Rules for the Authorization of Mobile Payment System Administrators

CD-02/2020
RULES FOR THE AUTHORIZATION OF MOBILE PAYMENT SYSTEM ADMINISTRATORS Approval: 01/23/2020 Effective Date: 03/01/2020

THE BOARD OF DIRECTORS OF THE CENTRAL BANK OF RESERVE OF EL SALVADOR

CONSIDERING:

I. That on August 13, 2015, through Legislative Decree No. 72, published in Official Diary No. 160, Volume 408, dated September 3, 2015, the Law to Facilitate Financial Inclusion was approved, which aims to promote financial inclusion, foster competition in the financial system, and reduce costs for users and clients of said system, regulating among other aspects, the requirements for constitution, authorization, operation, capital, guarantees, and grounds for revocation of electronic money provider societies.

II. That in accordance with what is established in Article 2 of the aforementioned Law, electronic money provider societies are fixed-capital anonymous societies; their purpose is to provide electronic money; they may also administer or operate mobile payment systems; that is, to clear and settle payments between electronic money providers, with the authorization of the Central Bank of Reserve of El Salvador, and observing the requirements established by it for such effect.

III. That in accordance with what is established in Article 2 of the aforementioned Law, federations supervised by the Superintendence of the Financial System may only administer or operate mobile payment systems, with prior authorization from the Central Bank of Reserve of El Salvador.

IV. That in accordance with what is established in Art. 14 of the aforementioned Law, Electronic Money Provider Societies may request authorization from the Central Bank of Reserve of El Salvador to be administrators of mobile payment systems, provided they comply with what the Central Bank disposes, in accordance with its Organic Law regarding payment systems.

Mobile payment administrators will be authorized to operate systems or technological platforms that allow payments or money transfers, primarily electronic money, between products of different financial institutions and regardless of the mobile telephone operator the client has.

V. That Article 3 of the Organic Law of the Central Bank of Reserve of El Salvador establishes that: “The Central Bank shall have as its fundamental object, to ensure the stability of the currency and its essential purpose shall be to promote and maintain the most favorable monetary, exchange, credit, and financial conditions for the stability of the national economy.”

VI. That Article 67, paragraph 1 of the Organic Law of the Central Bank of Reserve of El Salvador, establishes that “The Bank shall ensure the normal functioning of payment and securities settlement systems, especially those that are fundamental for the efficiency and stability of the financial system. Likewise, it will issue technical norms that will define the entry, participation, suspension, and exclusion of participants and administrators of payment and securities settlement systems.”

AGREES to issue the following:

RULES FOR THE AUTHORIZATION OF MOBILE PAYMENT SYSTEM ADMINISTRATORS

CHAPTER I
OBJECT, SUBJECTS, AND DEFINITIONS

Object
Art. 1.- These Rules aim to establish the process for the authorization of an administrator of mobile payment systems.

Subjects
Art. 2.- The subjects obliged to comply with these Rules are:
a) Electronic Money Provider Societies, constituted in accordance with what is established in the Law to Facilitate Financial Inclusion; b) Federations of Savings and Credit Cooperatives supervised by the Superintendence of the Financial System.

Definitions
Art. 3.- For the purposes of these Rules, the definitions indicated below have the following meaning:
a) Administrator of a Mobile Payment System or Administrator: Entity duly authorized by the Central Bank of Reserve of El Salvador to administer or operate a mobile payment system and that is supervised by the Superintendence of the Financial System. b) Central Bank: Central Bank of Reserve of El Salvador. c) Clearing or Netting: The conversion, in accordance with the operating rules of a system, of the rights and obligations derived from accepted payment orders in the system, into a single credit or debit that represents the difference existing between the transfer orders, so that only said net credit or debit is enforceable.

d) Electronic Money: Monetary value registered in favor of a holder or client, which constitutes a payment obligation enforceable against its provider, which is accepted by other actors who have agreed to receive or provide this service, as a means of payment in an amount equivalent to the cash delivered, and is stored in an electronic medium, which can be used by its holder to make local transfers, payments, and conversion to cash at nominal value.

e) Due Diligence: Set of differentiated internal control policies, procedures, and measures that are reasonably more rigorous, deep, demanding, and exhaustive than those entities must design and apply to clients classified as high risk, based on the analysis of Money Laundering and Asset Financing and/or Terrorism Financing risk factors and/or in accordance with the results of the Money Laundering and Asset Financing and/or Terrorism Financing risk level rating matrix.

f) Entity: Electronic Money Provider Societies constituted in accordance with what is established by the Law to Facilitate Financial Inclusion and the Federations of Savings and Credit Cooperatives supervised by the Superintendence of the Financial System.

g) Guarantee: Any liquid and enforceable asset, including money, that has been the subject of deposit, pledge, right of retention, or any other legal transaction that has the purpose of securing the rights and obligations derived from operations associated with the settlement of payment and securities settlement systems.

h) AML/CFT: Money Laundering and Asset Financing and/or Terrorism Financing.

i) Settlement: Set of norms, principles of common acceptance, and procedures that are executed for the confirmation, fulfillment, and extinction of payment obligations.

j) Transfer Orders: Orders and fund transfers in a mobile payment system.

k) Participant: Entity belonging to the Financial System subject to supervision, accepted as a member of a mobile payment system in accordance with its operating rules, and that is responsible to the system for assuming the settlement obligations derived from the transfer orders introduced therein.

l) Mobile Payment System: Set of norms, principles of common acceptance, and procedures that aim to execute, clear, and settle fund transfer orders through mobile devices.

m) Electronic Fund Transfers: Operations carried out by electronic means that originate charges or credits of money in electronic money records, such as fund transfers from one record to another, etc.

CHAPTER II
SUPERVISORY POWERS OF THE CENTRAL BANK

Art. 4.- The Central Bank is responsible for the supervision of payment and securities settlement systems and will develop this function with the objective of promoting the good functioning, security, and efficiency of the same.

Art. 5.- The Central Bank, following international standards, is responsible for determining the criteria and the procedure that an entity must follow to be authorized as an administrator of mobile payment systems.

Art. 6.- The Central Bank, as the authority in matters of payment and securities settlement systems, will be in charge of authorizing administrators of mobile payment systems, for which it will evaluate the information provided by the entity wishing to become an administrator of mobile payment systems.

Art. 7.- The entity wishing to operate as an administrator of mobile payment systems must provide the information and request authorization from the Central Bank in accordance with what is established in Article 8 of these Rules.

CHAPTER III
AUTHORIZATION PROCESS

Authorization Process
Art. 8.- The entity seeking to be authorized as an administrator of mobile payment systems must present a request duly signed by the Legal Representative or Legal Proxy, accompanied by the following documentation:
a) Documentation supporting that it will have at least (2) two participants. b) Proof that it is an entity supervised by the Superintendence of the Financial System. c) Internal Operating Rules, which must contain at least what is established in Article 14 of these Rules. d) Description of the technological platform, which must meet at least the requirements established in Article 15 of these Rules. e) Documentation accrediting the legal existence and the legal representation with which the legal representative of the society interested in being authorized to administer mobile payment systems acts, duly certified by a Notary.

The Central Bank of Reserve of El Salvador will have sixty (60) business days to issue the requested authorization.

Art. 9.- Once the information is received, the Payment Systems Surveillance Unit will proceed to review whether the documents established in the previous article of these Rules have been presented.

The Payment Systems Surveillance Unit, after analyzing the documentation established in the previous article, may warn the requesting entity to correct the deficiencies found.

If the review of the documentation reveals that it is incomplete or contains errors, the Payment Systems Surveillance Unit may require the requesting entity, within a period of ten (10) business days counted from the day following notification, to present the missing documents or those that need to be replaced.

The Payment Systems Surveillance Unit may, through a reasoned resolution, extend by up to another ten (10) business days, the period indicated in the previous paragraph, when the nature of the observations or deficiencies so requires.

The Payment Systems Surveillance Unit, in the same warning, will indicate to the requesting entity that if it does not complete the information within the aforementioned period, it will proceed without further procedure to archive the request, leaving it free to present a new request.

Art. 10.- The requesting entity may present a request for extension of the periods indicated in the previous article to the Payment Systems Surveillance Unit, expressing in its request the grounds on which it is based and proposing, if applicable, the relevant proof.

The extension period may not exceed ten (10) business days and will begin from the next business day after the expiration date of the original period.

Art. 11.- The period of sixty (60) business days, indicated in Article 8 of these Rules, will be suspended for the days that elapse between the notification of the request of Article 9 of these Rules, until the interested entity corrects the observations required by the Payment Systems Surveillance Unit.

Art. 12.- Once the required documents are presented in due form and the compliance with the authorization requirements is analyzed, the Payment Systems Surveillance Unit will proceed to prepare the respective technical report that determines whether the authorization or the denial of the request presented by the requesting entity is appropriate, as well as its start of operations.

Art. 13.- The Payment Systems Surveillance Unit will submit to the consideration of the Board of Directors of the Central Bank, the report prepared for the authorization of an administrator of mobile payment systems, as well as for the start of operations. The Agreement of the Board of Directors regarding this matter must be notified to the requesting entity, expressing the reasons that justify it.

CHAPTER IV
MINIMUM CONTENT OF INTERNAL OPERATING RULES

Art. 14.- The internal operating rules of each system, prepared by the Administrator thereof and which must be approved by the Central Bank, will establish in their content, at least the following:
a) The definition, description, and scope of the services provided. b) The determination of the system participants, their rights, obligations, and responsibilities. c) The definition of the technical requirements that participants must meet. d) Business model. e) Operating scheme of the electronic platform to be implemented. f) The processes and criteria for admission and temporary exclusion or withdrawal of participants, which must be public, objective, and equitable.

g) The description of the clearing process in all its stages, determining the precise moment when each stage begins and ends, the moment when orders will be considered irrevocable, the moment when orders will be considered final, and the number of cycles and start and end times of each of them.

h) The determination of the content, periodicity, and procedures for sending information and messaging between participants and the system.

i) The determination of the procedures for settling balances.

j) The determination of the mechanisms used for risk management, especially the regime applicable to constituted guarantees, as well as the definition of necessary contingency plans.

k) The determination of the mechanisms adopted for cases of non-compliance with the internal operating rules, as well as the mechanisms and instruments for resolving incidents and conflicts between participants.

l) The determination of the non-acceptance of any transfer order from a participant against whom a dissolution or liquidation procedure has been initiated, once such initiation has been known by the system.

m) The description of the procedure for determining, modifying, and disseminating tariffs, commissions, or any other charge that may be collected within the framework of the system's operation.

CHAPTER V
MINIMUM CONTENT OF TECHNOLOGICAL REQUIREMENTS

Art. 15.- Mobile payment system administrators must have a technological platform that allows the updating of their systems, security in the processing of information, and that additionally implements effectively the requirements indicated below:
a) Technological platforms, communication network, and equipment (servers, storage, among others) of the production environment must be redundant (contingencies), in such a way as to guarantee the continuity of operations, backup and recovery of information, and avoid the loss of information.

b) Information encryption mechanisms used in the communication network.

c) Physical separation of the different operational environments (production, development, and/or testing).

d) Security measures for the integrity, confidentiality, and availability of information.

e) Connection with the Central Bank's system(s), when required by it.

f) Sufficient and adequately segregated technical and operational personnel.

CHAPTER VI
OBLIGATIONS OF ADMINISTRATORS

Art. 16.- Administrators are obliged to:
a) Ensure the availability and operability of the system during its operating hours. b) Subscribe and keep valid the fund transfer and clearing service contracts with their participants. c) Notify the Central Bank for its knowledge of any proposal for modification to the contracts signed between participants and administrators and/or to the internal operating rules. d) Process the transfer orders received through the system in the form and conditions established in their operating rules and instructions. e) Apply computer security procedures that allow minimizing risks in the process of orders through the system. f) Present to the Central Bank for its authorization the modifications made to the operating rules. g) Keep the operational provisions of the system updated.

h) Establish, implement, and give continuity to internal risk control procedures.

i) Respond to their participants for operational or security failures of the system or any of its contingency plans, and for faults of their employees.

j) Send to the Central Bank the information requested by it, in accordance with what is established in the Instruction for the Submission of Information of Payment Systems, for the purpose of complying with the supervision of payment systems that corresponds to the Central Bank.

k) Ensure the confidentiality of client information and their operations, which shall be disclosed only to the client, the Central Bank, the Superintendence of the Financial System, the General Directorate of Internal Taxes, or the Consumer Defense Office, when these require it for the exercise of their functions.

l) Inform the Central Bank, if applicable, of any relevant situation that arises regarding its operability, as well as any other relevant fact.

m) Comply with what is provided in instructions or regulations issued by the Board of Directors of the Central Bank on payment systems, when applicable.

n) Comply with what is established in the Law Against Money Laundering and Assets, its Regulation, the Instruction of the Financial Investigation Unit of the Attorney General's Office insofar as it is applicable, and the Special Law Against Acts of Terrorism. On this point, administrators must attend to the following aspects:

1. If an electronic money provider society or federation wishes to be authorized as an administrator of mobile payment systems, it cannot use the same money laundering and terrorism financing prevention policies and procedures that it applies as an electronic money provider society or federation; it must establish policies and procedures in accordance with the business operation as a Mobile Payment Administrator, which must be designed according to the specific risk profile of the entity, encompassing mainly, the inherent risk of its products, services, participants, and the geographic location where the activities are developed.

2. Require its participants to comply with the legal and regulatory framework in matters of AML/CFT prevention, having to have a specific Manual in this matter. Administrators will be directly responsible for verifying compliance and management thereof.

3. Send to the Central Bank all the information requested by it as part of the application of Due Diligence for account opening, in accordance with what is established in the money laundering and terrorism financing prevention regulations, when it so requires.

4. That its directors, managers, or shareholders are not persons who have been judicially proven to participate in activities related to drug trafficking and related crimes, with money laundering and assets, and with terrorism financing activities, both in the national jurisdiction or abroad.

CHAPTER VII
FINAL PROVISIONS

Non-compliance
Art. 17.- Non-compliance with these Rules will be sanctioned in accordance with what is established in the Organic Law of the Central Bank of Reserve of El Salvador.

Unforeseen Matters
Art. 18.- Aspects not contemplated in these Rules will be resolved by the Board of Directors of the Central Bank upon proposal of the Payment Systems Surveillance Unit.

Effectiveness
Art. 19.- These Rules will enter into effect from March 1, 2020.