1. Definitions
The regulatory rules presented herein regulate the issuing, acquiring and usage of prepaid payment services. This regulatory rules document focuses primarily on "Cards", but applies to all prepaid services including smart/EMV cards and magnetic stripe card environments as well as other form factors for prepaid payment services, such as contactless and mobile payments.
1.1. Prepaid Payment Service Definition
A prepaid payment service, as regulated under these rules, is defined by the holding of monetary value in a prepaid account/electronic record that can be utilised to purchase goods or services from one or more businesses who agree to participate in the prepaid program. The defining features are:
- Monetary value is held on account for use to purchase goods and services for variable amounts as determined and agreed between the payer and payee at the time of purchase of the prepaid service
- Settlement of transactions can be between otherwise unrelated business entities.
Note: for the purposes of this document the terms "account", "electronic record" and "sub-record" are used interchangeably.
"Open loop" payment services enable the purchase of goods and services from a group of unrelated businesses through a prepaid account utilising a payment brand accepted at the participating merchants, i.e. multiple contracting entities, multiple issuers and multiple acquirers. "Open loop" prepaid services require a clearing and settlement services between different businesses. This includes the ability to encash any part of the prepaid balance through a third party network, such as ATM networks.
“Restricted loop” is a subset of an open loop program, in that the merchant acceptance of the program is limited to a specified merchant or a specified network of merchants. Examples of a restricted loop program include in its broadest form, prepaid accounts for the purchase of specific services or goods across a network of merchants (e.g., a prepaid coffee card accepted across a range of unrelated coffee shops, or a mall card accepted only at merchant locations within a specific mall);
"Closed loop" is the purchase of prepaid goods and services related to the goods and services within a defined contracting entity i.e. single contracting entity, single issuer & single/multiple acquirers. In its most restrictive form, close loop programs prepaid accounts for the purchase of services or goods from a specific merchant or merchant chain utilizing the settlement and clearing functions of the prepaid payment service. (e.g., a nationwide retailer offers a prepaid card valid only at its nationwide locations, an independent merchant offers a prepaid card valid only at its single store location but chooses to utilize the prepaid payment service for settlement and clearing functions).
Examples of closed loop prepaid goods and services include:
- Prepaid accounts for the purchase of specific services or goods, such as prepaid fares for public transport or prepaid airtime for mobile telephony services;
- Vouchers (a paper certificate or a series of electronic digits with a non-reloadable amount associated that allows the holder to make payments up to that value at a specific merchant or merchant chain);
- Gift cards for use at a merchant or merchant chain
A prepaid payment instrument is an access device, or token of identity, that can access a pre-funded account balance held by the issuer (refer to 1.2.1 Issuing Program Manager) to which a transaction can be charged. Such an access device could be a payment card, an internet wallet or a payment device utilising mobile technology.
Prepaid instruments encompassed in this regulatory framework include any access device that can provide transactional services against a prepaid balance, including but not limited to:
- Smart/EMV cards (payment cards with an embedded micro-processor);
- Magnetic stripe cards (payment cards with a magnetic stripe);
- Internet wallets (stored value internet accounts)
- Mobile payments
- Contactless payments (Near Field Communications technology)
1.1.1. Acceptance
Prepaid payment services within these regulatory rules can be used across a range of different acceptance models, or prepaid payment service programmes. These are:
Closed loop prepaid Payment Services2. A closed loop prepaid payment service is a prepaid product that is redeemable at a single merchant or at an affiliated group of merchants with the same name, mark, or logo3. The payment device is purchased on a prepaid basis and is honoured upon presentation at such single merchant or affiliated group of merchants. Closed loop prepaid products may or may not be reloadable.
Examples of closed loop prepaid products are:
i. Merchant branded gift cards
ii. Merchant branded store cards
Restricted loop prepaid payment services: A restricted loop prepaid payment service is a prepaid product that is used to acquire goods and services at a limited network of service providers (e.g. fuel stations), either within a clearly limited area or alternatively that can be used to pay for a limited range of goods and services. Restricted loop payment products may or may not be reloadable.
Examples of restricted loop prepaid products are:
Prepaid payment services that are accepted at different merchants located within a clearly defined area such as shopping cards or mall cards. Other examples include University or campus payment devices, Conference cards, Stadium cards, and other cards that are only accepted within a specific closed venue;
Prepaid payment services that are accepted at different merchants, located in different locations but that can only be used to purchase a limited range of goods and services such as Petrol cards, Meal vouchers or Public transport cards4.
C. Open loop prepaid payment services. Open loop prepaid products are payment instruments that are redeemable at all merchants or service providers where the payment brand is accepted without restrictions.
Open loop prepaid products may or may not be reloadable.
2 While closed loop prepaid payment services may be issued under these Rules in the Kingdom of Saudi Arabia, it is not anticipated that they will form the bulk of the programmes on offer
3 Where the prepaid payment service can be used to purchase or access a range of goods or services that are not predetermined at the time the prepaid account is loaded with value (e.g. airtime)
4 For example, transport cards that are accepted by transportation companies (cars, trains and others).
2.1.1. Reloadability
The regulatory principle presented herein governs both reloadable and non-reloadable prepaid payment service products.
a. Non-reloadable prepaid payment service. A prepaid payment service is non-reloadable if it has no mechanism for having additional funds added to the initial balance after the initial issuance.
b. Reloadable prepaid payment service. A prepaid payment service is reloadable if it has the ability of having more funds added after the initial issuance.
It is at the discretion of the prepaid Issuer to determine whether a prepaid product should be reloadable or non-reloadable (noting that re-loadable cards are subject to more rigorous KYC and AML requirements).
Common to both reloadable and non-reloadable prepaid services is that there is a deposit account that holds the available balance on the account until such a time as it is redeemed through spend against the balance or a cash withdrawal, when this service is allowed.
1.2. Stakeholder Definition
The implementation of a prepaid payment service payments system in the Kingdom of Saudi Arabia will impact a range of stakeholders, including for example: SPAN, prepaid payment service issuers, acquirers, merchants, accountholders and primary cardholders.
1.2.1.The Issuing Programme Manager (Issuer)
A prepaid payment service Issuing Programme Manager (IPM) is a regulated bank in the Kingdom of Saudi Arabia that is permitted to accept deposits, according to the Banking Control Law, issued by Royal Decree No. M/5 Dated 22.2.1386 H. The IPM operates the deposit account and collects the funds loaded onto the prepaid account. The IPM is responsible for:
a) Directly reimbursing the acquirers of the service providers (e.g. merchants) that are part of a closed loop payment device, or
b) Reimbursing acquirers through a scheme settlement arrangement if the service providers (e.g. merchants) are part of an open loop payment service.
1. Issuing activities. In order to operate a prepaid payment service programme, IPM’s have responsibility for undertaking the following activities directly, or through partners:
- Prepaid account recruitment. These are the activities associated with marketing to prospective prepaid payment service customers, including the development and distribution of marketing materials;
- Partner recruitment. Activities related to the recruitment of partners into the distribution network, such as an issuing processor, sellers/distributors and the load/reload network representatives (refer to 1.2.1 b);
- Customer recruitment and account set up. Includes the processing of prepaid payment service applications from their receipt by the IPM through to the approval stage (inclusive of the collection of KYC information), setting up new prepaid accounts and the sending out of “service Terms and Conditions” to new account holders;
- Payment product issuing. Includes all aspects related to the delivery of the payment service product to the customers, such as in the case of a prepaid card the production of the card through to the safe delivery of the card and PIN to the primary cardholder; The PIN distribution activity must be undertaken by the regulated entity (i.e. IPM);
- Load /reload network. Relates to the receipt and processing of funds deposited onto the prepaid account. These loads/reloads can potentially be made at a number of different channels, such as affiliated merchants, ATMs, bank transfers, person to person payments or Kiosks;
- Authorisation processing. Refers to the activities related to the approval/decline of an authorisation request associated with the prepaid payment service received by the issuer via SPAN or other payment networks;
- Transaction processing. Activities undertaken by the issuer, from the receipt of the clearing message from the acquirer to the point at which the transaction is posted onto the primary cardholder’s account. These activities also include the research and documentation of transactions disputed by the primary cardholder;
- Overdraft. Drawing more money than the bank accounts holds, prepaid service products are not allowed to go into overdraft;
- Statement production. Activities related to the preparation and delivery of customer statements, which can be via postal mail, web account, email, and SMS or ATM. Paper statements shall however be issued minimum at quarter basis to the primary cardholder (at no additional cost to them) if the cardholder specifically request this option;
- Customer service. Includes the activities associated with the handling and information storage of all general prepaid account related customer enquiries, requests and complaints;
- Fraud investigation. Activities related to the efforts put into preventing and following up suspected or actual cases of prepaid payment service misuse (both processes and systems);
- Usage Monitoring. Activities associated with monitoring the primary cardholder’s activities and customer due diligence that is required to ensure the programme’s on going compliance to AML and CTF regulations in force in the Kingdom of Saudi Arabia;
- Programme management. Includes the general administrative and managerial activities involved with operating the prepaid account business, including the analysis of information generated by the programme and the strategic planning and development of the prepaid product.
2. Other participants within issuing activities.
The IPM may share some of the activities described above with third party as regulated by the "Rules on Outsourcing" issued by the Saudi Central Bank. Outsourcing may be used in order to attain a larger distribution network or reduce transaction processing costs.
Examples of organisations with whom the issuer may share issuing activities are as follows:
- The programme manager. A programme manager may administer several aspects of a prepaid programme, which may include transaction processing and the distribution of the payment device and marketing materials;
- The issuing processor. The issuing processor will typically send the responses to the authorisation requests and post the transactions onto the prepaid accounts. It may also manage the customer service;
- The seller/distributor. The seller/ distributor may be an affiliated shopping mall or a merchant that distributes at a fee the prepaid payment service contracts to prospective cardholders;
- The load/reload network. The load/reload network can include, for example, a branch or an ATM, where primary cardholders can load funds onto the prepaid account with cash or via payment with credit or debit cards, within the allowed limits for the product. In accordance with the "SAMA Rules on Outsourcing", July 2008, issuers are required to seek "no objection" from SAMA on the use of 3rd party (merchant sites) for applying load services to prepaid accounts, where such loads shall be governed by the rules set out in section 2.3.
Table 1: Activities that the IPM could share with third parties
(iv)
(iii)
(ii)
(i)
Load/reload network
Seller/ distributor
Issuing Processor
Programme Manager
(Issuing Activities)
Outsource Partner
X
√
X
√
Prepaid Account Recruitment
(i)
X
X
X
√
Partner Recruitment
(ii)
X
X
X
√
Customer Recruitment & Set-up
(iii)
X
√
X
√
Payment Device Issuing (excluding PIN issuing)
(iv)
√
√
√
√
Load/Re-load
(v)
X
X
√
√
Authorisation Processing
(vi)
X
X
√
√
Transaction Processing
(vii)
N/A
N/A
N/A
N/A
Overdraft
(viii)
√
X
√
√
Statement Production
(ix)
X
√
For closed loop only
√
√
Customer Service
X
X
X
√
√
Fraud Investigation
Xi
X
X
√
√
Usage Monitoring
Xii
X
X
X
√
Programme Management
Xiii
1.2.2. The Acquirer
An acquirer of prepaid payment service is a regulated licensed bank, according to the Banking Control Law, issued by Royal Decree, No. M/5 Dated 22.2.1386 H. The acquiring business is governed by the SPAN Scheme Regulations; an acquirer can be either an ATM acquirer or a POS (merchant) acquirer or both.
An ATM acquirer is a regulated bank which is a member of SPAN and which has entered into an agreement with SAMA to acquire ATM transactions.
The POS (Merchant) Acquirer is a regulated bank which is a member of SPAN and which has entered into an agreement with SAMA to acquire Point-Of-Sale (POS) transactions & an agreement with The Merchant to provide him with POS service.
1.2.3.The Contracting Entity
The contracting entity is the individual or Juristic persons or Government entities that enter into the prepaid payment service contract with the IPM. Please note that for the purposes of these rules, the term ‘Contracting Entity’ may not in all cases be the same as the beneficial owner of the funds held on an account, sub account or electronic record supporting the prepaid payment instrument.
For a commercial prepaid product, the contracting entity will be the Juristic person which enters into the service agreement with the prepaid issuer.
For a retail prepaid product, the contracting entity can be the individual who is either the primary cardholder or legal guardian of the primary cardholder.
If the prepaid contracting entity (an individual or a Juristic person) has selected a multi account product (e.g. petty cash card, household cards), the contracting entity will be the primary cardholder and shall determine the value of the funds transferred to secondary card records (Note: secondary cards have no access to the funds on the primary cardholder record).
When the contracting entity is a governmental entity or a Juristic person, the due diligence processes related to KYC and AML for the cardholder (see 2.3 and 2.5) may be shared between the issuer and the contracting entity. However, the issuer remains responsible for satisfactory completion of the KYC and AML requirements in accordance with prevailing regulatory requirements
1.2.4. The Primary Cardholder
The primary cardholder is the individual that uses the prepaid payment service to pay for goods and services at the point of sale and, if applicable, to withdraw cash from ATMs and utilise money transmission services. The contracting entity (an individual or a Juristic person) and the primary cardholder may be the same, but can also be different parties. For example, a guardian could be the contracting entity for a youth card issued to a child.
1.2.5. Merchants
The term merchant refers to a Company, firm, corporation, government entity or other person who:
a) has a Merchant Account and an existing and on-going relationship with an Acquirer, and;
b) is designated to accept any payment by a cardholder using a valid Payment Card to pay for goods and/or services, and;
c) has contractually agreed to accept the payment device as a method of payment at their premises.
1.2.6. Merchant Account
The Merchants Account refers to an account held with the Acquiring Bank used solely for the purposes of settlement of POS transactions. All current SAMA rules are applicable to the opening and maintenance of this account. This account must be settled on a regular basis.
1.2.7. Saudi Arabian Payment Network – SPAN
SPAN operates the payments network and establishes operating rules for card payment device issuers, processors, merchants and ATMs that accept prepaid payment products. The prepaid payment services under this regulation will be accepted throughout the SPAN network, with additional acceptance through non-domestic payment networks, including the GCC countries, as agreed by SPAN.
1.3. Prepaid Payment Services Products Segmentations
1.3.1. Retail payment products
These include general purpose payment products, for example:
a) Payroll Cards (which can include remittance services where the consumer contracts directly for the services with issuer or his agent).
b) Student Cards.
c) Household Cards.
d) Youth Cards.
e) etc.
1.3.2. Government Entities payment products
Government Entities (which include all governmental institutions, ministries, and local juristic entities and the like) payment products are used by government entities to effect payments to recipients of state payment or to purchase products or services for such agencies. Also, to distribute compensation or benefits to employees and/or beneficiaries. Examples of Government Entities oriented cards are as follows:
a) Social Insurance accounts/payment products
b) Procurement accounts/payment products
Funds can only be loaded onto the prepaid account by a government entity itself.
1.3.3. Juristic Persons Payment products
Juristic Persons payment products are used by corporations (which include all appropriately licensed juristic institutions or entities and the like) to facilitate procurement; distribute compensation or benefits to employees, customers or beneficiaries.
Examples of Juristic Persons payment cards programmes are as follows:
a) Payroll cards
b) Employee benefits cards (Health care, transit, etc.)
c) Customers incentive cards
d) Procurement accounts/payment products