Key takeaways 

• The requirements under the MAS Exposure Draft apply only to BNM-registered merchant acquirers ("Qualified Acquirers") who:

1. enter into a contract with merchant(s), which results in a transfer of funds to the merchant(s) by: (i) conducting or being responsible for fund settlement; or (ii) issuing fund settlement instructions;
2. facilitate the merchant's acceptance of payment instruments; and
3. are direct participants of payment instrument network(s) to provide merchant acquiring services.

• The MAS Exposure Draft has a material impact on Qualified Acquirers, as they would:

1. be subject to potentially increased liabilities to merchants as they will be liable to provide fund settlement to merchants if the issuer, third party acquirer / payment facilitator or any parties involved in the handling of funds, fails to fulfil its settlement obligations;
2. have to ensure that they have adequate capital, and monitor / assess the suitability and fitness and propriety of its shareholders and key responsible persons; and
3. have to implement or materially enhance among others, its existing merchant acquisition and monitoring system, settlement system, outsourcing procedures, IT systems, data protection mechanisms, recruitment and reporting procedures.

• The requirements under the MAS Exposure Draft are generally similar to those imposed on licensed banks and/or approved operators of payment system. They will also inevitably affect other participants in the payment chain and persons who deal with Qualified Acquirers (including outsourced parties), as back-to-back obligations will be passed on by the Qualified Acquirers to ensure compliance with the relevant standards and requirements of the MAS Exposure Draft.
• There is no transition period for Qualified Acquirers. Accordingly, Qualified Acquirers will have to comply with the requirements under the policy document when it comes into force. They need to immediately undertake a gap analysis to begin planning for compliance with the final policy document.

For further information and to discuss what this development might mean for you, please get in touch with us. 

In more detail 

The key requirements and standards that BNM is proposing to introduce are set out below.

1. Fit and Proper Criteria for Key Responsible Person 

• The Exposure Draft has introduced the concept of key responsible persons ("KRP"). KRPs of Qualified Acquirers must fulfil similar fit and proper criteria imposed on licensed financial institutions on an ongoing basis, based on factors relating to: (i) probity, personal integrity and reputation; (ii) competency and capability; and (iii) financial integrity. Where the KRP no longer fulfils the fit and proper criteria, Qualified Acquirers must take immediate steps to remove the KRP.
• Qualified Acquirers must therefore put in place policies and procedures to periodically assess the fitness and propriety of its existing and future KRPs.

2. Shareholder Suitability Requirements

• Qualified Acquirers must ensure that its shareholder, i.e., a person that holds an aggregate interest of 5% or more in its shares: (i) fulfils shareholder suitability requirements relating to, among others, honesty, integrity, good reputation, adequate control of financial risks and sound financial position on an ongoing basis; and (ii) shall not act in a manner that would be detrimental to the safety and soundness of the Qualified Acquirer.
• While there is no positive reporting obligations on shareholder suitability under the MAS Exposure Draft, BNM retains wide discretion to require Qualified Acquirers to submit documents or information to facilitate BNM's ongoing assessment of shareholder suitability.   

3. Minimum Capital Requirements for Non-Bank Qualified Acquirers

• Small non-bank Qualified Acquirers will be required to maintain a minimum shareholders' funds of RM 300,000, whereas large non-bank Qualified Acquirers will be required to maintain a minimum shareholders' funds of RM 1,000,000. BNM has indicated that it is considering a one-year grace period for existing non-bank Qualified Acquirers to comply with the capital requirement. Qualified Acquirers falling under the prescribed thresholds need to consider if they need to rationalise their business or make capital calls to meet the increased capital amount.

4. Settlement Risk Management

• Qualified Acquirers must deposit funds received for settlement to merchants separate from their own funds in a dedicated deposit account with licensed banks, and ensure timely and complete fund settlement to merchants.
• Where settlement to small and medium enterprise (SME) merchants takes more than two (2) working days upon receiving the funds from payment instrument network / issuer or upon delivery of products / services (whichever later), Qualified Acquirers must either: (i) secure a bank guarantee from a licensed bank on such amounts; or (ii) place the settlement funds in a trust account with licensed banks.
• Qualified Acquirers are liable to provide funds settlement to merchants in the event that the issuer, the third party acquirer / payment facilitator or any parties involved in the handling of such funds, fails to fulfill its settlement obligations.
• Overall, the settlement related requirements and restrictions will lead to increased liabiliy and opreational costs on Qualified Acquirers.

5. Dealings with Merchants and Third Party Acquirer / Payment Facilitators

• Stricter requirements are imposed on Qualified Acquirers when dealing with merchants and other contracting parties. They are required to, among others:

1. conduct proper due diligence when onboarding merchants;
2. include certain prescribed provisions in merchant agreements such as: (i) to ensure all merchants maintain compliance with applicable security requirements and established security standards; and (ii) to implement appropriate rules and procedures on liability management and chargeback;
3. periodically monitor its merchants and other contracting parties that may expose merchants to payment and/or settlement risk, to ensure that these parties comply with the requirements under the MAS Exposure Draft; and
4. implement a clear and robust dispute resolution procedures with merchants.

• Qualified Acquires must implement a gap analysis on the proposed requirements against their current business operations to future proof against the new requirements.  

6. Outsourcing Arrangements

• While BNM's approval is generally not required for Qualified Acquirers to enter into outsourcing arrangements, Qualified Acquirers will need to comply with stricter corporate governance, administrative and operational requirements. Qualified Acquirers must perform appropriate due diligence on the outsourced parties, obtain Board approval to outsource its functions, establish a comprehensive outsourcing agreement with certain provisions prescribed by BNM and obtain a written undertaking from the outsourced parties to comply with secrecy / data privacy obligations imposed by BNM.
• Outsourcing agreements with IT related third party service provider must also contain provisions for disaster recovery and backup capability, IT system availability and oblige the service provider to provide sufficient notice to the Qualified Acquirer before undertaking any changes that may impact the IT systems of the Qualified Acquirer.  Qualified Acquirers are allowed to use cloud services but must conduct comprehensive risk assessments based on criteria prescribed by BNM. Unlike the Risk Management in Technology policy document issued by BNM, prior approval or consultation with BNM is not required for the use of public cloud, however the risk assessment must be documented and made available for BNM's review upon request.
• Qualified Acquirers should review and conduct a gap analysis on the proposed requirements against their existing outsourcing procedures, arrangements and contracts so that they have a checklist of new measures.

* * * * *

This client alert was issued by Wong & Partners, a member firm of Baker McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner or equivalent in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.