The new Stored Value Facilities Regulation – A new era in the FinTech space

Over the past couple of years, there has been rapid development in the FinTech space.  In response to such developments, the UAE Central Bank (“Central Bank”) has issued the Stored Value Facilities Regulation (“Regulation”), dated 30 September 2020 (released in November 2020).  The Regulation was published in the Official Gazette on 15 October 2020 and comes into effect on 15 November 2020.  The Regulation replaces and repeals the ‘Regulatory Framework for Stored Values and Electronic Payment Systems’ (the “Framework”) previously issued by the Central Bank in 2016.  The transition period is one year from the effective date of the Regulation.

The scope of the Regulation includes licensing and the ongoing supervisory and oversight requirements and related enforcement action in relation to the provision of Stored Value Facilities (“SVF”) in the UAE.  The Financial Free Zones continue to be outside the remit.  However, if financial institutions in any Financial Free Zone intend to conduct SVF related business in the UAE onshore, such financial institutions would be required to obtain a license of the Central Bank.

The key highlights are essentially a more streamlined application process for licensing, inclusion of the regulation and licensing of activities in relation to crypto-assets and virtual assets, the ability to obtain a license without having to partner with commercial banks, regulation of cross border offerings of SVFs into the UAE and recognition of e-KYC processes for such business activity. Additionally, a requirement has been introduced for the provision of independent assessments in seven areas by qualified assessors (these areas are corporate governance and risk management; float management; technology risk management; payment security management; business continuity management; business conduct and Customer protection; and AML/CFT control systems).

The following are the salient features of the Regulation:

• Licensing and Scope: Issuing and operating SVFs continues to be a regulated activity which requires a license form the Central Bank with the exception of “single purpose SVF” (such as closed loop payment schemes). This was the position under the Framework and has been confirmed under the new Regulation.
• Scope of SVF: Unlike the Framework, the Regulation now includes crypto-assets within the scope of SVF business and within the definition of virtual assets. The Regulation defines crypto-assets to include “cryptographically secured digital representations of value or contractual rights that use a form of distributed ledger technology and can be transferred, stored or traded electronically”. Accordingly, anyone issuing or operating in the crypto-asset space outside the financial free zones or on a cross border basis, would need to be appropriately licensed or approved, depending on its existing regulatory status. Such amendment to the existing position reflects the positive regulatory response to the technological advancements and the rapid developments in this area. Moreover, the definition of an SVF, now includes device based and non-devise based SVFs. This appears to be a variation from the Framework, which included only device based SVFs.
• Overseas SVF schemes: The Central Bank has expanded its authority over licensing and supervision of ‘overseas SVF schemes’. The Regulation provides guidance on factors to be considered by the Central Bank on whether an oversees SVF scheme falls could fall within the scope of the Regulation and attract licensing requirements. The Regulation additionally provides that the factors set out in the Regulation are neither exhaustive nor conclusive and that the Central Bank will use a holistic approach to judge each case on its merits and take into account the particular circumstances and all relevant facts.
• Exemptions: The Regulation has set out some exemptions from the Central Bank licensing requirements. These include certain cash reward schemes, certain bonus points schemes, SVF for purchase of certain digital products, and SVFs where the Float (essentially customer funds paid to the SVF provider in return for the SVF) does not exceed AED 500K and number of customers do not exceed 100 customers. The exemption must be applied for with the Central Bank who shall decide on the application of the exemption.
• Who can apply: A key requirement for submitting a licensing application to the Central Bank is that the applicant must be a company incorporated in the UAE, including free zones but excluding Financial Free Zones such as the DIFC and the ADGM. Traditionally, licensed firms were required to be incorporated in the mainland, without the ability to retain 100% ownership. This positive change will open up the licensing process to many global players that wish to capture the UAE market. This is an important change from the previous requirement for firms that intended to operate as a retail payment service provider, could only do so by partnering with commercial banks.
• Governance: The Regulation places stringent requirements regarding corporate governance, general risk management and internal control, and accounting systems. Similar to other categories of licenses offered by the Central Bank to financial institutions, the board of directors, senior management, and the controlling shareholder of the licensed SVF business must be approved by the Central Bank.
• Compliance Requirements: The licensed SVF business must comply with the risk management policies and procedures for the management protection of customer money (which is defined as Float under the Regulation) as well as the requirements regarding business conduct, customer protection, technology and specific risk management policies and procedures for managing the risks arising from the operation.
• AML and CFT: The Regulation sets out anti money laundering and countering the financing of terrorism procedures. Each licensed SVF business must conduct KYC for onboarding customers. In general, the electronic know your customer (eKYC) process currently adopted by licensed banks is acceptable for SVF account opening.
• Principal Business: The principal business of a licensed SVF business must be the issuance of SVF only. Any exception to this rule must be approved by the Central Bank.
• Licenced Banks: Licensed banks do not require an additional license to provide SVF schemes. However, they are required to obtain certain approvals if they plan to issue an SVF and carry out the SVF business. Additionally, there are separate requirements, obligations and exemptions for banks in relation to corporate governance, information and accounting systems, risk management and internal control systems, safekeeping and management of the Float.
• Outsourcing: Licensed SVF businesses may outsource activities and processes to service providers, including independent third parties, or companies within their group. Such outsourcing must be approved by the Central Bank.

Conclusion

The UAE is at the forefront of innovation and the issuance of the Regulation is timely to create a stimulus in the payments industry in the UAE in accordance with international standards. It will provide an easier access to international SVF providers to the UAE market.