronic money institutions and account information services providers activity; 1.5. obligations of payment institutions, electronic money institutions and account information services providers to notify the CBK while conducting their activities. 1.6. organization, management and administration of payment institution, electronic money institution and account information services provider

2 of 63 Article 2 Scope

1. This Regulation shall apply to applicants: 1.1. for authorization as a payment institution or electronic money institution or for registration as an account information service provider with the Central Bank of the Republic of Kosovo; 1.2. payment institutions, electronic money institutions authorized by Central Bank of the Republic of Kosovo; and 1.3. account information services providers applying to or registered by the Central Bank of the Republic of Kosovo. Article 3 Definitions
2. The terms and definitions used in this Regulation shall have the same meaning as the terms defined in Article 4 of the Law on Payment Services.
3. In addition to paragraph 1 of this Article, for the purpose of implementing this Regulation, the following terms and abbreviations shall have the following meanings: 2.1. Management body – means the body, directors or persons responsible for the management of the PIs and EMIs and, where relevant, persons responsible for the management of the payment services activities of the PIs and EMIs; 2.2. Director – shall mean any person appointed by the shareholders or the founders to serve as a member of a PI’s or EMI’s management body; 2.3. Persons responsible for the management – means a chief executive officer, chief financial officer, chief operating officer, and chief risk officer and any person who: 2.3.1. reports directly to the management body or participates or has authority to participate in major policymaking functions of the PI’s or EMI’s, and/or 2.3.2. is designated as a person responsible for the management by the CBK. 2.4. AIS – means account information services as defined in the Law on Payment Services; 2.5. AISP – means an account information service provider as defined in the Law on Payment Services; 2.6. AML/CFT – means anti-money laundering and counter terrorist financing; 2.7. ASPSP – means an account servicing payment service provider as defined in the Law on Payment Services; 2.8. CBK – means the Central Bank of Republic of Kosovo; 2.9. EMI – means an electronic money institution as defined in the Law on Payment Services; 2.10. FATF – means the Financial Action Task Force; 2.11. ICT – means information and communication technologies; 2.12. LPS – means the Law No. 08/L-328 on Payment Services; 2.13. Law on the prevention of money laundering and combating terrorist financing – means Law Nо. 05/L-096 On the Prevention of Money Laundering and Combating Terrorist Financing and/or the Law in force for Prevention of Money Laundering and Combating Terrorist Financing.

3 of 63 2.14. Law on accounting, financial reporting and auditing – means Law No. 06/l-032 on Accounting, Financial Reporting and Auditing and / or the Law in force for accounting, financial reporting and auditing; 2.15. PI – means a payment institution as defined in the Law on Payment Services; 2.16. PISP – means a payment initiation service provider as defined in the Law on Payment Services; 2.17. PII – means the professional indemnity insurance as defined in the Law on Payment Services; 2.18. PIS – means payment initiation services as defined in the Law on Payment Services; 2.19. PSP – means a payment service provider as defined in the Law on Payment Services. 2.20. Bearer shares – are shares of a legal person, whose ownership is transferred to the person that owns or holds the certificate/document of the bearer shares without the need of an agreement/contract for transferring the ownership of these shares; 2.21. Nominee shareholder – is the registered shareholder of a legal person that holds shares on the current shareholder’s behalf (beneficiary owner), according to an agreement; 2.22. Shell bank – a bank or institution engaged in equivalent activities, established in a country where it has no physical presence, which makes possible to exercise an actual direction and management without being affiliated with any regulated financial group; 2.23. Subsidiary – any legal entity in which another person or group of persons acting in concert holds directly or indirectly (i) the equivalent of fifty percent or more of any class of voting shares or (ii) a significant interest that permits such person or group of persons to exercise control over the legal entity in which such shares are held; CHAPTER II MINIMUM INITIAL CAPITAL FOR PAYMENT INSTITUTIONS AND ELECTRONIC MONEY INSTITUTIONS Article 4 Minimum initial capital

1. The minimum amount of capital required for authorization and maintained for payment institutions and electronic money institutions shall be in accordance with the provisions of Article 9 and 30 of the LPS and Article 4 of Regulation on own funds for payment institutions and electronic money institutions.
2. Each payment of minimum paid-in capital, its later increase and any change in the capital structure of the payment institution and of the electronic money institution should be made in cash and be accompanied with the presentation of information to CBK with regard to the source of this capital, respectively a banking document which proves the payment of capital (if applicable), as it is provided for in Article 20, Article 54 and Article 63, paragraph 1 subparagraph 1.3 of this Regulation.
3. CBK has the right to request further information and carry out further checks relating to the creation source/sources of contributions/funds that shall serve as a minimum initial capital or as a future increase in its structure.

4 of 63 4. CBK is entitled to request clarification and conduct further verifications regarding the source(s) which will serve as paid-in capital or as any other subsequent addition. 5. Where CBK concludes, or is reasonably suspicious of the capital structure or its source being associated to persons with criminal convictions by a final court decision, who have family relations or close personal, working or business relationship in accordance with legal stipulations, with the proposed shareholders/partners, or is related to companies registered in tax havens or offshores, it notifies and requires from the Financial Intelligence Unit whether it has information regarding the proposed shareholders/partners, and shall suspend the procedure on granting the authorization up to a response from the latter. 6. The sources of capital funds must be legal and must not derive from public borrowed funds, loans and/or other funds whose origin is unknown or unlawful. CHAPTER III INFORMATION REQUIRED FROM APPLICANTS FOR AUTHORIZATION AS PAYMENT INSTITUTIONS Article 5 Scope

1. This Chapter applies to applicants for authorization as PIs. This includes applicants that intend to provide the services referred to in subparagraphs 1.2.1 to 1.2.7 of Article 4 of the LPS or the service in subparagraph 1.2.8 in combination with other payment services.
2. Applicants that intend to provide only the service referred to in subparagraph 1.2.8 of Article 4 of the LPS are subject to the specific set of requirements for AISPs set out in Chapter IV of this Regulation. Article 6 General principles
3. Entities interested to be authorized as a payment institution (PI) should meet all requirements set out in the LPS and this regulation. The applicant may request from the CBK necessary forms of applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.
4. Financial institutions including Microfinance Institution and Nonbank Financial Institution that submit the application to be authorized as a payment institutions or electronic money institutions, apply all the requirements provided in LPS and this Regulation for payment institutions, with the exception of the requirements of Articles 7, 20 and 21.
5. The application to obtain an authorization as a payment institution shall be submitted in writing and signed by the founding shareholder(s) or their legal representative and shall be submitted to the CBK. The application must be submitted together with the complete documentation / information as required by the LPS and this regulation.
6. The information provided by applicants should be true, complete, accurate and up to date, and applicants shall comply with all the provisions in this Regulation that apply to them. The level of information detail should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and risk level of the payment services that are intended to be

5 of 63 provided. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the payments institution should have good reputation and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, its internal organization and the nature, scope or complexity of its activities and the duties and responsibilities of the relevant position. 5. When submitting the information required, the applicant should avoid making references to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections of those documents and provide these to the CBK. 6. Should the CBK requires clarifications on the information that has been submitted, the applicant should provide such clarification without delay. 7. All data requested under this Chapter for authorization as PI are needed for the assessment of the application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. 8. In all cases when the applicant is a foreign financial institution which applies to establish a payment institution in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the authorization as payment institution; 9. If it considers reasonable, CBK may request additional information other than information requested under this Chapter. 10. The required documentation according to this Chapter should be in one of the two official languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States. Article 7 Identification data of the entity

1. The identification details to be provided by the applicant for authorization as a payment institution should contain the following information: 1.1. the applicant’s corporate name and, if different, trade name; 1.2. the applicant’s business registration certificate as a legal person, issued by the Business Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as the unique identification number; 1.3. the applicant’s legal status, founding act (if applicable) and articles of association; 1.4. the address of the applicant’s head office; 1.5. the applicant’s electronic address and website, if available; 1.6. the name(s) of the person(s) in charge of dealing with the application file and authorization procedure, and their contact details; 1.7. any trade association in relation to the provision of payment services that the applicant plans to join, where applicable; 1.8. evidence of payment of the authorization application fee.

6 of 63 Article 8 Program of operations

1. In accordance with article 12, paragraph 1, subparagraph 1.1 of the LPS, the entity that applies for authorization as a payment institution submits to the CBK, the program of operations to be provided by the applicant should contain the following information: 1.1. a step-by-step description of the type of payment services envisaged, including an explanation of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Article 4, subparagraph 1.2 of the LPS; 1.2. a declaration of whether the applicant will enter or not into possession of funds (obtained from the users of the payment services provided); 1.3. a description of the execution of the different payment services, detailing all parties involved, and including for each payment service provided, the following elements: 1.3.1. a diagram of flow of funds, unless the applicant intends to provide PIS only; 1.3.2. settlement arrangements, unless the applicant intends to provide PIS only; 1.3.3. draft contracts between all the parties involved in the provision of payment services including payment schemes with cards, if applicable; 1.3.4. processing times. 1.4. a copy of the draft framework contract, as defined in Article 4 subparagraph 1.20 of the LPS; 1.5. the estimated number of branches from which the applicant intends to provide the payment services, and/or carry out activities related to the provision of the payment services, if applicable; 1.6. a description of any ancillary services to the payment services, if applicable; 1.7. a declaration of whether or not the applicant intends to grant credit and, if so, within which limits; 1.8. a declaration of whether or not the applicant plans to provide payment services abroad after the granting of the authorization; 1.9. an indication of whether or not the applicant intends, for the next 3 (three) years, to provide or already provides other business activities as referred to in Article 20 of the LPS, including a description of the type and expected volume of the activities; 1.10. the information specified in the CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 8, paragraph 4 of the LPS where the applicant intends to provide PIS and AIS. 1.11. information on investments in information and communication technology systems, accompanied by a list of equipment, software, etc.

7 of 63 Article 9 Business plan

1. In accordance with article 12, paragraph 1, subparagraph 1.2 of the LPS, the entity that applies for authorization as a payment institution submits to CBK, the business plan which should contain the following information: 1.1. a marketing plan consisting of: 1.1.1. an analysis of the entity’s competitive position in the payment market segment concerned; 1.1.2. a description of the payment service users, marketing materials and distribution channels; 1.2. where available for existing entity, certified annual accounts for the previous 3 (three) years, or a summary of the financial situation for those companies that have not yet produced annual accounts; 1.3. a forecast of the financial situation calculation for the first three financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include: 1.3.1. an income statement, balance-sheet forecast and explanations of their main items, including target scenarios and stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold; 1.3.2. explanations of the main lines of income and expenses, the financial debts and the capital assets; 1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three) years; 1.4. information on own funds, including the amount and detailed breakdown of the composition of initial capital as set out in Article 9 of the LPS; 1.5. information on, and calculation of, minimum own funds requirements in accordance with the method(s) referred to in Article 10 paragraph 1 of the LPS and Article 6 of the Regulation on own funds for payment institutions and electronic money institutions, unless the applicant intends to provide PIS only, including: 1.5.1. an annual projection of the breakdown of the regulatory capital (own funds) for three 3 (years) according to the method used; 1.5.2. an annual projection of the regulatory capital (own funds) for 3 (three) years according to the other methods. 1.6. a forecast regarding the implementation of the regulatory and supervisory framework (indicators of prudence, reports, etc.) for the next 3 (three) years; 1.7. if the entity has carried out another activity, before applying for authorization as a payment institution, the audited annual financial statements for the previous 3 (three) years, and in the case of a company established less than 3 (three) years ago, the audited financial statements, since its establishment.

8 of 63 Article 10 Organizational structure

1. In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, the applicant that applies for authorization as a payment institution to CBK, should provide a description of the organizational structure of its undertaking consisting of: 1.1. a detailed organizational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by descriptions of the functions and responsibilities of each division, department or similar structural separation; 1.2. an overall forecast of the staff numbers for the next 3 (three) years; 1.3. a description of relevant operational outsourcing arrangements consisting of: 1.7.1. the identity and geographical location of the outsourcing provider; 1.7.2. the identity of the persons within the PI that are responsible for each of the outsourced activities; 1.7.3. a clear description of the outsourced activities and their main characteristics; 1.4. a copy of draft outsourcing agreements; 1.5. a description of the use of branches and agents, where applicable, including: 1.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform, at least annually, for branches and agents and the frequency of these inspections; 1.5.2. the ICT systems, the processes and the infrastructure that are used by the applicant’s agents to perform activities on behalf of the applicant; 1.5.3. in the case of agents, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement; 1.5.4. an indication of the national and/or international payment system that the applicant will access, if applicable; 1.6. information whether the applicant is a participant on the national and/or international payment system; 1.7. a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Article 11 Evidence of initial capital
2. For the evidence of initial capital to be provided by the applicant in accordance with Article 9 of the LPS and Article 4 of the Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents: 1.1. for existing undertakings, an audited account statement or public register certifying the amount of capital of the applicant; 1.2. for undertakings in the process of being incorporated, a bank statement issued by a bank certifying that the funds are deposited in the applicant’s bank account.

9 of 63 Article 12 Measures to safeguard the funds of payment service users

1. For the entities that require to offer payment services 1.2.1 to 1.2.6 as listed in Article 4, paragraph 1, subparagraph 1.2 of LPS, where the applicant safeguards the payment service users’ funds through depositing funds in a separate account in a bank or through an investment in secured, liquid, low risk assets, the description of the safeguarding measures should contain: 1.1. a description of the investment policy to ensure the assets chosen are liquid, secured and low risk, if applicable; 1.2. the number of persons that have access to the safeguarding account and their functions; 1.3. a description of the administration and reconciliation process to ensure that payment service users’ funds are insulated in the interest of payment service users against the claims of other creditors of the PI, in particular in the event of insolvency; 1.4. a copy of the draft contract with the bank; 1.5. an explicit declaration by the PI of compliance with Article 11 of the LPS.
2. For the entities that require to offer payment services 1.2.1 to 1.2.6 as listed in Article 4, paragraph 1, subparagraph 1.2 of LPS, which will safeguard the funds of the payment service user through an insurance policy or comparable guarantee from an insurance company or a bank, the description of the safeguarding measures should contain the following: 2.1. a confirmation that the insurance policy or comparable guarantee from an insurance company or a bank is from an entity that is not part of the same group of firms as the applicant; 2.2. details of the reconciliation process in place to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times; 2.3. duration and renewal of the coverage; 2.4. a copy of the (draft) insurance agreement or the (draft) comparable guarantee. Article 13 Governance arrangements and internal control mechanisms
3. In accordance with Article 12, paragraph 1, subparagraph 1.5 of the LPS, the applicant that applies for authorization as a payment institution to CBK, should provide a description of the governance arrangements and the internal control mechanisms consisting of: 1.1. a mapping of the risks identified by the applicant, including the types of risks and the procedures the applicant will put in place to assess and prevent such risks; 1.2. the different procedures to carry out periodical and permanent controls including the frequency and the human resources allocated; 1.3. the accounting procedures by which the applicant will record and report its financial information; 1.4. the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae; 1.5. the identity of any auditor that is not a statutory auditor; 1.6. the composition of the management body and, if applicable, of any other oversight body or committee;

10 of 63 1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the PI’s internal controls; 1.8. a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; 1.9. where the applicant is the subsidiary of a regulated entity in an EU Member State or a foreign regulated entity, a description of the group governance. Article 14 Procedure for monitoring, handling and following up on security incidents and security￾related customer complaints

1. In accordance with Article 12, paragraph 1, subparagraph 1.6 of the LPS, the applicant that applies for authorization as a payment institution to CBK, should provide a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain: 1.1. organizational measures and tools for the prevention of fraud; 1.2. details of the individual(s) and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; 1.3. reporting lines in cases of fraud; 1.4. the contact point for customers, including a name and email address; 1.5. the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including notification of major incidents to the CBK under Article 96 of the LPS and in accordance with Article 5 of the CBK Regulation, to notify the Central Bank of the Republic of Kosovo of major operational or security incidents; 1.6. monitoring tools used and the follow-up measures and procedures in place to mitigate security risks. Article 15 Process for filing, monitoring, tracking and restricting access to sensitive payment data
2. In accordance with Article 12, paragraph 1, subparagraph 1.7 of the LPS, the applicant should provide a description of the process in place to file, monitor, track and restrict access to sensitive payment data consisting of: 1.1. a description of the flows of data classified as sensitive payment data in the context of the PI’s business model; 1.2. the procedures in place to authorize access to sensitive payment data; 1.3. a description of the monitoring instruments; 1.4. the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; 1.5. unless the applicant intends to provide PIS only, a description of how the collected data are filed; 1.6. unless the applicant intends to provide PIS only, the expected internal and/or external use of the collected data, including by counterparties;

11 of 63 1.7. the ICT system and technical security measures that have been implemented including encryption and/or tokenization; 1.8. identification of the individuals, bodies and/or committees with access to the sensitive payment data; 1.9. an explanation of how breaches of confidentiality and integrity of information will be detected and addressed; 1.10. an annual internal control program in relation to the safety of the ICT systems. Article 16 Business continuity arrangements

1. In accordance with Article 12, paragraph 1, subparagraph 1.8 of the LPS, the applicant should provide a description of the business continuity arrangements consisting of the following information: 1.1. a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; 1.2. the identification of the back-up site in case of activation of the business continuity plan, access to ICT infrastructure, and the key software and data to recover from a disaster or disruption; 1.3. an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; 1.4. the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; 1.5. a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts. Article 17 The principles and definitions applicable to the collection of statistical data on performance, transactions and fraud
2. In accordance with Article 12, paragraph 1, subparagraph 1.9 of the LPS, the applicant should provide a description of the principles and definitions applicable to the collection of the statistical data on performance, transactions and fraud consisting of the following information: 1.1. the type of data that is collected, in relation to customers, type of payment service, channel, instrument, jurisdictions and currencies; 1.2. the scope of the collection, in terms of the activities and entities concerned, including branches and agents; 1.3. the means of collection; 1.4. the purpose of collection; 1.5. the frequency of collection; 1.6. supporting documents, such as a manual, that describe how the system works.

12 of 63 Article 18 Security policy document

1. In accordance with Article 12, paragraph 1, subparagraph 1.10 of the LPS, the applicant should provide a security policy document containing the following information: 1.1. a detailed risk assessment of the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; 1.2. a description of the ICT systems, which should include: 1.2.1. the architecture of the systems and their network elements; 1.2.2. the business ICT systems supporting the business activities provided, such as the applicant’s website, electronic wallets, payment system, risk and fraud management system, identification and accounting; 1.2.3. the support ICT systems used for the organization and administration of the applicant, such as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers; 1.2.4. information on whether those systems are already used by the applicant or its group, and the estimated date of implementation, if applicable; 1.3. the type of authorized connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; 1.4. for each of the connections listed under subparagraph 1.3 of this Article, the logical security measures and mechanisms in place, specifying the control the applicant will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; 1.5. the logical security measures and mechanisms that govern the internal access to ICT systems, which should include: 1.5.1. the technical and organizational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; 1.5.2. how the issue of client environment segregation is dealt in cases where the applicant’s ICT resources are shared; 1.6. the physical security measures and mechanisms of the premises and the data center of the applicant, such as access controls and environmental security; 1.7. the security of the payment processes, which should include: 1.7.1. the customer authentication procedure used for both consultative and transactional access, and for all underlying payment instruments; 1.7.2. an explanation of how safe delivery to the legitimate payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;

13 of 63 1.7.3. a description of the systems and procedures that the applicant has in place for transaction analysis and the identification of suspicious or unusual transactions; 1.8. a detailed risk assessment in relation to its payment services, including fraud, which is linked to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; 1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for procedures that have not yet been formalized, an estimated date for their finalization. Article 19 Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing (AML/CFT) obligations

1. In accordance with Article 12, paragraph 1, subparagraph 1.11 of the LPS, the applicant should provide a description of the internal control mechanisms established in order to comply, where applicable, with those obligations. This description should contain the following information: 1.1. the applicant’s assessment of the money laundering and terrorist financing risks associated with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographical areas of operation; 1.2. the measures the applicant has or will put in place to mitigate the risks and comply with applicable AML/CFT obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities; 1.3. the systems and controls the applicant has or will put in place to ensure that its branches and agents comply with AML/CFT requirements, including in cases where the agent or branch is located abroad; 1.4. arrangements the applicant has or will put in place to ensure that staff and agents are appropriately trained in AML/CFT matters; 1.5. the identity of the person in charge of ensuring the applicant’s compliance with AML/CFT obligations, and evidence that their AML/CFT expertise is sufficient to enable them to fulfil this role effectively; 1.6. the systems and controls the applicant has or will put in place to ensure that its AML/CFT policies and procedures remain up to date, effective and relevant; 1.7. the systems and controls the applicant has or will put in place to ensure that the agents do not expose the applicant to increased money laundering and terrorist financing risk; 1.8. the AML/CFT manual for the staff of the applicant. Article 20 Identity and assessment of suitability of shareholders/partners with qualifying holdings in the applicant
2. In accordance with Article 12, paragraph 1, subparagraph 1.13 of the LPS, the entity that applies for authorization as a payment institution, for the purposes of identity and evidence of the

14 of 63 suitability of shareholders/partners with qualifying holdings in the applicant’s (PI’s) capital, should submit the following information: 1.1. a description of the group to which the applicant belongs and an indication of the parent undertaking, where applicable; 1.2. a chart setting out the shareholder structure of the applicant, including: 1.2.1. the name and the percentage holding (capital/voting right) of each person that has or will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications; 1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification; 1.3. a list of the names of all persons and other entities that have or, in the case of authorization, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity: 1.3.1. the number and type of shares or other holdings subscribed or to be subscribed; 1.3.2. the nominal value of such shares or other holdings. 2. Where a person who has or, in the case of authorization, will have a direct or indirect qualifying holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person: 2.1. the person’s name and name at birth, date and place of birth, citizenship (current and previous), identification number (where available) and/or passport number, address and a copy of the official identity document; 2.2. a detailed curriculum vitae stating the education and training, previous professional experience, any dismissal from employment and any professional activities or other functions currently performed; 2.3. a notarial statement, accompanied by supporting documents according to their territorial jurisdiction, containing the following information concerning the person: 2.3.1. the disclosure of spent convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside; 2.3.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 2.3.3. any insolvency case, including where the person was not responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 2.3.4. any pending criminal investigations; 2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI;

15 of 63 2.3.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether or not any of the events set out in subparagraphs 2.3.1 to 2.3.5 of this article, has occurred in respect of the relevant person; 2.3.7. any case of refusal of registration, authorization, membership or license to carry out trade, business or a profession; 2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 2.3.9. any case of expulsion by a public authority or institution in the financial services sector or by a professional body or association; 2.3.10. any position of responsibility with an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any; 2.3.11. any dismissal from employment or a position of trust, any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 2.3.13. the borrower's certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state; 2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to CBK. 2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures; 2.5. where an assessment of reputation of the person has already been conducted by a competent authority in the financial services sector, the identity of that authority and the outcome of the assessment; 2.6. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 2.7. a declaration whether the person is a politically exposed person and whether it has of any links to politically exposed persons, as defined in Law on AML/CFT. 3. Where a person or entity who has or, in the case of authorization, will have a direct or indirect qualifying holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity: 3.1. name;

16 of 63 3.2. where the legal person or entity is registered in a central register, commercial register, companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate; 3.3. the addresses of its registered office and, where different, of its head office, and principal place of business; 3.4. contact details; 3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a summary explaining the main legal features of the legal form or the entity; 3.6. decision of the decision-making body of the company on participation in the capital of the payment institution; 3.7. whether or not the legal person or entity has ever been or is regulated by CBK or by any other government body; 3.8. where such documents can be obtained, an official certificate or any other equivalent document evidencing the information set out in subparagraphs 3.1 to 3.6 of this Article, issued by the relevant competent authority; 3.9. the information referred to in subparagraphs 2.3, 2.4, 2.5, 2.6 and 2.7 of this Article in relation to the legal person or entity; 3.10. a list containing details of each person who effectively directs the business of the legal person or entity, including their name, date and place of birth, address, their national identification number, where available, and a detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs 2.3 and 2.7 above in respect of each such person; 3.11. the shareholding structure of the legal person, including at least their name, date and place of birth, address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or partners and beneficial owners, as defined in the Law on AML/CFT; 3.12. a description of the regulated financial group of which the applicant is a part, or may become a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis); 3.13. annual financial statements, at the individual and, where applicable, the consolidated and sub-consolidated group levels, for the last three financial years, where the legal person or entity has been in operation for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm in accordance with the Law on accounting, financial reporting and auditing, where applicable, including each of the following items: 3.13.1. the balance sheet; 3.13.2. the profit-and-loss accounts or income statement; 3.13.3. the annual reports and financial annexes and any other documents registered with the relevant registry or competent authority of the legal person;

17 of 63 3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); 3.15. where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall provide the existing financial statements (if any); 3.16. where the legal person or entity has its head office abroad, general information on the regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations); 3.17. for entities that do not have legal persons such as a collective investment undertaking, a sovereign wealth fund or a trust, the application shall contain the following information: 3.17.1. the identity of the persons who manage assets and of the persons who are beneficiaries or subscribers; 3.17.2. a copy of the document establishing and governing the entity including the investment policy and any restrictions on investment applicable to the entity. 4. The application shall set out all of the following information for each natural or legal person or entity who has or, in the case of authorization, will have a direct or indirect qualifying holding in the capital of the applicant: 4.1. details of that person’s or entity’s financial or business reasons for owning that holding and the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; 4.2. details of the person’s or the entity’s intentions in respect of the applicant and of the influence the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention; 4.3. information on the person’s or the entity’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; 4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or members in relation to the applicant; 4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities; 4.6. the identity of each member of the management body or of senior management who will direct the business of the applicant and will have been appointed by or following an appointment from such shareholders or members, together with, to the extent not already provided, the information set out in Article 21. 5. The application should set out a detailed explanation of the specific sources of funding for the participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:

18 of 63 5.1. notary statement of shareholders or partners for the source of paid-in capital and that the source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal. 5.2. details on the use of private financial resources, including their availability and source, to verify that the activity from which such funds were generated is legitimate and acceptable to the CBK; 5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation: 5.3.1. evidence of the source of capital, such as the independent external auditor's report, annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares; 5.3.2. certificate issued by the competent authorities, which provides data on the balance of the legal person or entity and on the payment of tax obligations. 5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation: 5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank deposits or other certificates for the source of capital creation; 5.4.2. certificates proving payment of tax obligations; 6. The information requirements established in this article are applicable to the authorization process of payment institutions and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in Article 13, paragraphs 1 and 2 of the LPS. Article 21 Identity and suitability assessment of directors and persons responsible for the management of the PI

1. In accordance with Article 12, paragraph 1, subparagraph 1.14 of the LPS, the entity that applies for authorization as a payment institution, for the purposes of the identity and suitability assessment of directors and persons responsible for the management of the PI, should provide the following information: 1.1. personal details, including: 1.1.1. their full name and name at birth, gender, place and date of birth, address and citizenship (current and previous), and personal identification number and/or passport number or copy of ID card or equivalent; 1.1.2. proof of university education background and documents certifying other qualifications of the person; 1.1.3. details of the position for which the assessment is sought, whether or not the management body position is executive or non-executive. This should also include the following details: 1.1.3.1. the competent body decision for appointment, or contract, as applicable;

19 of 63 1.1.3.2. the planned start date and duration of the mandate; 1.1.3.3. a description of the individual’s key duties and responsibilities; 1.2. where applicable, information on the suitability assessment carried out by the applicant, which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents; 1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought; 1.4. a declaration whether the person is a politically exposed person and whether it has any links to politically exposed persons, as defined in Law on AML/CFT. 1.5. evidence of reputation, honesty and integrity, which should include: 1.5.1. the disclosure of spent convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside; 1.5.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 1.5.4. any pending criminal investigations; 1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI; 1.5.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 has occurred in respect of the relevant person; 1.5.7. any refusal of registration, authorization, membership or license to carry out trade, business or a profession; 1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 1.5.9. any expulsion by a public authority or institution in the financial services sector or by a professional body or association; 1.5.10. any position of responsibility in an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the

20 of 63 alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any; 1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 1.5.12. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to CBK. 1.5.15. information concerning the following: 1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory authority that the individual has been directly or indirectly involved in; 1.5.15.2. refusal of registration, authorization, membership or license to carry out a trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; or expulsion by a regulatory or government body or by a professional body or association; 1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or similar situation, or having been asked to resign from employment in such a position, excluding redundancies; 1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer or a person who directs the business of an institution has already been conducted by foreign authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment; 1.5.15.5. whether or not any previous assessment of the individual, on authority from another, non-financial sector, has already been conducted, including the identity of that authority and evidence of the outcome of such an assessment.

21 of 63 Article 22 Identity of statutory auditors or audit firms In accordance with Article 12, paragraph 1, subparagraph 1.15 of the LPS, the entity that applies for authorization as a payment institution, information on the statutory auditors or audit firms should contain the names, addresses and contact details of auditors. Article 23 Professional indemnity insurance or a comparable guarantee for payment initiation services and account information services

1. As evidence of a professional indemnity insurance or comparable guarantee that is compliant with CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee and Article 8, paragraphs 2 and 3 of the LPS, the applicant for the provision of PIS or AIS should provide the following information: 1.1. an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, showing the coverage of the relevant liabilities; 1.2. documentation of how the applicant has calculated the minimum amount in a way that is compliant with Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, including all applicable components of the formula specified therein. CHAPTER IV INFORMATION REQUIRED FROM APPLICANTS FOR REGISTRATION AS ACCOUNT INFORMATION SERVICE PROVIDERS Article 24 Scope This Chapter applies to applicants for registration as AISP. This refers to applicants that intend to provide only AIS as defined in subparagraph 1.2.8 of Article 4 of the LPS. Should the applicant intend to provide additional services to those of AIS they should apply for authorization and refer to the provisions set out in Chapter III for PIs of this regulation. Article 25 General principles
2. Entities interested in registration as an account information service provider should meet all requirements pursuant to the LPS which are necessary for the application process and this regulation. The applicant may request from the CBK necessary forms for applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.

22 of 63 2. The application to obtain a registration as a AISP shall be submitted in writing and signed by the founders or their legal representative of the entity and shall be submitted to the CBK, with the physical presence of the founders or the legal representative of the entity. The application must be submitted together with the complete documentation/information required by the LPS and this regulation. 3. The information provided by applicants should be true, complete, accurate and up to date. All applicants should comply with all the provisions in the set of provisions in this Regulation that applies to them. The level of details should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the AISP/PI are of good repute and possess appropriate knowledge and experience to perform payment services, regardless of the institution’s size, internal organization and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position. 4. When submitting the information required, the applicant should avoid making references to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the CBK. 5. Should the CBK require clarifications on the information that has been submitted, the applicant should provide such clarification without delay. 6. All data requested under this Chapter for registration as AISP are needed for the assessment of the application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. 7. In all cases when the applicant is a foreign financial institution which applies to establish a AISP in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the registration as AISP; 8. If it considers reasonable, CBK may request additional information other than information requested under this Chapter. 9. The required documentation according to this Chapter should be in one of the two official languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States. Article 26 Identification data of the entity

1. If the applicant is a natural person, the identification details to be provided by the applicant should contain the following information: 1.1. name, address, nationality, date and place of birth; 1.2. a copy of the identity card /passport or an official equivalent identification document; 1.3. an updated curriculum vitae; 1.4. the following certificates issued by the competent authorities, according to their territorial jurisdiction not older than 3 (three) months:

23 of 63 1.4.1. that the person is not under criminal investigation; 1.4.2. that the person is not standing trial for a criminal offence; 1.4.3. that the person has not been convicted for committing a criminal offence; 1.5. the name(s) of the person(s) in charge of dealing with the application file and registration procedure, and their contact details. 2. If the applicant is a legal person, the identification details to be provided by the applicant should contain the following information: 2.1. the applicant’s corporate name and, if different, trade name; 2.2. the applicant’s business registration certificate as a legal person, issued by the Business Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as unique national identification number, if applicable; 2.3. the applicant’s legal status, founding act (if applicable) and articles of association; 2.4. the address of the applicant’s head office; 2.5. the applicant’s electronic address and website, if available; 2.6. the name of the person(s) in charge of dealing with the application file and registration procedure, and their contact details; 2.7. evidence of payment of the authorization application fees. Article 27 Program of operations

1. In accordance with Article 12, paragraph 1, subparagraph 1.1 of the LPS, the entity that applies for registration as AISP, submit to CBK the program of operations which should contain the following information: 1.1. a description of the AIS that is intended to be provided, including an explanation of how the applicant determined that the activity fits the definition of AIS as defined in Article 4 of the LPS; 1.2. a declaration of the applicant that they will not enter at any time into possession of customers/users of payment services funds; 1.3. a description of the provision of the AIS including: 1.3.1. draft contracts between all the parties involved, if applicable; 1.3.2. terms and conditions of the provision of the AIS; 1.3.3. processing times; 1.4. the estimated number of branches from which the applicant intends to provide the services, if applicable; 1.5. a description of any ancillary services to the AIS, if applicable; 1.6. a declaration of whether or not the applicant intends to provide account information services in another country once registered; 1.7. an indication of whether the applicant intends, for the next 3 (three) years, to provide, or already provides, business activities other than AIS as referred to in Article 20 of the LPS, including a description of the type and expected volume of the activities;

24 of 63 1.8. the information specified in CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee where the applicant intends to provide only AIS. 1.9. information on investments in information and communication technology systems, accompanied by a list of equipment, software, etc. Article 28 Business plan

1. In accordance with Article 12, paragraph 1, subparagraph 1.2 of the LPS, the entity that applies for registration as AISP, submits to CBK the business plan which should contain the following information: 1.1. a marketing plan consisting of: 1.1.1. an analysis of the company’s competitive position; 1.1.2. a description of AIS users in the account information market segment concerned marketing materials and distribution channels; 1.2. certified annual accounts for the previous 3 (three) years, if available, or a summary of the financial situation for those applicants that have not yet produced annual accounts; 1.3. a forecast financial situation for the first 3 (three) financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly; it should include: 1.3.1. an income statement and balance-sheet forecast, including target scenarios and stress scenarios as well as their base assumptions, such as number of clients, pricing and expected increase in profitability threshold; 1.3.2. explanations of the main lines of income and expenses, the financial debts and the capital assets; 1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three) years. Article 29 Organizational structure
2. In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, if the applicant is a natural person, the description of the organizational structure of the applicant’s undertaking should contain the following information: 1.1. an overall forecast of the staff number for the next 3 (three) years; 1.2. a description of the relevant operational outsourcing arrangements consisting of: 1.2.1. the identity and geographical location of the outsourcing provider; 1.2.2. the identities of the persons within the AISP that are responsible for each of the outsourced activities; 1.2.3. a detailed description of the outsourced activities and their main characteristics; 1.3. a copy of draft outsourcing agreements; 1.4. if applicable, a description of the use of branches and agents, including:

25 of 63 1.4.1. a mapping of the off-site and on-site checks that the applicant intends to perform of branches and agents; 1.4.2. the ICT systems, processes and infrastructure that are used by the applicant’s agents to perform activities on behalf of the applicant; 1.4.3. in the case of agents, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement; 1.5. a list of all natural or legal persons that have close links with the applicant AISP, indicating their identity and the nature of those links. 2. In accordance with Article 12, paragraph 1, subparagraph 1.12 of the LPS, if the applicant is a legal person, the description of the organizational structure of its undertaking should contain the following information: 2.1. a detailed organizational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation; 2.2. an overall forecast of the staff number for the next 3 (three) years; 2.3. a description of the relevant outsourcing arrangements consisting of: 2.3.1. the identity and geographical location of the outsourcing provider; 2.3.2. the identities of the persons within the AISP that are responsible for each of the outsourced activities; 2.3.3. a detailed description of the outsourced activities and its main characteristics; 2.4. a copy of draft outsourcing agreements; 2.5. if applicable, a description of the use of branches and agents, including: 2.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform of branches and agents; 2.5.2. the ICT systems, processes and infrastructures that are used by the applicant’s agents to perform activities on behalf of the applicant; 2.5.3. in the case of agents, the selection policy, monitoring procedures and agents’ training and, where available, the draft terms of engagement; 2.6. a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Article 30 Evidence of initial capital 2. For the evidence of initial capital to be provided by the applicant in accordance with Article 9 of the LPS and Article 4 of Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents: 2.1. for existing undertakings, an audited account statement or public register certifying the amount of capital of the applicant; 2.2. for undertakings in the process of being incorporated, a bank statement issued by a bank certifying that the funds are deposited in the applicant’s bank account.

26 of 63 Article 31 Governance arrangements and internal control mechanisms

1. In accordance with Article 12, paragraph 1, subparagraph 1.5 of the LPS, the entity that applies for registration as AISP, submits to CBK, a description of the governance arrangement and internal control mechanisms consisting of: 1.1. a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks; 1.2. the different procedures intended to carry out periodical and permanent controls, including the frequency, and the human resources allocated; 1.3. the accounting procedures by which the applicant will record and report its financial information; 1.4. the identity of the person(s) responsible for the internal control functions, including for the periodic, permanent and compliance controls, as well as an up-to-date curriculum vitae; 1.5. the identity of any auditor that is not a statutory auditor; 1.6. the composition of the management body and, if applicable, any other oversight body or committee; 1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the applicant’s internal controls; 1.8. a description of the way any agents and branches are monitored and controlled within the framework of the applicant’s internal controls; 1.9. where the applicant is the subsidiary of a regulated entity in a foreign country, a description of the group governance. Article 32 Procedure for monitoring, handling and following up on security incidents and security￾related customer complaints
2. In accordance with Article 12, paragraph 1, subparagraph 1.6 of the LPS, the entity that applies for registration as AISP, submits to CBK, a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain: 1.1. organizational measures and tools for the prevention of fraud; 1.2. details of the individuals and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; 1.3. reporting lines in cases of fraud; 1.4. contact point for customers, including a name and email address; 1.5. procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including the notification of major incidents to the CBK under Article 96 of the LPS and in accordance with CBK rules and Article 5 of the CBK Regulation, to notify the Central Bank of the Republic of Kosovo of major operational or security incidents. 1.6. monitoring tools used and the follow-up measures and procedures in place to mitigate security risks.

27 of 63 Article 33 Process in place to file, monitor, track and restrict access to sensitive payment data

1. In accordance with Article 12, paragraph 1, subparagraph 1.7 of the LPS, the entity that applies for registration as AISP, submits to CBK, a description of the process in place to file, monitor, track, and restrict access to sensitive payment data consisting of: 1.1. a description of the flow of data classified as sensitive payment data in the context of the AISP’s business model; 1.2. the procedures in place to authorize access to the sensitive payment data; 1.3. a description of the monitoring instruments; 1.4. the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; 1.5. a description of how the collected data are filed; 1.6. the expected internal and/or external use of the collected data, including by counterparties; 1.7. the ICT systems and technical security measures that have been implemented, including encryption and/or tokenization; 1.8. identification of the individual(s), bodies and/or committee(s) with access to the sensitive payment data; 1.9. an explanation of how breaches of confidentiality and integrity of information will be detected and addressed; 1.10. an annual internal control program in relation to the safety of the ICT systems. Article 34 Business continuity arrangements
2. In accordance with Article 12, paragraph 1, subparagraph 1.8 of the LPS, the entity that applies for registration as AISP, submits to CBK, a description of the business continuity arrangements consisting of the following: 1.1. a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; 1.2. the identification of the back-up site in case of activation of the business continuity plan, access to ICT infrastructure, and the key software and data to recover from a disaster or disruption; 1.3. an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; 1.4. the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded.

28 of 63 Article 35 Security policy document

1. In accordance with Article 12, paragraph 1, subparagraph 1.10 of the LPS, the entity that applies for registration as AISP, submits to CBK, a security policy document containing the following information: 1.1. a detailed risk assessment of the AIS the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect payment service users against the risks identified; 1.2. a description of the ICT systems, which should include: 1.2.1. the architecture of the systems and their network elements; 1.2.2. the business ICT systems supporting the business activities provided, such as the applicant’s website, the risk and fraud management system, and customer’s identification and accounting; 1.2.3. the support ICT systems used for the organization and administration of the AISP, such as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers and internal file servers; 1.2.4. information on whether or not those systems are already used by the AISP or its group, and the estimated date of implementation, if applicable; 1.3. the type of authorized connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; 1.4. for each of the connections listed under subparagraph 1.3, the logical security measures and mechanisms in place, specifying the control the AISP will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; 1.5. the logical security measures and mechanisms that govern the internal access to ICT systems, which should include: 1.5.1. the technical and organizational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; 1.5.2. how the issue of client environment segregation is dealt with in cases where the applicant’s ICT resources are shared; 1.6. the physical security measures and mechanisms of the premises and the data center of the applicant, such as access controls and environmental security; 1.7. the security of the payment service processes, which should include: 1.7.1. the customer authentication procedure used for consultative access; 1.7.2. an explanation of how safe delivery to the legitimate payment service user and the integrity of authentication factors, such as hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal;

29 of 63 1.7.3. a description of the systems and procedures that the applicant has in place for transaction analysis and the identification of suspicious or unusual transactions. 1.8. a detailed risk assessment in relation to its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; 1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for procedures that have not yet been formalized, an estimated date for their finalization. Article 36 Identity and assessment of suitability of shareholders/partners with qualifying holdings in the applicant

1. In accordance with Article 12, paragraph 1, subparagraph 1.13 of the LPS, the entity that applies for registration as AISP, for the purposes of the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant’s (AISP’s) capital, should submit the following information: 1.1. a description of the group to which the applicant belongs and an indication of the parent undertaking, where applicable; 1.2. a chart setting out the shareholder structure of the applicant, including: 1.2.1. the name and the percentage holding (capital/voting right) of each person that has or will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications; 1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification; 1.3. a list of the names of all persons and other entities that have or, in the case of registration, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity: 1.3.1. the number and type of shares or other holdings subscribed or to be subscribed; 1.3.2. the nominal value of such shares or other holdings.
2. Where a person who has or, in the case of registration, will have a direct or indirect qualifying holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person: 2.1. the person’s name and name at birth, date and place of birth, citizenship (current and previous), identification number (where available) and/or passport number, address and a copy of an official identity document; 2.2. a detailed curriculum vitae stating the education and training, previous professional experience, any dismissal from employment and any professional activities or other functions currently performed; 2.3. a notarial statement, accompanied by supporting documents according to their territorial jurisdiction, containing the following information concerning the person: 2.3.1. the disclosure of spent convictions, any criminal conviction or proceedings where the person has been found responsible and which were not set aside;

30 of 63 2.3.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found responsible and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 2.3.3. any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 2.3.4. any pending criminal investigations; 2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of an AISP or to the sound and prudent management of an AISP; 2.3.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether or not any of the events / circumstances set out in subparagraphs 2.3.1 to 2.3.5 has occurred in respect of the relevant person; 2.3.7. any refusal of registration, authorization, membership or license to carry out trade, business or a profession; 2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 2.3.9. any expulsion by an authority or public sector institution in the financial services sector or by a professional body or association; 2.3.10. any position of responsibility with an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them; 2.3.11. any dismissal from employment or a position of trust (fiduciary), any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 2.3.13. the borrower's certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state; 2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to CBK. 2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures;

31 of 63 2.5. where an assessment of reputation of the person has already been conducted by a competent authority in the financial services sector, the identity of that authority and the outcome of the assessment; 2.6. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 2.7. a declaration whether the person is a politically exposed person and whether it has of any links to politically exposed persons, as defined in Law on AML/CFT. 3. Where a person or entity who has or, in the case of registration, will have a direct or indirect qualifying holding in the applicant’s capital (including entities that are not a legal person and which hold or should hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity: 3.1. name; 3.2. where the legal person or entity is registered in a central register, commercial register, companies register or similar register that has the same purposes of those aforementioned, a copy of the good standing, if possible, or otherwise a registration certificate; 3.3. the addresses of its registered office and, where different, of its head office, and principal place of business; 3.4. contact details; 3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a summary explaining the main legal features of the legal form or the entity; 3.6. decision of the decision-making body of the company on participation in the capital of the AISP; 3.7. whether or not the legal person or entity has ever been or is regulated by CBK or by any other government body; 3.8. where such documents can be obtained, an official certificate or any other equivalent document evidencing the information set out above in subparagraphs 3.1 to 3.6 of this article, issued by the relevant competent authority; 3.9. the information referred to in subparagraphs 2.3, 2.4, 2.5, 2.6 and 2.7 of this article in relation to the legal person or entity; 3.10. a list containing details of each person who effectively directs the business of the legal person or entity, including their name, date and place of birth, address, their national identification number, where available, and a detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs 2.3 and 2.7 of this article in respect of each such person; 3.11. the shareholding structure of the legal person, including at least their name, date and place of birth, address and, where available, personal identification number or registration number, and the respective share of capital and voting rights of direct or indirect shareholders or partners and beneficial owners, as defined in the Law on AML/CFT; 3.12. a description of the regulated financial group of which the applicant is a part, or may become a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of competent authorities (on an individual or consolidated basis);

32 of 63 3.13. annual financial statements, at the individual and, where applicable, the consolidated and sub-consolidated group levels, for the last 3 (three) financial years, where the legal person or entity has been in operation for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been in operation and for which financial statements have been prepared), approved by the statutory auditor or audit firm in accordance with the Law on accounting, financial reporting and auditing, where applicable, including each of the following items: 3.13.1. the balance sheet; 3.13.2. the profit-and-loss accounts or income statement; 3.13.3. the annual reports and financial annexes and any other documents registered with the relevant registry or competent authority of the legal person; 3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); 3.15. where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall set out the existing financial statements (if any); 3.16. where the legal person or entity has its head office abroad, general information on the regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations); 3.17. for entities that are not legal persons such as a collective investment undertaking, a sovereign wealth fund or a trust, the application shall set out the following information: 3.17.1. the identity of the persons who manage assets and of the persons who are beneficiaries or subscribers; 3.17.2. a copy of the document establishing and governing the entity including the investment policy and any restrictions on investment applicable to the entity. 4. The application shall set out all of the following information for each natural or legal person or entity who has or, in the case of registration, will have a direct or indirect qualifying holding in the capital of the applicant: 4.1. details of that person’s or entity’s financial or business reasons for owning that holding and the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; 4.2. details of the person’s or the entity’s intentions in respect of the applicant and of the influence the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder, and the rationale for such intention; 4.3. information on the person’s or the entity’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; 4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or members in relation to the applicant;

33 of 63 4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the competent authorities; 4.6. the identity of each member of the management body or of senior management who will direct the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Article 37 of this Regulation. 5. The application should set out a detailed explanation of the specific sources of funding for the participation of each person or entity having a qualifying holding in the applicant’s capital, which should include: 5.1. notary statement of shareholders or partners for the source of paid-in capital and that the source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal. 5.2. details on the use of private financial resources, including their availability and source, to verify that the activity from which such funds were generated is legitimate and acceptable to CBK; 5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation: 5.3.1. proof on the source of capital made, such as the independent external auditor's report, annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares; 5.3.2. certificate issued by the competent authorities, which provides data on the balance of the legal person or entity and on the payment of tax obligations. 5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation: 5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank deposits or other certificates for the source of capital creation; 5.4.2. certificates proving payment of tax obligations; 6. The information requirements established in this article are applicable to the registration process of AISP and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in Article 13, paragraphs 1 and 2 of the LPS. Article 37 Identity and suitability assessment of directors and persons responsible for the management of the AISP

1. In accordance with Article 12, paragraph 1, subparagraph 1.14 of the LPS, the entity that applies for authorization as a payment institution, for the purposes of the identity and suitability assessment of directors and persons responsible for the management of the AISP, should provide the following information: 1.1. personal details, which should include:

34 of 63 1.1.1. the full name and name at birth, gender, place and date of birth, address and citizenship (current and previous), and personal identification number and/or passport number or copy of identification card or equivalent; 1.1.2. proof of university education background and documents certifying other qualifications of the person; 1.1.3. details of the position for which the assessment is sought, and whether or not the management body position is executive or non-executive, this should also include the following details: 1.1.3.1. the letter of competent body decision, contract or relevant drafts, as applicable; 1.1.3.2. the planned start date and duration of the mandate; 1.1.3.3. a description of the individual’s key duties and responsibilities; 1.2. where applicable, information on the suitability assessment carried out by the applicant, which should include details of the result of any assessment of the suitability of the individual performed by the institution, such as relevant board minutes or suitability assessment reports or other documents; 1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, and the nature and duration of the functions performed, in particular highlighting any activities within the scope of the position sought; 1.4. a declaration whether the person is a politically exposed person and whether it has of any links to politically exposed persons, as defined in Law on AML/CFT. 1.5. evidence of reputation, honesty and integrity, which should include: 1.5.1. the disclosure of spent convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside; 1.5.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found responsible and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 1.5.4. any pending criminal investigations; 1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI; 1.5.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 of this Article, has occurred in respect of the relevant person; 1.5.7. any refusal of registration, authorization, membership or license to carry out trade, business or a profession;

35 of 63 1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 1.5.9. any expulsion by an authority or public institution in the financial services sector or by a professional body or association; 1.5.10. any position of responsibility with an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any, in them; 1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 1.5.12. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to the CBK. 1.5.15. information concerning the following: 1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory authority that the individual has been directly or indirectly involved in; 1.5.15.2. refusal of registration, authorization, membership or license to carry out a trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; expulsion by a regulatory or government body, by a professional body or association; 1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or similar situation, or having been asked to resign from employment in such a position, excluding redundancies; 1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual, where required, to seek and process such information and use the provided information for the suitability assessment; 1.5.15.5. whether or not any previous assessment of the individual, on authority from another, non-financial institution, has already been conducted, including the identity of that authority and the evidence of the outcome of this assessment.

36 of 63 Article 38 Professional indemnity insurance or a comparable guarantee

1. The entity that applies for registration as account information service provider, as provisioned in Article 8, paragraph 2 and 3 of the LPS and in CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, as evidence of a professional indemnity insurance or comparable guarantee that is compliant with Regulation on professional indemnity insurance, should provide the following information: 1.1. an insurance contract or other equivalent document confirming the existence of professional indemnity insurance or a comparable guarantee, with a cover amount that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees showing the coverage of the relevant liabilities; 1.2. documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantees, including all applicable components of the formula specified therein. CHAPTER V ELECTRONIC MONEY INSTITUTIONS Article 39 Scope
2. This Chapter shall apply to applicants for authorization as EMIs and/or applicants who intend to provide e-money services and, where applicable, one or more of the payment services referred to in Article 4 subparagraph 1.2. of the LPS.
3. Applicants intending to provide only the payment services referred to in subparagraphs 1.2.1 to 1.2.7 or the service referred to in subparagraph 1.2.8 in combination with other service(s) referred to in subparagraphs 1.2.1 to 1.2.7 of Article 4 of the LPS, without providing e-money services, should refer to the specific rules on information required from applicants for authorization as PIs set out in Chapter III.
4. Applicants intending to provide only AIS without providing e-money services should refer to the rules on the information required from applicants for authorization to provide only AIS set out in Chapter IV of this Regulation. Article 40 General principles
5. Entities interested to authorize as electronic money institution should meet all requirements pursuant to the LPS which are necessary for the application process and this regulation. The applicant may request from the CBK necessary forms of applying and the instructions for completing them, only after holding the informative meeting with the CBK’s representatives.

37 of 63 2. Financial Institutions including Microfinance Institution and Non-bank Financial Institution that submit the application to be authorized as electronic money institution, shall apply all the requirements provided in LPS and this regulation for payment institutions, with the exception of the requirements of Articles 41, 54 and 55 of this Regulation. 3. The application to obtain an authorization as an electronic money institution shall be submitted in writing and signed by the founding shareholder(s) or their legal representative and shall be submitted to the CBK, with the physical presence of the founding shareholder(s) or proposed representative of the founding shareholder(s). The application must be submitted together with the complete documentation/information required by the LPS and this regulation. 4. The information provided by applicants should be true, complete, accurate and up to date. All applicants should comply with all the provisions in the set of provisions in this Regulation that applies to them. The level of detail should be proportionate to the applicant’s size and internal organization, and to the nature, scope, complexity and riskiness of the particular service(s) that the applicant intends to provide. In any event, in accordance with the LPS, the directors and the persons responsible for the management of the EMI are of good repute and possess appropriate knowledge and experience to perform e-money services and payment services, regardless of the institution’s size, internal organization and the nature, scope and complexity of its activities and the duties and responsibilities of the specific position. 5. When submitting the information required, the applicant should avoid making references to specific sections of internal procedures/documents. Instead, the applicant should extract the relevant sections and provide these to the CBK. 6. Should the CBK requires clarifications on the information that has been submitted, the applicant should provide such clarification without delay. 7. All data requested under this Chapter for registration as EMIs are needed for the assessment of the application and will be treated by the CBK in accordance with the professional secrecy obligations set out in the LPS without prejudice to applicable legal requirements and procedures on the exercise of the right to access, rectify, cancel or oppose. 8. In all cases when the applicant is a foreign financial institution which applies to establish an electronic money institution in Kosovo, a statement of the supervisor from the home country is needed, if applicable, stating that there is no objection for the establishment of operation in Kosovo and that it exercises consolidated supervision on applicants for the authorization as electronic money institution. 9. If it considers reasonable, CBK may request additional information other than information requested under this Chapter. 10. The required documentation according to this Chapter should be in one of the two official languages of the Republic of Kosovo, in original or notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation must be legalized by the responsible authorities of the respective States. Article 41 Identification data of the entity

1. The identification details to be provided by the applicant should contain the following information: 1.1. the applicant’s corporate name and, if different, trade name;

38 of 63 1.2. the applicant’s business registration certificate as a legal person, issued by the Business Registration Agency of Kosovo, in which it is defined the activity/ies for which the subject is submitting an application for authorization, as well as unique identification number; 1.3. the applicant’s legal status, founding act (if applicable) and articles of association; 1.4. the address of the applicant’s head office; 1.5. the applicant’s electronic address and website, if available; 1.6. the name(s) of the person(s) in charge of dealing with the application file and authorization procedure, and their contact details; 1.7. any trade association(s), in relation to the provision of e-money services and/or payment services, that the applicant plans to join, where applicable; 1.8. evidence of payment of the authorization application fees; Article 42 Program of operations

1. The entity that applies for authorization as an electronic money institution submits to CBK, the program of operations which should contain the following information: 1.1. an indication of the e-money services the applicant intends to provide: issuance, redemption, distribution; 1.2. if applicable, a step-by-step description of the type of payment services envisaged, including an explanation of how the activities and the operations that will be provided are identified by the applicant as fitting into any of the legal categories of payment services listed in Article 4, subparagraph 1.2 of the LPS, and an indication of whether these payment services would be provided in addition to electronic money services or whether they are linked to the issuance of electronic money; 1.3. a declaration of whether the applicant will at any point enter or not into possession of funds (obtained from the users of the payment services provided); 1.4. a description of the execution of the different e-money services and, if applicable, payment services, detailing all parties involved, for each e-money service and, if applicable, each payment service provided: 1.4.1. a diagram of flow of funds; 1.4.2. settlement arrangements; 1.4.3. draft contracts between all the parties involved in the provision of payment services including those with payment card schemes, if applicable; 1.4.4. processing times; 1.5. a copy of the draft contract between the electronic money issuer and the electronic money holder and the draft framework contract, as defined in Article 4 subparagraph 1.20 of the LPS if the applicant pretends to provide payment services in addition to e-money services; 1.6. the estimated number of branches from which the applicant intends to provide the services, if applicable; 1.7. a description of any ancillary services to e-money services and, if applicable, to payment services;

39 of 63 1.8. when the applicant intends to provide payment services in addition to e-money services, a declaration of whether or not the applicant intends to grant credit and, if so, within which limits; 1.9. a declaration of whether or not the applicant plans to provide e-money services and, if applicable, payment services abroad after the granting of the authorization; 1.10. an indication of whether or not the applicant intends, for the next 3 (three) years, to provide or already provides business activities other than e-money services and, if applicable, payment services, as referred to in Article 14 paragraph 5 of the LPS, including a description of the type and expected volume of the activities; 1.11. the information specified in Regulation on the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance or other comparable guarantee under Article 8 paragraph 4 of the LPS, where the applicant intends to provide PIS and AIS. 1.12. information on investments in information and communication technology systems, accompanied by a list of equipment, software, etc. Article 43 Business plan

1. The entity that applies for authorization as an electronic money institution submits to CBK, the business plan which should contain the following information: 1.1. a marketing plan consisting of: 1.1.1. an analysis of the entity’s competitive position in the e-money market and, if applicable, payment market segment concerned; 1.1.2. a description of the payment service users and electronic money holders, marketing materials and distribution channels; 1.2. certified annual accounts for the previous 3 (three) years, if available, or a summary of the financial situation for those companies that have not yet produced annual accounts; 1.3. a forecast financial situation calculation for the first 3 (three) financial years that demonstrates that the applicant is able to employ appropriate and proportionate systems, resources and procedures that allow the applicant to operate soundly, which should include: 1.3.1. an income statement and balance-sheet forecast and explanations of their main items, including target scenarios and stress scenarios as well as their base assumptions, such as volume and value of transactions, number of clients, pricing, average amount per transaction, expected increase in profitability threshold; 1.3.2. explanations of the main lines of income and expenses, the financial debts and the capital assets; 1.3.3. a diagram and detailed breakdown of the estimated cash flows for the next 3 (three) years; 1.4. information on, and calculation of, minimum own funds requirements in accordance with the method provided in Article 31 paragraph 3 of the LPS, if the EMI intends to provide e-money services only, or the method(s) determined by the CBK, if the applicant intends to provide payment services in addition to e-money services, including an annual projection of the breakdown of own funds for 3 (three) years according to the method used and, If applicable, an annual projection of the own funds for 3 (three) years according to the other methods used.

40 of 63 1.5. a forecast regarding the implementation of the regulatory and supervisory framework (indicators of prudence, reports, etc.) for the next 3 (three) years; 1.6. if the entity has carried out another activity, before applying for authorization as electronic money institution, the audited annual financial statements for the previous 3 (three) years, and in the case of a newer company, the audited financial statements, since its establishment. Article 44 Organizational structure

1. The entity that applies for authorization as electronic money institution submits to CBK a description of the organizational structure of its undertaking consisting of: 1.1. a detailed organizational chart, showing each division, department or similar structural separation, including the name of the person(s) responsible, in particular those in charge of internal control functions; the chart should be accompanied by a description of the functions and responsibilities of each division, department or similar structural separation; 1.2. an overall forecast of the staff numbers for the next 3 (three) years; 1.3. a description of the relevant operational outsourcing arrangements consisting of: 1.3.1. the identity and geographical location of the outsourcing provider; 1.3.2. the identity of the persons within the EMI that are responsible for each of the outsourced activities; 1.3.3. a clear description of the outsourced activities and their main characteristics; 1.4. a copy of draft outsourcing agreements; 1.5. a description of the use of branches, agents and distributors, where applicable, including: 1.5.1. a mapping of the off-site and on-site checks that the applicant intends to perform of branches, agents and distributors; 1.5.2. the ICT systems, processes and infrastructure that are used by the applicant’s agents and distributors to perform activities on behalf of the applicant; 1.5.3. in the case of agents and distributors, the selection policy, monitoring procedures, agents’ and distributor’s training and, where available, the draft terms of engagement of agents and distributors; 1.6. an indication of the national and/or international payment system that the applicant will access, if applicable; 1.7. a list of all natural or legal persons that have close links with the applicant, indicating their identities and the nature of those links. Article 45 Evidence of initial capital
2. For the evidence of initial capital to be provided by the applicant (of EUR 350,000) in accordance with Article 30 of LPS and Article 4 of Regulation on Initial Capital and Own Funds for Payment Institutions and Electronic Money Institutions, the applicant should submit the following documents: 1.1. for existing undertakings, an audited account statement or public register certifying the amount of capital of the applicant;

41 of 63 1.2. for undertakings in the process of being incorporated, a bank statement issued by a bank certifying that the funds are deposited in the applicant’s bank account. Article 46 Measures to safeguard the funds of electronic money users and/or payment service users

1. Where the applicant safeguards the electronic money users’ and/or payment service users’ funds through depositing funds in a separate account in a bank or through an investment in secure, liquid, low-risk assets, the description of the safeguarding measures should contain: 1.1. a description of the investment policy to ensure the assets chosen are liquid, secure and low risk, if applicable; 1.2. the number of persons that have access to the safeguarding account and their functions; 1.3. a description of the administration and reconciliation process for electronic money users and, if applicable, payment service users, against the claims of other creditors of the EMI, in particular in the event of insolvency; 1.4. a copy of the draft contract with the banks; 1.5. an explicit declaration by the EMI of compliance with Article 33 of the LPS.
2. Where the applicant safeguards the funds of the electronic money users and, if applicable, the payment service users through an insurance policy or comparable guarantee from an insurance company or bank, and unless the applicant intends to provide PIS only, the description of the safeguarding measures, setting out the following: 2.1. a confirmation that the insurance policy or comparable guarantee from an insurance company or bank is from an entity that is not part of the same group of firms as the applicant; 2.2. details of the reconciliation process in place to ensure that the insurance policy or comparable guarantee is sufficient to meet the applicant’s safeguarding obligations at all times; 2.3. duration and renewal of the coverage; 2.4. a copy of the (draft) insurance agreement or (draft) comparable guarantee. Article 47 Governance arrangements and internal control mechanisms
3. The entity that applies for authorization as an electronic money institution, should provide a description of the governance arrangement and internal control mechanisms consisting of: 1.1. a mapping of the risks identified by the applicant, including the type of risks and the procedures the applicant will put in place to assess and prevent such risks, in relation to e￾money services and, if applicable, payment services; 1.2. the different procedures to carry out periodical and permanent controls, including the frequency and the human resources allocated; 1.3. the accounting procedures by the which the applicant will record and report its financial information; 1.4. the identity of the person(s) responsible for the internal control functions, including for periodic, permanent and compliance control, as well as an up-to-date curriculum vitae; 1.5. the identity of any auditor that is not a statutory auditor;

42 of 63 1.6. the composition of the management body and, if applicable, any other oversight body or committee; 1.7. a description of the way outsourced functions are monitored and controlled so as to avoid an impairment in the quality of the EMI’s internal controls; 1.8. a description of the way any agents, branches and distributors are monitored and controlled within the framework of the applicant’s internal controls; 1.9. where the applicant is the subsidiary of a regulated entity in a foreign country, a description of the group governance. Article 48 Procedure for monitoring, handling and following up on security incidents and security￾related customer complaints

1. The entity that applies for authorization as an electronic money institution, should provide a description of the procedure in place to monitor, handle and follow up on security incidents and security-related customer complaints to be provided by the applicant, which should contain: 1.1. organizational measures and tools for the prevention of fraud; 1.2. details of the individuals and bodies responsible for assisting customers in cases of fraud, technical issues and/or claim management; 1.3. reporting lines in cases of fraud; 1.4. the contact point for customers, including a name and email address; 1.5. the procedures for the reporting of incidents, including the communication of these reports to internal or external bodies, including for applicants that intend to provide payment services in addition to e-money services, and the notification of major incidents to the CBK under Article 96 of the LPS and in accordance with the CBK rules and Article 5 of CBK Regulation, to notify the Central Bank of the Republic of Kosovo of major operational or security incidents. 1.6. monitoring tools used, the follow-up measures and procedures in place to mitigate security risks. Article 49 Process for filing, monitoring, tracking and restricting access to sensitive payment data
2. The entity that applies for authorization as an electronic money institution, should provide a description of the process in place to file, monitor, track and restrict access to sensitive payment data consisting of: 1.1. a description of the flows of data classified as sensitive payment data in the context of the EMI’s business model; 1.2. the procedures in place to authorize access to the sensitive payment data; 1.3. a description of the monitoring tool; 1.4. the access right policy, detailing access to all relevant infrastructure components and systems, including databases and back-up infrastructures; 1.5. a description of how the collected data are filed; 1.6. the expected internal and/or external use of the collected data, including by counterparties;

43 of 63 1.7. the ICT system and technical security measures that have been implemented, including encryption and/or tokenization; 1.8. identification of the individuals, bodies and/or committees with access to the sensitive payment data; 1.9. an explanation of how breaches of confidentiality and integrity of information will be detected and addressed; 1.10. an annual internal control program in relation to the safety of the ICT systems. Article 50 Business continuity arrangements

1. The entity that applies for authorization as an electronic money institution, should provide a description of the business continuity arrangements consisting of the following information: 1.1. a business impact analysis, including the business processes and recovery objectives, such as recovery time objectives, recovery point objectives and protected assets; 1.2. the identification of the back-up site in case of activation of the business continuity plan and access to ICT infrastructure, and the key software and data to recover from a disaster or disruption; 1.3. an explanation of how the applicant will deal with significant continuity events and disruptions, such as the failure of key systems; the loss of key data; the inaccessibility of the premises; and the loss of key persons; 1.4. the frequency with which the applicant intends to test the business continuity and disaster recovery plans, including how the results of the testing will be recorded; 1.5. a description of the mitigation measures to be adopted by the applicant, in cases of the termination of its payment services, ensuring the execution of pending payment transactions and the termination of existing contracts. Article 51 Principles and definitions applicable to the collection of statistical data on performance, transactions and fraud
2. The entity that applies for authorization as an electronic money institution should provide a description of the principles and definitions applicable to the collection of the statistical data on performance, transactions and fraud consisting of the following information: 1.1. the type of data that is collected, in relation to customers, type of payment service, channel, instrument, jurisdictions and currencies; 1.2. the scope of the collection, in terms of the activities and entities concerned, including branches, agents and distributors; 1.3. the means of collection; 1.4. the purpose of collection; 1.5. the frequency of collection; 1.6. supporting documents, such as a manual, that describe how the system works.

44 of 63 Article 52 Security policy document

1. The entity that applies for authorization as an electronic money institution should provide a security policy document in relation to its e-money service(s) and, where applicable, payment service(s) containing the following information: 1.1. a detailed risk assessment of the e-money service(s) and, where applicable, the payment service(s) the applicant intends to provide, which should include risks of fraud and the security control and mitigation measures taken to adequately protect e-money service users and, where applicable, payment service users against the risks identified; 1.2. a description of the ICT systems, which should include: 1.2.1. the architecture of the systems and their network elements; 1.2.2. the business ICT systems supporting the business activities provided, such as the applicant’s website, wallets, the payment system, the risk and fraud management system, customer’ identification and accounting; 1.2.3. the support ICT systems used for the organization and administration of the EMI, such as accounting, legal reporting systems according to regulatory requirements, staff management, customer relationship management, e-mail servers, internal file servers; 1.2.4. information on whether those systems are already used by the EMI or its group, and the estimated date of implementation, if applicable; 1.3. the type of authorized connections from outside, such as with partners, service providers, entities of the group and employees working remotely, including the rationale for such connections; 1.4. for each of the connections listed under subparagraph 1.3, the logical security measures and mechanisms in place, specifying the control the EMI will have over such access as well as the nature and frequency of each control, such as technical versus organizational; preventative versus detective; and real-time monitoring versus regular reviews, such as the use of an active directory separate from the group, the opening/closing of communication lines, security equipment configuration, generation of keys or client authentication certificates, system monitoring, authentication, confidentiality of communication, intrusion detection, antivirus systems and logs; 1.5. the logical security measures and mechanisms that govern the internal access to ICT systems, which should include: 1.5.1. the technical and organizational nature and frequency of each measure, such as whether it is preventative or detective and whether or not it is carried out in real time; 1.5.2. how the issue of client environment segregation is dealt with in cases where the applicant’s ICT resources are shared; 1.6. the physical security measures and mechanisms of the premises and the data center of the applicant, such as access controls and environmental security; 1.7. the security of the e-money and, where applicable, payment processes, which should include: 1.7.1. the customer authentication procedure used for both consultative and transactional access, and for all underlying payment instruments; 1.7.2. an explanation of how safe delivery to the legitimate e-money services user and, where applicable, payment service user and the integrity of authentication factors, such as

45 of 63 hardware tokens and mobile applications, are ensured, at the time of both initial enrolment and renewal; 1.7.3. a description of the systems and procedures that the EMI has in place for transaction analysis and the identification of suspicious or unusual transactions; 1.8. a detailed risk assessment in relation to its e-money services and, where applicable, its payment services, including fraud, with a link to the control and mitigation measures explained in the application file, demonstrating that the risks are addressed; 1.9. a list of the main written procedures in relation to the applicant’s ICT systems or, for procedures that have not yet been formalized, an estimated date for their finalization. Article 53 Internal control mechanisms to comply with obligations in relation to money laundering and terrorism financing (AML/CFT obligations)

1. The description of the internal control mechanisms that the entity that applies for authorization as an electronic money institution has established in order to comply, where applicable, with those obligations, should contain the following information: 1.1. the applicant’s assessment of the money laundering and terrorist financing risks associated with its business, including the risks associated with the applicant’s customer base, the products and services provided, the distribution channels used and the geographic areas of operation; 1.2. the measures the applicant has or will put in place to mitigate the risks and comply with applicable AML/CFT obligations, including the applicant’s risk assessment process, the policies and procedures to comply with customer due diligence requirements, and the policies and procedures to detect and report suspicious transactions or activities; 1.3. the systems and controls the applicant has or will put in place to ensure that its branches, agents and distributors comply with applicable AML/CFT requirements, including, in cases where the agent, distributor or branch is located abroad; 1.4. arrangements the applicant has or will put in place to ensure that staff, agents and distributors are appropriately trained in AML/CFT matters; 1.5. the identity of the person in charge of ensuring the applicant’s compliance with AML/CFT obligations, and evidence that their AML/CFT expertise is sufficient to enable them to fulfil this role effectively; 1.6. the systems and controls the applicant has or will put in place to ensure their AML/CFT policies and procedures remain up to date, effective and relevant; 1.7. the systems and controls the applicant has or will put in place to ensure that the agents and distributors do not expose the applicant to increased money laundering and terrorist financing risk; 1.8. the AML/CFT manual for the staff of the applicant.

46 of 63 Article 54 Identity and suitability assessment of shareholders/partners with qualified holdings in the applicant entity EMI

1. The entity that applies for authorization as an electronic money institution, for the purposes of meeting the requirements on the identity and evidence of the suitability of shareholders/partners with qualifying holdings in the applicant EMI’s capital, should submit to CBK the following information: 1.1. a description of the group to which the applicant belongs and an indication of the parent undertaking, where applicable; 1.2. a chart setting out the shareholder structure of the applicant, including: 1.2.1. the name and the percentage holding (capital/voting right) of each person that has or will have a direct holding in the share capital of the applicant, identifying those that are considered as qualifying holders and the reason for such qualifications; 1.2.2. the name and the percentage holding (capital/voting rights) of each person that has or will have an indirect holding in the share capital of the applicant, identifying those that are considered as indirect qualifying holders and the reason for such qualification; 1.3. a list of the names of all persons and other entities that have or, in the case of authorization, will have qualifying holdings in the applicant’s capital, indicating for each such person or entity: 1.3.1. the number and type of shares or other holdings subscribed or to be subscribed; 1.3.2. the nominal value of such shares or other holdings.
2. Where a person who has or, in the case of authorization, will have a direct or indirect qualifying holding in the applicant’s capital is a natural person, the application should set out all of the following information relating to the identity and suitability of that person: 2.1. the person’s name and name at birth, date and place of birth, citizenship (current and previous), identification number (where available) and/or passport number, address and a copy of an official identity document; 2.2. a detailed curriculum vitae stating the education and training, previous professional experience, any dismissal from employment and any professional activities or other functions currently performed; 2.3. a notarial statement, accompanied by supporting documents according to their territorial jurisdiction, containing the following information concerning the person: 2.3.1. the disclosure of past convictions, any criminal conviction or proceedings where the person has been found responsible against and which were not set aside; 2.3.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found responsible against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 2.3.3. any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 2.3.4. any pending criminal investigations;

47 of 63 2.3.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered to be relevant to the authorization to commence the activity of an EMI or to the sound and prudent management of an EMI; 2.3.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether any of the events/circumstances set out in subparagraphs 2.3.1 to 2.3.5 of this regulation, has occurred in respect of the relevant person; 2.3.7. any refusal of registration, authorization, membership or license to carry out trade, business or a profession; 2.3.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 2.3.9. any expulsion by an authority or public institution in the financial services sector or by a professional body or association; 2.3.10. any position of responsibility with an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any; 2.3.11. any dismissal from employment or a position of trust, any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 2.3.12. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 2.3.13. the borrower's certificate or report from the credit registry or an equivalent document issued by the competent authorities of the foreign state 2.3.14. the aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to CBK. 2.4. a list of undertakings that the person directs or controls and of which the applicant is aware of after due and careful enquiry; the percentage of control either direct or indirect in these companies; their status (whether or not they are active, dissolved, etc.); and a description of insolvency or similar procedures; 2.5. where an assessment of reputation of the person has already been conducted by a competent authority in the financial services sector, the identity of that authority and the outcome of the assessment; 2.6. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 2.7. a declaration whether the person is a politically exposed person and whether it has any links to politically exposed persons, as defined in Law on AML/CFT. 3. Where a person or entity who has or, in the case of authorization, will have a qualifying holding in the applicant’s capital (including entities that are not a legal person and which hold or should

48 of 63 hold the participation in their own name), the application should contain the following information relating to the identity and suitability of that legal person or entity: 3.1. name; 3.2. where the legal person or entity is registered in a central register, commercial register, companies register or similar register that has the same purposes of those aforementioned, an evidence of its status, where applicable, or a registration certificate; 3.3. the addresses of its registered office and, where different, of its head office, and principal place of business; 3.4. contact details; 3.5. corporate documents, the statute of the company, or, where the person is registered abroad, a summary explaining the main legal features of the legal form or the entity; 3.6. decision of the decision-making body of the company on participation in the capital of the electronic money institution; 3.7. whether or not the legal person or entity has ever been or is regulated by a CBK or by any other government body; 3.8. where such documents can be obtained, an official certificate or any other equivalent document evidencing the information set out in subparagraphs 3.1 to 3.6 of this regulation, issued by the relevant competent authority; 3.9. the information referred to in in subparagraphs 2.3 to 2.7 of paragraph 2 of this Article in relation to the legal person or entity; 3.10. a list containing details of each person who effectively directs the business of the legal person or entity, including their name, date and place of birth, address, their national identification number, where available, and detailed curriculum vitae (stating relevant education and training, previous professional experience, any professional activities or other relevant functions currently performed), together with the information referred to in subparagraphs 2.3 and 2.7 of paragraph 2 of this Article in respect of each such person; 3.11. the shareholding structure of the legal person, including at least their name, date and place of birth, address and, where available, personal identification number or registration number and the respective share of capital and voting rights of direct or indirect shareholders or members and beneficial owners, as defined in Law on AML/CFT; 3.12. a description of the regulated financial group of which the applicant is a part, or may become a part, indicating the parent undertaking and the credit, insurance and security entities within the group; the name of their competent authorities (on an individual or consolidated basis); 3.13. annual financial statements, at the individual and, where applicable, the consolidated and sub-consolidated group levels, for the last 3 (three) financial years, where the legal person or entity has been operating for that period (or, if less than 3 (three) years, the period for which the legal person or entity has been operating and financial statements were prepared), audited by the statutory auditor or audit firm, where applicable, including each of the following subparagraphs: 3.13.1. the balance sheet; 3.13.2. the profit-and-loss accounts or income statement; 3.13.3. the annual reports and financial annexes and any other documents registered with the relevant registry or competent authority of the legal person;

49 of 63 3.14. certificate by competent authorities on compliance with fiscal duties (for foreign legal persons - legally equivalent documents in accordance with the respective foreign legislation/jurisdiction); 3.15. where the legal person has not been operating for a sufficient period to be required to prepare financial statements for the 3 (three) financial years immediately prior to the date of the application, the applicant shall prepare the existing financial statements (if any); 3.16. where the legal person or entity has its head office in abroad, general information on the regulatory framework of that jurisdiction as applicable to the legal person or entity, including information on the extent to which that jurisdiction’s AML/CFT framework is consistent with the Financial Action Task Force Recommendations (FATF Recommendations); 3.17. for entities that are not legal persons such as a collective investment undertaking, a sovereign wealth fund or a trust, the application shall set out the following information: 3.17.1. the identity of the persons who manage assets and of the persons who are beneficiaries or subscribers, unit holders controlling the collective investment undertaking or having a holding enabling them to prevent the taking of decisions by the collective investment undertaking; 3.17.2. a copy of the document establishing and governing the entity including the investment policy and any restrictions on investment applicable to the entity. 4. The application shall set out all of the following information for each natural or legal person or entity who has or, in the case of authorization, will have a direct or indirect qualifying holding in the capital of the applicant: 4.1. details of that person’s or entity’s financial or business reasons for owning that holding and the person’s or the entity’s strategy regarding the holding, including the period for which the person or the entity intends to hold the holding and any intention to increase, reduce or maintain the level of the holding in the foreseeable future; 4.2. details of the person’s or entity’s intentions in respect of the applicant and of the influence the person or the entity intends to exercise over the applicant, including in respect of the dividend policy, the strategic development and the allocation of resources of the applicant, whether or not it intends to act as an active minority shareholder and the rationale for such intention; 4.3. information on the person’s or the entity’s willingness to support the applicant with additional own funds if needed for the development of its activities or in the case of financial difficulties; 4.4. the content of any intended shareholder’s or member’s agreements with other shareholders or members in relation to the applicant; 4.5. an analysis as to whether or not the qualifying holding will impact in any way, including as a result of the person’s close links to the applicant, on the ability of the applicant to provide timely and accurate information to the CBK; 4.6. the identity of each member of the management body or of senior management who will direct the business of the applicant and will have been appointed by, or following a nomination from, such shareholders or members, together with, to the extent not already provided, the information set out in Article 55 of this regulation. 5. The application should set out a detailed explanation of the specific sources of funding for the participation of each person or entity having a qualifying holding in the applicant’s capital, which should include:

50 of 63 5.1. notary statement of shareholders or partners for the source of paid-in capital and that the source of this capital is not a public borrowed fund, credit and/or other funds, the origin of which is illegal. 5.2. details on the use of private financial resources, including their availability and source to verify that the activity from which such funds were generated is legitimate and acceptable to the CBK;; 5.3. for shareholders organized as legal person or entity, notary statement of shareholders on the source of the initial capital paid and for any additional ones during the performance of the activity, must be accompanied by the following documentation: 5.3.1. proof on the source of capital made, such as the independent external auditor's report, annual financial statements, gifts or other resources intended to be used in the purchase of the applicant's shares; 5.3.2. certificate issued by the competent authorities, which provides data on the balance of the legal person or entity and on the payment of tax obligations. 5.4. for shareholders as individuals or natural persons, notarial declaration of shareholders on the source of the initial capital paid and for any additional ones during the development of the activity, must be accompanied by the following documentation: 5.4.1. proof on the source of capital creation such as buying and selling, gifts, wages, bank deposits or other certificates for the source of capital creation; 5.4.2. certificates proving payment of tax obligations; 6. The information requirements established in this article are applicable to the authorization process of payment institutions and to the approval process in any situation of change in direct or indirect qualifying holding of shareholding or quotas, as referred to in article 13, paragraphs 1 and 2 of the LPS. Article 55 Identity and suitability assessment of directors and persons responsible for the management of the EMI

1. The entity that applies for authorization as an electronic money institution, for the purposes of the identity and suitability assessment of directors and persons responsible for the management of the EMI, should submit to CBK the following information: 1.1. personal details including: 1.1.1. their full name and name at birth, gender, place and date of birth, address and citizenship (current and previous), and personal identification number and/or passport number or copy of identification card or equivalent; 1.1.2. proof of university education background and documents certifying other qualifications of the person; 1.1.3. details of the position for which the assessment is sought, whether or not the management body position is executive or non-executive. This should also include the following details: 1.1.3.1. the competent body decision of appointment or contract, as applicable; 1.1.3.2. the planned start date and duration of the mandate;

51 of 63 1.1.3.3. a description of the individual’s key duties and responsibilities. 1.2. where applicable, information on the suitability assessment carried out by the applicant which should include details of the result of any assessment of the suitability of the individual performed by the respective institution, such as relevant board minutes or suitability assessment reports or other documents; 1.3. evidence of knowledge, skills and experience, which should include a curriculum vitae containing details of education and professional experience, including academic qualifications, other relevant training, the name and nature of all organizations for which the individual works or has worked, the nature, and duration of the functions performed, in particular highlighting any activities within the scope of the position sought; 1.4. a declaration whether the person is a politically exposed person and whether it has of any links to politically exposed persons, as defined in Law on AML/CFT. 1.5. evidence of reputation, honesty and integrity, which should include: 1.5.1. the disclosure of past convictions, any criminal conviction or proceedings where the person has been found against and which were not set aside; 1.5.2. any civil or administrative decisions in matters of relevance to the assessment or authorization process where the person has been found against and any administrative sanctions or measures imposed as a consequence of a breach of laws or regulations (including disqualification as a company director), in each case which were not set aside and against which no appeal is pending or may be filed; 1.5.3. any insolvency case and that the person has not been responsible for the bankruptcy, or similar procedures of any entity exercising economic activity; 1.5.4. any pending criminal investigations; 1.5.5. any civil or administrative investigations, enforcement proceedings, sanctions or other enforcement decisions against the person concerning matters that may be considered relevant to the authorization to commence the activity of a PI or to the sound and prudent management of a PI; 1.5.6. where such documents can be obtained, an official certificate or any other equivalent document evidencing whether or not any of the events set out in subparagraphs 1.5.1 to 1.5.5 of this regulation, has occurred in respect of the relevant person; 1.5.7. any refusal of registration, authorization, membership or license to carry out trade, business or a profession; 1.5.8. any withdrawal, revocation or termination of a registration, authorization, membership or license to carry out trade, business or a profession; 1.5.9. any expulsion by an authority or public sector entity in the financial services sector or by a professional body or association; 1.5.10. any position of responsibility with an entity subject to any criminal conviction or proceedings, administrative investigations, sanctions or other enforcement decisions for conduct failings, including in respect of fraud, dishonesty, corruption, money laundering, terrorist financing or other financial crime, or of failure to put in place adequate policies and procedures to prevent such events, held at the time when the alleged conduct occurred, together with details of such occurrences and of the person’s involvement, if any;

52 of 63 1.5.11. any dismissal from employment or a position of trust, any removal from a fiduciary relationship (other than as a result of the relevant relationship coming to an end by passage of time) and any similar situation; 1.5.12. the current financial position of the person, including details concerning sources of revenues, assets and liabilities, security interests and guarantees, whether granted or received; 1.5.13. that the person is not under a mandatory execution process, for outstanding liabilities, as certified by the Bailiff’s Office; 1.5.14. The aforementioned documents must be issued no earlier than 3 (three) months from the date of the application submission to CBK. 1.5.15. information concerning the following: 1.5.15.1. investigations, enforcement proceedings or sanctions by a supervisory authority that the individual has been directly or indirectly involved in; 1.5.15.2. refusal of registration, authorization, membership or license to carry out a trade, business or profession; the withdrawal, revocation or termination of registration, authorization, membership or license; or expulsion by a regulatory or government body or by a professional body or association; 1.5.15.3. dismissal from employment or a position of trust, fiduciary relationship or similar situation, or having been asked to resign from employment in such a position, excluding redundancies; 1.5.15.4. whether or not an assessment of reputation of the individual as an acquirer or a person who directs the business of an institution has already been conducted by another competent authority, including the identity of that authority, the date of the assessment and evidence of the outcome of this assessment, and the consent of the individual where required to seek such information to be able to process and use the provided information for the suitability assessment; 1.5.15.5. whether or not any previous assessment of the individual has been carried out by any authority from another non-financial sector, including the identity of that authority and evidence of the outcome of such assessment. Article 56 Identity of statutory auditors and audit firms The identity of statutory auditors or audit firms to be provided by the applicant, where relevant, should contain the names, addresses and contact details of auditors. Article 57 Professional indemnity insurance or a comparable guarantee for PIS and AIS

1. As evidence of a professional indemnity insurance or comparable guarantee that is compliant with CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee and Article 8 paragraphs 2 and 3 of the LPS, the applicant for authorization as EMIs that, in addition to e-money services, intends to provide PIS or AIS, should provide the following information:

53 of 63 1.1. an insurance contract or other equivalent document confirming the existence of the professional indemnity insurance or comparable guarantee, with a cover amount that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee, showing the coverage of the respective liabilities; 1.2. documentation of how the applicant has calculated the minimum amount in a way that is compliant with the referred CBK Regulation on the criteria on how to stipulate the minimum monetary amount of the professional insurance or other comparable guarantee, including all applicable components of the formula specified therein. CHAPTER VI AUTHORIZATINON AND REGISTRATION Article 58 Authorization/registration procedures and conditions

1. CBK, for the authorization of payment institutions (PI) and electronic money institutions (EMI) and for registration of account information services providers (AISP), shall review the documents submitted in accordance with the requirements set out in LPS and in this regulation. 1.1. CBK shall, within 90 (ninety) days from the day of receiving the application, review the documentation submitted and inform the applicant in writing stating whether the application is completed or not; 1.2. if the documentation submitted is not completed and/or does not fulfil the requirements determined under LPS and this regulation, CBK shall notify the applicant regarding the deficiencies or discrepancies with the legal provisions of LPS and this Regulation together with a request for additional information or documents required. The deadline for submission of additional information or documents is, according to this paragraph, not later than 90 (ninety) days from the day of notification; 1.3. if the additional information or documents required under paragraph 1.2 of this Article are submitted within the deadline, then CBK shall inform the party that the application is complete; 1.4. The CBK shall suspend review procedures for the authorization/ registration application if the data and/or documentation requested for authorization/ registration are not provided by the applicant within 90 (ninety) days after the notification under paragraph 1.2 of this Article. In case of suspension of procedures for reviewing the application for authorization/ registration, CBK shall inform the applicant in writing; 1.5. CBK shall issue a decision whereby approves or rejects authorization as a payment institutions and electronic money institutions or registration as account information services providers within 90 (ninety) days from the day of informing the applicant that the authorization/registration application is complete. CBK shall immediately inform the applicant with regard to the decision reached. 1.6. during the period of reviewing the application, CBK may request additional information or certain changes/ improvements, if reasonable.

54 of 63 2. CBK may inspect the premises/offices, where the institution shall conduct the activities for which it requires to be authorized/registered, to verify whether the technical and security conditions are met to conduct these activities, in compliance with the by-laws issued by CBK. 3. The documentation provided in this regulation must be in Albanian language, in original or in notarized copy. In the case of documentation issued by the relevant official authorities in foreign countries, other than the Republic of Kosovo, the documentation must also be legalized by the responsible authorities. 4. CBK, if it deems it reasonable, may request the submission of updated certificates on the judicial status, criminal prosecution and the status of tax liabilities issued by the competent bodies, in case the validity period of the submitted documentation expires before the date of authorizer’s approval, registration and other approvals. 5. CBK shall decide to grant the authorization/registration only after it is convinced that the entity complies with the requirements set out in article 14 of LPS and in this Regulation. 5.1. The CBK shall decide to approve authorization/registration if the following conditions are fulfilled: 5.1.1. shareholders/partners have a good reputation, legal source of capital funds, financial capabilities for investing planned funds and financial capabilities for conducting the necessary financing for the sustainable continuation of this institution’s activity; 5.1.2. the shareholding capital committed is paid; 5.1.3. qualifications, experience and reputation of directors and persons responsible for the management of institutions, are adequate for implementing the business plan, as provided for in Article 12 of this Regulation; 5.1.4. the business plan submitted should be real and competitive in the market, and the expected financial state of the institution proposed should be satisfactory. 5.2. The CBK rejects the approval of the application in the following cases: 5.2.1. the conditions determined in article 14 of LPS and above under sub-paragraph 5.1, paragraph 5 of this Article are not met; 5.2.2. jeopardizes the financial viability of the proposed institution or the system of payment institutions, electronic money institutions or account information services providers in general; 5.2.3. one of the shareholders has been subject to insolvency filing procedures, including official administration or bankruptcy; 5.2.4. if the origin of the invested share capital is not clear to the CBK; 5.2.5. when at least one of the shareholders/ partners owns bearer shares or is a nominee shareholder (if applicable); 5.2.6. when at least one of the shareholders/ partners has a complex ownership and control structure; 5.2.7. when at least one of the shareholders/ partners is a shell bank; 5.2.8. when at least one of the shareholders/ partners represents high risk, based on the evaluations of the CBK. 5.2.9. false information is provided in the application.

55 of 63 5.3. CBK shall refuse the granting of authorization/registration, in any case when it judges that the authorization/registration of the entity would infringe the public interest. 5.4. The reasons based on which the approval of authorization/registration is rejected shall be clarified in the notice on rejection of authorization/registration. 5.5. The CBK, in order to carry out the assessments set out in this Article, in addition to reviewing the documentation submitted, shall cooperate and may request information from peer supervisory authorities and institutions specialized in combating economic crime, prevention of money laundering; the tax authorities; Competition Authority or any other relevant local or international/foreign institution. Article 59 Publication of decision on granting the authorization

1. CBK shall publish the decision on granting the authorization/registration to operate as a payment institution, electronic money institution or account information services providers.
2. The decision shall be published in the official website of CBK.
3. CBK shall register in the authorized/registered entities’ register, the payment institution, the electronic money institution, the account information services providers and the list of their agents (if applicable) with their data, in compliance with CBK’s by-laws. Article 60 Applicable Fees
4. Payment institutions, electronic money institutions and account information services providers applying for authorization/registration shall pay the application fee, according to the amount determined by the CBK. The fee paid shall be non-refundable in case of refusal of authorization/registration.
5. After authorization/registration, the payment institutions, electronic money institutions and account information services providers shall pay other fees according to the amounts determined by the CBK. Article 61 Registration characteristics
6. Authorization/Registration shall be granted for an indefinite period of time and shall be non￾transferable and non-tradable.
7. The authorization for the payment institution encompasses the words “payment institution” in addition to the name of the institution.
8. The authorization for the electronic money institution encompasses the words “electronic money institution” in addition to the name of the institution.
9. The registration for the account information services providers encompasses the words “account information services providers” in addition to the name of the institution.
10. After authorization/registration, the payment institutions, electronic money institutions or account information services providers shall commence operations within 12 (twelve) months from the date of notification for authorization/registration.

56 of 63 6. If the payment institutions, electronic money institutions or account information services providers do not commence operation within the deadlines under paragraph 5 of this Article, the authorization/registration approved by the CBK shall be revoked. The institution may re-apply for authorization/registration. 7. The payment institutions, electronic money institutions or account information services providers authorization/registration certificate shall be issued in accordance with the Regulation on Issuance of Licensing or Registration Certificates of financial institutions. 8. The payment institutions, electronic money institutions or account information services providers shall, before the commencement of financial activity, notify the CBK for the preparations made and its readiness to start the activity, for creating space and adequate infrastructure to carry out activities, including installing the information technology operating system. Article 62 Revocation or suspension of authorization/registration

1. The payment institutions, electronic money institutions or account information services providers authorization/registration could be revoked only upon the CBK’s decision if one or more of condition specified in article 16 of LPS.
2. The payment institutions, electronic money institutions or account information services providers authorization/registration shall be revoked by a CBK decision if the payment institutions, electronic money institutions or account information services providers is deemed insolvent or it is reasonably assessed that they are likely to become insolvent.
3. For the purposes of this Article, “insolvent” shall mean that the payment institutions, electronic money institutions or account information services providers is not paying its obligations or the value of the payment institutions, electronic money institutions or account information services providers obligations exceeds the value of its assets. The value of the payment institutions, electronic money institutions or account information services providers assets, liabilities and regulative capital is determined in accordance with the assessment standards and procedures set by the CBK.
4. The CBK may, when it deems it appropriate, decide to suspend the authorization/registration of the payment institutions, electronic money institutions or account information services providers. In such cases the periods and other conditions relating to the suspension shall be determined by decision of the CBK. CHAPTER VII APPROVAL AND OBLIGATION FOR NOTIFICATION Article 63 Prior approvals
5. Without the prior approval of CBK, the payment institution and the electronic money institution may not: 1.1. change of name; 1.2. changes to the founding document and/or statute;

57 of 63 1.3. increase of share capital; 1.4. reduction of capital; 1.5. change in qualifying holding; 1.5.1. this subparagraph is not applicable for foreign branches of payment institution and electronic money institutions; 1.6. appointment of directors and persons responsible for the management; 1.6.1. the requirements for the approval of directors and persons responsible for the management according to this article are also applicable to the appointment of the internal auditor; 1.6.2. the approval process is repeated for each reappointment or extension of the mandate. 1.7. opening and relocation of offices inside the country; 1.7.1. for the purposes of this Regulation, relocation of the PI’s and EMI’s offices inside the country means the change of location of the respective office within the territory of the same municipality; 1.8. sale or transfer (complete or partial) of the payment institutions and electronic money institutions’ portfolio to another entity; 1.9. merger and/or acquisition; 1.10. dividend distribution. 2. The CBK shall approve or reject the transaction under paragraph 1 of this Article within 2 (two) months of the date of completion of the request, based on the documentation specified in paragraphs 3 and 4 of this Article. 3. For approving transactions under paragraph 1 of this Article, the payment institutions and electronic money institutions shall present a written request accompanied by the following documentation: 3.1. change of the name: 3.1.1. decision by the decision-making body; and 3.1.2. written reasoning for such change. 3.2. amendments to the founding act and/or statute: 3.2.1. decision by the decision-making body; 3.2.2. amended founding act and/or statute; 3.2.3. written reasoning for such amendment to the founding act and/or statute. 3.3. increase of share capital: 3.3.1. if the payment institutions and electronic money institutions’ share capital is increased from internal sources: 3.3.1.1. statement on source of capital increase; 3.3.1.2. the payment institutions and electronic money institutions’ external audit report for previous year; 3.3.1.3. financial statements of last period reported to the CBK, which prove the sufficiency of these sources within the payment institutions and electronic money institutions’ capital structure.

58 of 63 3.3.2. if the payment institutions and electronic money institutions’ share capital is increased from external sources, requirements of Article 20 and Article 54 of this Regulation shall apply. 3.4. reduction of share capital: 3.4.1. decision by the decision-making body; 3.4.2. description of the impact of such change on capital requirements under LPS, Regulation on Own funds for payment institutions and electronic money institutions and this Regulation; 3.4.3. written reasoning for the decrease of share capital. 3.5. change in qualifying holding: 3.5.1. report of the joint stock company in the case of shareholders organized as a business organization or CVs of individual shareholders; 3.5.2. name, nationality, place of residence and business and professional history for the last ten (10) years of the applicant and any beneficial owner of the applicant who, as a result of the transaction, would indirectly benefit five percent (5%) or more of the payment institutions and electronic money institutions’ capital interests, as well as the information/documentation required by Article 20 and Article 54 of this Regulation; 3.5.3. list of business organizations wherein the proposed owners, including the beneficial owners (as described above), hold shares, specifying the level of such shareholding and the registered addresses of those business organizations; 3.5.4. for each legal entity, the audited financial statements (audited if applicable) for the last three (3) years; 3.5.5. the source and amount of funds used in the exercise of amalgamation as set forth in Article 20 and Article 54 of this Regulation; and 3.5.6. in any case where the amalgamation of the shares would cause the payment institutions and electronic money institutions to become a subsidiary of a foreign financial institution, a statement from the responsible supervisory authority of the home country that there are no objections to the commencement of operations in Kosovo and that it exercises global consolidated oversight on the payment institutions and electronic money institutions established in Kosovo, if applicable; 3.5.7. signed notarized agreement for change of share ownership. 3.6. appointment of directors and persons responsible for the management: 3.6.1. documentation specified in Article 21 and Article 55 of this Regulation. 3.7. opening and relocation of offices: 3.7.1. decision by decision-making body; 3.7.2. justification for office opening or relocation; 3.7.3. written notification on fulfilment of technical and safety conditions. Such notice shall specify the steps taken to fulfil these conditions and the photographs proving this. 3.8. sale or transfer (complete or partial) of the payment institutions and electronic money institutions’ portfolio to another entity; 3.8.1. decision by decision-making body on such transactions;

59 of 63 3.8.2. signed agreement or draft agreement between the payment institutions and electronic money institutions and the other entity. 3.9. merger and/or amalgamation: 3.9.1. decision by the decision-making body of the payment institutions and electronic money institutions and the other financial institution involved in the process for approval of their reorganization through merger; 3.9.2. agreement or draft agreement and detailed report of the merger process, signed by the legal representatives of institutions involved in the merger process. The agreement or draft agreement and the report shall be in writing and in accordance with the applicable legislation; 3.9.3. payment institutions and electronic money institutions’ draft statute after implementation of the merger process; 3.9.4. strategic and operational plans for implementing the merger, including required amalgamation analyses and financial statement projections for the merged payment institutions and electronic money institutions; 3.9.5. in case of change of directors and persons responsible for management of the merged payment institutions and electronic money institutions, documentation shall be submitted in accordance with the requirements for directors and persons responsible for management under this Regulation; 3.9.6. new structure of the payment institutions and electronic money institutions shareholders. 3.10. dividend distribution: 3.10.1. decision by shareholders’ assembly and board of directors on dividend distribution; 3.10.2. projections related to balance, income statement and initial capital on monthly basis for the 12 (twelve) upcoming months, reflecting the potential dividend payment; 3.10.3. audited financial statements for previous year. 4. The CBK may request additional documents other than those specified in paragraph 3 of this Article. 5. The application for approval of the above transactions and the documentation attached to the application shall be filed by the payment institutions and electronic money institutions and shall be in one of the two official languages of the Republic of Kosovo, either in original or in a certified copy. In the case of documentation issued by relevant official authorities in foreign countries other than the Republic of Kosovo, the documentation shall also be certified by the responsible authorities of the respective states. 6. The CBK shall approve the applications submitted by payment institutions and electronic money institutions for transactions under paragraph 1 of this Article only if the following criteria are met: 6.1. change of name: 6.1.1. the proposed new name of the payment institutions and electronic money institutions shall be in accordance with the LPS, the Law on Business Organizations and the Law on the Use of Languages. 6.2. changes to the founding act and/or statute:

60 of 63 6.2.1. changes shall not stand in violation with the applicable legislation, depending on the type of change concerned. 6.3. increase of share capital: 6.3.1. authorization conditions related to capital shall apply mutatis mutandis; 6.4. reduction of share capital: 6.4.1. the impact of such decrease on the payment institutions and electronic money institutions, including but not limited to the impact that the decrease may have on the payment institutions and electronic money institutions’ financial viability, ownership structure and shareholder suitability. 6.5. change in qualifying holding; 6.5.1. the proposed amalgamation is evaluated according to the same criteria that apply to the approval of a payment institutions and electronic money institutions authorization request with regard to shareholders, including but not limited to, the expected effects of the proposed amalgamation on the payment institutions and electronic money institutions’ financial viability and ownership structure and the impact of such amalgamation may have on the payment institutions and electronic money institutions oversight by the CBK. 6.6. appointment of directors and persons responsible for the management: 6.6.1. the criteria under Article 65 of this Regulation shall apply; 6.7. opening and relocation of offices inside the country: 6.7.1. the impact of opening or relocation on the community in which the office is or will be located; 6.7.2. the payment institutions and electronic money institutions shall provide the CBK with sufficient information and facts that the office is ready to conduct its business in terms of technical and security conditions including computer system, staffing, security, etc; 6.7.3. the CBK shall have the right to order the suspension of the activity in the relevant office even after approval if it finds that the technical and security conditions for the exercise of financial activity have not been met; 6.8. sale or transfer (complete or partial) of the payment institutions and electronic money institutions’ portfolio to another entity: 6.8.1. the impact of the sale or transfer of portfolio on payment institutions and electronic money institutions clients; 6.8.2. the impact of the sale or transfer of the portfolio on the payment institutions and electronic money institutions’ financial standing; 6.8.3. the sale or transfer of the portfolio shall not give rise to an anti-competitive effect; 6.9. merger and/or acquisition: 6.9.1. the merger or acquisition does not jeopardize the financial standing of the merged payment institutions and electronic money institutions; 6.9.2. the payment institutions and electronic money institutions has a system of organization, management, decision-making and information technology that enables the full integration of the merged or acquired payment institutions and electronic money institutions in a way that does not jeopardize its operation;

61 of 63 6.9.3. the merger or acquisition is economically viable; 6.9.4. the merger and/or acquisition does not give rise to an anti-competitive effect; 6.9.5. it is the responsibility of the payment institutions and electronic money institutions to obtain approval from other authorities that may be necessary before the transaction is completed. 6.10. dividend distribution. 6.10.1. the impact of the dividend distribution on the payment institutions and electronic money institutions, including but not limited to, the expected effects on the payment institutions and electronic money institutions’ financial viability. 7. When deciding whether to approve such transactions, the CBK shall also consider other criteria for the purpose of achieving its goals as set forth in the applicable legislation. Article 64 Requirements for notifying PIs, EMIs and AISPs changes

1. PIs shall notify the CBK within 30 (thirty) days (1 month) of occurrence of changes for the following transactions: 1.1. any change in ownership of shareholders who possess less than ten per cent (10%) of the capital; 1.2. resignation of directors and senior managers; 1.3. closing the offices inside the country; 1.4. changes to the organizational structure if such changes are not reflected in the PIs or EMIs statute, the director or senior managers.
2. Payment institutions and electronic money institutions shall notify the CBK without delay of operational risk events if one of the following cases occur: 2.1. financial losses resulting from theft, financial fraud or other similar cases, which represent a loss to the payment institution and electronic money institution in an amount exceeding € 1,000 (one thousand Euros); 2.2. events that result in serious damage or loss of payment institutions and electronic money institutions’ important data or books, interruption of operations for more than 3 (three) hours in two or more offices, or interruption of operations for more than 5 (five) hours in a single office, affecting the normal operations of the payment institutions and electronic money institutions; 2.3. in case payment institutions and electronic money institutions’ exclusive information is stolen, sold or published without payment institutions and electronic money institutions’ permission or if information is lost that could damage payment institutions and electronic money institutions’ financial stability; 2.4. frequent breach of applicable rules by the persons responsible for management.

62 of 63 CHAPTER VIII ORGANIZATION, MANAGEMENT AND ADMINISTRATION OF PAYMENT INSTITUTION, ELECTRONIC MONEY INSTITUTION AND ACCOUNT INFORMATION SERVICES PROVIDER Article 65 Governance of PI, EMI and AISP

1. Payment institutions, electronic money institutions and account information service providers shall act in accordance with the recognized principles of good governance to ensure that the business of the institution is realized in a safe and sound manner. Payment institutions, electronic money institutions and account information service providers’ governance should be in accordance with the LPS and this Regulation.
2. Payment institutions, electronic money institutions and account information service provider shall have a board of directors consisting of not less than 3 (three) members, of which the majority shall be independent and non-executive directors.
3. Directors and persons responsible for management should fulfil the “fit and proper” criteria as requested by the CBK.
4. Directors and persons responsible for management of Payment institutions, electronic money institutions and account information service provider should at least meet the following criteria: 4.1. hold a university degree in the field of economy, jurisprudence or another relevant field, for the position where the person is appointed; 4.2. have 3 (three) years of experience in the banking and/or financial sector or any other field considered appropriate by the CBK; 4.3. have a high ethical and professional reputation; 4.4. have not been removed by the CBK from a position in a financial institution; 4.5. have not been convicted by a criminal court for a criminal offense with imprisonment of 1 (one) year or more, concerning which the option of fine has not been ruled; 4.6. have not been convicted of economic crimes or found guilty of economic offences under the Criminal Code; 4.7. have not been denied, by court decision/competent authority, the exercise of activities within the powers prescribed for directors and persons responsible for management; 4.8. have not been excluded or suspended by the competent authority from practicing the profession on grounds of personal misconduct; 4.9. have not caused or been responsible for the bankruptcy of any entity that conducts economic activity; 4.10. have not been subject to insolvency filing procedures including official administration or bankruptcy and are free from paying past due liabilities.
5. In exceptional circumstances, after being satisfied with the qualifications, professional experience and conduct of the person, the CBK may exempt a director or senior manager from the provisions of subparagraph 4.9 and 4.10 of paragraph 4 of this Article.
6. The board of directors of payment institution and electronic money institution is assisted by at least 2 (two) committees:

63 of 63 6.1. the audit committee which includes and is chaired by a non-executive member of the board of directors and at least 1 (one) member of the audit committee may be an external expert in the field of accounting or auditing; and 6.2. the risk management committee whose members must also be members of the Board of Directors; 7. The CBK may require payment institutions and electronic money institutions to have additional committees other than those specified in this article. 8. Payment institutions and electronic money institutions may establish additional committees other than those specified in this article. 9. The provisions of this article relating to the Board of Directors and the Committees at the level of the Board of Directors do not apply to branches of foreign payment institutions and electronic money institutions. CHAPTER IX FINAL PROVISIONS Article 66 Enforcement, Improvement Measures and Penalties Any violation of the provisions of this Regulation shall be subject to corrective measures and administrative penalties, as set out in Article 67 of Law No. 03/L-209 on the Central Bank of the Republic of Kosovo, as amended and supplemented by Law No. 05/L-150, and Article 125 of Law No.10/L-026 on Payment Services. Article 67 Repeal Upon entry into force of this Regulation, provisions of the Regulation on the registration of non-bank financial institutions regarding the transferring and receiving money and payment services for payments within and outside the country (hereinafter payment service); adopted by the Board of the Central Bank of the Republic of Kosovo on 30 April 2020, shall be repealed. Article 68 Entry into force This Regulation shall enter into force 15 days from the date of its approval. Dr.sc. Bashkim Nurboja Chairperson of the Board of the Central Bank of the Republic of Kosovo