80738 This volume is a product of the staff of the International Bank for Reconstruction and Development / The World Bank. The World Bank does not guarantee the accuracy of the data included in this work. The findings, interpretations, and conclusions expressed in this paper do not necessarily reflect the views of the Executive Directors of the World Bank or the governments they represent. The material in this publication is copyrighted. FINANCIAL SECTOR ASSESSMENT PROGRAM UPDATE SAUDI ARABIA CPSS CORE PRINCIPLES FOR SYSTEMICALLY IMPORTANT PAYMENT SYSTEMS DETAILED ASSESSMENT OF OBSERVANCE SEPTEMBER 2011 INTERNATIONAL MONETARY FUND THE WORLD BANK MONETARY AND CAPITAL MARKETS DEPARTMENT FINANCIAL SECTOR VICE PRESIDENCY MIDDLE EAST AND NORTH AFRICA REGION VICE PRESIDENCY 2 CONTENTS GLOSSARY ....................................................................................................................................... 3 EXECUTIVE SUMMARY ..................................................................................................................... 4 I. SUMMARY, KEY FINDINGS, AND RECOMMENDATIONS ................................................................. 6 A. General ................................................................................................................................. 6 B. Information and Methodology Used for Assessment .......................................................... 6 C. Institutional and Market Structure ....................................................................................... 6 D. Legal and Regulatory Framework ....................................................................................... 8 E. The Real Time Gross Settlement System: SARIE ............................................................... 9 F. Retail Payment Systems and Instruments .......................................................................... 13 G. Securities Settlement Systems ........................................................................................... 19 H. Payment and Securities Settlement Systems Oversight ..................................................... 20 II. ASSESSMENT OF THE CPS AND CENTRAL BANK RESPONSIBILITIES ........................................... 23 III. AUTHORITIES’ RESPONSE ......................................................................................................... 44 3 GLOSSARY ACH Automated Clearing House AML/CFT Anti-Money Laundering and Combating the Financing of Terrorism ATM Automated Teller Machine BCP Business Continuity Policy BCL Banking Control Law BTD Banking Technology Department CMA Capital Markets Authority CML Capital Market Law CP Core Principle CPSIPS Core Principles for Systemically Important Payment Systems CPSS Committee on Payment and Settlement Systems DVP Delivery-versus-Payment EBPP Electronic Bill Presentment and Payment ETF Exchange-traded fund FIFO First-in-First-out FSAP Financial Sector Assessment Program GCC Gulf Cooperation Council IPSS Integrated Payments Strategy System IOSCO International Organization of Securities Commissions MOU Memorandum of Understanding NPS National Payments System ORR Operating Rules and Regulations OTC Over-the-counter POS Point of Sale RTGS Real Time Gross Settlement SAMA Saudi Arabian Monetary Agency SARIE Saudi Arabian Riyal Interbank Express SDC Securities Depository Center SIMAH Saudi Credit Bureau SPAN Saudi Payments Network SSS Securities Settlement System 4 EXECUTIVE SUMMARY The present document is the assessment of the systemically important payment systems in the Kingdom of Saudi Arabia (KSA) based on the CPSS Core Principles for Systemically Important Payment Systems (CPSIPS). The document also contains an analysis of some developmental issues related to the reform of the payments system as a whole. The assessment was conducted in the context of the field mission of the Financial Sector Assessment Program (FSAP) Update to the KSA (April 2011). The assessor of the CPSIPS was Massimo Cirasino. The national payments system (NPS) in Saudi Arabia efficiently serves the needs of a broad set of users. In particular, SAMA has implemented a comprehensive and robust infrastructure to support the provision of payment services and products by commercial banks. The infrastructure is primarily concentrated on payments in riyals and comprises the following systems: (i) the Saudi Arabian Riyal Interbank Express (SARIE) real time gross settlement (RTGS) system, which processes a wide range of large-value and small-value payments and provides settlement facilities for a number of clearing systems, as well as for transactions executed at the Tadawul stock exchange; (ii) the check clearing houses operated at SAMA branches; (iii) automated teller machine (ATM) and point-of-sale services provided through Saudi payments network; (iv) electronic bill presentment and payment processed by the national electronic bill presentment and payment service; (v) the Public Key Infrastructure (PKI) which provides advanced security facilities; and (vi) the SAMA Joint Network (SJN) providing a highly secured communications network. The NPS in Saudi Arabia is characterized by a high level of standardization. Many critical aspects relating to the payment and SSS are covered in the existing legal framework. However, there is no comprehensive payment system law, and the enactment of such a law is strongly recommended. The payment system law could also provide a legal basis for Emergency Liquidity Assistance (ELA) operations. The Banking Control Law provides SAMA with the mandate to regulate and operate the payment systems and allowed SAMA to issue the relevant policies and regulations for payment systems. The current framework covers the following: (i) clarity of timing and finality of settlements; (ii) recognition of electronic processing of transactions; (iii) protection from third party claims for the collateral pledged in a payment system; (iv) ensuring fair and competitive practices in the provision of payment services; and (v) consumer protection for retail payment services. The following other important aspects are not covered explicitly: (i) legal recognition of bilateral and multilateral netting arrangements; and (ii) nonexistence of zero hour and similar rules in case of insolvency. SARIE system is the backbone of the NPS. It is a RTGS systems and the only systemically important payment system in the country. SARIE processes both large-value and small-value payments, both gross settlement and net settlement, and supports both credit transfers and debit transfers. The settlement is effected on the accounts maintained by the 20 direct participants with SAMA. All settlements in SARIE are deemed final and irrevocable. SARIE observes fully all the 5 Core Principles for Systemically Important Payment Systems, with the exception of CP 1 (Legal) and CP 9 (Access), which are broadly observed. SSS work safely and efficiently, although some improvements are underway. Corporate securities transactions, with the exception of sukuks, are settled on T+0 with the cash leg occurring at the end of the day and the transfer of securities being executed immediately after trade confirmation. Risks are mitigated by caps and other controls such as the prohibition of short selling . CMA, Tadawul, and SAMA are in an advanced phase to bring to fruition their plans to move towards intra-day settlement based on delivery-versus-payment. Fair and open access to the settlement infrastructure by brokers/dealers, in particular, those that do not belong to a bank, should be discussed in the context of this reform. SAMA is working to establish its payment system oversight function from an operational perspective. The power of SAMA to oversee the payment systems is stated in the central bank and banking laws. However, the powers of the central bank to operate, regulate, and oversee the payment systems are not detailed in the law and could be also covered by the proposed Payment System Law. SAMA should also clarify in detail its policy stance in payment system oversight in a publicly available document, which would expand on the scope of its actions and its plans to achieve its public policy objectives in payment system matters, the scope of the oversight function should be ample to include all clearing and settlement systems. SAMA should accelerate the process of creating a full-fledged oversight unit, independent from payment system operations, and ensure the visibility of the payment system oversight function both internally and externally. SAMA and CMA are encouraged to finalize their MOU and include specific reference to the areas of joint interaction in the payment and settlement space. Structured cooperation could take the form of joint technical working groups of a permanent nature. SAMA is continuing to play a laudable role as a catalyst in the development of the NPS. In 2009, SAMA-in close consultation with relevant stakeholders-conducted a comprehensive NPS review (Integrated Payment Systems Strategy, IPSS). The implementation of the IPSS is a very comprehensive project and will build, for example, on recent improvement such as the switch to International Bank Account Number requirements for accounts. Also, SAMA and the banks are involved in a large-scale effort to foster inclusion in payment services by introducing prepaid cards for the 12 million-strong un banked and under-banked segments. 6 I. SUMMARY, KEY FINDINGS, AND RECOMMENDATIONS A. General This assessment of the systemically important payment systems in Saudi Arabia is based on the Core Principles for Systematically Important Payment Systems (CPSIPS). The assessment was conducted in the context of the mission of the Financial Sector Assessment Program (FSAP) Update to Saudi Arabia in April 2011. The assessor of the CPSIPS was Massimo Cirasino.1 B. Information and Methodology Used for Assessment The information used included all relevant laws and rules governing payment and securities settlement systems (SSS), and the abundant material available on the issue inside and outside the central bank and securities commission. In addition, extensive discussions were held with different departments of regulators and overseers; Saudi Arabian Monetary Agency (SAMA)2 and the Capital Markets Authority (CMA); several stakeholders in the Saudi Arabia payments system, including four commercial banks (SABB, Bank Saudi Fransi, Saudi Investment Bank, SAMBA); the stock exchange, Tadawul; the Securities Depository Center (SDC); and a broker/dealer (Jadwa Investment). Self assessments by the SAMA of the country’s main payment systems (Saudi Arabian Riyal Interbank Express (SARIE), Saudi Payments Network (SPAN), SADAD, and the check clearing process) were provided to the assessor prior to the mission. The self-assessments were prepared by the SAMA’s Banking Technology Department (BTD), in close consultation with system participants. The self assessment of the SSS with the Committee on Payment and Settlement Systems (CPSS) International Organization of Securities Commissions (IOSCO) Recommendations for SSS, performed by the CMA, was also provided. The SAMA answers to the questionnaire of the World Bank Global Payment System Survey were also used. In addition to the 2001 CPSS-CPSIPS Report, the methodology used follows the Guidance Note for Assessing Observance of CPSIPS prepared by the IMF and the World Bank in collaboration with the CPSS in August 2001. C. Institutional and Market Structure The National Payments System (NPS) in Saudi Arabia is comprehensive and designed to serve the needs of a broad set of users. The infrastructure operated by the SAMA is primarily concentrated on payments in Saudi riyals. The payment systems operated by the SAMA are as follows: (i) the SARIE real time gross settlement (RTGS) system processes a wide range of high and low value payments and provides settlement facilities for a number of clearing systems, as 1 Head of the Financial Infrastructure Unit and the Payment Systems Development Group of the Financial and Private Sector Development Vice Presidency at the World Bank. 2 The BTD at SAMA is also the operator of a number of payment systems. 7 well as for transactions executed at the Tadawul stock exchange; (ii) check clearing houses operated at the SAMA branches throughout Saudi Arabia; (iii) automated teller machine (ATM) and point-of-sale services provided through the SPAN system; (iv) electronic bill presentment and payment (EBPP) processed by the SADAD system; (v) the public key infrastructure, which provides advanced security facilities; and (vi) the SAMA joint network, a highly secured communications network. The NPS in Saudi Arabia is characterized by a high level of standardization. Figure 1: The National Payments System in the Kingdom of Saudi Arabia SARIE System – RTGS Net (T+0, on behalf of clearing banks) NET* NET* NET* Gross Securities Depository Government Securities SADAD Cheque Clearing house SPAN Center (SDC) Register EBPP System 3 Automated, 7 Manual Card payment Operated by TADAWUL Operated by the SAMA network Gross (T+0) Billers Tadawul Securities Exchange Banks Brokers Billing information Accounts Account s Investors Clients (legal and natural persons) Securities Transactions Payment Transactions Further netted together in the SARIE along with 21 * other net settlement positions Transaction or information related flow Settlement related flow 8 D. Legal and Regulatory Framework The legal and regulatory framework for payment and securities settlement systems includes several pieces of legislation, namely: the Central Bank Law, the Banking Control Law; the Securities Market Law; Competition Law; Anti-Money Laundering/Combating the Financing of Terrorism (AML/CFT) Law; Electronic Transaction Law; and, Central Bank Regulations having the power of Law. In addition the SAMA has issued operating rules and procedures for the various payment systems that it operates: the SARIE System Operating Rules & Regulations (ORR); the SPAN Business Books, which define the rules, regulations and operating procedures attaching for the SPAN system; and, the Rules for Members of the Automated Clearing System and the Cheque printing standards for the cheque clearing houses. The SAMA has issued detailed rules on AML and know-your-customer (KYC). These rules include: (i) Rules Governing AML/CFT; (ii) AML/CFT Instructions for Financing Companies; (iii) Rules Governing the Opening of Bank Accounts & General Operational Guidelines in Saudi Arabia. Many critical aspects relating to the payment and securities settlement systems are covered in the legal framework; however there is not a payment system law, addressing all the key concepts related to settlement. The Banking Control Law provides the SAMA with the mandate to regulate and operate the payment systems and allowed the SAMA to issue the relevant policies and regulations for payment systems. The legal and regulatory framework covers the following: (i) clarity of timing and finality of settlements; (ii) recognition of electronic processing of transactions; (iii) protection from third party claims for the collateral pledged in a payment system; (iv) ensuring fair and competitive practices in the provision of payment services; and, (v) consumer protection for retail payment services. The following other important aspects are not covered explicitly: (i) legal recognition of bilateral and multilateral netting arrangements; (ii) non-existence of zero hour and similar rules in case of insolvency. The power of the SAMA to oversee the payment systems is stated in the central bank and banking laws. Reference to the SAMA oversight authority is general, in the context of ensuring the adequate and safe functioning of payment systems in the country. However, the powers of the central bank to operate, regulate, and oversee the payment systems are not detailed in the law. The securities regulator, the CMA, is empowered to oversee and regulate securities settlement aspects. In 1984, a Ministerial Committee composed of the Ministry of Finance and National Economy, Ministry of Commerce and the SAMA was formed to regulate and develop the market. The SAMA was the government body charged with regulating and monitoring market activities until the CMA was established in July 2003 under the Capital Market Law (CML) by Royal Decree No. (M/30). The CMA is the sole regulator and supervisor of the capital market, it issues the required rules and regulations to protect investors and ensure fairness and efficiency in the market. 9 The Saudi Stock Exchange Company (Tadawul) was approved in March 2007 in accordance with the Capital Markets Law. The Tadawul was established to develop a full- fledged security market that provides comprehensive and diverse financial services. The Tadawul is the only authorized entity to carry out the trading of private securities, both equities and bonds. The TADAWUL also operates a Securities Depository Center (SDC). The Capital Market Law provides for the establishment of the Securities Depository Center solely entrusted to execute the transactions of deposit, transfer, settlement, clearing and registering ownership of securities traded on the Exchange. The functions of the Securities Depository Center are currently operated by The Saudi Stock Exchange (Tadawul). The SDC is not a self regulatory organization (SRO). Non-bank payment services providers need to be registered and licensed. The SAMA is the licensing and registering authority for clearing houses, payment card processing companies and Money Transfer Operators (MTOs). The SAMA and the CMA jointly license and register Non- Banking Financial Institutions, and the CMA is the registering and licensing authority for Central Securities Depositories (CSD). E. The Real Time Gross Settlement System: SARIE The SARIE system is the backbone of the NPS in Saudi Arabia and is a RTGS system. The SARIE system was launched in 1997, and has been periodically enhanced, with the last software update done in May 2008. SARIE processes both large-value and small-value payments; both Gross settlement and net settlement; both real-time and deferred settlement; and supports both credit transfers and debit transfers. The settlement is effected on the accounts maintained by the twenty direct participants with the SAMA, all settlements done on the SARIE are deemed final and irrevocable. The SARIE system settles clearing positions from 24 other systems including SPAN, SADAD and TADAWUL exchange. Except the TADAWUL exchange positions all the other clearing positions are aggregated and settled on overall net basis towards the end of the SARIE operating cycle – at 15 hours on Saturday-Wednesday and at 13 hours on Thursdays. The transactions interfaces of the SARIE are depicted in Figure 2. 10 Figure 2: The SARIE Payments Flow Source: SAMA The usage of the SARIE system has been steadily increasing. The total value settled has nearly doubled in only three years between 2007 and 2010, while the number of transactions processed through the SARIE has also grown from 25 to 35 million over the same period of time (Table 1). Table 1: SARIE - Transaction Statistics YEAR 2004 2005 2006 2007 2008 2009 2010 2011 Q1 SARIE - Value Settled (trillion SR) 8.02 10.15 13.82 33.7 35.91 61.23 55.54 14.27 SARIE - Volume (million) 15.39 18.43 20.79 24.83 31.64 32.83 35.11 10.61 `SARIE – Turnover of GDP ( percent) - - 10 23 20 44 34 - * Source: SAMA 11 Table 2: SARIE - Values of Transactions (million Riyals)3 Year Customer Payments Interbank Payments Others Total Bulk Single Total Bulk Single Total 2004 293,601 735,407 1,029,008 86,796 6,899,906 6,986,702 8,325 8,024,035 2005 379,637 1,011,538 1,391,175 116,589 8,629,928 8,746,517 8,450 10,146,142 2006 441,327 1,204,279 1,645,606 107,618 12,077,171 12,184,789 9,563 13,839,959 2007 550,269 1,320,991 1,871,260 72,670 31,730,199 31,802,869 28,720 33,702,849 2008 719,303 2,092,324 2,811,628 79,047 32,979,135 33,058,182 35,946 35,905,756 2009 716,980 2,176,457 2,893,437 42,404 58,280,884 58,323,287 17,440 61,234,165 2010 866,620 2,015,081 2,881,701 36,500 52,541,938 52,578,438 83,860 55,543,999 2011 Q1 277,622 552,042 829,664 9,964 13,384,741 13,394,705 41,516 14,265,885 Table 3: SARIE - Number of Transactions4 Year Customer Payments Interbank Payments Others Total Bulk Single Total Bulk Single Total 2004 14,098,532 877,876 14,976,408 22,173 141,572 163,745 253,386 15,393,539 2005 16,799,123 1,146,879 17,946,002 33,075 163,934 197,009 284,878 18,427,889 2006 18,516,565 1,494,688 20,011,253 52,588 195,700 248,288 527,226 20,786,767 2007 21,766,617 1,721,542 23,488,159 61,136 244,912 306,048 1,038,765 24,832,972 2008 27,221,118 2,332,241 29,553,359 63,151 262,510 325,661 1,756,664 31,635,684 2009 27,982,379 2,621,772 30,604,151 77,232 265,862 343,094 1,881,898 32,829,143 2010 30,253,374 3,003,368 33,256,742 74,786 236,820 311,606 1,542,060 35,110,408 2011 Q1 9,376,865 818,313 10,195,178 18,834 61,287 80,121 334,996 10,610,295 3 Forty Sixth SAMA Annual Report, 2010. 4 Forty Sixth SAMA Annual Report, 2010. 12 SARIE participants are linked through a private network provided by Saudi Telecom Company. SARIE participants use a SAMA-supplied SARIE gateway application to connect to the SARIE system through the private network. The payment messages conform to the SWIFT messaging standards and the account numbers conform to the IBAN standards. Access to the SARIE system is authenticated using smartcards and digital certificates are used to confirm authenticity and integrity of the payment messages. The liquidity optimization methods supported by the SARIE are queuing and prioritization. SARIE places unsettled transactions in a queue and allows the initiating participant to set priority for a transaction and also to re-prioritize while the transaction is in queue. Queued transactions are processed in a First-In-First-Out (FIFO) manner in the order of priority. There are multi-lateral offsetting algorithms that kick-in automatically by non-time related parameters and can also be triggered manually. The SAMA provides liquidity support options for settlement of SARIE transactions. The SAMA has a published “Limit and Collateral policy” for SARIE transactions. Participants can use their reserves at the SAMA for intraday purposes, request intra-day collateralized overdraft, overnight repos and also use riyal proceeds from foreign exchange transactions. A range of collaterals are accepted for collateralized intra-day overdraft – Government development bonds; T-Bills; Special Bonds; Floating rate notes; and, Farmers certificates. Overnight repos are available at an interest rate of 20 percent per annum and an administrative fee of SR 500. Any unsettled positions at the end of the day are rejected. In addition, SARIE participants can borrow from other participants, the transactions being confirmed bilaterally outside of the RTGS system and are generally uncollateralized; funds are transferred amongst the participants through SARIE system. SARIE operations are governed by the SARIE ORR, and have been periodically updated. The SARIE ORR was first published in April 1997, and since then there have been four updates, with the most recent change made in January 2005. The changes to ORR are made by the SAMA after detailed discussions internally and with the banks. The ORR is available at a restricted SARIE intranet website accessible to all the participants and the SAMA. SARIE pricing is determined by the SAMA, and it aims at full recovery of the operating costs. SARIE has single-tier membership structure with membership available only to banks. The SARIE supports only direct membership and membership is open only to banks. Currently there are twenty direct participants in the SARIE system. The SARIE ORR have specified certain mandatory operational capabilities for participants, and only participants that have those capabilities, are granted membership. Membership decisions are handled by the SAMA. SARIE has a well-defined Business Continuity Policy and is periodically tested. The system has multiple business contingency measures – (i) switch to an on-site contingency system recovery; (ii) Switch to systems at the contingency site; and, (iii) exchange data on computer 13 disks and use manual data uploads in case of a communication failure. A fully fledged back-up system is available at the primary site with real time data replication amongst the systems, enabling the SARIE operations to seamlessly switch to the back-up system in case of a localized failure in the main system . In addition, there is a fully equipped system at a contingency site, with an onsite fully fledged back-up. The data from the primary site is replicated on a real-time basis to the contingency site. The contingency site is located outside of Riyadh. There is a Business Continuity Policy which describes in detail how the contingency measures are to be invoked, by whom and when. The last BCP testing was conducted in first quarter of 2010. The BCP aims to recover full functionality within 5-10 minutes of notifying initiation of contingency measures. The SAMA has undertaken an Integrated Payments Strategy Review and has proposed some enhancements to the SARIE system. In particular, the IPPS has proposed that the Automated Clearing House (ACH) type functionalities be moved onto a separate system. The switch to IBAN requirements for accounts has already been successfully completed and has further increased the efficiency of the system. F. Retail Payment Systems and Instruments Commercial Banks are the sole providers of retail payment products in the kingdom. The retail payment instruments available for retail payment needs are cheques, direct debits, credit transfers, credit and debit cards. Debit cards are the most popular with around 1.56 million transactions on a daily basis, however over two thirds of these are for ATM withdrawals. The SAMA and the banks are involved in a massive program to foster inclusion to payment services by introducing prepaid cards for the 12 million un-banked and under-banked segments. The statistics for the payment card transactions and cheque systems are provided in tables 4 and 5 respectively. The retail portion of the credit transfers and debit transfers are shown in table 2 and 3. The SAMA is the operator of the major retail payment systems—the clearing house, the card payments switch, and EBPP systems. 14 Table 4: Payment card statistics 2004 2005 2006 2007 2008 2009 2010 Total number of Automated Teller 4,104 4,588 6,079 7,543 8,893 9,950 10,885 Machines (ATMs) Total number of ATMs transactions 412,193 533,203 626,712 656,491 871,533 941,701 1,074,863 (thousands) Total values of cash withdrawals at 200,422 245,902 279,101 308,734 379,009 411,285 468,390 ATMs (million Riyals) Total number of Point of Sale (POS) 35,521 44,253 61,557 72,351 82,620 80,505 terminals in the country 57,180 Total number of POS transactions 52,177 66,127 83,132 99,435 120,684 124,830 151,180 (thousands) Total values of sales at POS (million 23,971 28,076 30,966 39,431 51,403 56,256 71,857 Riyals) Source: SAMA Table 5: Cheque statistics Year 2004 2005 2006 2007 2008 2009 2010 Cheques Volume 7,438 7,578 7,181 7,079 7,330 7,117 7,073 (thousand) Cheques Value 486,524 505,210 502,337 596,246 713,328 655,467 724,165 (million SR) Source: SAMA. The figures include Commercial and Personal Cheques, and Bank Drafts which are also processed through the cheque clearing houses. Cheque Clearing House The SAMA operates ten cheque clearing houses, three of which are automated which process over 90 percent by value. The cheque clearing houses in Riyadh, Jeddah and Damman are automated and are structured as an ACH, these process 90 percent by value and 88 percent by volume of all cheques. The SAMA and the twenty commercial banks are the members of these cheque clearing houses. Even in the three ACHs the physical exchange of cheques is still required. Although the volumes of transactions settled through these clearing houses saw a significant drop between 2005 and 2010, the value has been increasing and reached SR 724 billion in 2010, refer Figure 3. 15 Figure 3: Clearing Houses settlement values and volumes The Cheque Clearing Houses clears both low-value and large-value cheques denominated in riyal. The Cheque clearing houses are used primarily by the government and corporate sector. Majority of the Government departments do not have access to the RTGS system (SARIE) and hence continue to use cheques for their payments. The corporate prefer to use cheques to control their cash flow. On a daily basis around 23,577 cheques are processed in the cheque clearing houses, this is slightly lower than the figure of 23,725 in the previous year. The average value of a cheque in 2010 was SR 2,414, a 10 percent rise over SR 2,185 in the previous year. The Cheque clearing houses have one clearing cycle daily from Saturday to Thursday, and final settlement is done on T+0 in SARIE on a multilateral net basis. The clearing cycle is daily at 12 noon, and multi-lateral net settlement positions are communicated to the RTGS system – SARIE individually from each of the ten clearing houses. At SARIE, these positions are netted along with net settlement positions from other retail payment systems and the final aggregate net positions is effected in SARIE at 15 hours Sunday to Wednesday and at 13 hours on Thursdays. In case a participant is unable to settle, the transactions would be unwound and the participant would be liable to the other members which would need to be settled bilaterally. This situation has however never happened. On an overall basis funds are credited to the cheque presenters’ account on a T+3 basis. The SAMA has established a committee to review, update and publish the rules, procedures and standards for cheques clearing. The SAMA has published standards for Automated Cheque Clearing and Cheque printing. These documents are available to all members upon request. The committee is now working on reviewing the rules, updating them and finally publishing them. This committee is also working on defining the requirements for a planned upgrade of the automated cheque clearing house. 16 There is no clear Business Continuity Plan (BCP) in place for the clearing houses, however there are multiple business continuity measures available. The ACHs have onsite contingency systems in place. In case of connectivity issues between the clearing houses and the SARIE system, the settlement positions can be input manually. The three ACHs can stand in for each other; in case of the manual cheque clearing houses the clearing can be conducted at one of the other clearing houses. However there is no clear BCP in place explaining how and when these measures are to be invoked and also these measures are not tested periodically. Information on bounced cheques is included in the credit information database – SIMAH. The SAMA regulates and oversees the operations of the credit information database in the Kingdom – SIMAH, this was established in 2008. Information about bounced cheques is now being added in SIMAH, this has reduced the incidence of bounce cheques. POS and ATM switch The SAMA operates a national payment card switch – SPAN. The SPAN was implemented in 1990. It provides authorization, transaction routing and clearing services for all ATM and POS transactions in the Kingdom. There are 16 commercial banks connected to the SPAN. The SPAN is also connected to the international payment card networks – Visa, Master Card, American Express and the GCC country switches (see Figure 4). As of March 2011, there were 12 million cards issued by commercial banks which use the SPAN and 80,500 POS terminals were part of the SPAN (see Table 6). The SPAN also operates a Claims Processing System (CPS) to handle inter-bank disputes related to transactions processed by the SPAN, the rules related to this are set by the SAMA. Table 6: Number of ATMs and POS 2004 2005 2006 2007 2008 2009 2010 Total number of ATMs in the country 4,104 4,588 6,079 7,543 8,893 9,950 10,885 Total number of POS terminals in the country 35,521 44,253 57,180 61,557 72,351 82,620 80,505 * Source: SAMA 17 Figure 4: The SPAN system – Payment Card Switch The SAMA has published a number of rules, procedures, guidelines and standards related to processing of payment card transactions. The SAMA has published SPAN business books related to these and has also adopted the international standards like EMV and PCI data security standards and has made them applicable for transactions processed through the SPAN. The participant banks are required to issue EMV chip chards; comply with the PCI data security standards and also all the POS and ATM devices are subject to certification by the SPAN. The SAMA has mandated all domestic card transactions to be processed through the SPAN system. Settlement for domestic SPAN transactions is effected in the SARIE with multi-lateral net settlement positions being aggregated with net positions from other retail systems. The SPAN conducts clearing once a day – 6.30 AM for ATM transactions and 4 AM for POS transactions, and submits the multi-lateral net positions for settlement to the SARIE system. The SARIE system aggregates these positions with the positions from the other retail systems and settles on an overall multi-lateral net settlement basis on the same day. The participants in the SPAN are informed about their positions, the SARIE system also sends aggregated settlement position information subsequently before settlement. The SPAN system does a combined clearing for Thursday and Friday on Saturday. The international payment card network transactions are settled in the SARIE against specific Saudi Riyal accounts held at the SAMA. The transactions pertaining to the GCC country switches are settled in nostro accounts held with the SAMA and the vostro accounts held by the SAMA with the other GCC country central banks. 18 The SAMA operates the SPAN on a full cost recovery basis. The capital investment costs are amortized over a period of 3-7 years depending on the classification of the particular asset. The participants are charged on a per transaction basis, there are no other annual membership fees. The transactions fees are tiered and are charged for each authorization and settlement. The issuers are charged for both authorizations and settlement, the acquirers are charged for only the settlement. The fees are different for ATM and POS transactions, with the lower range for POS transaction fees being lower, and the higher range being higher than ATM transactions. The fees are listed in Table 7. These fees are now being reviewed in consultation with the participants, and are likely to drop by over 65 percent. There are no interchange fees for POS and ATM transactions processed through the SPAN. Table 7: The SPAN transaction Fees Bill Presentment The SAMA operates the EBPP system – SADAD. The SADAD system started operations and 2007 and was implemented around the solution provided by CheckFree. Currently has around 100 billers and 6 million customers paying bills using this system. SADAD processed around 271,000 bill payment transactions amounting to over SR 199 Million on a daily basis in 2010. SADAD supports a variety of billing related payments – bills for recurring services like utilities; pre-payment for services like mobile phone re-charge; and, one-off payments for services like airline ticketing and purchasing vouchers. The billers submit their bills to SADAD, and the customers can pay their bills through their bank’s channels – internet, ATM, call centre etc. and also through channels operated by the billers. The SAMA sets the rules, fees and membership criteria for the SADAD. SADAD does not publish membership rules, in general only large corporate billers and Government organizations are accepted. There is however a plan underway to expand services to other smaller billers and merchants. The operating rules are provided to participants at the time of their joining SADAD. The fees are charged only to the billers, and the billers are encouraged not to pass on the fees to 19 the customers. The fees are set on a per biller basis based on the nature of industry of the biller, projected 5 year volume, average value of each bill and projected penetration. The fees are not set to achieve full cost recovery. SADAD payments are settled in SARIE. The billers maintain accounts with commercial banks who are participants in SARIE. The commercial banks and the billers communicate the bill payment information to SADAD. At a designated cut-off – Midnight 12 PM, SADAD prepares a clearing file and transmits to the billers and banks, and computes the multi-lateral net settlement positions and transmits it to the SARIE system for settlement in the next settlement cycle. The SARIE system aggregates SADAD multi-lateral net positions with those from the other retail payment systems and executes an aggregated multi-lateral net settlement. SADAD does a combined settlement for Thursday and Friday on Saturday. G. Securities Settlement Systems The SAMA manages the clearing and settlement of Government Securities - Government Development Bonds (GDBs), Floating Rate Notes (FRN) and Treasury Bills. The SAMA operates a registry with securities accounts for banks investing in Government securities – the GDBs, T-Bills and FRN. The primary market transactions and secondary market transactions are settled by the SAMA against the current accounts of the commercial banks processing the transaction and the corresponding transfers recorded in the securities account of the involved investors. Currently only banks and government agencies (mainly Pensions Funds) can participate in T-Bill auctions banks which take place on Mondays. Auctions for banks are base on competitive bidding. The ownership is registered at the level of the intermediary and not the beneficial owner (in case of banks’ client investors). Transactions in the primary market are settled in SARIE on Wednesdays (T+2). Secondary market transactions among banks are executed by sending instructions between the buyer and the seller via SARIE and then funds are moved in SARIE itself and securities in the registry. There is a single common central securities depository (Securities Depository Center, SDC) for corporate securities - equities and bonds. Around 99.5 percent of negotiable securities in the Kingdom are immobilized and dematerialized in the SDC. The SDC handles both the commercial equities and bonds, and is used to facilitate transfer of ownership arising from secondary market transactions. Commercial banks, broker-dealers and other financial institutions are direct participants in the SDC, the Authorized Persons. In all there are 97 market participants of which 65 provide services as a dealer. Beneficial owners are identified at the individual level in the CSD, which is a department of the Stock Exchange, Tadawul. Securities settlement works on a T+0 rolling settlement cycle for equities and exchange- traded funds (ETFs) and T+2 for corporate bonds and Islamic bonds (SUKUKs) and attempts to conform to a Delivery Versus Payment (DVP) model. Equities and ETFs transactions are settled real time according to a DVP model 1 arrangement at the level of 20 investors5 and corporate bonds and SUKUKs are settled according to a DVP model 3 arrangement.6 Trades are executed only where the seller has the securities in its account at the SDC and the relevant Clearing Bank will guarantee payment for the securities. The automated trading system automatically checks whether these conditions are met, and will not execute trades that do not meet both conditions. Market participants (broker/dealers) are required to settle the cash-leg through a commercial bank of their choice, the Clearing Bank. Clearing banks place specific limits for the settlement positions of their market participant clients. The CSD has an interface with the SARIE system through which the net settlement positions for the Clearing banks are reconciled within the SARIE at 15.30 hours on all trading days, which is then settled in the SARIE system with finality by 15.40 hours. Given the retail nature of the Saudi Arabian capital markets, individual investors are required to make their securities and funds available prior to executing the transaction. Ownership of securities is transferred upon confirmation of trade and the seller is – in many cases – able to have access to funds immediately after confirmation and transfer of ownership. The Over-the-counter (OTC) derivatives market is at a nascent stage of development in Saudi Arabia. The banks deal primarily in plain vanilla derivative products which are mainly used for risk management purposes such as hedging and/or management of FX or interest rate risks. They typically do not use structured and/or synthetic OTC products either for their customers or for their own account. FX swap products are the major OTC derivative products used by the banks. Furthermore, the size of the overall OTC derivatives market in Saudi Arabia is nominal and all activities of banks in this area are monitored by the SAMA through periodic reporting. H. Payment and Securities Settlement Systems Oversight The SAMA is in the process of establishing a fully-fledged payment systems oversight function. The payment systems oversight function has de facto been performed regularly by the SAMA BTD. Currently, BTD is in the process of staffing an oversight unit which is operationally independent from the units that operate the payment systems. The SAMA has not set down its oversight policy and objectivities in a policy document. In performing its oversight, the SAMA classifies payment systems as: 1) Systemically Important Payment Systems (SIPS); 2) Retail Systems of Systemic Importance (RSSI); 3) Retail Systems of Prominent Importance (RSPI); and, 4) Other Retail Payment Systems. The SAMA uses various oversight tools in the exercise of its oversight policy. Monitoring, dialogue and moral suasion, and on-site inspections are the most relevant oversight tools used by the SAMA. Issue of regulations, sanctions and production and publication of statistics and other analysis are less often used. 5 At the investors level, the securities and funds legs are both settled on a gross basis throughout the day. 6 The securities and funds legs are both settled on a net basis at the end of the settlement cycle. 21 In 2009, as part of its catalyst role in payment system reforms, the SAMA – in close consultation with relevant stakeholders - conducted a comprehensive national payments system review in Saudi Arabia, whose details are provided in Box 1. Box 1: Strategic review of the National Payments System in the Kingdom of Saudi Arabia In 2009, the SAMA conducted a review of the national payments system that led to the definition of an Integrated Payments System Strategy (IPSS) assisted by the Boston Consulting Group (BCG). The project was guided by the following objectives: • Reduce reliance on paper-based payment instruments by providing a set of convenient and trusted non- cash payment instruments; • Improve efficiency and automation in Business-to-Business (B2B) payments initiation & reconciliation and electronic invoice presentment and payment (EIPP); • Test and identify opportunities for the SAMA BTD to continue its payments market catalyst role and expand its role as a shared service utility provider for banks and corporates; • Provide a pragmatic architecture that will be appropriate for the future and that can be implemented over the next 5 years; and, • Enable the SAMA and the banks to continue to provide payment services in a commercially sustainable manner and to continue to invest in developing new and enhanced payment services. A high level summary of the proposed strategy is: 1. Strengthen the SARIE system to handle projected volumes, advance integration with GCC RTGS systems, and re-position the SARIE as a true RTGS system by shifting processing of low-value retail transactions in a separate ACH type system. 2. Design, develop and implement a basic prepaid account/card (TAYF) for the un-banked and several other customer segments (e.g. children, government offices, domestic employees, gas station private label cards etc.) 3. Develop and implement a “merchant acquiring strategy” that focuses on creating an end-to-end governance process over the total card experience and addresses the pressing SPAN processing problems 4. Design, develop and implement mobile payments (M-Payments) respecting the current roles of the SAMA, banks and Telco operators 5. Provide advanced payment services to corporate customers through enabling B2B billing in the SADAD and developing EIPP products on ACH platform. 6. Plan for the development of a new messaging service (CorpLink) to enable Corporates communicate with their banks in SWIFT message formats in a more secure and confidential manner than through SWIFT. The SAMA is currently developing a plan for implementing this strategy by 2020. The CMA has jurisdiction over corporate securities settlement systems. The CMA’s responsibilities are spelled out in the Capital Markets Law. The CMA conducts regular inspection on the CSD and engages in constant dialogue with Tadawul and market players. 22 Cooperation in the payment space exists but is not formalized. The SAMA and the CMA currently engage in dialogue with each other but the other regulators however there are no formal Memorandum of Understanding (MOU) in place. Also, the SAMA consults and co-operates with payment system stakeholders for specific operational matters, and also holds regular meetings at senior levels to discuss strategic issues. However, no National Payments System Council/Committee does exist. 23 II. ASSESSMENT OF THE CPS AND CENTRAL BANK RESPONSIBILITIES The SARIE is a systemically important payment system as it is the backbone of the NPS in Saudi Arabia. SARIE handled approximately 3.9 million transactions for a value of over SR 5.2 trillion in March 2011. Thus, SARIE is being assessed below against the ten CPSIPS of the CPSS and the four Responsibilities of the central banks in applying the CPSIPS. The assessment of systemically important payment systems is conducted over existing payment systems/arrangements, although relevant projects and reforms are taken into account. Each Core Principle (CP) and Central Bank Responsibility was assessed on a qualitative basis based on a five-fold assessment categorization: observed, broadly observed, partly observed, non-observed, and not applicable. A CP is considered observed whenever all assessment criteria are generally met without any significant deficiencies. A CP is considered broadly observed whenever only minor shortcomings are found, which do not raise major concerns and when corrective actions to achieve full observance with the CP are scheduled and realistically achievable within a prescribed period of time. A CP is considered partly observed whenever the shortcomings are sufficient to raise doubts about the ability to achieve observance within a reasonable time frame. A CP is considered non-observed whenever major shortcomings are found in adhering with the assessment criteria. Whenever a system is assessed to be broadly, partly or non-observed with a CP, recommendations are proposed for achieving full observance. A CP is considered not applicable whenever it does not apply given the structural, legal and institutional conditions. The detailed assessment and recommended actions are presented in Tables 8-11 below. 24 Table 8: Detailed assessment of observance of CPSS Core Principles for SIPS Saudi Arabian Riyal Inter-bank Express (SARIE) CP I – The system should have a well-founded legal basis under all relevant jurisdiction. Description A relatively complete legal framework is in place for payment systems in Saudi Arabia, including:  the Central Bank Law  the Banking Law  the Securities Market Law;  Competition Law;  AML/CFT Law;  Electronic Transaction Law; and,  Central Bank Regulations having the power of Law. In addition the SAMA has issued operating rules and procedures for the various payment systems that it operates: the Saudi Arabian Riyal Inter-bank Express (SARIE) System Operating Rules & Regulations (ORR); the “SPAN Business Books” define the rules, regulations and operating procedures attaching to the SPAN system; and, the “Rules for Members of the Automated Clearing System” and the “Cheque printing standards” for the cheque clearing houses. Many critical aspects relating to the PRSSS are covered in the legal framework; however there is not a payment system law, addressing all the key concepts related to settlement. The legal and regulatory framework covers the following: (i) clarity of timing and finality of settlements; (ii) recognition of electronic processing of transactions; (iii) protection from third party claims for the collateral pledged in a payment system; (iv) ensuring fair and competitive practices in the provision of payment services; and, (v) consumer protection for retail payment services. The following other important aspects are not covered explicitly: (i) legal recognition of bilateral and multilateral netting arrangements; (ii) non-existence of zero hour and similar rules in case of insolvency. The power of the SAMA to oversee the payment systems is stated in the central bank and banking laws. Reference to the SAMA oversight authority is general, in the context of ensuring the adequate and safe functioning of payment systems in the country. However, the powers of the central bank to operate, regulate, and oversee the payment systems are not detailed in the law. Assessment Broadly Observed Comments Although the regulatory framework as defined by SARIE ORR is sound, the lack of a specific payment system law excluding explicitly any conflict with other laws and regulation can give rise to some uncertainty on the legal framework for settlement. CP II – The system’s rules and procedures should enable participants to have a clear understanding of the system’s impact on each of the financial risks they incur through participation in it. Description The SARIE ORR contains rules and procedures for the system. These rules are clear, comprehensive and up to date. They include details of the system design and timetable and define credit risks, liquidity risks, legal risks, operational risks systematic risks, as well as safeguards against these risks. Participants may access these rules and procedures through a restricted intranet website accessible for all participants. 25 The SARIE ORR contains provisions related to the following aspects:  ownership and operation of the system;  admission and expulsion of participants;  certification of participants by the SAMA;  definition of each payment type and its usage;  responsibilities of all parties using SARIE;  use of system functions by participants;  types of system functions which are reserved for the SAMA use; and,  direct debit scheme rules governing banks, payers and originators. Assessment Observed. Comments - CP III – The system should have clearly defined procedures for the management of credit risks and liquidity risks, which specify the respective responsibilities of the system operator and the participants and which provide appropriate incentives to manage and contain those risks. Description The risk management approach designed for SARIE provides a rigorous and comprehensive mechanism for controlling risks: first, there are intraday limits on exposure of the system to any participant; second, there are requirements to provide collateral against such exposure. All limits are fully collateralized. The level of limits and the nature and value of collateral are decided by the SAMA. The SAMA has issued a Limit and Collateral Policy to all participants. This sets out the rules governing intraday limits and specifies the types of acceptable collateral. The policy states that participants may negotiate intraday overdraft limits with the SAMA and that the intraday overdraft limit must be fully collateralized by Saudi Arabian government-issued instruments which can be readily liquidated and over which the SAMA has jurisdiction. A haircut, currently at 10 percent of the value of the collateral, is applied. The policy then lists the instruments that are allowable as collateral.  Government Development Bonds;  Treasury bills;  special bonds;  floating rate notes;  farmers’ certificates. The SAMA holds a Letter of Undertaking signed by each bank, pledging the specified instruments as collateral. The balance on a participant’s account must never be less than zero plus any intraday debit limit approved by the SAMA. All intraday debit balances on a participant’s account must be discharged at the end of the day, at which stage the participant’s account must have a zero balance or be in credit. If any action is required to safeguard the integrity of the banking system, the SAMA can adjust these requirements. SARIE also features real-time monitoring of banks’ daylight limits by the SAMA and the banks, thus providing enhanced capability for actively managing institutional and systemic risk. In the event that a participant is unable to arrange for receipt of sufficient funds to 26 place their account in credit, before cut-off time they may arrange an overnight Repo from the SAMA (up to 75 percent of available collateral). Such loan may be granted, at the discretion of the SAMA. Commission will be charged at the rate of 20 percent per annum, plus a SR 500 administrative charge. Government securities are registered at the SAMA and repos/reverse repos and currency swaps are managed by the Investment Department. Repos and reverse repos can be activated also during the operating day, but the collateral used to guarantee the overdraft is earmarked and is not available for use in the repo. As government securities are not registered at the level of beneficial ownership, banks can in principle use their own clients’ securities as collateral. However, the percentage of securities held by bank customers is not high. An interbank market exists and is typically based on bilateral uncollateralized loans. However, the market is not used actively given the abundant liquidity in the system. In addition, the SARIE supports multiple liquidity optimization features - queuing, prioritization and offsetting mechanisms to prevent gridlock. In particular, The SARIE system places unsettled transactions in a queue and allows the initiating participant to set priority for a transaction and also to re-prioritize while the transaction is in queue. The queued transactions are processed in a FIFO manner in the order of priority. There are multi-lateral offsetting algorithms that kick-in automatically by non-time related parameters and can also be triggered manually. Payments that stay in a queue for a relatively longer period of time (more than half an hour currently are charged at a penalty rate. Assessment Observed. Comments Financial risks are properly managed in the SARIE system. As the liquidity is typically abundant, SARIE participants do not use liquidity facilities extensively. In the medium term, some improvements to liquidity management could include less discretionary rules and a more straightforward link between the funds account and the securities accounts of banks in order to activate intraday liquidity facilities in a more automatic fashion. CP IV – The system should provide prompt final settlement on the day of value, preferably during the day and at a minimum at the end of the day. Description SARIE is a Real Time Gross Settlement System. Same-day value payments are processed in real time and normally settled within seconds, when funds are available on the remitter’s account. Forward value payments, which can be sent up to 14 days before the value date, are stored in the SARIE central system until the value date and settled at the start-of-day on the value date, subject to the availability of liquidity. SARIE ORR require that payment transactions shall be final and irrevocable upon settlement. The settlement confirmation is sent to the payee participant only after affirming and debiting the account of the payer participant. Payments pending in a queue at the end of the operating day are rejected by the system. Assessment Observed Comments - 27 CP V – A system in which multilateral netting takes place should, at a minimum, be capable of ensuring the timely completion of daily settlements in the event of an inability to settle by the participant with the largest single settlement obligation. Description SARIE is a Real Time Gross Settlement System. Assessment Not Applicable Comments - CP VI – Assets used for settlement should preferably be a claim on the central bank; where other assets are used, they should carry little or no credit risk and little or no liquidity risk. Description Settlement in SARIE occurs in central bank money at the SAMA. The receiving participant receives the payment message only after settlement has been irrevocably confirmed by SARIE. Each participant’s account maintained on SARIE is the record of the participant’s current account and is binding on the SAMA and the participant in the absence of manifest error. Assessment Observed Comments - CP VII – The system should ensure a high degree of security and operational reliability and should have contingency arrangements for timely completion of daily processing. Description Security protection is provided through a combination of hardware, software, encrypted communication lines, physical security at all SARIE sites and written security procedures. In particular, the SARIE System has a number of advance security features to ensure that it operates smoothly and in a fully controlled environment. These features include: • Digital signatures are used to guarantee the origin of payment messages. • All communication lines used for the SARIE system are encrypted. • Access to the SARIE system is secured through the use of smart cards. • All SARIE sites are tightly controlled with access to the system being provided only to authorized personnel. • There is a full dual configuration and contingency sites. • There are additional features in place relating to security of transactions, security of reporting, and resilience of systems, etc. • Security features are continuously reviewed and updated. Contingency arrangements are in place, and regularly tested, to facilitate the timely completion of daily processing. The SARIE system uses many different techniques to give the entire system the level of contingency that it needs and is designed to cope with a single point of failure. There are a number of safeguards built into both the hardware and software that, should a single item fail, the operation of SARIE will be unaffected. In the event of the failure of more than one item at the same time, a switch to the relevant contingency site can be achieved in a very short period of time – say within 5-10 minutes. Hardware redundancy of all the critical system parts along with the following design features will assure availability. Primary locations are provisioned as follows: primary system, secondary system (standby), shared database with mirrored discs, using real-time mirroring, periodic backups and offline file transfer in case of total communication failure. 28 Contingency locations are provisioned as follows: primary system, secondary system (standby), shared database with mirrored discs, using real-time mirroring, periodic backups and offline file transfer in case of total communication failure. Real-time replication of data occurs between the Primary and Contingency site databases. This configuration also applies in the Gateway sites (at Participants). Some banks have their own private Contingency site while others use shared Contingency sites provided by the SAMA. The SAMA has a documented Business Continuity Plan (BCP) in place, and SARIE was last tested in third quarter of 2010. No major disruptions to the system have occurred in the many years of its operations. In 2010, a communication link failure due to accidental cutting of communication cables caused by external factors occurred. All the SAMA systems are periodically audited by both external and internal auditors. Assessment Observed. Comments The SAMA is working to streamline contingency procedures across the different payment and settlement systems to achieve even higher level of efficiency. The SAMA is encouraged to continuously assess whether the many clearing systems that settle in SARIE introduce relevant operational risk. CP VIII – The system should provide a means of making payments, which is practical for its users and efficient for the economy. Description SARIE is a fully integrated RTGS system that permits all Saudi banks to make immediate interbank money transfers through accounts held at the SAMA. The system features a quasi 24-hour availability7 to send payment instructions and ensures payment finality and irrevocability. The system also gives banks real-time, direct access to their accounts with the SAMA and enables them to continuously monitor their financial positions. SARIE Business Day hours are as follows : • Saturday to Wednesday 09:00 to 16:00. • Thursday 09:30 to 13:30. • Friday is non-business day. • National holidays are non-business days in SARIE. Forward value payments (up to 14 days from send date) and maturing direct debits are settled at the start of the daily business cycle. Same day value payments are irrevocably settled with finality in real time provided the sending participant has sufficient liquidity in his account. Payments will be queued until sufficient liquidity is available. If sufficient liquidity is not available by close of business, the SAMA may cancel any queued payments. Other payment and securities settlement systems that rely on SARIE for settlement 7 The system is available to send payments at all times, with the exception of a short period at the end of the business day, during which daily house-keeping processes run. 29 purposes are a total of 24 separate clearings, as follows: • SADAD; • SPAN ATM & POS; • Cheque Clearings; • TADAWUL; • Settlement of the Saudi positions arising from international card systems AMEX, VISA and MasterCard; • Other card settlement systems in and between Saudi and other GCC countries. Government securities trading is also channeled through SARIE as transaction instructions are exchanged between banks using the SARIE free format messages and settlement of the cash leg occurs in the RTGS system. SARIE integrates the clearing and settlement positions of all other existing systems, i.e. ATM, EFTPOS, cheque clearings, into a single interbank settlement position that is settled through the banks’ accounts in the books of the SAMA. In addition, SARIE is linked to the SAMA MIS accounting system to receive settlement account balances at start of day and for the sending of the end of day balances for those accounts for updating in the SAMA’s general ledger system. Fee rates are set out in the SARIE Charging Policy which was last updated in July 2006. Fees are divided into:  Transaction fees  Minimum monthly fees  New or Amalgamated Participant fees  Withdrawal of a Participant  Clearing settlement fees  Service fees (covering the other SARIE support services provided by the SAMA)  Exceptional and penalty fees aimed at encouraging good behavior The maximum fee that Participants may charge to customers is also set out in the SARIE Charging Policy. Fees charged for forward value payments are lower than those for same day value. No throughput mechanisms: as there are no different prices charged, based on time of the day. Normal time taken to process a transaction from end to end is as follows:  Real time for same day value Customer and Bank-to-Bank payments.  Two days for Direct Debits from date of sending to final settlement.  Receiving banks must credit funds to the Beneficiary as soon as possible after receipt of settled payments and not later than the end of the business day with some small exceptions as set out in the SARIE ORR. SARIE system has been upgraded to add the feature of IBAN account format which 30 provides the facility for Sending banks (and Remitters) to perform validation check on Beneficiary account number. IBAN has significantly improved the accuracy of account numbers being received in inward payments. Assessment Observed Comments Operating hours and the daily business cycle were amended in 2006 in cooperation with system participants. It is likely that operating hours might need to be extended and the calendar for settlement of other systems in SARIE be reconsidered in light of technological and business development. The SAMA is engaged in discussions with commercial banks on this topic. Banks interviewed during the assessment expressed a high level of satisfaction on the services provided by SARIE. Incidentally, it was mentioned that very minor problems have been caused occasionally by data communication delays. The SAMA is working actively to address the issue. The SAMA could also engage in a discussion with participants to verify whether the settlement of a single netting position for all retail systems do not expose these systems to operational spillover effects in case of problems in one of the clearing processes. The SAMA is considering separation of low and mass payments from large value ones and the processing of the former in an ACH type system. CP IX – The system should have objective and publicly disclosed criteria for participation, which permit fair and open access. Description The SARIE ORR state that all participants must be commercial banks, must have systems, procedures and trained staff satisfactory to the SAMA for participation in SARIE and must be certified by the SAMA in accordance with the ORR. There is no requirement in relation to a minimum number of transactions, the SAMA must approve all participants. New participants are charged a once-off fee on joining the SARIE system as specified in the SARIE Charging Policy. The commercial banks operating in the Kingdom are the Participants. The SAMA also acts as a Participant. The SAMA may admit additional Participants as members of SARIE if in the opinion of the SAMA they meet the qualifying criteria defined by the SAMA from time to time. There is no indirect participation in the system. Clear rules for exit or exclusion of a participant also exist. The rules are available on the dedicated SARIE intranet where access is restricted to Participants and the SAMA. The rules are also available from the SAMA in hardcopy. Assessment Broadly Observed Comments Only banks are allowed to participate in the system so far and this policy does not seem to be based on a recent analysis of the risk associated with participation. The SAMA most likely conducted a review of the access policy when SARIE was launched and ORR produced, however the assessor did not find written reference to any documentation of this debate, which in any cases occurred several years ago. 31 Acceptance of new participants is discretionary by the SAMA and not based on disclosed objective criteria. CP X – The system’s governance arrangements should be effective, accountable and transparent. Description The SARIE is fully owned, operated and overseen by the SAMA. Governance arrangements are as follows: SARIE operations are managed within the Banking Technology Department of the SAMA by a dedicated team. Operational interactions with other relevant SAMA departments are in place and carried out smoothly. A formal users’ group is established for participants to provide regular feedback on systems’ operation. Also, any changes to the system are discussed with system participants before implementation. SARIE pricing policy is determined by the SAMA, aims at full recovery of the operating costs and is deemed fair by system. Penalties and sanctions for non compliance are envisaged as follows: • Cut-off Delay: SR 12,000; • Late payment of SARIE fee invoice: SR 1,000; • Late Squaring: SR 1,000; • Contingency test failure: SR 15,000; • Incorrect payment entry: SR 1,500; • Manual input by the SAMA: SR 15,000; • Out of SARIE (Live): SR 20,000; • Out of SARIE (Test): SR 3,000; • Restart of database engine during business hours without permission: SR 20,000 • Losing SARIE application tape: SR 5,000. In addition, fees for the SAMA Technical Support were charged for a total of SAR314,000. The system fully observes almost all the CPSIPS. Assessment Observed Comments The SAMA is continuously working to streamline its operations in the payment system and divided operations from oversight (see assessment of central bank responsibilities below). Other systems are deemed of importance by the SAMA and have been assessed against the CPSIPS, namely the cheque clearing process, SPAN, and SADAD. The main outcomes of the self assessments, as well as some improvement opportunities identified by the FSAP team are presented in Boxes 2, 3 and 4. 32 Box 2: Self-Assessment of the Cheque Clearing Process and Improvement Considerations The cheque clearing process has been classified by the SAMA as a Retail System of Systemic Importance. In the assessment of the SAMA, the following CPSIPS principles are assessed as fully compliant –VI, VIII, IX. The principle X is almost fully compliant with minor deficiencies; and principles I, II, III, IV, V, VII is assessed as adequately compliant. On an overall basis the SAMA has assessed the SPAN system as adequately compliant to the CPSIPS. There is no clear Business Continuity Plan (BCP) for the cheque clearing houses, however there are a number of business continuity measures including manual operation of the cheque clearing process and shifting clearing operations to one of the other nine clearing houses in the event of a failure in one of the clearing houses. The clearing house net settlement positions from each of the ten clearing houses are further netted along with the net settlement positions from the SADAD and the SPAN system and settled at the SARIE. The rules for unwinding in the event of a settlement failure have not been adequately specified. The SAMA could consider establishing an upper value limit for cheques, requiring those transactions to be settled in the SARIE system as a credit transfer– either on a gross basis or net basis. A more aggressive pricing policy to discourage the usage of cheques should also be considered. 33 Box 3: The SPAN system – Self Assessment and Improvement Considerations The SPAN system has been classified by the SAMA as a Retail System of Systemic Importance. In the assessment of the SAMA, the following CPSIPS principles are assessed as fully compliant –VI, VIII, IX. The principles: I, II, III, IV, VII and X are almost fully compliant with minor deficiencies; and principles V is assessed as adequately compliant. On an overall basis, the SAMA has assessed the SPAN system as almost fully compliant to CPSIPS. The settlement of the SPAN system is on a multi-lateral net basis at the SARIE system, where in it is further netted against the net positions from other net settlement systems. In the event of a settlement failure the process of unwinding in terms of the prioritization is not well-defined. By the nature of transactions, for the end customer the transactions are final – as in the customer has already received the cash for an ATM withdrawal or has purchased the goods. The impact of the settlement failure would be in terms of the acquiring bank remaining unpaid, which in turn could cause the merchant involved in case of a POS transaction likely being impacted. A combination of establishing limits; requiring collaterals and establishment of settlement guarantee funds could mitigate the settlement risks. In January 2011, 6.8 percent of the POS transactions and 9.8 percent of the ATM transactions were unsuccessful, with over 10 percent of the failures being due to system errors. On an overall basis for year 2010, the system uptime was 99.9 percent. A number of important enhancements have been planned in 2011 for the SPAN system: (i) strategic re-pricing to create incentives for the issuers of payment cards; (ii) re-branding of the SPAN payment brand; (iii) introduction of prepaid cards to meet the needs of the 12 million unbanked; (iv) systems upgrade to bring in real-time monitoring of the system performance; and (v) establishment of an internal quality assessment team. These enhancements planned by the SAMA have the potential to further improve the overall performance of the SPAN system. The SPAN system currently does not process transactions initiated through the internet and mobile phones. The SAMA could consider enhancing the SPAN system to support routing and authorization of transactions initiated from these systems as well. There is no formal mechanism for reporting fraudulent transactions to the SPAN system. The data on fraudulent transactions are held at the issuer level. The SPAN system could require all the participating institutions to report all fraudulent transactions to the SPAN system, which could then be used develop various fraud mitigation services like identifying merchants introducing higher proportion of fraud to the system etc. 34 Box 4: The SAMA Self-assessment of the SADAD system and Improvement Considerations The SAMA has classified the SADAD system as a Retail System of Systemic Importance. In the assessment of the SAMA, the following CPSIPS are assessed as fully compliant –VI, VII, VIII, IX. The principles: I, II, III, IV, V and X are almost fully compliant with minor deficiencies; and principles IX is assessed as adequately compliant. On an overall basis the SAMA has assessed the SPAN system as adequately compliant to the CPSIPS. SADAD payments are settled in the SARIE system. It is not clear what the impact of a settlement failure would be on the billers and the payers – if they are not paid, would they treat the underlying bill as unpaid?, would the payer then be refunded, by whom and when? It is important that the SAMA institute mechanisms to address such an eventuality with a clear mechanism to unwind the transactions and ensure the interests of the billers and payers are protected. The membership rules for SADAD are determined and enforced by the SAMA, and currently only high- volume billers and Government entities are accepted as members. The membership rules are not publically available. The SAMA is currently reviewing the membership rules with a view to enable participation of the smaller billers as well. The SAMA could consider enabling participation of other specialized bill aggregators focused on specific niche segments to leverage the SADAD system to provide their services. 35 Box 5: The Self-assessment of the Securities Depositary Centre and Improvement Considerations The CMA has assessed the Securities Depositary Center (SDC) using the CPSS-IOSCO Recommendations for Securities Settlement Systems (RSSS). In the assessment of the CMA, the SDC is in full compliance with fourteen of the CPSS-IOSCO recommendations. Of the remaining five recommendations, three (5, 9 and 19) are inapplicable, one (16) is broadly observed, and one (17) is partly observed. The self-assessment outlines that the legal framework governing the SDC is well-founded, clear and transparent. The laws, regulations and procedures governing the system are public and readily accessible to participants. Settlement risk is minimized by several aspects of the legal and technical framework. Securities are held at the SDC on a dematerialized basis, and new listed securities may only be issued on a dematerialized basis. Securities held at the SDC are required to be held in accounts in the name of the client. The SDC's records are conclusive as to the ownership of securities held there. Credit risk is mitigated since trades are executed only where the seller has the securities in its account at the SDC and the relevant Clearing Bank will guarantee payment for the securities. The automated trading system automatically checks whether these conditions are met, and will not execute trades that do not meet both conditions. Equity and Exchange-Traded Fund (ETF) trades are settled in real time on T+0 according to a DVP model 1 arrangement.8 Sukuk and corporate bond trades are settled on a T+2 basis according to a DVP model 3 arrangement. For all products, proceeds of securities settlements, i.e., cash and securities, are credited to client accounts in real time upon settlement and are available immediately. A form of settlement risk exists, as cash settlement takes place in the books of 15 commercial banks (Clearing Banks) and ultimate reconciliation of payments are made by the Clearing Banks utilizing the SARIE payment system only at the end of the day when investors have already completed the transfer of securities (in all cases) and have availability of funds deriving from their selling (in most cases). Clearing Banks are subject to prudential regulation by the SAMA, and the SAMA sets criteria for Clearing Banks. Payment flows are fairly distributed between Clearing Banks, ranging from 8 percent to 16 percent of the gross daily payment flow. A committee consisting of representatives from the CMA, the SAMA and Tadawul exists to review the current clearing and settlement process for securities trading. Operational risk is well managed. Tadawul has appropriate systems and procedures to identify and manage its operational risks, including a business continuity plan and backup facilities that are regularly tested. The SDC does not use or accommodate the relevant international communication procedures and standards. Since cross-border linkages are not in place or currently contemplated, the CMA is of the opinion that such communications procedures and standards are currently not needed. However, if in the future cross-border linkages with the SDC were considered, compliance with international communication procedures would be also considered, and would be needed to achieve an assessment 8 The self-assessment states that equities and ETFs are settled according to a DvP model 2 arrangement and bonds are settled according to a DvP model 1 arrangement. This is true in case the payment flows of the Clearing banks define the applicable DvP model, however, the payment flows to and from the clients of the Clearing banks define the applicable DvP model. 36 of "Observed". The self-assessment also outlines that currently the CPSS-IOSCO disclosure framework is not public, but that it will be disclosed following this self-assessment. 37 The main consideration for the cheque clearing, SPAN and SADAD is that the settlement risk management for retail payment systems might be reconsidered. All retail payment systems settle at the SARIE system. The individual systems send the final multi-lateral net clearing positions to the SARIE system, the SARIE system aggregates all these positions and does a consolidated final net settlement. While there are various liquidity optimization and liquidity support mechanisms available in the SARIE system, in the event of a credit problem encountered by a participant, liquidity support mechanisms could not be available as all of them need good quality collateral. In absence of credit by the SAMA, the only recourse in such a case would be to unwind. However given that the individual systems clearing positions are further netted against the clearing positions of all the other systems, unwinding would be extremely complicated and would raise a number of issues most importantly what should be the order and priority for these unwinds. A comprehensive risk management framework perhaps comprising of a combination of net-debit limits in individual systems with a consolidated settlement guarantee fund could be studied in order to mitigate these risks. Securities settlement systems work safely and efficiently, although some improvements are envisaged. A detailed assessment of Securities Settlement Systems (SSS) with the CPSS- IOSCO Recommendations for SSS was not within the scope of the FSAP update. The CMA, however, provided a self-assessment of corporate securities based on the recommendations (see Box 5). The legal framework could be improved by the formal inclusion in the law of the concept of netting. Also, the segregation of client money and client assets, which is currently covered by the Authorized Persons Regulation, could be included in the law. Equities transactions are settled on T+0 with the cash leg occurring at the end of the day and the transfer of securities being executed immediately after trade confirmation. Risks in the settlement process are mitigated by the existence of caps and other controls, such as the prohibition of short selling. The CMA, Tadawul and the SAMA are in advanced phase to move towards intra-day settlement based on DVP. Fair and open access to the settlement infrastructure by broker/dealers, in particular those that do not belong to a bank, should be discussed in the context of this reform. Furthermore, the government securities registry might be further integrated through appropriate interfaces with SARIE to facilitate collateralization in the RTGS system, as well as settlement of secondary market transactions, which might favor the development of the secondary market. 38 Table 9. Saudi Arabia: Central Bank Responsibilities in Applying the Core Principles Responsibility A – The central bank should define clearly its payment system objectives and should disclose publicly its role and major policies with respect to systemically important payment systems. The SAMA has played a fundamental catalyst role in the development of a safe and Description efficient payments system in Saudi Arabia. The SAMA has been periodically communicating its objectives with respect to the payment systems. In 1997, the SAMA specified its objectives in the establishment of the SARIE system. Since then, SAMA has also been periodically reviewing the payment systems with the most recent being the IPPS review. The SAMA’s oversight authority is stated in general terms in the central bank charter (Article 3) and banking law (Article 16). However, as mentioned before, the SAMA’s detailed objectives are not specified in the law or regulation. Moreover, the SAMA has not clearly specified its oversight policies in a public document. Assessment Broadly Observed Comments The SAMA’s role in the payment system might be further clarified in an upcoming ministerial decree. In addition, payment system oversight could be also covered by the Payment System Law discussed under CP 1. The SAMA should clarify in detail its policy stance in payment system oversight in a publicly available document, which would expand on the scope of its actions and its plans to achieve its public policy objectives in payment system matters. For example, with regard to policy objectives, the SAMA might want to clarify that its oversight extends beyond the two traditional main objectives of efficiency and reliability of payment systems to a wider set of issues including the promotion of competition in the payment services market and the protection of consumer interests. With regard to the scope of its oversight role, the oversight policy document would explicitly state the SAMA decision to apply its powers over all payments and SSS in the country. The oversight policy document would also cover in detail the SAMA major policies and instruments. Major policies would touch upon the main aspects of payment systems including, risk control, access, governance, transparency, pricing, system reliability and business continuity, efficiency, etc. Instruments would range from moral suasion to on- site inspections, from regulation to cooperation, from sanctions to the direct provision of 39 payment services. Finally, the policy document would elaborate on institutional arrangements and cooperation in the payment system arena (see Responsibility D below). Responsibility B – The central bank should ensure that the system it operates comply with the CPs. Description With respect to oversight of SARIE and other systems operated by the central bank, the SAMA has been applying the CPSIPS at pre-launch stages and post-launch stages to: design, build and, as appropriate, upgrade these systems; develop and refine policies and procedures related to these systems; and conduct periodic assessments to fully understand how payment systems are operating and providing services, and take actions to resolve identified risks. Assessment Observed Comments - Responsibility C – The central bank should oversee observance with the CPs by system it does not operate and it should have the ability to carry out this overnight Description The SAMA owns and operates all the interbank payment systems in Saudi Arabia, and also oversees them. In addition, the SAMA is also overseeing the provision of payment services in the country. The SAMA is setting up a dedicated oversight unit, initially placed within the BTD and is working to equipping it with the proper skills and resources. The principles of separation between payment system operations and oversight is recognized and increasingly operationalized within the SAMA. Assessment Broadly observed Comments The SAMA should accelerate the process of creating a full-fledged oversight unit. Consideration should be given of where to place the new unit within the SAMA organizational chart in order to enhance the visibility of the payment system oversight function both internally and externally. Responsibility D – The central bank, in promoting payment system safety and efficiency through the CPs, should cooperate with other central banks and with any other relevant domestic or foreign authorities. Description The SAMA is the primary overseer of the payment systems in Saudi Arabia. Corporate SSS are supervised by the CMA. 40 The SAMA has periodic high-level interactions with the CMA, including by participating to a joint committee, to which comprises Tadawul, as well. However, there are no formal arrangements in place for co-operative oversight, although an MOU is under discussion. Internally, the SAMA BTD carries out its oversight function in cooperation with the banking supervision and banking inspection departments. Cooperation between authorities and stakeholders in the payment system space is active, as mentioned, and is carried out through a number of technical working groups. However, no NPS/Council committee is established in Saudi Arabia. At the GCC level, the SAMA cooperates actively with other central banks. In the Arab region, the SAMA is an active member of the Committee on Payment Systems of the Arab Central Banks and work with the Arab Monetary Fund, the IMF, and the World Bank under the umbrella of the Arab Payments Initiative. Internationally, the SAMA recently joined the CPSS as member of the payments committee Assessment Broadly observed Comments The SAMA and the CMA are encouraged to finalize their MOU and include specific reference to the areas of joint interaction in the payment and settlement space. Structured cooperation could take the form of joint technical working groups of a permanent nature. The SAMA could also prepare MOU among different departments with a stake in the payment field. An NPS Council/Committee could be constituted as a consultative and cooperative body comprising representatives from relevant all stakeholders to provide an umbrella to the many existing technical committees and enhance the visibility of the topic with the media and the society as a whole. 41 Table 10. Saudi Arabia: Summary Observance of CPSS Core Principles and Central Bank Responsibilities and Suggestions SARIE and Central Bank Responsibilities Assessment grade Principles grouped by assessment grade Count List Observed 8 CP2, CP3, CP4, CP6, CP7, CP8, CP10, Responsibility B Broadly observed 5 CP1, CP9, Responsibilities A, C, D Partially observed - - Non-observed - - Not applicable 1 CP5 Table 11. Saudi Arabia: Recommended Actions to Improve Observance of CPSS Core Principles and Central Bank Responsibilities in Applying the CPs-SARIE Reference principle Recommended actions Legal foundation Although the regulatory framework as defined by SARIE ORR is sound, the lack of a specific payment system law Core principle 1 excluding explicitly any conflict with other laws and regulations can give rise to uncertainty on the legal framework for settlement. The SAMA should start a process that could lead to the enactment of such a law. Understanding and management of Financial risks are properly managed in the SARIE system. risks As liquidity is typically abundant, SARIE participants do not use liquidity facilities extensively. In the medium term, Core principles 2 and 3 some improvements to liquidity management could include less discretionary rules and a more straightforward link between the funds accounts and the securities accounts of banks in order to activate intraday liquidity facilities in a more automatic fashion. Settlement Core principles 4, 5 and 6 Security and operational reliability, and contingency arrangements Core principle 7 Efficiency and practicality of the Operating hours and the daily business cycle were amended in 2006 in cooperation with system participants. It is likely 42 Reference principle Recommended actions system that operating hours might need to be extended and the calendar for settlement of other systems in SARIE Core principle 8 reconsidered in light of technological and business developments. The SAMA is engaged in discussions with commercial banks on this topic. Banks interviewed during the assessment expressed a high level of satisfaction with the services provided by SARIE. It was mentioned that very minor problems have been caused occasionally by data communication delays. The SAMA is working actively to address the issue. The SAMA could also engage in a discussion with participants to verify whether the settlement of a single netting position for all retail systems does not expose these systems to operational spillover effects in the event of problems in one of the clearing processes. Criteria for participation The SAMA should issue a risk-based access policy and disclose its criteria for fair and open access to SARIE by Core principle 9 financial institutions. In this context, possible access by nonbank financial institutions to the SAMA settlement systems should be discussed. Governance of the payment system Core principle 10 Central Bank responsibilities in The SAMA’s role in the payment system might be further applying the CPs clarified in an upcoming ministerial decree. In addition, payment system oversight could be also covered by the Central Bank responsibility A B, C and D Payment System Law discussed under CP 1. The SAMA should clarify in detail its policy stance in payment system oversight in a publicly available document, which would expand on the scope of its actions and its plans to achieve its public policy objectives in payment system matters. The SAMA should accelerate the process of creating a full- fledged oversight unit. Consideration should be given to where to place the new unit within the SAMA in order to enhance the visibility of the payment system oversight function both internally and externally. The SAMA and the CMA are encouraged to finalize their MOU and include specific references to the areas of joint 43 Reference principle Recommended actions interaction in the payments and settlements space. Structured cooperation could take the form of joint technical working groups of a permanent nature. SAMA could also prepare MOU among different departments with a stake in the payments field. An NPS Council/Committee could be constituted as a consultative and cooperative body comprising representatives from relevant stakeholders to provide an umbrella for the many existing technical committees and enhance the visibility of the topic with the media and society as a whole. 44 III. AUTHORITIES’ RESPONSE The authorities have considered the findings of the detailed assessment. In response to SAMA’s initial comments, the assessor:  acknowledged the high level of standardization reached by the Saudi financial market;  highlighted that the Banking Control Law (BCL) provides SAMA with a legal framework for payment systems;  recognized that the level of risk in securities settlement is mitigated by the fact that short- selling is not allowed and stocks are prefunded. Other comments were:  according to SAMA, there is no compelling reason to expand the membership of the SARIE system;  SAMA did not share the assessor’s opinion that the current oversight regulation is not sufficiently detailed for the overseer to fully exert its power; SAMA also did not endorse the recommendation that a specific oversight unit should be created;  SAMA stressed that although they are always looking for opportunities for improvement, they believe the current framework to be the most appropriate for the Saudi market.