In reference to Central Bank Circular No. (361000085193) dated 16/6/1436 AH and Document number (M.A.Q/15631) dated 11/6/1433 AH Regarding the rules for prepaid services in the Kingdom of Saudi Arabia and the necessity of applying them to all prepaid payment services and products, and in light of the difficulties observed by the central bank that banks have faced in implementing paragraph number (12), from Rule number (2,4,2) related to the delivery of prepaid cards and their PINs to the concerned employees/beneficiaries, and Rule No. (3.2) Regarding the requirements of the Know Your Customer (KYC) principle for prepaid cards (salary card product), and based on discussions with banks and financial institutions on this matter, the central bank has studied these difficulties and classified them (especially in light of the implementation of several important national initiatives such as the Wage Protection Program) and has established appropriate mechanisms to address them.

Accordingly, you will find attached options to address those difficulties. The central bank also emphasizes that all banks and financial institutions must adhere to what is stated in the attached document The rules of prepaid services, and the implementation of the requirements of the Know Your Customer (KYC), principle and the necessity of clearly defining the responsibilities and commitments of the contracting entity (legal person) in the agreement related to the issuance of prepaid cards (payroll card product) concluded in this regard, especially with regard to the distribution of cards and secret numbers to the workers under the sponsorship of the legal person. The agreement must be reviewed and approved by the Compliance Manager in the bank before its application and enforcement. Additionally, these agreements must be reviewed by the internal auditor and/or the legal advisor of the contracting entity (legal person).

The Central Bank affirms that the bank bears full responsibility for implementing the procedures and instructions of the Central Bank regarding the verification of the requirements of the "Know Your Customer" principle and ensuring that the objectives of those requirements are met. The Central Bank also emphasizes the need to comply with what is stated in this circular and..."With prepaid service rules""And emphasizing that this should be limited to a prepaid card account (salary card product) and starting to implement this from this date."

Updating the Rules for Prepaid Payment Services in the Kingdom of Saudi Arabia (Payroll Card Product)

First:

According to the prepaid services rules stated in paragraph number (12) of Rule Number (2,4,2) The text states: "Such cards may be delivered to the relevant employees/beneficiaries through the legal entity, and the PINs for the cards must be delivered by the issuing authority (It's Branches or representatives) to the primary cardholder and documented through written records kept in the main accounts file". Banks and financial institutions face challenges in delivering the PINs to primary cardholders for several reasons, which may cause delays in opening some accounts. To address these difficulties, banks and financial institutions may apply one of the following options for distributing the PINs of prepaid cards (wage card product), while ensuring that the chosen option is documented by the bank in the agreements made in this regard. The central bank also emphasizes that the bank bears full responsibility for implementing the procedures and instructions of the central bank concerning the verification of Know Your Customer (KYC) requirements, ensuring the necessary diligence is applied by the bank to achieve the goals of these requirements.

Options for addressing these difficulties:

1- (First Option): Activating payroll cards by having the cardholder visit the bank branches, as follows:

- Salary cards (in an inactive state) and PIN numbers are sent together to the contracting party (the legal entity - institutions or companies).

-The cards and PINs are to be handed over to two different responsible individuals from the staff of the contracting entity (the legal entity).

- The two officials from the contracting entity (legal personality) are responsible for distributing cards and secret numbers to their clients. This process should be documented, and the client (primary cardholder) must sign to acknowledge receipt of the card and the secret number.

- The client (primary cardholder) visits one of the bank branches to complete the card activation process and fulfill the requirements of the Know Your Customer (KYC) principle.

2- (Option Two): Activating payroll cards through a visit by the bank's employees to the headquarters of the contracting entity (legal entity), as follows:

- Salary cards (in an inactive state) and PINs are sent together to the contracting entity (legal entity - institutions or companies).

- The cards and PINs are to be handed over to two different responsible individuals from the personnel of the contracting party (the legal entity).

- The two officials from the contracting entity (legal entity) are responsible for distributing the cards and PINs to their respective clients, documenting the process, and obtaining the client's (primary cardholder's) signature upon receipt of the card and PIN.

- The bank coordinates with the officials of the contracting entity (legal entity) to visit its site through two branch employees who have different responsibilities and authorities, with the aim of implementing the Know Your Customer (KYC) requirements.

- After the bank verifies the matching of the client's information (the primary cardholder) and applies the Know Your Customer (KYC) requirements, and the client receives the card and the associated PIN, the card is activated.

3- (The third option): Activating bank cards through mobile messages (One Time Password – OTP):

- Payroll cards (in inactive status) are sent to the contracting party (the legal entity - institutions or companies).

- The contracting entity (legal personality) - through one of its responsible employees - undertakes the distribution of the cards to its employees through a documented mechanism and obtains the client's (primary cardholder's) signature upon receiving the card.

- The bank coordinates with the contracting party (the legal entity) to arrange a visit for the bank's personnel (two branch employees with different levels of responsibilities) to the worksite in order to fulfill the requirements of the Know Your Customer (KYC) principle and to obtain the client's (primary cardholder's) signature on a declaration confirming receipt of their card and the accuracy of their mobile number.

- The bank sends a One Time Password (OTP) to the mobile phone of the client (primary cardholder) that was registered in the account opening form and signed by the client.

- The primary cardholder is enabled to activate their card using a one-time password (OTP) through one of the bank's electronic channels (such as an ATM). These channels will be programmed to prompt the customer to enter a new permanent PIN for the card. The bank is committed to setting a specific validity period (48 hours for example) for the OTP sent to the customer's mobile phone number.

Secondly:

According to what was reported in The Rules of Prepaid Services, and due to the difficulties associated with the requirement to reapply the Know Your Customer (KYC) principle at every renewal of the legal residency - which is often valid for twelve months - for resident customers working for governmental or non-governmental entities, or individuals classified as domestic workers, despite the basic information (such as the customer’s name and the sponsor’s name) not changing. Banks may address these difficulties for prepaid cards (salary card products) by adhering to the following:"

- After the bank implements the requirements of the Know Your Customer (KYC) principle and meets the client (the primary cardholder) face-to-face when opening a prepaid card account (such as a salary card product), it's not necessary for the client - only resident individuals - to come to the bank again to update their information and re-apply the KYC requirements as long as the core information of the client (such as: the client's name, sponsor's name, nationality) has not changed. It suffices to update and match the client’s information electronically using the data available from the (NIC-National Information Center), provided that the bank retains a printed copy of the electronic update of the client's information.

- The bank must reapply the Know Your Customer (KYC) principle after a maximum period of five years from the last application of the principle and meet the customer face-to-face, provided that there have been no changes to the customer's basic information during this period.

- The bank must freeze the prepaid card account (salary card product) of the customer if any of their basic information changes, which the bank may discover. This should be done during the electronic update phase, and the customer must be notified and requested to visit the bank to apply the Know Your Customer (KYC) principle.

This procedure is limited to residents of the Kingdom.

Thirdly:

According to what was reported in  "Prepaid Services Rules" and the accompanying difficulties in reapplying the Know Your Customer (KYC) principle for individual expatriate clients who are coming to work for government or non-government entities. These clients have been allowed to open prepaid card accounts (Payroll Card product) under a temporary residency based on a work visa in their passport, limited to a ninety-day period. In addition Circular number (341000029727) from the Central Bank dated 7/3/1434 AH. Regarding the amendment of the title and requirements of the third paragraph of Rule No. (3-1-200) : "Regarding the accounts of "individual expatriates and residents in the Kingdom / work visa residence for three months in the passport", banks may address these challenges by adhering to the following (after the issuance of the official residence permit for the client):

- Sufficient to update the data of the expatriate client (primary cardholder) in this case electronically by utilizing the services of the (NIC- National Information Center), provided that the bank retains a hard copy of the electronic update of the client's information.

In case the bank discovers—during the electronic update phase—any discrepancies in the fundamental data of the expatriate worker (such as the sponsor's name) from that provided during the account opening of a prepaid card (salary card product), the bank must immediately freeze the account and inform the account holder. The bank would then request the account holder to visit the bank to fulfill the requirements of the Know Your Customer principle, as per the procedures mentioned in the "Prepaid Services Rules.

- This mechanism is limited to individual expatriates working for government or non-government entities, or domestic workers classified as residents, who have fulfilled all the requirements of the Know Your Customer (KYC) principle and have been met face-to-face by the bank during the prepaid account opening phase (salary card product).