Professional Documents
Culture Documents
A Brief On Regulations For EMIs
A Brief On Regulations For EMIs
Chartered Accountants
A brief on
Regulations for
Electronic Money
Institutions (EMIs)
© 2018 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of
independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
A brief on Regulations for Electronic Money
Institutions
State Bank of Pakistan [“SBP”] vide its circular letter
ERD/M&PRD/PR/01/2019-34 dated 1 April 2019 launched
Electronic Money Institutions [“EMIs”] Regulations
[“Regulations”] that will be licensed by SBP to issue e-money
for the digital payment.
Objective
Applicability
18 April 2019
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Executive Summary
The State Bank of Pakistan [“SBP”] notified Electronic
Money Institutions [“EMIs”] Regulations [“Regulations”]
which provides a regulatory framework for the institutions
desirous of offering innovative, user-friendly and cost-
effective low-value payment services to the public.
EMIs may issue e-money payment instrument, distribute
e-money payment instruments, redeem e-money payment
instruments and any other activity permitted by SBP.
e-Money will be used to make payments for goods and
services, bill payments, fund transfers and cash deposits
and withdrawals from e-money accounts. However, EMI
will not conduct the business of banking including the
acceptance of funds from public for the purpose of lending,
investments or any speculative activity.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
other circumstances. However, SBP shall give notice
with grounds to revoke license;
• Governance requirements for EMI: Fit and Proper
Test is applicable to key employees of the prospective
EMI which proposes that all the Directors and CEO
would require proper clearance from SBP before they
take on any position in the EMI.
The responsibilities of the Board of Directors include
defining the roles and responsibilities of key individuals,
ensuring all internal controls such as risk management,
IT, audit, security and human resource. The BOD can
remove CEO by properly following guidelines;
• Capital Requirement for becoming an EMI: Startup
capital requirement for an EMI is PKR 200million and
the minimum ongoing capital to be maintained at all
times is divided into 4 slabs and the EMI should inform
to SBP when the outstanding e-money balance
exceeds PKR 20 million; and
• Customer Due Diligence; requirements for EMIs:
Customer due diligence is crucial to be fulfilled by the
EMI in which the EMI should go about with the
customer’s proper details and use two factor
authentication for customer verification, along with this
the EMI should perform proper due diligence for high
risk clients as per SBP guidelines.
The Regulations also encompass other regulatory
requirements including outsourcing activities, Anti-
Money Laundering and countering of financing
terrorism, Consumer Protection, Complaint Handling
Mechanism, Oversight, and Regulatory Reporting etc.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
A brief on Regulations for Electronic Money Institutions
Authority discounts which doesn’t affect the amount or
length of time e-money is held by the customer.
These Regulations are being issued in exercise of
powers conferred upon State Bank of Pakistan not to issue e-money payment instruments at a
under provisions of Payment Systems and discount i.e. issue e-money payment
Electronic Fund Transfers Act, 2007 [“ PS&EFT instruments that has a monetary value greater
Act”] than the funds received from customers.
e-Money shall be used for making payments for 2. The applicant entity shall fulfil all the
goods and services, bill payments, fund transfers application requirements mentioned in
and cash deposits and withdrawals from e-money Annexure “C”.
accounts.
3. The applicant shall have the capability to
EMI: efficiently handle all the transactions as an
EMI and fulfil its obligations under PS&EFT
not to conduct any banking activity (other than Act and these regulations prior to launching
that required under Para 14 of these any product or service under its EMI
regulations) or any speculative activity. license.
to take approval from SBP before offering 4. The applicant shall have necessary financial
cross-border e-money products/services. resources, policies, procedures, system &
controls, IT systems etc. to efficiently
Anything which adds to the monetary value of e- discharge its responsibilities as an EMI.
money shall not be paid to customer and
offered by EMI, however, EMI may offer 5. SBP reserves the right to reject any
discounts on goods and services provided such application without giving any reason.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
SBP may grant EMI license in the following it enters into insolvency proceedings.
three stages:
any other reason substantiating the need for
1. “In-Principle” approval to be granted to fulfil suspension or revocation of license granted to
preconditions prior to commencement of EMI.
pilot operations of operating as EMI.
Before suspending/revoking the license,
2. EMI to commence pilot operations upon
attaining operational readiness, fulfil SBP shall give notice specifying the ground(s)
requirements mentioned in In-Principle upon which it proposes to suspend/revoke the
approval. SBP may also conduct off-site license and shall require the EMI to submit to it
evaluations/onsite inspections of the EMI at within 30 days a written statement of objections
any stage of the licensing procedure. to the suspension or revocation of the license.
3. License to commence commercial Where the SBP is of the opinion that safety,
operations shall be granted subject to soundness, reliability or efficiency of an EMI is
satisfactory completion of pilot operations or may be threatened, it may, without prior
and fulfilment of all SBP’s requirements. notice, suspend or revoke the permission of
EMI.
SBP may suspend/revoke the Approval at any
stage, if EMI fails to comply with the conditions Governance Arrangements
of SBP Approval in a timely manner. SBP may
give notice of its intention to do so, specifying
Regulation 9
the ground(s) upon which it proposes to
suspend/revoke the approval and shall require
EMI shall have adequate governance
the EMI to submit within 30 days, a written
arrangements to ensure integrity of its e-money
statement of objections to the suspension
business. EMI shall follow the Code of
/revocation of the approvals.
Corporate Governance issued by SECP as far
as the provisions thereof do not conflict with any
Suspension/Revocation of License provisions of the PS&EFT Act and other
relevant regulations issued by SBP.
Regulation 8
Fit and Proper Test [“FPT”]
SBP may revoke/suspend the license of an EMI if:
FPT to be applicable to sponsor shareholder(s),
revocation/suspension is in public interest; Directors, CEO and Key Executives of the
prospective EMI. The fitness and propriety will
it is found to be involved in illegal or prohibited be assessed as per the requirements
activities; mentioned in Annexure D-4.
it fails to comply with conditions of the License; The Directors and CEO would require prior
regulations, rules, guidelines, instructions, clearance from SBP before assuming their
directions and circulars issued by SBP or any responsibilities. The compliance of FPT for Key
other applicable laws Executives would be the responsibility of EMI
and the relevant record shall be made available
any information provided by EMI is found to be to SBP as and when required.
misreported to SBP.
Any changes in the information pertaining to the
it is not able to safeguard the customers’ funds. persons subject to FPT should immediately be
submitted to PSD. Any violations, misreporting
it is not able to carry out its operations safely and delay in submission of information to SBP
and efficiently. may result in withdrawal of SBP’s
approval/license or penal action or both under
provision of e-money issuance by the EMI PS&EFT Act.
endangers the stability of the payment systems
of Pakistan. The appointment, compensation package,
promotion/demotion and renewal of the
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
employment contracts of Key Executives shall Where office of any Director/CEO falls vacant,
be duly approved by the Board of Directors of such position can only be filled with prior
the EMI. approval of SBP. However, any new
appointment / placement of Key Executives
EMI shall also develop and implement other than Directors or CEO shall be intimated
appropriate screening procedures to ensure to SBP within seven days of appointment /
high standards and integrity at the time of hiring placement.
all employees. In case it is found at any stage or
during the course of inspection by SBP that FPT Management
guidelines have not been followed or the
incumbent is not a fit and proper person, strict No member of BOD of an EMI shall be
action shall be taken under the relevant appointed in the EMI in any capacity except as
provisions of PS&EFT Act. CEO of the EMI who holds 10% or more of
paid-up capital either individually or in concert
Responsibilities of Board of Directors with family members. In addition, maximum two
[“BOD”] members of the BOD of EMI can be the
Executive Directors including its CEO.
The main responsibilities of BOD are as follows:
The BOD of EMI shall appoint a qualified and
Define the key roles and responsibilities of the experienced person as Compliance Officer who
directors and senior management. shall report directly to the CEO and shall be
responsible for effective compliance of all the
Approve and monitor the objectives, strategies relevant rules, regulations, laws and timely
and the business plans of the EMI and oversee submission of required accurate data, returns
that the affairs of the institutions are performed and other information, as required by SBP from
within the framework of applicable laws and time to time.
regulations.
Capital Requirements
Determine, review, approve and ensure
implementation of internal policies, risk Regulation 10
management, internal control systems, audit, IT
security, human resource etc. Startup capital requirement of becoming an EMI is
PKR 200 million and the minimum ongoing capital to
Create a separate department for internal audit be maintained at all times shall be as follows:
duly approved by the BOD.
BOD can remove CEO with a prior notice of 2 Average Daily On-Going
months from the date of the notice issued where Outstanding E- Capital Required
Slabs
the BOD, acting reasonably, are of the opinion Money Balance
that the CEO has acted fraudulently, (OEB)
negligently, or in material breach of the EMI’s
1. Up to PKR 4 PKR 200 million
policies, procedures or his/her employment
Billion
agreement. Acting CEO appointed pursuant to
resignation/removal of the CEO is required to 2. Between PKR 4 PKR 200 million plus
meet FPT criteria prescribed for CEO and the Billion and PKR 5% of (OEB) in excess
EMI shall duly submit FPT documents to SBP 10 Billion of PKR 4 Billion
before assumption of the charge. 3. Between PKR PKR 500 Million plus
10 Billion and 7.5% of (OEB) in
In case of temporary vacation (not exceeding PKR 20 Billion excess of PKR 10
one month) of the office of CEO, EMI shall Billion
ensure to entrust charge of the office of CEO to
4. Above PKR 20 PKR 1.25 Billion plus
an officer who meets the FPT Criteria
Billion 10% of (OEB) in
prescribed for Key Executives and whose FPT
excess of PKR 20
documents have already been submitted to
Billion*
SBP.
* EMI is required to inform SBP as soon as OEB
exceeds PKR 20 million.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
The items qualified for calculating initial as well 5. Conduct additional due diligence of those
as ongoing capital are given in Annexure B. customers who are categorized as high risk as
per AML/CFT regulations and risk based
Security Deposit at SBP-BSC shall be guidelines of SBP.
maintained at least ten percent (10%) of the
required capital or any other amount prescribed 6. Take consent of customers on the terms and
by SBP. 5% of the security deposit will be kept conditions of e-money payment instruments
in a non-remunerative current account with the including the charges/fee associated with such
SBP Banking Service Corporation and five instruments. The copy of terms and conditions
percent (5%) in the form of Government shall also be made available to customers
securities to be kept under lien at SBP-BSC. through various channels like email, website,
brochures, mobile phones, IVR etc.
Customer Due Diligence
7. Ensure that a CNIC holder can obtain/open
only one e-money payment instrument with an
Regulation 11
EMI.
Following are the requirements which are required
8. Send transaction alerts in real time to their
to be fulfilled by EMI while issuing e-money
customers for all transactions.
payment instruments:
9. During issuance of e-money payment
1. Collect at least the following customer
instruments or during transaction processing,
information:
identify any suspicious activity and report such
transactions to FMU in the form of STRs.
Name
10. Ensure compliance of domestic and
Father/spouse’s name
international sanctions obligations i.e. freezing
of assets and non-provision of services to
CNIC
individuals/entities designated/proscribed by the
UN Security Council or by the Government of
Mobile Number
Pakistan under the Anti-Terrorism Act, 1997.
Residential Address
e-Money payment instruments’ limit
Any other two field information which is not
present on CNIC such as place of birth, Regulation 12
mother’s name etc.
The aggregate monthly load limit of an e-money
Customer is required to provide a copy of payment instrument shall be Rs. 50,000 and Rs.
CNIC and a live digital photo (where 200,000 on biometric verification of CNIC from
applicable). NADRA.
2. Use at least Two-Factor Authentication for Cash withdrawal limit for e-money holders shall
customer verification be Rs. 10,000 per day subject to biometric
verification or at least two-factor authentication.
3. Activate e-money payment instruments only
after verification of customers’ particulars as Issuance and redemption of e-money
well as after pre-screening for designated and
proscribed persons before initiation of customer payment instruments
relationships or allowing use of payment
services. Regulation 13
4. Allow their customers one credit/fund transfer EMI to issue an e-money payment instrument
transaction before verification of customers’ without any delay at par value on receipt of
credentials. In case, the customer’s credentials funds.
are not verified then e-money payment
instrument/account shall be closed and EMI e-Money payment instruments can be funded
shall file an STR accordingly. through:
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
I. Interbank Fund Transfer (IBFT) using any The SBP shall have powers to advice and
ADCs. request EMIs and agents for data and
information, inspection of the books and
II. Cash in at EMI branches/agent premises of the agent, direct an EMI to instruct
locations/ATMs/bank branches. The one its agent, terminate agreement with agent, take
through agent’s location shall be subject to remedial action arising from the conduct of an
biometric verification. agent at any time as SBP may deem necessary.
EMI to redeem e-money payment instruments EMI shall publish an updated list of all agents
at par value at any time upon the request of e- and locations on their websites and assign
money holder without any charges. Further, transaction limits to agents on the basis of
biometric verification is required, in case of potential business volume.
redemption of e-money in cash.
EMI shall not issue e-money payment
Safeguarding customers’ funds instruments through its agents.
EMI shall solicit prior one time approval in Outsourcing of functions to third
writing from SBP to engage agents for providing parties
payment services to EMI’s customers.
Regulation 17
EMI can use the existing Branchless Banking
agent network. No function can be outsourced outside Pakistan
without prior written approval from SBP.
EMI shall develop a central policy on the Agent
Network Management [“ANM”] duly approved For outsourcing, EMI shall follow the
by its Board. instructions specified in Framework for
Outsourcing Risk Management by Financial
EMI shall ensure that agents do not represent Institutions as issued and amended by SBP
themselves as an EMI or staff of EMI. from time to time.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Outsourcing shall not release the EMI from its detailed report as per annexure “B” to the EMI
primary responsibility of security, integrity and regulations.
confidentiality of data/information.
AML/CFT Requirements
Complaint handling mechanism
Regulation 20
Regulation 18
To mitigate the risk of money laundering and
EMIs need to ensure that adequate measures terrorist financing activities, EMIs shall:
for customer protection, awareness and dispute
resolution are in place as they will deal with a Deploy the automated transaction monitoring
large number of first time customers with low system to proactively monitor the transactions;
financial literacy level.
Comply with all the AML/CFT Laws, Guidelines,
EMIs shall have appropriate customer Regulations issued by SBP or any other
protection against risks of fraud, loss of privacy authority from time to time;
and even loss of service.
Identify and assess the ML/TF risks that may
EMI, shall have board approved dispute arise in relation to the development of new
resolution mechanism to settle all disputes. products and new business practices, including
new delivery mechanisms and the use of new or
EMI shall have a proper and separate complaint developing technologies for both new and pre-
management mechanism for resolution of the existing products; and
customer complaints.
Conduct risk assessments prior to the launch or
EMIs shall have customer awareness programs use of new products, practices and
that should cover use of e-money payment technologies.
instruments, protection against frauds and rights
and obligations to use EMIs services etc. Risk Management Mechanism
Security and Confidentiality Regulation 21
For fidelity and secrecy of the information, the EMI overall risk management including enterprise
shall: risk management policies and procedures duly
approved by the Board. Where applicable, EMI
Ensure that personal information of customers shall ensure compliance with SBP’s Enterprise
is used, disclosed, retained and protected as Technology Governance & Risk Management
committed or agreed; Framework for Financial Institutions as issued
vide BPRD Circular No. 05 of 2017 dated May
Ensure the Security, Integrity, Confidentiality 30, 2017.
and Availability of data and services as per the
international standards and SBP guidelines approved policies and procedures for
prescribed from time to time; information, systems security and necessary
internal controls in place.
Comply with the relevant Sections of PS&EFT
Act, 2007; BCP and DRP drills to be conducted half-yearly
in first two years of commencement of
Get their systems audited from SBP’s approved operations and quarterly thereafter and results
Panel of Auditors before commencement of of the drills be recorded in a formal report as per
their business operations and thereafter on the international best practice.
annual basis; and
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Oversight of EMIs Record Retention
Regulation 22
EMIs shall maintain all necessary records for at
Following are the reporting requirements for EMI: least 10 years or as required by the relevant
laws.
Annual audited financial statements shall be
submitted to SBP within three months of the EMIs shall keep all records obtained through
financial year-end. CDD measures, business correspondence, and
results of any analysis undertaken, following the
Capital Returns shall be submitted to SBP on termination of the business relationship as
quarterly basis. required by the relevant laws.
EMIs shall calculate the ongoing capital after EMIs shall ensure that transaction records
three months from the commencement of their should be sufficient to permit reconstruction of
e-money business. For calculating on-going individual transactions so as to provide, if
capital, average daily outstanding e-money over necessary, evidence for prosecution of criminal
the preceding three months shall be taken into activity.
account.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Glossary
AML/CFT Anti-Money Laundering and Countering of Financing Terrorism
PS&EFT Act Payment Systems and Electronic Fund Transfers Act, 2007
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Definitions
Electronic Money Institution Non-banking entities duly authorized to issue payments in the form of
or EMI electronic money.
Electronic Money or Monetary value as represented by a claim on the issuer which is stored
e-money in an electronic including magnetic device or Payment Instrument,
issued on receipt of funds of an amount not less in value than the
monetary value issued, accepted as means of payment by undertakings
other than the issuer and includes electronic store of monetary value on
an electronic device that may be used for making payments or as may
be prescribed by the State Bank.
e-Money holder Any person to whom the e-money has been issued or any person who
uses the e-money to make payments for purchases of goods and
services and who has a claim on e-money issuer for the e-money
issued by the EMI.
Aggregate monthly load Total amount of e-money transferred/loaded into an e-money account
limit held by an e-money holder over the period of a calendar month.
Average outstanding Average amount of balances maintained by an EMI with licensed banks
e-money related to e-money in issue, for any given period and in the manner as
defined by SBP.
Key Executive
Payment Instrument Any instrument issued by EMIs, whether tangible or intangible, that enables a
person to obtain money, goods or services or to otherwise make payment; but
excludes Payment Instruments prescribed in Negotiable Instrument Act, 1881
Payment Services Services that enable the customers to make payments for goods and
services, bill payments, fund transfers, cash deposit and withdrawal from e-
money accounts.
Trust Account An account maintained by an EMI with a licensed bank in Pakistan in which
the EMI is required to place all funds collected from its customers against the
issuance of e-money and is segregated from EMI’s own funds.
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.
Offices in Pakistan
Karachi Office
Sheikh Sultan Trust Building No. 2
Beaumont Road
Karachi 75300
Phone +92 (21) 3568 5847
Fax +92 (21) 3568 5095
eMail karachi@kpmg.com
Lahore Office
351-Shadman-1, Main Jail Road,
Lahore Pakistan
Phone +92 (42) 111-KPMGTH (576484)
Fax +92 (42) 3742 9907
eMail lahore@kpmg.com
Islamabad Office
Sixth Floor, State Life Building
Blue Area
Islamabad
Phone +92 (51) 282 3558
Fax +92 (51) 282 2671
eMail islamabad@kpmg.com
www.kpmg.com.pk
© 2019 KPMG Taseer Hadi & Co., a Partnership firm registered in Pakistan and a member firm of the KPMG network of independent
member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved.