An Appraisal of The CBN's Frameworks for Sandbox Operations and Quick Response Code Payments

Saturday, February 06, 2021/ 10:00 AM / By Frances Obiago (Aelex) / Header ImageCredit: Aelex

Introduction

On 13^thJanuary 2021, the Central Bank of Nigeria (CBN) released two regulations: theFramework for Regulatory Sandbox Operations ("Sandbox Framework") and theFramework for Quick Response (QR) Code Payments in Nigeria ("QR CodeFramework").

The CBNstated that the frameworks are aimed at strengtheningthe payment systems space and the development of other disruptive technologiesrelating to financial services in Nigeria.

Wewill briefly consider the frameworks and their potential impact for the financialtechnology (fintech) industry in Nigeria.

The Sandbox Framework

Owing to the growinginterest in fintech), the CBN deemed it necessary to set up a regulatory sandbox,a closed testing environment designed for experimenting safely with innovativeproducts, services and solutions. This, according to the CBN, would allow it "stayabreast of innovations while promoting a safe, reliable and efficient payments systemto foster innovation without compromising on the delivery of its mandate".

To be eligible toparticipate in a sandbox, an applicant must have conducted adequate assessmentto demonstrate the usefulness and functionality of its product, service orsolution and have a business plan to show that the product, service or solutioncan be successfully deployed after exit from the sandbox.

The sandbox applicationprocess is open to both existing CBN licensees, local companies intending totest an innovative payments product or service deemed acceptable by the CBN,and innovators whose proposed solution involve technologies which are currentlynot covered under existing CBN regulations. As part of its bid to promoteinnovation, the CBN permits participants to leverage on the sandbox of otherregulators if any aspect of their products, services or solutions fall withinthe jurisdiction of the other regulators.

There are severalobligations imposed on participants in the sandbox including, putting in placetesting parameters to limit risks to the financial system and consumers,ensuring proper maintenance of records during the testing period for a maximumof 5 years, submitting periodic reports to the CBN on the progress of the testand submitting a final report containing key outcomes and performanceindicators against agreed measures for the success or failure of the test and also,findings of the test.

An application forparticipation in a sandbox must state the initial testing timeline (in months)for the proposed product, service or solution. A participant may, however,apply to the CBN for the extension of the testing period and, such anapplication may be granted by the CBN upon proof that, in general, the solutionhas tested positively and the extended testing is necessary to respond tospecific issues or risks identified during initial testing. TheCBN also has the power to withdraw the approval granted to an innovator toparticipate in a sandbox.

Upon completion of asandbox test, the CBN would decide whether the product, service or solutionshould be introduced and may provide support to asuccessful participant for the purpose of obtaining any requisite licence(s).

The CBN intends to have onesandbox cohort/group per year. The number of innovators to be accepted into acohort will be based on the CBN's resource capacity to support innovators.

The QR Code Framework

TheCBN, in furtherance of its mandate to promote innovation in the payments systemspace, issued the QR Code Framework which provides regulatory guidance for theoperation of QR Code payment services in Nigeria.

QRCodes are a kind of matrix barcode¹ representing information presented as square grids and made up of black squaresagainst a contrasting background. They are read by using a digital device and canbe used to present, capture and transmit payments information across paymentsinfrastructure.

QR Code payments inNigeria are to be based on the EMV?é?« QR Code specification for payment systemsand the merchant-presented mode specification (i.e. where merchants present theQR Code for buyers to accept in order to conclude payment transactions). QRCodes are also required, at a minimum, to be encrypted (AES) and/or signed; andall applications, updates and patches must be duly certified by the PaymentsTerminal Service Aggregator.

TheCBN may, however, also approve the implementation of any other QR Code standard,provided it meets prescribed security requirements, demonstratesinteroperability with other existing implementation in the industry and/or providescost benefits to end-users (i.e. merchants and customers).

TheFramework imposes various obligations on merchants, customers, issuers,acquirers and payment service providers, who are the major participants in QRCode payment services. These obligations include the following:

Merchants - required to useand display only approved QR Codes in Nigeria and comply with serviceagreements executed with an acquirer.

Customers - requiredto use QR Code payments applications availed by an issuer without modificationsand adhere to all minimum security guidelines as stipulated by the issuer.
Issuers - required toprovide QR Code payment applications to customers upon request and activationby customer; execute service agreement with their customers; determine andagree appropriate transaction limits with customers for QR Code payments basedon the customers?óÔé¼Ôäó risk profile assessment; and provide adequate training,support and security guidelines to customers on the use of QR codes forpayments.
Acquirers - required to executeservice agreement with merchants; determine and agree appropriate transactionlimits with merchants for accepting QR Code payments based on its risk profileassessment of the merchant; and ensure that appropriate security protocols areapplied.
Payment Service Providers - required to support the processing and settlement for all issuers and acquirers.

Inaddition to the above, issuers and acquirers are required to have clearlydefined risk management policies and guidelines for the operation of QR Code payments;agree minimum due diligence guidance for merchant onboarding; and ensure thatbehavioural monitoring and fraud management systems are implemented to prevent,detect and mitigate fraud and money laundering.

Issuersare also required to oversee the management of fraud risk and to this end, arerequired to provide quarterly risk management assessment reports to the CBN whichshall include, among others, a fraud report, vulnerabilities assessment andrisk-mitigating measures introduced.

Concluding Thoughts

Theintroduction of the QR Code and Regulatory Sandbox Frameworks are welcome developments,particularly with the increased roll-out of financial technology-related products,services and solutions by innovators in Nigeria.

Althoughmost banks and other payment service providers already allow payments to bemade using QR codes, the QR Code Framework will serve to protect consumers whomake use of such codes and provide guidance to the other relevant players inimplementing and operating QR code payment schemes.

Similarly,the introduction of a regulatory sandbox is a positive step given the constant emergenceof innovators in Nigeria and the global interest in the products, services andsolutions developed by these innovators. The provision of support to successfulparticipants by the CBN, especially in the obtaining of licences will alsoserve as an incentive for innovators to apply and participant in the sandbox.

Footnotes

1. A barcode is a machine-readable optical labelthat contains information about the item to which it is attached.