Qatar’s Payment Services Regulation: the KYC and AML duties in section 17, from e-KYC to merchant approval
An e-wallet issuer or a merchant acquirer in Qatar is not left to build its financial crime controls from first principles. The Qatar Central Bank's Payment Services Regulation takes the existing AML/CFT framework, applies it to every licensed payment service…
An e-wallet issuer or a merchant acquirer in Qatar is not left to build its financial crime controls from first principles. The Qatar Central Bank’s Payment Services Regulation takes the existing AML/CFT framework, applies it to every licensed payment service provider, and then adds controls that are specific to payments: which identity documents count, how far a simplified digital onboarding may go, and who has to approve a new merchant.
The regulation carries the short title “Payment Services Regulation” for 2021 and states that it enters into force as of 15 September 2021. It is issued under Articles (71), (72) and (73) of the QCB Law, which it defines as Law No. (13) of
- The financial crime content sits mainly in section 17, headed Know Your
Customer (KYC), Anti-Money Laundering (AML), Combating Financing of Terrorism (CFT) and Financing of Weapons of Mass Destruction Proliferation.
Who section 17 reaches
The regulated payment services are the issuance of e-money, merchant acquisition, domestic money transfer, and any other payment service that has one or more of the characteristics in the scope section and is not exempted. Any person providing such services must obtain prior authorization from the QCB.
Banks are not outside it. A bank licensed under the QCB Law is exempted from needing a new licence for a payment service it is currently offering. The regulation then says that sections 10 to 24 of Part B apply to an exempted payment service provider in respect of the payment services listed in section 5. Section 17 falls inside that range.
The baseline: the whole AML/CFT framework applies
Section 17.1 is one sentence and it does most of the work. It says the following must be implemented by all licensed payment service providers:
- the provisions of Law No. (20) of 2019 on Combating Money Laundering and Terrorism Financing;
- Law No. (27) of 2019 on Combating Terrorism;
- the instructions of AML/CFT issued in May 2020;
- QCB guidelines; and
- any other circulations issued by the controllers and law enforcement bodies in Qatar.
The regulation does not restate those instruments. Read across the whole text, it does not use the phrase “suspicious transaction” at all. For reporting suspicion, look to the law and the instructions that section 17.1 names, not to this regulation.
Which documents count for KYC
Section 17.2 fixes the identity document by customer type. The provider must use one of the following, or any superseding documents the QCB requires:
- Citizens and residents: the ID card issued by the Ministry of Interior, with the ID number as the unique customer identity.
- Companies: a valid commercial registration certificate, with the registration number as the unique customer identity.
- Visitors and non-residents: a valid passport, with the passport number as the unique customer identity.
- Minors, for issuing e-money: the ID card issued by the Ministry of Interior, with the consent of the guardian.
Section 17.6 adds a timing rule. Without prejudice to the general principle of KYC in the May 2020 instructions, a service provider must have the customer’s identification documents, and the data and information that validate their identity, when establishing a business relationship with the customer for the first time. Section 17.7 requires a customer acceptance policy that takes into account all factors related to the customers, their business and any other indicators related to customer risks.
e-KYC: allowed for small transactions, with a one-year clock
Section 17.3 is the provision a digital wallet business will read first. Its stated aim is to facilitate faster adoption of digital payments. A licensee may provide payment services involving small transactions to new customers initially by performing an e-KYC procedure. The examples given are verification of the mobile number by one-time password, receiving an electronic copy of one of the section 17.2 documents, phone verification and biometric authentication.
Conditions travel with that permission.
It does not dilute the AML/CFT requirements. The e-KYC procedure is allowed without compromising the requirements of AML/CFT and proliferation financing, or the requirements of managing other risks.
Full KYC follows. Full KYC and an update of the customer’s identity and data must be done within one year, or whenever the customer wants to increase the transaction limit, whichever is earlier.
The limits are capped twice. The limits on the number of transactions and the maximum balance for customers onboarded through e-KYC are defined in the licensee’s board-approved policy, but subject to the overall limit defined by the QCB.
One drafting point is worth knowing before an auditor raises it. Section 17.3 says the e-KYC procedure must follow the requirements in “section 12.9 on e-KYC security principles”. In the published text, section 12.9 is the duty to report security incidents to the QCB. The e-KYC security principles are at section 12.10, which requires the licensee to comply with the security principles for e-KYC issued by the QCB when onboarding customers digitally.
Merchants: due diligence, and QCB approval for each new one
Section 17.4 applies to a licensee providing an e-money service or a merchant acquisition service. It must exercise customer due diligence on potential merchants who apply to participate in its scheme, and it must:
> “look into the merchant’s background to ascertain that the merchant is not a > front for criminal or illegal activities”
The same section then goes further than due diligence. Qatar Central Bank approval must be obtained when adding any new merchant within the provider’s systems, according to the form approved for the purpose. The details listed include the name of the merchant or company, its address, website and phone numbers, a copy of a valid commercial register, the nature of its work and the services or products to be provided.
Section 17.5 is a single line: a licensee must ensure that all transactions in Qatar are carried out in Qatari Riyal.
The AML controls outside section 17
Several other provisions belong in the same compliance file.
Governance. The internal corporate governance arrangements a provider must establish and keep updated include, as a minimum, a general framework of AML/CFT. That covers AML/CFT and proliferation financing guidelines and the mechanism applied for a risk-based methodology.
Risk management. The provider must have effective procedures to identify, manage, monitor and report all types of risks to which it might be exposed. The list names AML/CFT risk alongside operational, cybersecurity, settlement, market, legal, reputational and business risk.
No outsourcing of the function. The outsourcing section ends with a flat rule: the functions of the Compliance and AML/CFT Department may not be outsourced.
Agents. A licensee must obtain prior approval from the QCB to appoint an agent and must carry out proper due diligence before appointing any person as one. It is responsible as the principal for all the acts of any omission or commission by its agents.
Transaction limits and AML checks. E-money issuers must fix the transaction limit (per transaction, daily, weekly and monthly), the transaction velocity limit, fraud checks and AML checks based on the risk assessment, subject to compliance with the overall limit set by the QCB. The regulation sets caps by customer type. Its table of e-wallet balance limits prints 50.000 for a bank customer who is an individual, 30.000 for a nonbank customer who is an individual, 30.000 for a visitor and 8.000 for a minor.
The escrow bank is given a role. A non-bank licensee must place the money collected in an escrow account with a bank licensed by the QCB. The agreement with that bank should include a clause under which the bank shall ensure that the licensee adheres to the KYC requirements and the AML/CFT instructions while establishing customer and merchant relationships and performing payment transactions.
Cross-border transfers. A non-bank licensee must not conduct cross-border remittances to individuals outside Qatar unless it has obtained an exchange house licence from the QCB.
Records, fraud reports and penalties
A licensee must store, in a secure and safe manner, all records and documents relevant to any payment transaction and any other permitted business for at least 15 years since the transaction was executed or since the provider broke off its business relationship with the client. Records must be recoverable and reusable if needed. The licensee must also keep log files and audit trails for all financial transactions.
Fraud has its own reporting line. A licensee must report instances of fraud, along with the modus operandi adopted by the perpetrators, immediately to the body the regulation calls the Financial Investigation Unit of the State Security Department, while notifying the QCB about the incident. A quarterly report to the QCB on customer complaints, incidents that affected payment services and frauds is also required, in the prescribed format.
On enforcement, the scope section says any person who contravenes the regulation shall be subject to the financial sanction established in the QCB Law and in the AML/CFT rule promulgated by Law No. 20 of 2019, or any other law in force. The penalty section says that in case of any violation the QCB shall impose a financial penalty by virtue of the QCB Law or any other law in force.
Three things worth doing
- Age your e-KYC book. List every customer onboarded through e-KYC with the onboarding date and any request to raise a limit. Anyone approaching one year without full KYC is approaching a breach of section 17.3, and so is anyone whose limit was raised first.
- Reconcile the merchant list against QCB approvals. For each merchant live on your systems, find the due diligence file and the QCB approval. Section 17.4 asks for both.
- Check what has been outsourced. If any part of compliance or AML/CFT work sits with a vendor or a group service company, test it against the rule that the functions of the Compliance and AML/CFT Department may not be outsourced, and take a view before the QCB does.
Sources
This article draws on the following sources. Follow the links for the original text.
AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator qatar