Payment System Oversight Framework

EIANGKO SENINII NO PILIPINAS OFFICE OF TI{E GOVERNOR CIRCULAR NO. 1OS9 Series of 202O Subject: Payment System Oversight Framework The Monetary Board, in lts Resolution No. 803 dated 25 June 2O20, approved the Payment System Oversight Framework, which sets out the approach and rules of the Bangko Sentral ng Pilipinas (Bangko Sentral) in the conduct of its oversight function pursuant to RepublicAct (R.A,) No. 11127 orthe National Payment Systems Act (NPSA)and R.A. No. 7653 orThe New Central BankAct as amended by R.A. No. 11211. Section 1. The following sections shall be created in the Manual of Regulations for Payment Systems (MORPS): Part I Powers of the Bangko Sentral 101 Payment System Oversight Framework Policy Stotement. A safe and efficient national payment system is crucial to the smooth functioning of financial markets and the stability of monetary and financial systems. lt is also instrumental in achieving and sustaining inclusive economic growth. Thus, the Bangko Sentral adopts this oversight framework for the effective and efficient governance of the national payment system. Delinition of Terms. In addition to the definition of terms under Section 4 of R.A. No. LLl27, the following terms shall be defined as follows: a. Notionol Payment system (NPs) - refers to all payment systems and components including instruments, services, processes, schemes, procedures, infrastructures and participants that ensure the circulation of money or movement of funds in the philippines. b' Operator of a Payment System (OPS) - as defined under Section 202 of the MORPS. c. Systemicolly lmportant PaymentSystem (SIPS) - a payment system which poses or has the potential to pose systemic risk that could threaten the stability of the NPS. d. Prominently lmportont Poyment System (PIPS) - a payment system which may not trigger or transmit systemic risk but could have a major economic impact or undermine the confidence of the public in the NPS or in the circulation of money.l t European Central Bank (ECB), "Oversight standards for retail payments" (June 2003) as cited in the Bank for International Settlements (815) "Central Bank Oversight of Payment and Settlement Systems" (May 2005).

e. Designated Pdyment System (DPS) - a payment system that is designated by the Bangko Sentral either as a: (1)S|PS, or (2) ptpS. f. Payment System Management Body (PSMB)- a body organized by participants of a DPS for self-regulation and accredited by the Monetary Board for the purpose of managing and governing participants of the relevant DpS. g. Finoncial Morket lnfrostructure (FMl) - a multilateral system among participating institutions, including the operator of the system, used for the purposes of clearing, settling, or recording payments, securities, derivatives or other financial transactions. 2 h. Payment service Provider (PsP) - an entity that provides payment services to end-users, such as consumers, merchants, and bitlers, including government institutions. critical service Provider (csP) - an entity that provides process arrangements, technology, service or infrastructure that is critica13 in ensuring the operational reliability of an FMl, an operator of a designated payment systems (ODpS) or, in some cases, multiple FMls/oPSs. This does not include entities that provide utilities and activities not directly related to the essential operations of an FMl/OPS.4 Obiectives oI the Oversight Function. The Bangko Sentral performs oversight functions primarily to ensure safety, efficiency, and reliability of the Nps. Safety builds and preserves confidence in the financial system, This objective requires reliability and integrity of the payment system as well as effective management of a broad spectrum of payment-related risks such as legal, compliance, credit, liquidity, business, custody, investment and operational risks, including cybersecurity breaches, operational and settlement failures, and fraudulent transactions. Efficiency is characterized by the presence of quick and affordable payment means which are fit for the purpose of the transactions and the needs of the users and the participants. lnteroperability and healthy competition among the PSPs and the OPSs are necessary to achieve efficiency. Responsibility lor Oversight Pursuant to the authority granted under Section 5 of R'A, No. 71L27 or the NPSA and Section 3 of R.A, No. 7653 or The New Central Bank Act as amended by R.A. No. 11211., the Bangko Sentral, through an appropriate oversight department, is responsible for overseeing the NPS, including the payment system that the Bangko Sentral owns and operates pursuant to Section 8 of R.A. No. 11127. The Bangko Sentral shall adopt internal safeguards to ensure independence between its overseer and operator functions. 2 Committee on Payments and Market lnfrastructures (CPMI) - International Organization of Securities Commission (IOSCO) "Principles for Financial Market Infrastructures', (20L2), 3 Critical service refers to a service delivered to an FMI/ODPS wherein the capability of the FMI/ODPS to perform its functions will be impaired if the service is not rendered. Assessment of criticality of service shall consider substitutability, wherein a service may be considered critical if there is no substitute for said service or, if substitute is available, transition shall require significant resources (time and financial resources). a BlS, "Assessment methodology for the oversight expectations applicable to CSPs" (December 2014).

Cooperative Anersight. With regard to payment activities and interlinkages of FMls that relate or interconnect with payment systems, the Bangko Sentral shall pursue cooperative oversight with relevant local regulators, government agencies, and foreign regulators. Apart from enhancing oversight capacity and response, cooperative oversight prevents regulatory arbitrage resulting from gaps, inefficiencies, duplications, and inconsistencies in the regulations for FMls. In this respect, the Bangko Sentral shall establish measures to facilitate effective and efficient flow of information among various regulators and government agencies. The cooperation and information-sharing process shall be compliant with relevant statutory provisions and consistent with the responsibilities for authorities under the Principles for Financial Market lnfrastructures {PFMt).s Other locol regulators and government ogencies. The Bangko Sentral shall coordinate with other regulators including primary regulators of FMls that relate to or interconnect with payment systems. The grant, suspension, or revocation of any government license necessary for the conduct of business of an OPS must be done only with prior consultation with the Bangko Sentral,6 being the primary regulator of the OPS. b, Foreign regulators or overseers of payment systems of other countries. The Bangko Sentral's cooperative oversight shall conform to the arrangements entered into by the Philippines through regional and global affiliations such as, but not limited to, the Executives' Meeting of East Asia and Pacific Central Banks (EMEAP), South East Asian Central Banks (SEACEN), and Association of South East Asian Nations (ASEAN). ln cases where a payment system participant in the Philippines also operates in other jurisdictions, or a domestic payment system interacts with FMls in other countries, the Bangko Sentral can directly coordinate with foreign regulators or overseers of payment systems. The coordination aims to facilitate safe, efficient, and reliable cross-border payment transactions. Scope of Oversight. The oversight function of the Bangko Sentral shall cover the NPS including activities of the following institutions: a. Operators of payment systems (OPS). All OPS shall comply with the relevant regulations and guidelines set out bythe Bangko Sentral, including governance, risk management and reporting requirements. An OPS shall remain financially and technically capable to ensure that the payment system it operates remains robust and responsive to the needs of its participants. b, Finoncial Market lnfrostructures (FMl). The Bangko Sentral focuses its oversight on the NPS. Cooperative oversight shall be pursued by the Bangko Sentral for payment activities and interlinkages of other FMls that relate to or 5 International standards for financial market infrastructures, i.e., payment systems, central securities depositories, securities settlement systems, central counterparties and trade repositories, issued by the CPMI and the IOSCO. 5 Section 9 of R,A. No. U127.

interconnect with payment systems. Payment system FMls, at the minimum, shall observe the relevant PFMI and comply with applicable Bangko Sentral rules and regulations. PFMlassessment responsibilities for other FMls shallbe subject of cooperative oversight with the FMI's primary regulator. Likewise, the oversight function shall extend to the payment and settlement activities of correspondent banks and custodians.T c. Payment System Monagement Body (PSMB). A PSMB, duly accredited by the Monetary Board, shall be responsible for promoting the development and interoperability of the payment system, the creation of payment system rules and agreements, and the establishment of standards to ensure that payment transactions are safely and efficiently cleared and settled with finality; provided, that the said rules, agreements, and standards shall be subject to review and prior approval by the Bangko Sentral. The PSMB shall develop a comprehensive and holistic governance framework that satisfactorily demonstrates how the PSMB will perform self-regulation among its members in accordance with the NPSA. The PSMB shall establish policies and procedures to implement the governance framework, including assurance measures for members' compliance with the PSMB rules and regulations, to instill discipline among its members and to promote development of the payment system. The development and implementation of the framework, policies and procedures by the PSMB shall be subject of oversight by the Bangko Sentral. The Bangko Sentral may accredit several PSMBS. Conversely, the Bangko Sentral may revoke the accreditation of a PSMB for failure to perform its function or when it no longer serves its purpose as a PSMB. d. Payment service providers (PSPS). PSPs shall ensure that the payment instruments and delivery channels they offer are responsive to the needs of the end-users and compliant with relevant regulatory requirements, including, but not limited to, payment regulations, consumer protection, information security, and anti-money laundering/combating the financing of terrorism (AML/cFr). e. Criticol Service Provider (CSP) of a designated poyment system. The Bangko Sentral shall exercise its oversight function over the CSPs of DPS. The Bangko Sentral may engage in a cooperative oversight with the prirnary regulator of a CSP that operates not only in the Philippines but also in other jurisdictions. At the minimum, CSPs shall observe the relevant principles for CSPs as provided in the PFMI. 7 Custodians hold securities for their customers, including banks, and provide related services. BlS, "Central Bank Oversight of Payment and Settlement Systems" (May 2005).

Oversight Activities.E Consistent with a risk-based approach that takes into consideration both the payment system's risk profile and its impact in the NPS, the Bangko Sentral shall perform the following oversight activities: a. Monitoring existing and planned poyment systems. The Bangko Sentral monitors existing and planned payment systems to obtain an in-depth knowledge of the interaction among payment systems and the interlinkages between payment systems and other FMls. By monitoring payment systems, the Bangko Sentral aims to ultimately determine the impact of these systems on the broader financial and monetary systems. Relative to this activity, the Bangko Sentral adopts the following policies: (L) Registrotion and licensing. The Bangko Sentral requires registration of all OPS in accordance with the guidelines provided under Section 202 of the MORPS. A registered OPS that intends to operate within a designated payment system shall secure prior approval from the Bangko Sentral,s The licensing framework under the MORPS shall include, at a minimum, the requirements for PSPs, ODPS, and payment services, arrangements, instruments, and activities. (21 Off-site monitoring. The Bangko Sentral shall require the participants of payment systems to submit periodic and ad hoc reports on payment and other financial transactions, key risk indicators, incidents, and other statistics, key documents, and information relevant to its oversight of the NPS. The submission of the required reports to the appropriate oversight department shall conform to the reporting governance framework of the Bangko Sentral. As deemed relevant, the Bangko Sentral shall conduct meetings with existing andlor prospective participants of a payment system. (3) On-site octivities. The Bangko Sentral shall perform on-site activities which shall complement off-site activities to strengthen the oversight of the NP5. The appropriate oversight department shall determine the frequency and scope of on-site activities. These activities shall include, but are not limited to, review of contractual arrangements governing payment systems, evaluation of pricing mechanisms against the principles adopted by the Bangko Sentral, verification of compliance with relevant laws, regulations and policies, and validation of representations made by the participants in the payment systems. b, Assessing the NPS and poyment systems ogoinst the safety, efficiency ond reliability objectives. In pursuit of these objectives, the Bangko Sentral conducts continuous assessment of payment systems and the NPS based on 8 The Bangko Sentral's oversight activities are consistent with those provided in the "Central Bank Oversight of Payment and Settlement Systems" issued by the CpMl. e Pursuant to R.A. tl1Z7, operators of deslgnated payment systems are required to secure prior authority from the Bangko Sentral.

information gathered from its monitoring activities. The Bangko Sentral adopts the following policies in connection with this activity: (Il lnternotionally Accepted Stondards and Practices (lASPs). IASPs are established, thoroughly-developed, and generally-accepted guidance prescribed by reputable international-standard setting bodies, which include multilateral agencies.l0 The Bangko Sentral shall require the observance of IASPs in the design and operation of payment systems. (21 Assessment Criteria. The Bangko Sentral shall adopt different sets of assessment criteria in consideration of the characteristics and risk profile of payment systems, the size and profile of the transactions these systems process, and the system architecture, governance and controls, among others, established by the participants in the payment systems. (31 Designation. The Bangko Sentral shall designate a payment system which poses or has the potential to pose systemic risk that could threaten the stability of the NPS. To protect public interest, the Bangko Sentral may also designate a payment system which may not trigger or transmit systemic risk but could have a major economic impact or undermine the confidence of the public in the NPS or in the currency in general, Designation shall conform to the criteria and the process provided in this framework. (41 Enforcement oction. The Bangko Sentral may deploy enforcement actions, including but not limited to monetary and/or administrative penalties and sanctions, to ensure compliance with relevant laws and regulation and bring about timely corrective actions. Any violation committed by an OPS or any other participant in a payment system, and/or by their directors and officers, shall be subject to the sanctions set forth in Sections 36 and 37 of R.A. No. 7653, as amended, and Sections 19 and 20 of R.A. No. 11127, as appropriate. lnducing Change. The Bangko Sentral acts as a catalyst for change to pursue development and innovation of payment systerns, enhance the safety and efficiency of the NPS, as well as address emerging payment risks or issues. The Bangko Sentral may pursue its reform agenda in several ways, such as, but not limited to, the following means: (11 Stokeholder dialogue. The Bangko Sentral may regularly conduct dialogues and collaborate with key stakeholders on innovative approaches towards improving the payment system to ensure that oversight expectations are consistent with industry initiatives and the needs of the end users. Towards this end, a formalforum, led by the Bangko Sentral with key stakeholders as regular members, may be created. Further, the Bangko Sentral shallconduct focused research and, as suitable, collaborate with other local and/or 10 Examples include: The World Bank (WB), and the BlS.

foreign regulators on payments development in the country, Joint actions or projects can be pursued for this purpose. (21 Policy issuonce. The Bangko Sentral shall issue policies to enable innovative solutions for the payrnent systems to thrive while keeping the existing and emerging payment-related risks adequately managed and mitigated. These policies shall include principles and requirements on various areas, such as, but not limited to governance, risk management, consumer protection, data confidential ity, informatio n security, AM L/CFT, a nd prici ng mecha n ism. Designation of a Payment System. A payment system shall be designated as SIPS or PIPS upon determination by the Bangko Sentral that the payment system poses or has the potential to pose systemic risk, or the designation of the payment system is necessary to protect public interest. The Bangko Sentral shall take into account the following criteria and any other relevant considerations approved by the Monetary Board for the purpose of designating payment systems: a. Market share; b. Aggregate settlement risk based on volume and value of transactions; c. Nature and complexity of transactions that the system processes; d. Interdependence with other payment systems or FMls; and e. Absence of alternative payment system. Designotion Vetting on the designation of a payment system shall be based, among others, on information gathered from offsite monitoring, stakeholder dialogue, on-site activities, and cooperative oversight. Once the designation criteria are met, the Bangko Sentral shalI initiate a focused review on the payment system's profile, including its current and potential impact on the NPS. ln the course of the assessment, the Bangko Sentral shall engage the participants of the payment system being evaluated for possible designation, Upon approval of the designation of a payment system, the Bangko Sentral shall notify the participants of the payment system. A transitory provision for compliance with the requirements for a designated payment system shall be included in the notification, as applicable. Moreover, the Bangko SentraI shall inform the public of the designation of a payment system. Designoted Poyment System (DPS). Participants of DPS shall be subject to periodic assessment by the Bangko Sentral, The assessment shall be comprised of on- site visits and off-site monitoring activities. Assessments shall focus on the observance of standards such as the PFMI and other lASPs, compliance of participants in the DPS with laws, regulations, and determination of whether the factors considered for designation continue to exist. The participants in a DPS shall demonstrate adequate governance and risk management arrangements consistent with the principles set out in relevant laws and regulations. These arrangernents cover several areas of concern including the access of participants to the system, managernent of liquidity, credit, operational, settlement and general business risks, finality of settlement, fair market competition, reasonable pricing rnechanism, independent assurance/audit, and transparency.

Operdtor of a Designated Payment System (ODPS). Recognizing the role assumed by an operator in the maintenance and operation of a designated payment system, the Bangko Sentral, through the Monetary Board, shall set the organizational and operational requirements for an ODPS. At a minimum, an ODPS shall: a. Secure a certificate of authority issued by the Monetary Board prior to (1) registering the Articles of lncorporation and By-Laws, or any amendments thereto, or (2) obtaining a license to do business in the Philippines for submission to the Securities and Exchange Commission (SEC), as applicable; b. Be a stock corporation, and licensed to do business in the Philippines in case of foreign entities; c. Be a registered OPS pursuant to Section 2O2 of the MORPS and must secure prior authority to be an ODPS from the Bangko Sentral. lf an existing payment system is designated, the operator shall secure an authority to be an ODPS from the Bangko Sentral; d. Obtain prior approval of the Monetary Board for any change in ownership or control, directly or indirectly, of more than ten percent (10%) of the voting stock of the ODPS;l1 e. Secure approval from the Bangko Sentral prior to implementation of a significant modification in its business model; f. Comply with the fit and proper rule set on qualifications and disqualifications of indlviduals elected or appointed as directors or officers of the ODPS with respect to their integrity/probity, physical/mental fitness, relevant experience, education, training, competence and other qualifications necessary in the performance of their duties. In this regard, the officers and directors of an ODPS may be confirmed, disqualified, suspended, removed, or watch-listed by the Monetary Board, without prejudice to imposition of other enforcement actions; g. Comply with governance, risk management and internal control standards set by the Bangko Sentral, including but not limited to the observance of relevant PFMI principles, confidentiality of payment information, and compliance with R.A, No. 9160, otherwise known as the "Anti-Money Laundering Act of 2OO1r" and other related laws; h. Comply with the outsourcing framework prescribed by the Bangko Sentral including the scope and extent of the responsibility of the ODPS in regard to the actions of its service provider(s), requirements on ensuring that governance, risk management, and internal controlstandards are consistently applied to the outsourcing arrangement and to the parties involved, or any limitation of functions that may be outsourced. In this regard, the ODPS is expected to establish accreditation and continuing compliance requirements on its service provider(s) or participant OPS to maintain the integrity of the payment system; i. Exhibit high degree of security and operational reliability; and u Section 13 of R.A. No. 11127.

j. Adopt contingenry requirements (e.9., operational, liquidity) to ensure timely completion of processing commitments. An ODPS is expected to engage with the appropriate oversight department of the Bangko Sentral to discuss how it intends to observe relevant standards. The requirements a, b and d for ODPS as cited above shall not apply to payment systems owned and operated by the Bangko Sentral. Designotion of o Manoger to Mdndge the Operotions of the ODPS. When a threat to the safety, efficiency and reliability of a designated payment system exists, the Eangko Sentral, upon determination of its appropriate payment system oversight department, and with prior approval of the Monetary Board, shall appoint without need for prior court hearing, a manager of recognized competence in payment systems to manage the operations of the ODPS in accordance with Section 17 of R.A. No. 11127. The Monetary Board shall not be precluded from replacing the manager assigned if it is deemed necessary. Revocation of Designation. The Bangko Sentral, through the Monetary Board, may revoke the designation of a payment system upon determination that the payment system no longer meets the designation criteria of a DPS provided in this framework. The participants in the DPS and the public shall be informed of the revocation of the designation. Enforcement Action. The Bangko Sentral may deploy enforcement actions to ensure compliance with the provisions of this Section and bring about timely corrective actions. Any violation of this Section shall subject the participants of a payment system and/or its directors, officers, and/or employees to the sanctions set forth in Sections 36 and 37 of R.A, No. 7553, as amended, and Sections 19 and 20 of R.A. No. 11127, as appropriate. Section 2. The provisions in Section 101. of the MORPS as introduced by Circular No. 1049 dated 09 September 2019 on Registration of OPS shall be renumbered to "Section ZOZ - Operator of a Payment System" under "Part 2 - Organization, Management, and Administration of Participants in Payment Systems" of said manual, Section 3. This Circular shall take effect fifteen (15) calendar days following its publication either in the Official Gazette or in a newspaper of general circulation. FOR THE MONETARY BOARD: BENJAMIN E. DIOKNO Governor Date 7 JuIY 2A2U