Saudi Arabian Monetary Authority Publishes Draft Payment Services Regulation

SAMA will soon regulate payment services that have so far remained unregulated. Both local and offshore payment service providers will likely need to apply for licenses.

On 1 December 2019, the Saudi Arabian Monetary Authority (SAMA) published a draft Payment Services Regulations (PSR) for consultation and public feedback. The PSR represents SAMA’s maiden voyage into the regulation and licensing of payment service providers, taking into consideration the rapid evolution and proliferation of payment service providers that is taking place globally. The consultation period will last one month, ending on 30 December 2019. Following this period, SAMA will consider the feedback and amend the PSR as necessary. 

SAMA will likely pass implementing regulations for the PSR in early 2020. These regulations are likely to feature a granular level of detail in regard to specific requirements and processes for license applications. 

This Client Alert examines the regulatory objectives of the PSR and their implications for both local and offshore payment service providers.

Background

The PSR serves as a foundational set of regulations that defines key concepts and establishes the regulatory parameters for SAMA’s authority over payment service providers. The PSR explicitly establishes the licensing and supervision of (i) payment systems; (ii) their operators; and (iii) payment service providers (Article 3).

Under the PSR, a payment system is defined as the instrumentalities, processes, and principles for the processing and settlement of payment orders and the clearing operations related thereto inside the Kingdom or with parties outside of the Kingdom. Notably, it remains to be seen what obligations payment service providers based outside of the Kingdom will face. While such providers will need to be licensed, it is unclear how much reliance may be placed upon their own existing national regulations.

The PSR includes within the definition of payment services “all payment services, including those services related to execution of payment operations, means of payment, transfer and processing. This includes by way of example but is not limited to: the management of transfer operations and electronic money through platforms or payment processes, the establishment of innovative intermediation/facilitation platforms for the banking sector, the establishment of payment wallets, and electronic ledgers.”

As for the implementing regulations, the PSR will determine which payment services fall within its scope and require licensing, and which payment services will be exempted as outside the scope due to the characteristics/nature of their users (Article 2.2).

It will be important for the implementing regulations to provide a sufficient level of detail regarding this scope to avoid confusion in the market. Further, the implementing regulations should avoid a “one size fits all” licensing and requirements framework, and ensure proportionality based on the nature and scale of each applicant.

Regulatory Objectives

The PSR provides that SAMA in the course of implementing this law will consider the following objectives: (i) safeguarding the stability and resilience of the monetary and financial system; (ii) increasing the security and capability of the payment infrastructure and financial markets in the Kingdom to mitigate potential risk; (iii) incentivizing innovation and competition in payment services in the Kingdom; and (iv) ensuring the protection of consumers insofar as payment services are concerned (Article 4).

Below is a summary of the key articles in the PSR.

Articles 5-6: Licensing

Article 5 provides that in the implementing regulations, SAMA will:

• Set out requirements for licensing and continuing obligations incumbent upon licensed firms
• Take necessary steps to protect consumers of payment services
• Establish a dispute resolution procedure for hearing complaints and disputes subject to the terms of this law and its implementing regulations
• Establish requirements for the protection of client funds insofar as payment services are concerned
•  Define and interpret the terms and concepts in this law 
• Establish standards for interoperability among payment systems both within and outside of the Kingdom
•  Maintain a register of payment systems, payment system operators, and payment service providers
•  Assess the capital adequacy and liquidity of payment system operators and payment service providers and their controllers
•  Support international cooperation
•  Own and operate its own payment systems directly or indirectly (through companies SAMA establishes for this purpose)

Article 6 provides that SAMA shall determine when a person is engaged in regulated activities that require licensing by the law, including the circumstances in which persons outside of the Kingdom are deemed to be conducting regulated activities within the Kingdom.

Article 6 also provides that the requirements for licensing will include, inter alia, (i) capital adequacy; (ii) legal form and organizational structure; outsourcing arrangements; (iii) consumer protection and dispute resolution requirements; (iv) corporate governance and internal controls; (v) membership rules (in a payment system); and (vi) any other requirements set out in the implementing regulations.

Ensuring that licensing requirements and processes and ongoing regulatory obligations are proportional to the type of activity will be important so as to encourage innovation and guarantee that the consumer benefits from competition and choice, as well as avoid unnecessary barriers to entry.

Article 7: Insolvency

Article 7 provides that a payment system will be treated as a regulated entity for purposes of the Kingdom’s insolvency law and implementing regulations. This implies that SAMA will likely issue specific implementing regulations addressing the insolvency of payment systems/payment system operators/payment service providers that will establish a special insolvency regime for payment systems/payment system operators/payment services providers in line with the recommendations and standards established by the Bank of International Settlements (BIS), the International Organization of Securities Commissions (IOSCO), and the Financial Stability Board (FSB). 

Article 8: Access and Client Funds

Article 8 provides that payment system operators must provide access (the precise wording in Arabic is to provide the “benefit”) to payment systems on reasonable commercial terms in an equitable manner. This may constitute the beginning of “open banking” type requirements. However, the scope and intention behind this provision remains to be seen.

Article 8 also requires that client funds are segregated from those of the payment service provider and that measures are taken to ensure the protection of such funds.

Articles 9-12: Systemically Important Systems 

SAMA shall maintain a public register of all systemically important payment systems. Article 9 grants SAMA the authority to classify any payment system as systemically important on the basis of the objectives set out in Article 4 in addition to the following four considerations: (i) nature and scope (value and currency) of payments processed; (ii) market share; (iii) whether any disruptions in the payment system would have a major impact on the financial system and public confidence therein; and (iv) connectivity to financial markets.

Under Article 10, payment systems that are designated as systemically important will be notified by SAMA, and it will be incumbent upon such systems to adhere to the rules applicable to systemically important payment systems pursuant to the implementing regulations.

As yet, the precise scope of these rules remains to be seen. However, SAMA has published an operational framework setting out its objectives in relation to the regulation of systemically important financial market infrastructure that includes payment systems, having regarding to the recommendations and established by the BIS, IOSCO, and the FSB.

Under Articles 11-12, systemically important payment systems must have rules that specify

• When a payment order initiated by a member becomes final, and when such an order will be subject to final settlement — i.e., when settlement finality occurs within the system, including scenarios in which multiple payment systems are involved
• The arrangements that will ensure the protection of final clearing and its applicability in scenarios in which the payment system operator or one of its members becomes insolvent
•  Rules relating to the execution/implementation of guarantees by the payment system operator or its members
•  Rules that allow a systemically important payment system to manage the insolvency of members
•  When payment transactions are cleared and settled and become irreversible, even if a relevant participant or operator becomes insolvent

These rules are guided by the requirements of the BIS-IOSCO’s Committee on Payment and Settlement System (CPSS) Principles for Financial Market Infrastructures as well as key attributes published by the FSB.

Articles 14-16: Insolvency Exceptions

Articles 14-16 prescribe the manner in which certain payment transactions conducted on systemically important payment systems are treated in insolvency scenarios. Notably, certain provisions of the Kingdom’s insolvency law and implementing regulations will not apply in respect of such payments. Once again, the establishment of insolvency rules and arrangements outside of the jurisdiction’s usual insolvency framework is in line with the measures set out in the applicable CPSS and FSB standards.

Article 17: Disputes Committee

Article 17 establishes a special committee comprising subject-matter experts appointed by Royal Decree, and specifies broadly its rules of operation, with jurisdiction to hear disputes (both public and private) and grievances arising out of the implementation of the PSR. This committee has broad powers, including the compulsion of evidence, the calling of witnesses, and the imposition of sanctions. 

Article 18: Violations

Article 18 provides that the conduct of any activities that require licensing pursuant to the PSR constitutes a violation of its terms, which may be punishable through the imposition of financial penalties. Such a violation may amount to criminal conduct, and this article contemplates the imposition of criminal sanctions (imprisonment) for violators. This article specifies that, should a violator be a legal entity, the individuals that are found responsible for the operation of such legal entity may be found to be criminally liable for violations. Agreements and contracts that violate the PSR will be treated as void.

It remains unclear whether violations are ipso facto crimes or whether SAMA has the discretion to decide that a violation amounts to a crime.

Article 19: Exemptions

Article 19 provides SAMA, in its absolute discretion, to exempt any entity from some or all of the provisions of the PSR. This article specifically contemplates exemptions with a view toward encouraging innovation and the development of the payment services ecosystem in the Kingdom.

Articles 21-22: Information Sharing

Article 21 provides SAMA with the right to share information on any person subject to the PSR for the discharge of its regulatory mandate and specifically further to requests from other authorities.

Article 22 provides that payment service providers and payment system operators licensed under the PSR may not share information about members or users except in compliance with the PSR or other applicable regulations, or pursuant to the explicit consent of the member or user. 

Conclusion

With the advent of the PSR, SAMA will soon regulate payment services that have so far remained unregulated. For this reason, both local and offshore payment service providers likely will need to apply for licenses and become regulated. Such requirements will require payment services providers and systems operators to familiarize themselves with the applicable requirements and commit the necessary time and resource to ensure compliance with a host of obligations (e.g., conduct of business, suitability, anti-money laundering, Know Your Customer (KYC), risk management, and capital adequacy). Failure to obtain a license whilst continuing to provide covered services may result in the imposition of sanctions that include financial penalties and may rise to the level of criminal sanctions of up to one year in prison.