Central Bank Intensifies Oversight of Payment Service Providers

Implementation of ‘Payment Service Provider Oversight Framework’ Marks New Phase for Payment Service Companies After ‘Guidelines for Handling Payment Service Provider Violations’ Take Effect

According to Iran digital economy annotation, although the guidelines for handling payment service provider violations were approved last December, their implementation in recent months has led to more comprehensive oversight of payment service providers by the Central Bank and Shaparak.

For the past six years, since the inception of payment service providers, the Central Bank and Shaparak had not clearly defined the procedures for addressing violations by these companies. However, it now appears that the Central Bank and Shaparak have aimed to reduce violations by specifying the methods of handling such infractions. In other words, the regulatory approach to this directive is focused on increasing deterrence.

The guidelines establish a ‘Payment Service Provider Violation Committee’ within the Central Bank to address violations and decide on appropriate disciplinary actions. The committee’s secretariat is located within the Payment Systems Supervision Department. The committee includes the Central Bank’s Director General of Payment Systems, Director General of Legal Affairs, Head of the Payment Systems Supervision Department, Head of Information Security, and Head of Anti-Money Laundering. The committee is chaired by the Director General of Payment Systems, who can invite other relevant Central Bank departments and Shaparak’s CEO as non-voting members if necessary.

The guidelines specifically identify three types of violations: non-compliance with national laws and regulations, actions that endanger the security of the payment network, and actions that jeopardize the operational regulations of the payment network.

The committee’s secretariat receives reports of violations through the Payment Systems Supervision Department, legal and regulatory bodies, other Central Bank departments, or from Shaparak.

The guidelines stipulate that after reviewing, the committee’s decisions will be sent to Shaparak, which will then forward them to the violating company. The company has ten days to appeal; if no appeal is made within this period, the decisions will be enforced.

Violations are categorized into three levels. Level one violations, which are severe and have significant economic or social consequences, are non-negotiable. Level two violations, while serious, do not have grave economic or social impacts. Level three violations may affect specific sectors, groups, or businesses.

The guidelines also allow for the removal of violation records from a payment service provider’s history after five years, provided there are no further infractions.

The implementation of these guidelines, along with the new oversight framework for payment service providers, has made the regulatory environment more stringent for payment service providers.

The oversight framework outlines specific requirements for payment service providers, including how they should handle contacts, support merchants, and monitor activities. The framework defines the scope of these obligations.

Payment service providers are required to conduct comprehensive reviews of their partnered payment service providers twice a year. The results of these reviews will determine the status of the payment service provider.