Standards for the Protection of the Rights and Interests of Digital Financial Services Consumers

Central Bank of the Republic of Uzbekistan Decision No. 28/4 dated November 27, 2021 Appendix

STANDARDS FOR THE PROTECTION OF THE RIGHTS AND INTERESTS OF DIGITAL FINANCIAL SERVICES CONSUMERS

These Standards define the advisory approach and norms in the field of protecting the rights and interests of consumers of digital financial services (hereinafter referred to as "consumers") and are applied to the activity of credit and payment organizations providing digital financial services (hereinafter referred to as "financial organizations") in providing digital financial services.

Chapter 1. General Provisions

1. These Standards are developed for the following purposes:

• ensuring respect for the rights and legitimate interests of consumers;
• preventing unfair practices in the interaction between financial organizations and consumers related to digital financial services;
• reducing risks that may arise for consumers when using digital financial services.

2. The following main concepts are used in these Standards:

• consumer – physical persons (including individual entrepreneurs) and/or legal entities that have applied to financial organizations with the desire to use digital services of financial organizations, are using these services and/or have used them previously;
• remote service system – a set of telecommunications tools, digital and information technologies, software, and equipment that ensures communication between financial organizations and consumers for the use of digital services;
• digital financial services (hereinafter referred to as "digital services") – financial services provided to consumers by financial organizations or their agents using a remote service system. Digital services include independent customer registration, attracting funds to deposits and transferring calculated interest payments to the customer's bank account, providing loans, opening and maintaining bank accounts, including obtaining information on fund movements on accounts, making money transfers, contactless payment for products (services), and other financial services.
• disclosure of information by financial organizations – ensuring the availability of information about digital services by placing it on the official websites and mobile applications of financial organizations;
• provision of information by financial organizations – providing information to the consumer about digital services by sending it through the official websites, mobile applications, and/or other remote service systems of financial organizations.

Chapter 2. Disclosure (Provision) of Information about Digital Services to Consumers

3. The minimum volume of information disclosed (provided) by financial organizations on their official websites, mobile applications, and other remote service systems regarding digital services to consumers must include:

• the corporate name, legal address, contact phone numbers and/or email address, official website, and official pages on social networks (Telegram, Facebook, Instagram, etc.) of the financial organization;
• a list of digital services and other related services available on pages accessible via no more than one hyperlink from the main page of the official website and/or mobile application of the financial organization;
• the procedure and usage of digital services (electronic document, video clip, etc.);
• tariffs and commission fees of the financial organization for providing digital services to consumers;
• risks that may arise for consumers when using digital services;
• methods of protection against fraud for consumers when using digital services;
• rights of consumers in the event of technical failures arising due to the fault of financial organizations during the provision of digital services;
• restoration periods for the provision of digital services in the event of technical failures arising due to the fault of financial organizations;
• addresses and methods for submitting consumer complaints;
• methods for protecting consumer rights, including the possibility of pre-trial dispute resolution;
• the procedure and deadlines for providing documents related to the provision of digital services at the consumer's request (including the electronic version of the document);
• the procedure for providing a copy of the contract and/or other document (including the electronic version of the document) confirming the provision of digital services to consumers;
• methods for sending information related to the provision of digital services to consumers;
• the distribution of liability for non-performance, improper performance, or inadequate performance of obligations between financial organizations and their agents in the framework of providing digital services;
• restrictions (if any), terms, and methods for using digital services;
• methods for consumers to change the terms of digital services and refuse digital services;
• information on the procedure for compensating damages caused to consumers in the cases specified in paragraph 22 of these Standards.

4. The reasons for requesting permission (access) to use consumers' personal data (phone numbers, calls, SMS messages, photos, videos, camera, location, files, etc.) when using the remote service system, and the purposes for which they are used, are specified in the digital services contract (offer). In this regard, the contract (offer) is first presented during the initial entry into the remote service system, and then permission to use consumers' personal data is requested.

The procedure for correcting errors and deficiencies in the event that transfers and/or payments are not executed due to technical failures arising due to the fault of financial organizations is provided for in the digital services contract (offer).

5. When a consumer applies to a financial organization for the purpose of using their digital services, information about the services provided is fully disclosed.

6. Financial organizations ensure that the procedure for disclosing information about digital services to consumers meets the following criteria:

• creating equal rights and opportunities for consumers to receive information (restrictions may only be related to the technical characteristics of the device used by the consumer);
• limiting the disclosure of information that may lead to ambiguous interpretation of the characteristics of the digital service;
• provision of information in the state language (excluding foreign language signs that are trademarks) and in an accessible format (fonts and shapes convenient for reading). Information may additionally be provided in other languages at the discretion of the financial organization;
• creating the opportunity for consumers to receive a notification about the provision of digital services (execution of the operation) no later than one day from the date the digital service was provided (operation was executed), in accordance with the procedure and terms specified in the contract (offer), at the consumer's request, unless otherwise provided by legislation;
• creating the opportunity for consumers to receive a document related to the provision of digital services (including the electronic version of the document) at the consumer's request;
• creating the opportunity for consumers to receive a copy of the contract and/or other document confirming the provision of digital services.

Chapter 3. Requirements for Software and Financial Organizations Used in Providing Digital Services

7. The interface of the software provided by financial organizations must be in the state language, and the volume and fonts of the information therein must be rounded and understandable for consumers to use. In this regard, important information about fines and risks must be reflected similarly to information about the affordable terms of the digital service. The interface may additionally be provided in other languages at the discretion of the financial organization. Financial organizations must introduce a function that allows consumers to change the scale of the software interface themselves.

8. Financial organizations ensure that the remote service system itself has the opportunity for consumers to send questions and receive answers regarding the remote service system.

9. Financial organizations ensure that their remote service system provides consumers with the opportunity to select the language for using the system (if the system allows use in two or more languages).

10. Financial organizations ensure that their remote service system provides consumers with the opportunity to monitor bank accounts and download account statements.

11. Financial organizations ensure that their remote service system provides consumers with the opportunity to view and download confirmation documents (receipts and invoices) for transfers and/or payments made by consumers. In this regard, the document confirming the execution of the transfer and/or payment must reflect the following information:

• the amount of the transfer and/or payment;
• the date and time of the transfer and/or payment;
• the type of transfer and/or payment;
• the name of the person accepting the transfer and/or payment;
• information allowing identification of the transfer and/or payment.

12. Financial organizations ensure that their remote service system provides the opportunity to save payments and transfers made by consumers as "templates" and the function of using them to execute operations in the future.

13. If the remote service system does not provide the opportunity to remotely terminate the contract (offer) formalized through it, this condition must be provided for in the contract (offer).

14. If the consumer has not viewed (skimmed) all pages (parts) of the contract (offer) to the end, it must be ensured that the opportunity to press the button expressing the customer's consent to the service terms is not given.

15. If the consumer is not active for a certain period of time in the remote service system (this period must be specified in the digital services contract (offer)), the session must be automatically terminated, and the consumer must be logged out of the remote service system.

16. The remote service system must have the function of viewing devices and their active sessions entered using one consumer's data and stopping the work of other devices through authentication.

17. Mobile applications of financial organizations must have the function of identifying information about the consumer's current credit debts (if any) and existing credits obtained from the credit institution that is the owner of the mobile application. This information must include:

• total debt amount;
• credit balance;
• amount of accrued interest;
• amount and date of the next payment;
• amount of overdue principal debt and interest;
• amount of accrued penalties;
• possibility of early repayment of the credit;
• possibility of early repayment of the credit;
• possibility of automatic execution of payments on the credit (indicating the exact date and terms of fund expenditure, the amount of funds to be spent, and the personal bank card from which funds will be spent);
• opportunity to view and download the payment schedule;
• monitoring of operations performed on the credit.

18. Banks provide consumers with the following information about their deposits (deposits) in their mobile applications:

• type of deposit (demand, term, savings);
• exact term, interest rate, and minimum and maximum amounts of the deposit;
• exact name of the deposit, if the deposit name is not available, the opportunity for the consumer to independently choose a name;
• terms for crediting additional funds to the deposit account or spending funds;
• function of automatic crediting of funds to the deposit account (auto-deposit) (indicating the exact date and terms of crediting, the amount of funds to be credited, and the personal bank card from which funds will be spent);
• opportunity to know the exact date (date) of calculation of interest on deposits;
• monitoring of operations performed on deposits;
• terms for full or partial early withdrawal of the deposit;
• opportunity to view the calculation of daily interest on the deposit;
• information on whether capitalization of interest on the deposit is available or not.

19. If suspicious operations are detected or the bank card is lost, the mobile applications of banks must have the function of blocking the card owner through card authentication.

20. When entering the remote service system using one consumer's data, security notifications and/or SMS messages about access to this system from other devices must be sent to the consumer immediately.

21. Financial organizations must ensure the confidentiality of information about consumers. Other service providers attracted on a contractual basis are also responsible for data security.

22. Financial organizations must ensure: a) If the user of digital services is a physical person, ensuring the protection and confidentiality of the consumer's personal data; b) Establishing the procedure for compensating damages caused to consumers in the following cases:

• violation of the terms specified in the digital services contract (offer) by financial organizations;
• the terms of the actually provided digital services do not match the terms specified in the digital services contract concluded between consumers and financial organizations or other documents confirming the provision of digital services;
• introduction by financial organizations of restrictions on the free use of digital services by consumers that are not specified in the contract (offer) and not provided for by legislation. c) Ensuring the availability of at least one active (technically operational) digital communication channel used for providing digital services. d) Ensuring that consumers are notified in advance if the need to re-download the remote service system arises due to the addition of new functions and services to it, which may lead to the inability to use the system at all and/or restrictions in its use.

23. When operations without acceptance (payments for which the customer has previously given permission) are performed on a bank card by a financial organization, information about these operations must be provided to the consumer in the form of an SMS message to the consumer's phone number or through other communication channels agreed with the consumer (e-mail, call, push notification, etc.). The content of the information must indicate the used card number, the name of the organization and service, the amount and time of the operation.

24. Problems and errors arising during the execution of operations through the remote service system must be presented to the consumer in a convenient and understandable format. Displaying errors in a technical format is inappropriate.

Chapter 4. Interaction with Consumers in Providing Digital Services

25. During the process of concluding a contract for the provision of digital services or obtaining another document confirming the provision of digital services, consumers must be informed about the distribution of liability between financial organizations and their agents for non-performance, improper performance, or inadequate performance of obligations within the framework of providing digital services.

26. Financial organizations must ensure the continuity of their activities and the accessibility of services in accordance with the terms specified in the contract (offer). Financial organizations must notify consumers in advance through their official communication channels about preventive and technical work being carried out in the system before these operations are performed.

In the event of force majeure circumstances that may lead to a violation of the rights and legitimate interests of consumers, financial organizations must notify consumers as soon as possible and take immediate measures to eliminate the arising problems.

27. Digital services must be carried out in a currency agreed upon by financial organizations and consumers (except for cases provided for by legislative acts). When offering a currency exchange service through digital services, the credit institution must disclose all commission fees to the consumer, as well as the actual exchange rate of foreign currency used for this operation.

28. If a consumer loses access credentials to the remote service system, financial organizations must provide instructions for accessing personal accounts. These instructions must be posted on the official website of the financial organization for consumers to use.

29. Financial organizations must establish the procedure for carrying out interaction with consumers in providing digital services. In particular, detailed information is provided to consumers about communication channels for contacting financial organizations (call center, website, hotline, Telegram bot, online chat).

30. When developing internal documents regulating the procedure for interaction with consumers, financial organizations ensure the presence of rules regulating the following:

• claims that a consumer may address to a financial organization regarding liability issues in accordance with paragraph 25 of these Standards;
• the organization of receiving and registering consumer appeals and responding to them in the prescribed manner;
• the description of reasons for rejecting issues raised in the consumer's appeal (if applicable);
• deadlines for considering consumer appeals.

31. The procedure for considering appeals must comply with legislative acts. Information about the procedure for considering appeals by financial organizations must be posted on their official websites and/or mobile applications (if available).

32. Financial organizations must ensure the timely and impartial consideration of consumer appeals and notify the appellants of the results.

33. When appeals related to services provided by a third party are received, all actions aimed at resolving the arising problems and errors (difficulties) must be carried out directly by the financial organization.

34. Financial organizations, taking into account the legal requirements regarding the rights of persons with disabilities, create opportunities for persons with disabilities to use information about digital services on an equal basis with other consumers.