4. Systems & Operations
4.1. Overview of AFAQ Service's Architecture
The AFAQ Service is made up of the following components:
• Sending Domestic RTGS system,
• Sending Regional Payment Gateway (RPG),,
• Central Component,
• Receiving Regional Payment Gateway (RPG),
• Receiving Domestic RTGS system,
• Communications network linking all of the other components of the full system,
• In the case of the countries using the CSM, the functions of the Domestic RTGS system, for both Sending & Receiving cross-border payments, will be performed at the AFAQ Service CC. The service is technically hosted by GPC. The service is managed by the NCB of the country using the CSM as part of their Domestic RTGS services.
4.1.1 Sending Domestic RTGS
The Sending Domestic RTGS system, operated by that country's NCB, handles all communications with the Direct Participants in the sending country. It also deals with all aspects of the processing of outward cross- border payments in accordance with the OR of that country's Domestic RTGS system, including, message validation, accounting, verification of availability of funds on the account of the Sending Participant, debiting the account of the Sending Participant, crediting the account of the Receiving NCB and translation of the messages, if necessary, to the format required by the Sending RPG.
4.1.2 RPG
RPG’s main functions are to validate, transform and route the cross-border payment messages.
• Message routing and validation,
• Message queuing in any event causing the AFAQ Service or RPG to queue messages until they can be delivered,
• Handling of Payment Completion Confirmations,
• Exception handling and return of payments,
• Systems management and access control,
• Synchronization of static data with the AFAQ Service cc.
• Holding of the current Participant Directory for message validation purposes.
• Holding of the current FX Translation Rates table for message validation purposes.
• Holding of the current Calendar for message validation purposes.
• Conversion of message formats MX from/to MT.
• Rejection of cross-border cross-currency payments where validation fails.
4.1.3 Sending RPG
The Sending RPG, operated by that country's NCB, receives individual payment messages from the Sending Domestic RTGS system, validates the message format, encrypts all the sensitive data, adds the summary data required for settlement and prepares the full message for transmission to the AFAQ Service CC. The Sending RPG also processes Payment Completion Confirmation messages from the AFAQ Service CC and matches them with the previously sent payment messages.
4.1.4 Receiving RPG
The Receiving RPG, operated by that country's NCB, receives payment messages from the AFAQ Service CC, decrypts the sensitive data, translates the messages into the format required by the Receiving Domestic RTGS system and forwards the messages to the Receiving Domestic RTGS.
Any data not included in the message from the Receiving RPG to the Receiving Domestic RTGS system is retained and available in the Receiving RPG. Receiving Direct Participants and Receiving NCBs have access to this data.
The Receiving RPG also processes Payment Completion Confirmation messages from the Receiving Domestic RTGS, matches them with the previously sent payment messages and transmits the Completion Confirmation to the AFAQ Service CC.
4.1.5 AFAQ Service CC
The AFAQ Service CC will perform the following main functions:
• Receive payment messages from the Sending RPG,
• Validate the message format and content,
• Perform the accounting entries over the shadow accounts of sending and receiving NCBs, and the Primary Accounts of Direct Participants in the case of countries using the CSM,
• Transmit the payment message to the Receiving RPG, or, to the Direct Participants in the case of countries using the CSM,
• Process Payment Completion Confirmation messages from the Receiving RPG, match them with the previously sent payment messages and transmit the Completion Confirmation to the Sending RsPG, or, to the Direct Participants in the case of countries using the CSM,
• Process payment rejections and returns,
• Maintain the Direct Participants directory,
• Maintain FX Exchange Rates for cross-currency conversion and end-of-day Settlement,
• Maintain the Business Day Timetable and Calendar,
• Provide enquiry services to NCBs, and to the Direct Participants in the case of countries using the CSM,
• Produce and transmit MT950 Shadow Account statements at end-of-day, and
• Perform end-of day Settlement activities.
4.1.6 Receiving Domestic RTGS
The Receiving Domestic RTGS system, operated by that country's NCB, handles all communications with the Direct Participants in the receiving country. It also deals with all aspects of the processing of Inward cross-border payments in accordance with the rulebook of that country's RTGS system, including, debiting the account of the Sending NCB, crediting of the account of the Receiving Participant, sending of the Payment Completion Confirmation to the Receiving RPG and transmission of the inward payment message to the Receiving Participant.
4.1.7 Country Specific Model (CSM)
The architecture for the CSM is the same as for the standard RPG configuration except that there is no automated communication with the country's Domestic RTGS system that processes domestic transactions.
4.2. Service's Architecture
As SAMA has adopted the CSM for carrying out SAMA and Direct Participants operations in AFAQ's Service, the functions of a Domestic RTGS system in respect of both inward and outward cross-border payment processing and bookkeeping of Direct Participants' mirror accounts and the relevant NCB shadow accounts are performed in the AFAQ Service CC.
4.3. SAMA's Systems
SAMA controls the installation, maintenance, operation, security, and contingency of the Service and has the right to regulate, administer and monitor the Service using the facilities afforded.
4.4. Direct Participants' Systems
Each Direct Participant is responsible at its own cost for the development, maintenance, security and reliability (including back-up and contingency) of its host system connected to the Service and any links from or to the Service.
4.5. Certification
No Direct Participant may use the Service until it and its systems used in relation to the Service have been certified by SAMA.
4.6. Monitoring
SAMA has the right to monitor relevant Direct Participant's activities for the sake of ensuring that the Service is operated properly, exercising responsibility for central risk management and mitigating pertinent risks.
4.7. Responsibility for Liquidity
SAMA has no responsibility to monitor Direct Participant’s liquidity. It is the responsibility of each Direct Participant to manage its own Liquidity.
4.8. Information
The Service provides reporting and enquiry facilities operating in near real-time; giving each Direct Participant immediate visibility of respective position & enabling it to manage its Liquidity.
4.9. Enhancements to Systems
SAMA may arrange for enhancements and changes to the Service and advise the Direct Participants accordingly, giving such notice before the changes are to be implemented as SAMA considers reasonable. SAMA may give directions for the safe, accurate and timely implementation of changes, updates and distributions. The changes will be binding on the Direct Participants and each Direct Participant will at its own cost carry out all necessary tests & modifications to its own systems linked to the Service and to its pertinent procedures to give effect to these measures.
4.10. Service Levels
SAMA may from time to time specify the service levels to be provided by the Service and by the Direct Participants systems used in connection with the Service.
4.11. Reporting
Each Direct Participant must inform SAMA Immediately of any event which may affect its role or function as a Direct Participant in the Service, including any known or planned disconnection from the Service, or any significant changes to Its host system interface to the Service, its organisation, or environment.
4.12. Operating Procedures
Each Direct Participant must maintain their own internal operating procedures that comply with these Operating Rules.
4.13. Contingencies
Each Direct Participant must ensure that their back-up and contingency procedures are such that the Service is capable of completing their daily processing requirements, without compromising the integrity, security, or performance of the Service. Each Direct Participant will ensure that it has access to adequate contingency facilities to enable It to send and receive its Payment Messages at least during the Operational Phase of the Business Cycle. Each Direct Participant shall ensure that their contingency procedures allow the resumption of operations at the contingency site when required, with the minimum loss of operational time in accordance with the Business Continuity Management Framework published by SAMA, as amended from time to time.
4.14. Tests
Each Direct Participant will comply with the Business Continuity Management Framework issued by SAMA & conduct realistic tests of contingency facilities at least twice annually to ensure the readiness and capability of operations. Signed records of the conduct of such tests must be retained.
4.15. Back-ups
Each Direct Participant is responsible for backing up data and programs for its own the Service operations.
4.16. Confidentiality
Unless advised otherwise by SAMA, The Direct Participant agrees to keep confidential all information concerning SAMA's business or its ideas, intellectual properties, products, customers or services that are of confidential, proprietary or trade secret nature.
4.17. Security
The Direct Participants will abide by applicable rules, regulations, policies and frameworks issued by SAMA; including the Service Security Policy as amended by SAMA from time to time. The Direct Participant must ensure the security and soundness of (SAMA - AFAQ) operations and inform SAMA in case of any security incidents.
4.18. Fraudulent Activities
The Direct Participant must take necessary actions & implement adequate measures to prevent, detect and respond in a timely manner to fraudulent activities involving the Service & report such activities to SAMA and the Direct Participants concerned in accordance with relevant fraud prevention guidelines.
4.19. Accounts at SAMA
Each Direct Participant must maintain a current the Service account at SAMA. Relevant Direct Participant's account must be held in accordance with SAMA's banking conditions from time to time.