DFSA Licensing for FinTech Payment Institutions Offering Virtual IBANs

By /

Virtual International Bank Account Numbers (vIBANs) are unique, generated account numbers that payment institutions can issue to their clients. While they function similarly to traditional IBANs for payment processing, vIBANs are not tied to a specific, physical bank account but rather act as identifiers that route funds to a master client funds account held by the payment institution [implied]. This allows payment institutions to efficiently manage and reconcile a large volume of client transactions by assigning a unique vIBAN to each client or even each transaction.

Payment institutions offering vIBAN services essentially provide Money Services, specifically by providing or operating a Payment Account and potentially executing a Payment Transaction on a Payment Account provided or operated by another Person [PIB 1.3.5A(a)(i, ii)]. Clients can receive and sometimes send payments using their assigned vIBAN, with the payment institution managing the underlying funds. The institution holds these client funds, making client money protection mechanisms a crucial aspect of regulatory oversight.

The Dubai Financial Services Authority (DFSA) is the independent regulator of financial services conducted in or from the Dubai International Financial Centre (DIFC) [implied]. Its role is to maintain and develop the financial stability and integrity of the DIFC, and to protect users of financial services within the DIFC [implied]. For FinTech payment institutions seeking to offer vIBAN services within or from the DIFC, obtaining the appropriate DFSA Licence and adhering to its regulations is mandatory [GEN 7.2.1]. This article will guide such institutions through the key aspects of the DFSA licensing process, focusing on the regulatory requirements relevant to their business model.

Identify the appropriate DFSA license category

For FinTech payment institutions providing vIBAN services, the most relevant DFSA Licence category is likely Category 3D [PIB 1.3.5A].

PIB Rule 1.3.5A explicitly states that an Authorised Firm is in Category 3D if:

(a) its Licence authorises it to Provide Money Services and it: (i) provides or operates a Payment Account; (ii) executes a Payment Transaction on a Payment Account provided or operated by another Person; or (iii) issues a Payment Instrument; and (b) it does not meet the criteria of Categories 1, 2, 3A, 3B, 3C or 5. [PIB 1.3.5A]

The functionality of vIBANs directly aligns with providing or operating a Payment Account [PIB 1.3.5A(a)(i)]. When a client is assigned a vIBAN, the payment institution is essentially providing them with an account identifier for receiving and potentially sending funds, which are managed within the institution’s pooled client money accounts. Furthermore, the processing of payments initiated or received via these vIBANs would constitute executing a Payment Transaction [PIB 1.3.5A(a)(ii)].

The term “Provide Money Services” is further defined in the GEN module. GEN Rule 2.6.1(1) outlines various activities that constitute Providing Money Services, including:

(a) currency exchange; (b) money transmission; (c) issuing or administering means of payment (such as credit cards, debit cards, cheque books and electronic money); (d) safeguarding money or money value; (e) issuing Payment Instruments; (f) executing Payment Transactions; (g) providing Account Information Services; and (h) providing Payment Initiation Services. [GEN 2.6.1(1)]

While vIBAN providers may not be directly involved in currency exchange or issuing physical payment instruments, their core activity of enabling clients to receive and manage funds through vIBANs falls under safeguarding money or money value [GEN 2.6.1(1)(d)] and directly involves executing Payment Transactions [GEN 2.6.1(1)(f)] and providing or operating Payment Accounts as per PIB 1.3.5A(a)(i).

Therefore, a FinTech payment institution offering vIBAN services will typically need to apply for a Licence authorizing it to Provide Money Services, and consequently, will likely fall under the Category 3D classification according to the prudential requirements outlined in the PIB module [PIB 1.3.5A]. There are no specific regulatory classifications solely for “vIBAN providers,” but the activities they undertake are clearly within the scope of Providing Money Services.

Detail the licensing requirements:

Category 3D Authorised Firms are subject to specific licensing requirements designed to address the risks associated with providing payment services. These requirements are detailed across various DFSA Rulebook modules, including PIB, COB, and GEN.

– Capital Requirements:

Category 3D firms must meet both a Base Capital Requirement and potentially an expenditure-based minimum capital requirement.

  • The Base Capital Requirement for a standard Category 3D firm is US$300,000 [PIB 3.6.2].
  • Additionally, payment institutions are typically subject to a minimum capital requirement calculated as a percentage of their payment volume or fixed overheads, as specified in PIB Rule 3.7. PIB Rule 3.7.1 states that a Category 3D Authorised Firm that Provides Money Services must maintain Risk Capital Resources of the higher of:
    • (1) the Base Capital Requirement applicable to it under section 3.6; and
    • (2) the sum of:
      • (a) 0.5% of the first US$3 million of its average outstanding electronic money and payment volumes; plus
      • (b) 0.2% of the next US$27 million of its average outstanding electronic money and payment volumes; plus
      • (c) 0.1% of the amount by which its average outstanding electronic money and payment volumes exceeds US$30 million; and
      • (d) 25% of its annual expenditure in the previous financial year. [PIB 3.7.1]
  • It’s important to note that PIB Rule 3.7.1(4) allows a Payment Service Provider that also issues Stored Value to exclude from the payment volume calculations payments directly related to issuing Stored Value. FinTechs offering vIBANs should carefully consider if their activities involve issuing Stored Value.
  • These capital requirements aim to ensure that the institution has sufficient financial resources to absorb potential losses and continue operating.

Operational Risk Management:

Effective operational risk management is crucial for payment institutions due to the high volume and value of transactions they process. PIB Chapter 6 outlines the requirements for managing Operational Risk.

  • PIB Rule 6.2.1 mandates that an Authorised Firm must establish, implement, and maintain an adequate operational risk management framework that is appropriate to its business. This framework should include processes for identifying, assessing, measuring, monitoring, and controlling operational risk.
  • For Category 3D firms that Provide Money Services, PIB Rule 6.12.1(c)(i) specifically requires them to comply with sections 6.2 to 6.9 of PIB concerning operational risk management.
  • Furthermore, GEN Chapter 5 lays out overarching requirements for senior management responsibilities and the establishment of effective risk management systems [GEN 5]. This includes producing a business plan that enables the firm to manage its risks [GEN 5.3.10].
  • For vIBAN providers, specific attention should be paid to risks related to transaction processing, cybersecurity, fraud prevention, and the reliability of their technology infrastructure.

Client Money Protection Mechanisms:

As vIBAN providers hold client funds, robust client money protection mechanisms are essential and mandated by the COB module.

  • COB Rule 6.12.1 defines Client Money as all Money held or controlled on behalf of a Client in the course of, or in connection with, Providing Money Services [COB 6.12.1]. This clearly includes funds received and held via vIBANs.
  • Category 3D firms Providing Money Services are subject to the Client Money Provisions in COB Appendix 5 [COB A5.1]. This appendix details requirements for:
    • Payment of client money into client accounts [COB A5.3].
    • Establishing and maintaining client accounts with segregation from the firm’s own funds [COB A5.4].
    • Specific rules regarding exceptions to holding client money in client accounts [COB A5.5].
    • Reconciliation procedures to ensure accuracy of client money records [COB A5.11].
    • Client disclosure regarding how their money is held [COB A5.9].
  • Furthermore, GEN Rule 8.6.1(c) requires an Authorised Firm that holds or controls Client Money to arrange for a Client Money Auditor’s Report to be submitted to the DFSA annually.

Governance Structures and Mandatory Appointments:

A robust governance structure with clearly defined roles and responsibilities is a key licensing requirement. Based on our previous conversation:

  • The applicant must demonstrate that it will be capable of being directed and managed by suitable individuals [GEN 7.2.5(b)].
  • Certain mandatory appointments must be held by Authorised Individuals resident in the U.A.E. (subject to potential waivers) [previous conversation]:
    • Senior Executive Officer.
    • Finance Officer (unless the firm is a Credit Rating Agency).
    • Compliance Officer.
    • Money Laundering Reporting Officer (unless the firm is a Credit Rating Agency).
  • The Compliance Officer must have sufficient resources and unrestricted access to records and senior management [previous conversation].
  • The firm must establish and maintain compliance arrangements, including documented processes and procedures [GEN 7.2.5(c)].

Technology and Security Requirements:

Given the digital nature of vIBAN services, strong technology and security controls are paramount.

  • GEN Rule 5.5 outlines requirements for establishing and maintaining a Cyber Risk Management Framework [GEN 5.5.2]. This includes identifying and assessing cyber risks [GEN 5.5.5] and implementing measures to protect ICT Assets [GEN 5.5.6-5.5.15].
  • If the vIBAN services rely on Distributed Ledger Technology (DLT) or similar technology, the additional requirements in COB Section 15.7 (Technology and Governance Requirements for firms providing Financial Services relating to Crypto Tokens) might be relevant, even if vIBANs themselves are not classified as Crypto Tokens. This section requires firms using such technology to have robust governance, security protocols, and conduct annual technology audits [COB 15.8].
  • Payment institutions must ensure the security and integrity of their payment processing systems and protect client data in accordance with relevant regulations.

Application process

The application process for a DFSA Licence involves several stages and requires careful preparation.

– Pre-application Considerations:

Before formally applying, FinTechs should:

  • Thoroughly understand the DFSA regulatory framework, particularly the PIB, COB, and GEN modules.
  • Conduct a gap analysis of their current operations and systems against the DFSA requirements.
  • Develop a comprehensive business plan outlining their vIBAN service offering, target market, revenue model, and operational processes [GEN 5.3.10].
  • Determine their proposed governance structure and identify suitable individuals for mandatory appointments [previous conversation].
  • Assess their capital adequacy and ensure they can meet the minimum capital requirements [PIB 3.6, 3.7].

Documentation Requirements:

The formal Licence application will require submitting various documents to the DFSA, including [GEN 7.2]:

  • Completed application form.
  • Detailed Regulatory Business Plan (see specifics below).
  • Financial projections demonstrating the applicant’s ability to meet capital requirements.
  • Information on the applicant’s controllers in the appropriate AFN form [GEN 7.2 Guidance].
  • Curriculum Vitae (CVs) and other information for proposed Authorised Individuals, demonstrating their fitness and propriety [previous conversation].
  • Details of the applicant’s compliance arrangements, including policies and procedures [GEN 7.2.5(c)].
  • Information on the applicant’s risk management framework [GEN 5.3].
  • Details of client money handling procedures and proposed client accounts [COB Appendix 5].
  • Information on technology infrastructure and cybersecurity controls [GEN 5.5, COB 15.7 (if applicable)].

Regulatory Business Plan Specifics for vIBAN Services:

The Regulatory Business Plan is a critical document that should specifically address aspects relevant to vIBAN services:

  • Detailed description of the vIBAN service: Explain how vIBANs are generated, assigned to clients, and linked to the underlying client money accounts.
  • Payment processing flow: Outline the end-to-end process for receiving and potentially sending payments via vIBANs.
  • Client onboarding and due diligence procedures: Describe how clients will be identified and verified in compliance with AML/CFT requirements.
  • Client money handling procedures: Detail the processes for receiving, holding, reconciling, and disbursing client funds held through vIBANs, referencing COB Appendix 5.
  • Technology infrastructure and security: Provide a comprehensive overview of the technology platform used to deliver vIBAN services, including security measures, data protection protocols, and business continuity plans, referencing GEN 5.5 and COB 15.7 (if applicable).
  • Fraud prevention measures: Describe the systems and controls in place to detect and prevent fraudulent activities related to vIBAN usage.
  • Compliance monitoring and reporting: Outline how the institution will ensure ongoing compliance with DFSA regulations, including client money reconciliation and reporting obligations.

Timeline and Key Milestones:

The DFSA Licence application process can take several months, and the timeline depends on the completeness and quality of the application. Key milestones typically include:

  • Pre-application discussions with the DFSA (optional but recommended).
  • Submission of the formal Licence application.
  • DFSA’s initial review of the application.
  • Provision of clarifications and additional information as requested by the DFSA.
  • DFSA’s in-depth assessment of the application, including fitness and propriety of individuals and adequacy of systems and controls.
  • Granting of the Licence.

Common Challenges and How to Address Them:

Common challenges faced by FinTechs applying for a DFSA Licence for vIBAN services include:

  • Demonstrating a thorough understanding of the complex regulatory requirements: Invest time in studying the relevant DFSA Rulebook modules and consider engaging with regulatory consultants.
  • Developing robust client money protection mechanisms that meet DFSA standards: Implement clear segregation of client funds, establish robust reconciliation procedures as per COB Appendix 5, and ensure readiness for client money audits.
  • Establishing adequate technology and cybersecurity controls: Implement industry best practices, conduct regular vulnerability assessments, and develop a comprehensive cyber risk management framework as per GEN 5.5.
  • Ensuring the fitness and propriety of proposed Authorised Individuals: Conduct thorough due diligence and ensure individuals have the necessary experience and qualifications for their roles.
  • Crafting a comprehensive and well-articulated Regulatory Business Plan: Clearly and accurately describe the vIBAN service, its operational processes, and how all regulatory requirements will be met.

5. Ongoing compliance obligations:

Once licensed, vIBAN providers are subject to continuous compliance obligations to maintain their authorisation.

– Reporting Requirements:

Category 3D firms must comply with various reporting requirements outlined in PIB Chapter 2 and GEN Chapter 8. This includes:

  • Submitting prudential returns to the DFSA using the electronic prudential reporting system [PIB 2.3.2].
  • Providing the DFSA with financial statements prepared in accordance with IFRS or IFRS for Small and Medium-Sized Entities [GEN 8.2.1].
  • Submitting an Annual Information Return [GEN 8.7.1].

Client Money Audits:

As firms holding Client Money, vIBAN providers must arrange for an annual Client Money Auditor’s Report to be submitted to the DFSA [GEN 8.6.1(c)]. This report provides assurance that the firm is complying with the Client Money Provisions in COB Appendix 5.

Technology Risk Assessments:

Firms should conduct ongoing assessments of their technology infrastructure and cybersecurity controls to ensure their resilience against cyber threats and compliance with GEN Rule 5.5 and COB Section 15.8 (if applicable).

AML/CFT Requirements Specific to Payment Services:

Payment institutions are particularly susceptible to money laundering and terrorist financing risks and must adhere to stringent AML/CFT requirements as detailed in the DFSA’s AML module [COB 30 Guidance, GEN 152 Guidance]. This includes:

  • Implementing robust customer due diligence (CDD) procedures.
  • Establishing transaction monitoring systems to detect suspicious activities.
  • Having a designated Money Laundering Reporting Officer (MLRO) responsible for overseeing AML/CFT compliance [previous conversation].
  • Conducting regular AML/CFT training for staff.
  • Complying with requirements related to wire transfers and other payment transactions.

Conclusion with actionable next steps for FinTechs

Obtaining a DFSA Licence to offer vIBAN services requires a thorough understanding of the regulatory landscape, meticulous preparation, and a commitment to ongoing compliance. For FinTechs looking to enter this regulated space within the DIFC, the following actionable next steps are recommended:

  • Conduct a detailed review of the DFSA Rulebook, paying particular attention to the PIB (especially Category 3D and Money Services), COB (especially Client Money Provisions and Technology Requirements), and GEN modules.
  • Develop a comprehensive business plan that clearly articulates the vIBAN service offering and how it aligns with the DFSA’s regulatory objectives.
  • Perform a thorough gap analysis of current operations and systems against the DFSA requirements and develop a remediation plan.
  • Engage with regulatory consultants experienced in DFSA licensing to gain expert guidance and support throughout the application process.
  • Initiate pre-application discussions with the DFSA to clarify any uncertainties and gain valuable insights into their expectations.
  • Begin compiling the necessary documentation for the Licence application, ensuring accuracy and completeness.
  • Identify and assess the suitability of individuals for mandatory appointments and ensure they meet the DFSA’s fit and proper criteria.
  • Develop robust client money handling procedures and ensure the ability to meet the requirements of COB Appendix 5 and prepare for annual client money audits.
  • Implement strong technology and cybersecurity controls in line with GEN Rule 5.5 and COB Section 15.7 (if applicable).

By taking these proactive steps, FinTech payment institutions offering vIBAN services can navigate the DFSA licensing process effectively and establish a regulated and sustainable business within the dynamic financial ecosystem of the DIFC.

Related Posts

Scroll to Top