Technical Assistance Consultants Final Report

Project Number: TA 4894 November 2009

Islamic Republic of Pakistan: Improving Access to Financial Services Technology Options

(Financed by the Asian Development Bank)

Prepared by FINCON Services Inc.

For Ministry of Finance & State Bank of Pakistan

This consultants report does not necessarily reflect the views of ADB or the Government concerned, and ADB and the Government cannot be held liable for its contents. (For project preparatory technical assistance: All the views expressed herein may not be incorporated into the proposed projects design.

Improving Access to Financial Services in Pakistan

Final Report

Technology Options (VOLUME III)

MINISTRY OF FINANCE GOVERNMENT OF PAKISTAN TA No. 4894-ADB

Submitted by: Fincon Services Inc. Canada

November 2009

ADB TA 4894-PAK: Improving Access to Financial Services ABBREVIATIONS ADB AML/CFT ATM BB BDO CBR CEO CGAP FMFB G-Cash ICT ISO IVR KPI KYC MAC m-banking MCB MFB MFI MoIT MTN NADRA / CNIC PCIDSS PMN POS PTA RPF SBP SIM SLA SMART SMS SRO TPSP UBL USF WIZZIT Asian Development Bank Requirements to ensure anti-money laundering and countering the funding of terrorism Automated Teller Machine Branchless Banking Banco de Oro, Philippines Central Board of Revenue Chief Executive Officer World Bank Consultative Group Assistance Programme First Microfinance Bank Globe Telecom E-payment System, Philippines Information and Communication Technologies International Standards Organization Interactive Voice Relay Key Performance Indicators Know-Your-Customer requirements - Procedures for positive identification of Branchless Banking clients Message Authentication Code Mobile Banking or Branchless Banking MCB Bank Microfinance Banks Microfinance Institutions Ministry of Information Technology MTN Banking South Africa National Database and Registration Authority Payment Card Industry Data Security Standard Pakistan Microfinance Network Point of Sale Device e.g. debit card reader Pakistan Telecommunication Authority Request for Proposal State Bank of Pakistan Smart card inserted inside all GSM phones Service Level Agreement SMART Money Philippines Short Messaging Service Statutory Regulatory Order Third Party Technology Supplier United Bank Ltd Universal Service Fund WIZZIT Branchless Bank South Africa

Final Report

Page 3 of 86

ADB TA 4894-PAK: Improving Access to Financial Services TABLE OF CONTENTS 1. EXECUTIVE SUMMARY........................................................................................ 6 1.1. INTRODUCTION & OVERVIEW ...................................................................... 6 1.2. SITUATION ANALYSIS ................................................................................... 8 1.3. THE BRANCHLESS BANKING REGULATION................................................ 9 1.4. POTENTIAL DEVELOPMENT PATH FOR THE BRANCHLESS BANKING REGULATION ...................................................................................................... 10 1.5. ADVANCING BRANCHLESS BANKING DEVELOPMENT WITHIN THE CURRENT REGULATION .................................................................................... 11 1.6. SUPPORTING ACTIVITIES ........................................................................... 13 2. BACKGROUND.................................................................................................... 14 2.1. PROJECT ACTIVITIES.................................................................................. 14 3. THE BRANCHLESS BANKING REGULATION ................................................... 16 3.1. SUMMARY OF THE REGULATION............................................................... 16 3.2. INTERNATIONAL CONTEXT ........................................................................ 18 3.2.1. Overview................................................................................................................18 3.2.2. Essential lesson from the international cases.........................................................21 4. EXAMPLES OF LOCAL BANK-LED BRANCHLESS BANKING ACTIVITIES...... 23 4.1. MOBILINK GENIE.......................................................................................... 23 4.2. UBL ORION ................................................................................................... 24 4.3. MICROFINANCE BANK ACTIVITIES ............................................................ 25 4.3.1. Tameer Microfinance bank ....................................................................................25 4.3.2. First Microfinance Bank (FMFB)..........................................................................26 5. CURRENT INDUSTRY OPINION ........................................................................ 28 5.1. MOBILE OPERATORS .................................................................................. 28 5.2. COMMERCIAL BANKS.................................................................................. 30 5.3. MICRO-FINANCE BANKS (MFBS) ................................................................ 31 5.4. BRANCHLESS BANKING TECHNOLOGY PROVIDERS .............................. 32 6. PROJECTIONS AND ADVICE REGARDING BRANCHLESS BANKING REGULATION.......................................................................................................... 33 6.1. OVERVIEW.................................................................................................... 33 6.2. POSSIBLE REVISIONS TO THE EXISTING BRANCHLESS BANKING REGULATION ...................................................................................................... 33 6.3. FUTURE DIRECTION OF BRANCHLESS BANKING REGULATION ............ 34 7. ADVANCING BRANCHLESS BANKING DEVELOPMENT WITHIN THE CURRENT BRANCHLESS BANKING REGULATION ............................................. 37 7.1. COMMERCIAL INEVITABILITY VERSUS PILOTING AND DEVELOPMENT ASSISTANCE ....................................................................................................... 37 7.2. ACHIEVING FORWARD MOVEMENT .......................................................... 38 7.3. COMMERCIAL VIABILITY AND SMART SUBSIDY TARGETING ................. 38 7.3.1. Financial sources for the competition ....................................................................39 7.3.2. USF sponsored Branchless Banking project concept and process.........................40 7.3.3. Suggested target subsidy recipients, project size and outcomes............................42 7.4. PROJECT SUPPORT - MOBILE BASED FUND REMITTANCE .................... 42 7.4.1. Basic objectives .....................................................................................................42 7.4.2. Main players...........................................................................................................42 7.4.3. Overview................................................................................................................43 7.4.4. International remittances........................................................................................43

Final Report

Page 4 of 86

ADB TA 4894-PAK: Improving Access to Financial Services 7.4.5. Extending the Reach of Financial Services ...........................................................44 7.4.6. Involving MFBs .....................................................................................................44 7.4.7. Conformance to Regulation ...................................................................................45 7.4.8. Agent Authorization and Capacity Development ..................................................45 7.5. ADDITIONAL PROJECT SUPPORT ACTIVITIES.......................................... 46 7.5.1. Consultancy to assist with feasibility analysis and project specification ..............46 7.5.2. Training and capacity building ..............................................................................47 7.5.3. Service Level Agreements (SLA) / Agency Agreement (AA) ..............................48 7.5.4. Operator/Technology Provider SLAs ....................................................................48 7.5.5. Operator / Agent SLAs ..........................................................................................49 7.5.6. Payment system standardization ............................................................................49 7.5.7. Service and Technological components (for consideration of minimum tax SRO) ..........................................................................................................................................50 8. CONCLUDING REMARKS .................................................................................. 52 8.1 REGULATORY REFINEMENT & DEVELOPMENT ........................................ 53 8.2. PILOTING FOR OPTIMAL AND ACCELERATED BB ROLL-OUT TO UNBANKED AND RURAL AREAS........................................................................ 54 8.3. TECHNICAL ASSISTANCE ........................................................................... 55 ANNEX A1: GUIDELINES FOR SERVICE LEVEL AGREEMENT BETWEEN BANK, OPERATOR AND / OR CUSTOMER....................................................................... 57 ANNEX A2: GUIDELINES FOR SERVICE LEVEL AGREEMENT ........................... 60 ANNEX B: MOST IMPORTANT TECHNICAL STANDARDS................................... 65 ANNEX B1: PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)......................................................................................................................... 65 ANNEX B2: ISO 8583 .............................................................................................. 68 ANNEX B3: MESSAGE AUTHENTICATION CODE (MAC)..................................... 71 ANNEX C: SITUATIONAL ANALYSIS CARRIED OUT DURING FIRST & SECOND INTERIM PERIODS ................................................................................................. 73 ENDNOTES & REFERENCES ................................................................................ 86

Final Report

Page 5 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

1. EXECUTIVE SUMMARY
1.1. INTRODUCTION & OVERVIEW
This Final Report for the Project on Improving Access to Financial Services in Pakistan is the third deliverable in project activities outlined for the Technology Options Component. The report covers details of all project activities completed by the technology consultant over the period from commencement in October 2007 to completion and provides analysis and a summary of outcomes from the project. Objectives for the technology specialist have been to carry out research internationally, and consultations in-country, from which to identify and examine the most feasible models of Branchless Banking (BB) for implementation in Pakistan. Over the course of the project, this task has evolved to be defined within the context of supporting the development and implementation of the Branchless Banking Regulation that was released in draft form in November 2007 and formally issued by the State Bank of Pakistan (SBP) on March 31st, 2008. There are approximately 25 million bank accounts held in Pakistans government and privately owned commercial banks, though the number of individual account holders is less than half of this figure. Of these, it is estimated that less than one third, who are account holders in five banks offering m-banking services, have access to some form of branchless banking. Furthermore, the transaction level of mobile banking is to date generally low until recently representing only 0.01% of all transactions which take place in the country. As well, the current outreach of these services into unbanked rural and low income areas which could most benefit from BB services is minimal. The consultant believes that the SBPs issuance of BB regulation, while representing a relatively conservative Bank-led approach, has contributed to sound and secure market development. Overall, the publishing of clear regulation provides stability. However, there are some aspects where, in the consultants opinion, additional stimulus to help accelerate the pace of roll-out of transformational BB services would be beneficial. Complementing the consultants initial task therefore was an activity focused on identifying and defining various recommendations and measures that would help to accelerate the emergence and development of branchless banking in areas of the country that are unbanked and would benefit from its successful roll-out. The consultant developed nine recommendations or specific measures, which are all described in or attached to this Final Report. These comprise the following:

Final Report

Page 6 of 86

ADB TA 4894-PAK: Improving Access to Financial Services 1. The existing BB Regulation - Recommendation on a minor adjustment to the final BB Regulation as issued, dealing with the KYC measures enacted for sign-up of new customers. The object is to enable greater flexibility for BB service providers in the precise methodology chosen to meet the AML/CFT requirements of the SBP; 2. Future BB Regulation - Guidance on implementation of future BB regulation, as the next step to facilitating greater freedom in the participation of non-bank entities in BB. This would include the allowance of some form of e-money account for very low level banking (i.e., stored value accounts that are less than full bank accounts) which are often part of successful BB services internationally; 3. Telecommunications Regulation - Recommendation on a revision to the Telecommunications Regulation on Branchless Banking that was issued by the Ministry of Information Technology (MoIT), through the Telecommunications Regulatory Authority), in order to remove or lighten a case of double regulation on telecom operators related to interconnection and inter-operability of BB systems; 4. Pilot Project - A detailed conceptual design for the piloting the rural outreach of one or more commercial Branchless Banking initiatives through a smart subsidy competition that would demonstrative the feasibility of Branchless Banking being implemented and having a transformative impact beyond the natural boundaries of the already banked urban population; 5. BB User Application - Description of a fund remittance component for the pilot project that would enable an application with very high demand and utility for rural users; 6. Technical Assistance on Pilot implementation Development of the terms of reference, specifications and implementation of the pilot project; 7. Technical assistance to provide capacity building Focusing on key target operating entities/partnerships (e.g., micro-finance banks and telecom operators) which are ready for BB short-term implementation. These measures would be in the areas of management and staff development; BB agent training; focused market study; preparation of promotion and marketing materials and user guides; 8. BB Service level Agreements - Guidelines and template for service level agreements between bank, telecom operator and/or agents or users (attached as Annex A); and 9. Technical standards on system and inter-operability and security an outline of the three most relevant and recommended standards to be followed and specified in Pakistan (attached as Annex B), namely: Payment Card Industry Data Security Standard (PCIDSS); Standard

Final Report

Page 7 of 86

ADB TA 4894-PAK: Improving Access to Financial Services for Financial Transaction Card originated Messages (ISO8583); and Message Authentication Codes (MAC). All of these were identified at the time of the 2nd Interim Report and were discussed with members of the Project Steering Group (namely in SBP and MoIT) and with industry stakeholders. The measures received broad support, while some were agreed for implementation in a slightly modified fashion than originally conceived. It is worth noting that after a slow start following the issuance of BPs BB Regulation in March 2008, the banking and telecom industry were finally making moves to commence implementation of new BB services in Q1 and Q2 2009, and the pace of service roll-out of the earliest new entrant is rapid. The Consultant has made recommendations which have already contributed to progress. It is also recognized that some of the recommendations can afford to be implemented in a measured and patient way, as and when judged necessary. On the other hand, some (such as the technical assistance recommendations) are, in the professional judgement of the Consultant, important to further development. Some are already useful since they are in the form of guidance, whereas some (such as the capacity building measures) should be treated as requiring a response and action from the Steering Committee and ADB. While all of the above thus remain as primary recommendations and/or outputs from the consultancy, they are presented in this Final Report together with some comments, as appropriate, as to how they could or should be implemented.

1.2. SITUATION ANALYSIS

Key industry stakeholders, including banks, mobile operators and third party technology providers were contacted three times during the course of the consultancy. These occasions were November 2007, August 2008 and December 2008. Discussions centred progressively on their views regarding the technological and commercial aspects of m-banking (i.e., branchless banking) on the draft and final Branchless Banking regulation, and on their possible intentions in the Branchless Banking field and related matters. All mobile operators contacted expressed strong interest in pursuing a Branchless Banking initiative with a financial partner in accordance with the Regulation which dictates a bank-led approach. While several also expressed concerns with the regulation which, in their opinion, did not fully recognize the market risk (as opposed to the prudential risk) that they would be expected to bear. Clearly, there were some factors holding back the mobile operators from rapid investment in BB, even though at least two of the operators have now made moves to invest in some form of BB initiative.

Final Report

Page 8 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Microfinance banks such as Tameer and First Microfinance Banks are keen to lead or to participate in piloting activities especially in agent capacity development in current Branchless Banking initiatives in the use of Point of Sale (POS) machines and mobile ATMs. In addition, the mobile operator Telenor has taken a controlling interest in Tameer, ostensibly for the purpose of entering into the BB field in accordance with the BB Regulation. In addition to the SBP, the Ministry of Information Technology, as the policy making body for telecommunications, and the Pakistan Telecommunication Authority (PTA), have taken steps to provide a regulatory framework, which is generally positive except for one area prescribing enforced interconnection, which the mobile operators consider to be a double regulatory burden, and to which the consultant, following discussion with MoIT and PTA has recommended a revision. The detailed situational analysis carried out during first and second interim period is placed at Annex C.

1.3. THE BRANCHLESS BANKING REGULATION

Following the issuance of the Draft Guidelines on Branchless Banking in November 2007, the SBP undertook a consultation process with the banking and telecommunications industries. The Draft Guidelines had highlighted a number of AML/CFT security risks from which it had determined the degree of regulation required. Having considered the viewpoints, concerns and inputs of many, the SBPs March 31st Regulation has established a sound and relatively risk-free framework for the start-up of Branchless Banking activities in Pakistan under a range of permissible bank-led models. The regulation outlines clear rules for risk-based customer due diligence, as well as delineating the roles and responsibilities of key of bank officials within any financial institution taking responsibility for branchless banking. However, the regulation allows for the use of banking agents, which could be a wide range of corporate or individual entities and also managed by telecom operators so long as the AML/CFT requirements are strictly met under the terms of a strong agency agreement. The regulation further outlines the potential role of third party technology suppliers and lays out in detail the requirements for customer protection and awareness, as well as Branchless Banking procedures. On balance the Consultant supports the need for regulation which places banks in the critical role of responsibility for Branchless Banking transactions. The Consultant also highlights the fact that in the vast majority of international cases, considered to be leading examples of branchless banking, although the energy and market leadership usually comes from telecom operators, a banking partner invariably plays the key role of account hosting and financial management. Of six leading international cases studied in detail, one was initiated entirely by a bank, while all of the remainder were initiatives of telecom operators and all but one have a bank in the critical role of meeting

Final Report

Page 9 of 86

ADB TA 4894-PAK: Improving Access to Financial Services the AML/CFT requirements of their respective central banks. It is argued that at least three of these cases could meet the requirements of the BB Regulation, with the relevant agency agreements in place, and thus be labelled as bank-led even though the banks were not necessarily prominent in the start-up and marketing of the service. In the light of this, it is important to note that market and brand leadership (most often carried by the telecom operator) should not be confused with process and regulatory conformance. The key lesson is to encourage (and not to hinder) the evolution of BB models to take place with whatever face or marketing approach the telecom banking partnership would like to use, provided the risk-based customer due diligence, relevant KYC requirements and AML/CFT controls are in place and vetted by the banking partner, either directly or through a tight agency agreement. The Consultant points out that the strongly bank-centric, as well as bank-led, approach taken by the BB Regulation will most likely result in relatively slow and measured BB development. During the final consultant mission in December 2008, it was clear that the telecom operators, whose role is critical to the success of BB roll-out into unbanked and rural territory, were still positioning themselves and seeking to negotiate favourable strategic and revenue sharing arrangements with leading commercial and microfinance banks though, as noted, one has taken the bold step of acquiring a controlling interest in an MFB for this purpose.

1.4. POTENTIAL DEVELOPMENT PATH BRANCHLESS BANKING REGULATION

FOR

THE

Existing regulation - While generally supporting the BB regulation, the Consultant believes that the first and only revision that is pressing on the existing Branchless Banking Regulation is to make an adjustment to the Level 1 entry conditions (KYC requirements), to be better adapted to the realities of small, remote communities and remote transactions. Assuming such applications will be conducted by agents, remote from the physical reach of direct bank employees, the required conditions could make better use of existing technological capacity. This could, in the Consultants view, involve some minor revision to the current Level 1 KYC / entry requirements. Specifically, it is not unusual for agents in other Branchless Banking cases internationally to be able to open customer accounts without the customer physically filling out a form or having a face-to-face contact with a designated employee of the financial institution as the Regulation states, but for the transaction still to have a good level of control. A strong example of how this is successfully being implemented by a leading example in South Africa is discussed in the report.

Final Report

Page 10 of 86

ADB TA 4894-PAK: Improving Access to Financial Services After discussion with SBP on this matter, the consultant understands that SBP will, on a case by case basis, consider all reasonable operational and technical proposals on this matter from banks and/or bank-operator partnerships, provided they meet the KYC requirements of the bank or banking partner. Future regulation - The shape of future regulation (i.e., the next phase) should include consideration of the following, in the Consultants view: (i) Set and clarify legal boundaries between e-money, retail payments and related stored-value accounts and allow non-bank participation under defined terms, to be evolved, with possible revision of relevant draft legislation, discussed in the report, if necessary. While the Consultant has noted that almost all international BB cases involve a bank-telecom operator partnership with the bank playing the key security and accounting role, it is also true that several cases allow the lowest introductory form of BB account (i.e., with the lowest deposit and daily transaction limits) to be a form of stored value e-money account that does not require a formal bank account to be held by the user; (ii) Permit non-bank entities, especially those who have the credibility and security of having a banking partner in their Branchless Banking service (which is demonstrated to be the international norm) and who demonstrate responsibility in their own KYC practices, to be able to offer a stored value account (e-money account) which does not necessarily involve customers having to have a direct contractual relationship with any bank. Several of the best international examples offer such a start-up option, while allowing customers to graduate to a full bank account when they wish, under relevant terms and conditions. (iii) Consider the addition of a new Level 0 which would reflect the suggestions in (ii) above and (iv), or adjust level 1 to have some more permissive conditions (new Level 0 is preferred). (iv) Evolve appropriate regulations which reflect the reality of the future direction of Branchless Banking, while ensuring that the non-bank entities i.e., telecom operator and/or secondary agency manager fully meet the KYC due diligence and required AML/CFT standards. It is clear in the cases of G-Cash (Philippines) and M-Pesa (supported by the Telecom giant Vodaphone) that their Central Banks have evolved regulatory Circulars for non-bank entities to fully satisfy AML/CFT requirements that are reasonable and proportional to the need.

1.5. ADVANCING BRANCHLESS BANKING DEVELOPMENT WITHIN THE CURRENT REGULATION

Given the new conditions pertaining since issuance of the Branchless Banking Regulation, in which the entry of banks and telecom operators into the Branchless Banking arena is going ahead through only tentative though
Final Report Page 11 of 86

ADB TA 4894-PAK: Improving Access to Financial Services definite steps at the moment, the Consultant has developed a proposed approach for piloting and assistance within the accepted Branchless Banking Regulatory framework, with the following objectives: 1. 2. Encourage accelerated entry to Branchless Banking / m-banking by both banks and MFBs; Expand the frontiers of current reach, to the outreach target clientele, i.e., the unbanked and rural areas, and products of interest to the rural population; Facilitate bank operator joint venturing and partnership, which is an essential ingredient; Build experience and maturity (SBPs objective) in order to accelerate also the eventual expansion into new acceptable models (i.e., to nonbank led models) in a more liberal regulatory future.

3. 4.

A pilot concept with supporting initiatives has been proposed, combining all of the above elements, by including a mandatory rural expansion, bank telecom operator partnership, but also majoring on products of specific interest to rural clientele, such as small scale savings and payments (Level 1) and remittances, by means of an m-banking platform. The proposal recommends that the SBP, in partnership with a funding agency, should offer financial support to accelerate commercial entry into Branchless Banking / m-banking with specified products, applications and performance targets, through a subsidy competition. Banks and telecom operators would be invited to bid for one or more packages of subsidy / support against a specification that seeks out one or two best-case proposals from the industry, with good medium to long term prospects for success. The Consultant has proposed that SBP approach Pakistans Universal Service Fund (USF) to support the pilot concept, since it has several very significant advantages and could potentially bring rapid movement. The advantages include, but are not limited to, the facts that: (i) The USF has been established by the Ministry of IT to spread the benefits of the telecom revolution to all corners of Pakistan, to promote development of telecommunication services in un-served and underserved areas, and to make available services to progressively greater proportions of the country's population. The USF has more than sufficient financial resources available built up over the last two years by levying 1.5 percent of the revenues of licensed operators in the telecommunications sector, and has a

(ii)

Final Report

Page 12 of 86

ADB TA 4894-PAK: Improving Access to Financial Services successful track record of holding least subsidy tender competitions for network roll-out and ICT services into rural areas; and (iii) The USF has a Special Projects category into which various ICT services and applications are supported, which could include ecommerce and m-banking applications.

The Consultant met with the CEO of the USF Company to present the concept of supporting one or more Branchless Banking / m-Banking pilots. The CEO showed interest and suggested that the USFs Board of Directors would probably consider the proposal favourably if a formal approach was made by SBP. However, the CEO also expressed the view that the USF would most likely prefer to consider the proposal, as an investment focused on transformative BB operations in rural areas, after seeing a BB initiative already introduced into the urban market place and building up a successful track record there over several months. In view of this and in view of the consultants assessment that up to three banks and operators are already planning to commence BB operations in Q1/Q2 2009, it was concluded to hold the USF based pilot back, but as an initiative ready for implementation later in 2009 if required in order to increase geographical and socio-economic outreach, assuming initial commercial steps are taken by banking and telecom operators, as expected, early in the year. The purpose of a delay therefore is to allow the industry players first to start up their BB initiatives and then for SBP (and possibly the Consultant) to monitor the need for intervention to accelerate progress of the services into unbanked and rural territory.

1.6. SUPPORTING ACTIVITIES

The report also includes several activities in support of the pilot concept and growth of BB generally which will provide, among other things, the pilot project development, training and capacity building, and assistance with Service Level Agreements and Service Agreements as well as technological advice. These measures were listed in Section 1.1 and guidance are provided on both of these in Annexes A and B respectively.

Final Report

Page 13 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

2. BACKGROUND
2.1. PROJECT ACTIVITIES
Following issuance of the Draft Guidelines on Branchless Banking in November 2007, the SBP undertook consultations with the banking and telecom and technology industries and, as noted above, subsequently issued a Branchless Banking Regulation on March 31st, 2008. During the period since commencement of the project (October 2007 to the present), the technology consultant has conferred three times with the SBP, the Ministry of Information Technology (MoIT), the Pakistan Telecommunications Authority (the regulator) as well as with the leading players in the financial, telecom and technology industries, in order to understand all issues relative to the development of Branchless Banking in Pakistan. The consultant has also researched world experience in Branchless Banking and consulted a wide range of reports and other sources on the subject. A summary of the most relevant international cases of BB services is provided in the tables of Section 3.2. The consultants first visit to Pakistan was in November 2007. During the August 2008 second visit, the Consultants discussions with representative banks, mobile operators and third party technology providers focussed on understanding their views of the regulation on Branchless Banking, to understand any remaining hurdles they foresaw, to discuss their possible intentions in the Branchless Banking field, and what assistance, if any, they view as being necessary. All had previously been interviewed in November 2007, following the release of Draft Guidelines on Branchless Banking. A summary of the experience gained by domestic banks and telecom service providers related to m-banking and branchless banking is provided in Section 4. During the third visit, the Consultant held discussions with SBP and MoIT regarding preliminary conclusions and recommendations made in the Second Interim Report issued on October 2008. The Consultant also met with the market players again and focused on their current plans with respect to the introduction of BB initiatives and/or need to external support for piloting in rural areas, agent training, etc. This final report brings together the findings of the investigations and analysis of all previous reports and builds on the content and discussion of the 2nd

Final Report

Page 14 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Interim Report dated October 2008. It now reflects a more finalized understanding of the situation which pertains almost one year since issuance of the final SBP Branchless Banking Regulation and following more extensive discussions with the industry representatives and with SBPs Banking Policy & Regulations, Microfinance and Information Technology Departments key office bearers.

Final Report

Page 15 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

3. THE BRANCHLESS BANKING REGULATION

3.1. SUMMARY OF THE REGULATION
The Draft Guidelines issued in November 2007 had highlighted a number of AML/CFT security risks from which it had determined the degree of regulation required. Having considered the viewpoints, concerns and inputs of many through its consultation with the banking and telecommunications industry, the SBPs March 31st Regulation incorporates several adjustments that had been highlighted by others as necessary, while keeping to the essential bank-led model that was presented in the Draft Guidelines. The regulation establishes a sound and relatively risk-free framework for the start-up of Branchless Banking activities in Pakistan under a range of permissible bank-led models that describe the relationship between banks and telecom operators, namely: One-to one (exclusively between one bank and one telecom operator); One-to-many (one bank offering Branchless Banking services via any number of telecom operators); and Many-to many (several or all telecom operators offer access to the financial services of any bank).

From a regulatory perspective, it has to be pointed out that the SBP has taken a position that both reflects international experience and is relatively riskaverse. It is an additive approach to Branchless Banking regulation, as apposed to a more radical and transformational approach that is advocated by some i . In reality, the regulation is a hybrid which goes well beyond an additive approach through the facilitation of agency agreements. The regulation outlines clear rules for risk-based customer due diligence, at three different levels which are defined by transaction and account size as well as by the level of due diligence and security measures required to be undertaken by the financial institutions. As well, the Regulation delineates the roles and responsibilities of key of officials within any financial institution (FI) taking responsibility for Branchless Banking initiatives. However, the regulation allows for the use of banking agents, which could be comprised of a wide range of corporate or individual entities and also managed by telecom operators, so long as the AML/CFT requirements are strictly met under the terms of a super agency agreement. Whether through an agency, or even a joint venture agreement which is also allowed, this could thus go a long way towards a more transformational approach, with a telecom operator through its offices and distributors managing a whole Branchless

Final Report

Page 16 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Banking agency network, though under the control and responsibility of the bank taking final responsibility and authority. The SBP Regulation further outlines the potential role of third party technology suppliers and lays out in detail the requirements for customer protection and awareness, as well as Branchless Banking procedures. On balance, the Consultant accepts and supports the need for regulation that places banks in the critical role of responsibility for Branchless Banking transactions, at least for the first phase of Branchless Banking market development in the country. The next section also demonstrates that of the six international examples cited as leading cases (among an increasing number worldwide), four have the critical involvement of banks in a form that, in the Consultants opinion, render the case either as bank-led or capable of conforming to the AML/CFT protection principles espoused by the March 31st Branchless Banking Regulation. However, there are a few challenges, or drawbacks, with a heavily bank-led or bank-centric approach, which is what the Regulation represents. These are described below in logical and progressive order, to indicate the strategic nature of the issues: By placing banks heavily in the lead player role, even though there is room for Telecom Operator partnership, there is a form of imbalance that will slow down the pace of Branchless Banking development in Pakistan. Because banks are naturally more risk-averse, while also being more experienced regarding AML/CFT, they do not necessarily share the energy and motivation that the telecom operators do for marketing Branchless Banking services in rural areas. The telecom operators see Branchless Banking as a key opportunity for market differentiation and revenue generation in marginal areas. This is evidenced by the fact that the vast majority of Branchless Banking initiatives worldwide have been energized by telecom operators, even where a bank has the critical role to host the account transactions, However, because the banks are explicitly placed in the lead role by the Branchless Banking Regulation, they have received a negotiating advantage with telecom operators, who they generally need for effective Branchless Banking roll-out into unbanked territory. Telecom operators therefore have no choice but to secure an agreement which, the Consultant understands from discussions held, are weighted in the favour of the banks. They are able to use their negotiating position bequeathed by the Regulation to retain or demand more of the

Final Report

Page 17 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Branchless Banking value chain than is warranted by the relative amount of marketing risk they would bear vis--vis the operators. A few aspects of the Regulation, and associated telecom regulation, which appear at first to be minor, may also mitigate against speedy and effective roll-out with the active involvement of the telecom operators, without adding appreciably to the AML/CFT security. One example of this is the specific KYC documentation required by the Regulation at the Level 1 entry point (signing up new account holders). The possibility for simplification is discussed in Section 5.2.

3.2. INTERNATIONAL CONTEXT

3.2.1. Overview The previous consulting reports reviewed a large number of international examples of branchless banking. A variety of systems are utilized internationally, with variations depending on IT platforms, the management of currency, customer-sponsor interaction and presentation of services. At their core, each system provides a number of financial services that include the following: Fund deposits and withdrawal transactions, also known as Cashin/Cash-out functionality; Account information on such items as balances, transactions, account status and history of account activities; Payments involving transfer of funds for services such as utility bills, airtime credits and even an assortment of vending devices. Financial transfers that include moving funds to different accounts or people, or the receipt of remittances from abroad;

With similar challenges of large territories, difficult geography and socioeconomic constraints, Branchless Banking models from Africa and South East Asia (in particular, the Philippines) are particularly relevant to implementation and business models under consideration in Pakistan. A total of seven well-known cases were considered as having a demonstrable track record, a body of descriptive information, and containing features relevant to the Pakistan environment. Six of these involve both banks and telecom operators and were studied more closely. The SMART Money and G-Cash cases in Philippines, MTN Banking in South Africa, M-Pesa in Kenya ii , and Celpay in Zambia were selected because they have a relationship between bank and telecom operators, while WIZZIT of South Africa is especially relevant to

Final Report

Page 18 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Branchless Banking activities based on debit cards with settlements carried out via ATMs or agents equipped with POS machines. Tameer Microfinance Bank has been involved in piloting of both POS and ATM approaches to Branchless Banking, while the United Bank Limited (UBL) and Mobilink have some experience in limited forms of Branchless Banking or mobile banking (m-banking) in Pakistan. Figure 2-1 places these cases within in a spectrum of relevance for consideration in the Pakistan regulatory context. It will be noted that the three player categories operators, ATM or credit cards, and banks are shown in the diagram, with the specific international and Pakistani examples placed to show their position within the Pakistan Branchless Banking spectrum. Figure 2-1: International and Pakistan BB l
Most relevant to BB / m-Banking & BBRs

Operators Cards Banks

International Pakistan

Brazil

South Africa UBL

Orion

Other Africa Mobilink

Genie

Philippines
G-Cash

Caixa Economica WIZZIT MTN Banking M-PESA Celpay SMART Money

Tameer

FMFB (AKFED)
M-PESA

o It is clear that the five models with most relevance to Pakistan under the current Branchless Banking Regulation are WIZZIT, MTN Banking, M-Pesa, Celpay and SMART Money. Various key features of these, plus G-Cash, are summarized in Table 2-1 below. The right hand column indicates which models appear to be capable of meeting the requirements of the Branchless Banking Regulation, as currently exists, given joint venture or acceptable agency agreements in place.
Table 2-1: Features of most relevant international cases
SMART Money G-Cash MTN Banking Philippines Philippines South Africa Telecom Telecom Telecom Bank-led Telecom Bank-led Agents or Bank Telecom Office or Agents Agents or bank Bank or ATM Easy Pay pay points Master card No Master card Country Driver AML/ CFT Account opening Cash In Cash Out ATM Card Model (M= many) 1 -1 M-1 1 -1 Can Meet BBR

Final Report

Page 19 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ATMs WIZZIT M-Pesa South Africa Kenya Bank Telecom Bank-led Bank-led Agents or bank Telecom office or agent Telecom or agents Bank branch Agents Master card No 1M M-1

POS at agent locations Bank + N/A Bank + N/A

Celpay

Zambia, DRC

Telecom

Bank-led

N/A

M1

N/A

Although only WIZZIT could be stated to have been initiated entirely from a bank, all of the above cases except G-Cash have a bank in a critical role which meets the AML/CFT requirements of their respective central banks iii . The following two tables provide an overview of the two key models which are operator driven though with bank-led features that could meet the principles of the Branchless Banking regulation. Table 2-2: SMART MONEY Philippines Vision and marketing Banking partner Service levels SMART Communications Banco de Oro (BDO) - Retail bank with full range of cash and debit card services 1. SMART Money (Mobile) Account 2. Normal Bank Account At agent locations but limited to US$ 950 Similar to Pakistan BB Regulation

Account opening KYC for account opening Transaction hosting & All SMART Money transactions made & held within control the BDO system Management, account security, etc. under its normal banking license BDO Takes full responsibility for audit, fraud, liquidity & security of SMART Money Central Bank Service operates entirely within the limits of the regulation Central Banks jurisdiction Agency 12,000 accredited retail agents perform cash-in / arrangements cash-out functions Platform technology Encrypted SMS, TPS Interface & BDO Transaction Platform Telecom Operator SMART receives its income mainly from the SMS Financial interest charge levied for the transaction, with some exceptions Table 2-3: MTN Banking South Africa Vision and marketing Banking partner MTN (Largest Mobile Operator in Africa) Standard Bank MTN Banking is a 50/50 joint venture between operator and bank

Final Report

Page 20 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Central Bank regulation Service levels Service operates entirely under Standard Banks licence as a Division Mobile banking account integrated with other banking products, account holders receive a bank card. Account opening Performed by agents, supervised and vetted by KYC Dept. of Standard Bank KYC for account Standard Banks KYC Dept. performs real-time photo opening and national database access electronically, based on files sent from the agent Transaction hosting & Standard Bank control Agency Accredited retail agents perform account opening arrangements functions with real-time support and decision making with Standard Bank KYC dept. Platform technology Supplied by Fundamo Inc., outsourced from Standard Bank. Enhanced SIM based (SIM Toolkit) Platform can support SIM browsers, WAP, USSD, Java and structured SMS. Telecom Operator 50% JV partner and thus shares in the business, Financial interest additional to SMS traffic 3.2.2. Essential lesson from the international cases Various lessons were highlight in previous reports. However, the essential lesson to consider within the current context where the Branchless Banking Regulation has already been approved is the following: The majority of Branchless Banking cases internationally, as best exemplified and represented by the SMART Money and MTN Banking cases, have been the result of telecom operator vision, energized by the market motivation of mobile operators. The majority of cases also have a solid banking partner responsible for the transaction hosting, account security, fraud control and banking liquidity. Whereas the bank has usually played a silent or less prominent role, the Branchless Banking initiative has been operated under the banks financial institution licence. In principle therefore, these cases could be understood as meeting the regulatory requirements of being bank-led models, even though the initiatives were clearly telecom operator energized. There can be a range of market / financial risk-taking and value chain participation in the banking business (i.e., risk-reward models). The two cases illustrated by Tables 2-2 and 2-3 show two extremes. In the one case, SMART Telecoms motivation was almost entirely to achieve market differentiation through offering an m-banking product to rural customers and also to
Page 21 of 86

Final Report

ADB TA 4894-PAK: Improving Access to Financial Services increase SMS traffic (while leaving the banking revenues to the banking partner); in the second case, MTN appears to have wanted to have part of the banking business through a 50/50 joint venture ownership. The consensus in Pakistan, which has become a very competitive and low margin telecom market, is that the operators generally wish to participate in the banking business and not be relegated to being satisfied as merely communication channel providers. This is a rational and reasonable position for the Pakistan market, which will also contain considerable risk by them for Branchless Banking rollout. In the light of the above, it is important to note that market and brand leadership (most often carried by the telecom operator) should not be confused with process and regulatory conformance. Thus the application of Pakistans Branchless Banking Regulation would be best performed with a light hand on ownership of the business, so long as the regulatory principles are kept. In this way, it is possible that the impact on the market place (pace of growth) could be more positive than if the SBP sought strict adherence to the concept of having banks front and centre. The key lesson is to encourage (and not to hinder) the evolution of Branchless Banking models to take place with whatever face the telecom banking partnership would like to use, provided the risk-based customer due diligence, relevant KYC requirements and AML/CFT controls are in place and vetted by the banking partner, either directly or through a tight super-agency agreement.

Final Report

Page 22 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

4. EXAMPLES OF LOCAL BANK-LED BRANCHLESS BANKING ACTIVITIES

During the two in-country investigations, a number of Branchless Banking initiatives were identified and discussed with stakeholders; these are examples of current services that had proceeded or at least been planned prior to the finalization of the Branchless Banking Regulation.

4.1. MOBILINK GENIE

Mobilink was one of the first telecom operators in Pakistan to launch financial services via mobile phones in collaboration with partners KASB Bank, Atlas Bank and the Citibank credit card service. Mobilink Genie is a Mobilink network specific application where bank and credit card customers can use their mobile phones to make bill payments, conduct account to account transfers, and purchase mobile airtime credits for a transaction cost of approximately 20 rupees per transaction. The financial services are hosted by the banking partners; the current four partners are KASB Bank, Citibank, Atlas Bank and Adamjee Insurance. It is understood that UBL and HBL also plan to become hosts of the service. However, to date the customer base of the partner banks as a percentage of total accounts in the Pakistan banking system is very small. Genie was launched in July 2008 (ahead of the final BB Regulation). It has the following features: Platform offers payment options to existing account holders of participating banks; Account sign-ups are handled through the KYC of the participating banks; All account platforms are those of the banks; The Genie platform is a Java based communications channel interface It does not fall under the objectives of branchless banking, though it has some similarities with the international cases MTN Banking & Celpay.

The application is encoded in a special SIM chip that is provided with password protection to customers for installation on their mobile phones. The service is bank-led in that risks associated with cash handling are assumed by the financial partners. Because it is nevertheless an initiative of Mobilink, it is a many-to-one model and does not fit with the SBP Branchless Banking regulation in more ways than one, although neither is it, in the opinion of the Consultant, conflicting with the Branchless Banking Regulation since its objectives are limited to existing customers, nor does it permit cash-in / cashout facilities nor deposit acceptance through the extensive network of Mobilink agents because they lack required authorization as banking agents. Hence it

Final Report

Page 23 of 86

ADB TA 4894-PAK: Improving Access to Financial Services is not fulfilling any vision of reaching beyond the urban base of the participating banks. Money deposits can be completed at bank branches and as credit card payment. The most recent review of Mobilinks website (October 2009) indicates that Genie is to date still the companys only active mobile banking initiative.

4.2. UBL ORION

UBLs Orion is another example of a bank-led approach, but it is operatorneutral (one to many); transactions can be processed over any GSM mobile phone network. Orion was launched in the first half of 2007, ahead of the BB regulation. Touted as a mobile wallet, the system does not require a special SIM to operate but rather uses SMS text messages and IVR voice responses of a centralized information processing centre at UBL to make and confirm limited financial transactions, including deposits, money transfers between accounts and UBL mobile wallets, and branch withdrawals. In summary, the Orion Mobile Wallet has the following features: A one-to-many service managed exclusively for UBL account holders; SMS based, available to subscribers of any mobile service; Sign-up by SMS, linked to UBL account, though the Mobile Wallet is a separate service; Cash-in / out are using conventional ATMs

Users without UBL accounts can make deposits, accept transfers and withdraw funds from Orion users with accounts, but non-account holders must conduct the transactions at UBL branches and are required to register with identification; which can be as simple as entering their national ID number with SMS commands on a mobile. The service is also interconnected with UBLs online internet banking and other money transfer services, enabling international remittances to be sent to an Orion account. Features of this service have resulted in UBLs handling of 10-15% of all remittance transfers to Pakistan. It is also worth noting that UBL, with approximately 1,045 branches, represents perhaps 15% of Pakistans banking customer base 2 .

Data on actual accounts or account holders was unavailable at report completion.

Final Report

Page 24 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

4.3. MICROFINANCE BANK ACTIVITIES

4.3.1. Tameer Microfinance bank Tameer MFB has collaborated with a third-party technology provider, the Karachi-based Access Group, to develop a debit-card type application in which customers are served via a large network of branchless merchants (banking agents) equipped with on-line POS machines. In the early stages, clients have to apply and verify their identity at regional Tameer service centres to become participants in the microfinance program, before an account is opened and banking card issued. Clients can then go to any participating merchant (banking agent) and use the card to carry out transactions, that include account deposits, payments for goods or utilities, limited cash withdrawal, and repayment of their microfinance loans, by swiping the POS, providing a security PIN and selecting options that provide real-time processing and verification of transactions. This Branchless Banking approach involves a significant investment and operating costs that necessitate piloting and phased approaches to development, but it has the potential to reach a very large number of unbanked clients. In August 2008 Tameer reported that its POS network has been completely launched with several application modules including interbank transfers and domestic POS to POS remittances with mobile SMS notification. In August, Tameer also had 29 branches plus 22 service centres, which are typically 20 km from the nearest branch. By end of 2008, Tameer expects to have 32 branches and 40 service centres. It has placed 33 POS machines, including 8 mobile ones. In December 2008, it was learned that Tameer had received an investment from the telecommunications operator Telenor amounting to a 51% controlling interest in, ostensibly for the purpose of the two being able to roll out, in partnership, a BB initiative which meets the requirements of the BB Regulation. It was further understood that Telenor/Tameer has made application to SBP for a co-branded initiative and has received an in-principle approval to proceed. An August 2009 Press release states that the initiative is expected to launch soon, while Telenor has very recently announced the launch of this new joint product branded as Telenor EP on 15th October. Both companies have indicated that their interests extend to rural areas of the country. Even though Tameer is the least rural of the MFBs, Telenors system coverage and agent network extend deep into rural territories nation-wide.

Final Report

Page 25 of 86

ADB TA 4894-PAK: Improving Access to Financial Services After Tameer Bank determined that the use of mobile banking would be the most effective method to reach rural clients, they reached an agreement with telecom operator Telenor. Tameer wanted the service to be co-branded with Telenor, in order to be able to reach out to 18+ million of Telenors subscribers who are not Tameer clients. After starting to work with Tameer, Telenor in turn saw the benefits of holding a bank licence in order to facilitate the development of their branchless banking vision. The mobile banking model being pursued by Tameer and Telenor will involve Telenors franchisees and retailers acting as trained banking service agents. Both Telenor and Tameer expressed an interest in receiving technical and financial support. This would take the form of both the USF based pilot for rural roll out discussed in Section 7.3, as well as support for agent training and various other requirements they have, discussed in Section 7.5. 4.3.2. First Microfinance Bank (FMFB) FMFB is associated with the Agha Khan Development Network (AKDN). It provides a variety of microfinance services such as savings; remittance and loan products that are typically group-based and that include health, education, housing and home improvement loans. Future products include loans for housing construction. To receive services, clients sign up for accounts at regional FMFB offices or via mobile van branches and are required to have only national identification cards (NIC) for verification. By using service desks instead of branches, FMFB is able to reduce the cost of service delivery, provide more local outlets, and increase client access, which would otherwise be possible only through traditional branches located in regional centres. FMFB has grown by over 50 percent over the last year and reported having 158,000 active borrowers in August 2008 and approximately 200,000 in December. The approach used by FMFB to now expand more into rural areas has been to conclude an agreement with Pakistan Post Office to place service desks housed in postal offices, and to use mobile banking vans. FMFB had a total of 83 branches in August 2008; including 28 rural post offices based branches and had expanded on this number by December. FMFB has also commenced to link up its branches through a VSAT satellite network. 29 are currently linked. It also has developed an open source JAVA based quasi-online replicated and updatable (noncentralized) accounting platform, using the same software as AKDN. All local branch transactions are carried out locally on line, while a

Final Report

Page 26 of 86

ADB TA 4894-PAK: Improving Access to Financial Services centralized database updates communications network. itself periodically through the

Concurrent work related to FMFB is in piloting a telecom operator-led mobile phone Branchless Banking application tested out in Afghanistan, which is similar to the M-PESA initiative in Kenya. Afghan telecom operator Roshan and First MFB Afghanistan are adapting a common MIS system to manage e-money credits that are stored on mobile phone accounts and available for customers to make payments, transfer funds, and make deposits and withdraws in cash via a large network of Roshan agents. This work is providing an invaluable regional test of risks and viability of a model that is being considered for application in Pakistan. In the meantime, FMFB is also in discussion with local telecom operators regarding the possibilities for launch of a Branchless Banking initiative. FMFB believes that its agreement with the Pakistan Post Office should place it in a good position for developing an agency model, in collaboration with a telecom operator that could meet the requirements of the Branchless Banking Regulation. However, it is recognized that more work needs to be done to develop the agency model and FMFB believes that the Pakistan Microfinance Network (PMN) could have an important role to play in facilitating such a model; that several microfinance banks might be able to use.

Final Report

Page 27 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

5. CURRENT INDUSTRY OPINION

5.1. MOBILE OPERATORS
Contrary to the international case of SMART Telecom in the Philippines, which was satisfied with an increased SMS traffic business case from Branchless Banking operations, most operators in Pakistan view their future role in Branchless Banking not just as a communication channel for Branchless Banking, but as authorized agents able to provide a variety of financial services and products for transaction fees. Of the telecom operators with whom the Consultant met, Mobilink was the only one that had an enhanced Branchless Banking application (Genie as described earlier) in collaboration with local banks. Although all operators - including Mobilink have indicated they are engaged in discussions or negotiations with one or more financial institution regarding a new Branchless Banking roll-out, no one has yet announced firm plans, or was willing to disclose these plans in any detail. Prior to the publishing by SBP of the Branchless Banking Regulation, most had cited the absence of firm regulations as the reason for inaction. However, following issuance of the Regulation, although they had indicated that they were poised to proceed with Branchless Banking services with bank partners or subsidiaries, there was some disappointment with the final Branchless Banking Regulation. Their disappointments centred on the following: 1. Some believe that the bank-led model is simply too restrictive, limiting what they would have preferred to roll out. As noted earlier, the Consultant is not convinced that the desire for an operator-led model is in itself good enough reason for holding back, since almost all international models to date have had a bank in a key partnering role. 2. Some claim (probably more credibly) that the Branchless Banking Regulation places the operators at a disadvantage in negotiating with banks, since the latter are reported to be very reluctant to allow the operators a reasonable portion of the banking revenue in exchange for the extensive effort and marketing risk involved in establishing and managing the Branchless Banking agency network, which will surely fall largely to the operators. This was discussed in Section 2.1. As noted in Section 4.3.1, one operator addressed this issue by taking a 51% controlling interest in an MFB. 3. Customer ownership is an issue that is critical to the telecom operators and not really addressed in the Branchless Banking Regulation. However, the Regulation appears to assume that the customer always belongs to

Final Report

Page 28 of 86

ADB TA 4894-PAK: Improving Access to Financial Services the bank, because Branchless Banking is only defined as the extension of a banks business. Even though this may be the case from a purely technical and SBP perspective, it is not the case from a marketing perspective, thus any agreement between bank and telecom operator needs to define areas of market responsibility and ownership that go beyond the apparent frame of reference of the Regulation. 4. Operators also feel that the regulatory policy direction set by the MoIT and the Branchless Banking (Implementation) Regulations enacted by the PTA include a provision regarding interconnection that is overly burdensome on operators in a competitive market. This regulation (4) stipulates that No operator / Third Party Technology Supplier (TPSP) shall deny interconnection to another operator / TPSP that has branchless banking system with the same or other Financial Institutions. The consultant believes that this regulation could at least appear to be an unfair intrusion into a competitive value added market, and should be modified. In the context that operators typically take the marketing lead in Branchless Banking initiatives, and that a one-to-one model is legitimate and complies with the Branchless Banking Regulation, it would increase an operators marketing risk if any late entering third-party operator is able to demand access to the service. It would amount to a secondary regulatory burden. With respect to 4 above, i.e., the PTA Regulation, the Consultant suggests that the PTA Regulation be revised to state the following: Interconnection from an operator and/or Third Party Technology Supplier (TPSP) that has a branchless banking system to another operator / TPSP with its own system, or with another Financial Institution, shall be negotiated on a bilateral basis. Following a minimum period of one year (or two years) from commencement, PTA may consider the merits of instituting mandatory interconnection between systems. Most operators appear to be moving ahead, in measured steps, towards the negotiation of agency and/or joint venture agreements with one or more bank, even though believing that the regulatory environment is less than ideal for them. As of December 2008, two operators had definite plans to enter the market in Q1 or Q2 2009. As stated in Section 4.3.1, Telenor has moved first and is launching its EP m-banking product on 15th October 2009, in partnership with Tameer Microfinance Bank. In additional, it is understood that Warid Telecom and Wateen Telecom have imminent plans (see Section 5.2). Compared to the attitude of operators in November 2007, who then mostly stated that they would expect to press ahead with piloting or rolling out a service without needing the assistance of the ADB or any other donor, the consultant noticed a more open view amongst operators in August and

Final Report

Page 29 of 86

ADB TA 4894-PAK: Improving Access to Financial Services December towards accepting financial assistance. The possible need for assistance was now related to the objective of reducing the risks in moving Branchless Banking forward under the terms of the SBP and PTA regulation.

5.2. COMMERCIAL BANKS

In November 2007, banking representatives agreed that most banks have not yet fully embraced Branchless Banking as a mainstream product or service channel. Beyond UBLs Orion, discussed in Section 3.2, some banks, such as MCB Bank (MCB), currently offer a service by which customers can perform simple account administration and, in some cases, make credit card or utility payments via mobile phones. Mostly these services are technology neutral, in that transactions can be carried out on any operator network using widely available SMS text functions, IVR voice and public internet technologies. Work with the SBP has proceeded in planning for the establishment of Remittance Desks that are staffed with IT and administration personnel who facilitate remittance fund transfers and look at new technologies, such as branchless banking, that support this goal. UBLs Orion includes e-remittance capability, with the help of which UBL has been successful in capturing approximately 5-10% all remittances made to Pakistan. During SBPs bankers workshop held on August 15, 2008 to explain the Branchless Banking Regulation, several conversations had by the Consultant with banking representatives revealed some rising interest branchless banking. However, this did not translate into much publicly displayed interest from them or discussion at the workshop itself. By December 2008, it was clear that at least one commercial bank (MCB) had developed advanced plans to enter the BB field by Q2 2009. In this case, it is clear that initial steps will be additive, meaning that the initiative will be geared towards offering existing account holders an enriched mobile banking environment, though transformative steps venturing into the non-banked market using the broader reach of mobile operators into rural and unbanked territory are expected by Q3 2009. At report preparation stage it was not evident whether MCB or others are planning a strictly bank-led one-to-many BB model, in which multiple telecom operators shall be invited to participate, or will be in direct partnership with one telecom partner for a one-to-one initiative. The Consultant projects that by the third quarter of 2009 there will be at least one of each kind of initiative active in the market place and that the total will be at least three BB initiatives. By the third quarter of 2009, it became clear that MCB had established industry leadership by launching an aggressive program under the name of

Final Report

Page 30 of 86

ADB TA 4894-PAK: Improving Access to Financial Services MCB Mobile, with expansion objectives apparently well beyond those of existing services such as Orion or Genie 3 . The company CEOs initial statement indicated that MCB Mobile was just a first step by the bank in ensuring the cost effective delivery of financial services outside the banks traditional branch network. He added that with the advent of the State Bank of Pakistans Branchless Banking Guidelines, development of a number of new financial products and services were already underway at MCB. These products have been designed to not only increase MCBs customer reach, but they would serve to broaden the access to financial services to a sizable bankable population who have mobile phones but no bank accounts or formal banking relationships 4 . MCBs characterization of its service on the website of MCB Mobile Announcing the launch of millions of branches and the initial pace of development indicates that the transition to transformative branchless banking will not take long 5 . MCBs reported number of 11, 000 customers signing up in August 2009, and reported USD 1 million dollar transaction volume in that one month alone, needs to be viewed in the context of SBPs previously reported transactions for the whole mobile banking sector during the January-March 2009 Quarter (prior to MCBs launch) of just 15,460 transactions, with monetary value of just Rs 3.3 Million 6 . It thus appears that the entry by MCB Mobile is immensely transformative to the sector, outstripping the existing m-banking transaction volumes reported by SBP by several times. MCBs entry thus promises to lead the industry into significant growth and expansion. This will soon be supplemented by the Tameer/Telenor EP m-banking entry, and eventual Mobilinks acceleration of its mobile banking activities. Beyond MCB, it is understood that Bank Al-Falah has signed a contract with Raseen Technologies ([Link]) for implementation of m-banking using the telecom infrastructure of Warid Telecom and Wateen Telecom.

5.3. MICRO-FINANCE BANKS (MFBS)

In general, the MFB representatives whom the Consultant met are interested in the potential of Branchless Banking services; these services are viewed as a way to lower operational costs, to introduce new product lines such as insurance and remittances, and to encourage a greater number of rural and non-served clients to use and benefit from the MFBs services. Further details regarding Tameers and FMFBs initiatives towards Branchless Banking were provided in Section 3.3.
3

It was confirmed in August 2009 that MCB has launched its service and reported a successful start-up with 11,000 customers having signed up within the first month and USD 1 million worth of savings or transactions. By October 6, the transaction volume reported by MCB since inception had risen to US$2.5 million. 4 [Link] 5 [Link] 6 Retail Payment Systems of Pakistan (January March 2009), SBP

Final Report

Page 31 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

5.4. BRANCHLESS BANKING TECHNOLOGY PROVIDERS

Technology Providers supply services ranging from turnkey Branchless Banking applications to customized system development of integrating technologies between banks, mobile operators and banking switch networks. The companies are referred to as Third Party Service Providers (TPSPs) in the Branchless Banking Regulation. The platforms provided by the TPSPs enable Branchless Banking transactions that are secure, verifiable and do not disrupt existing system processes of the participants. The Branchless Banking Regulation stipulates that TPSPs are not permitted to act as Branchless Banking agencies unless they have a specific agency or outsourcing agreement with a financial institution for that purpose. Since TPSPs are able to take responsibility for transaction hosts or any platform within the FI network, they must also comply with the SBPs Guidelines on Outsourcing Arrangements, which are stipulated in Circular No. 9 dated July 13, 2007. As indicated by stakeholder feedback, many local IT companies are available to provide generic services to the sector; however, there are very few companies that specialize in Branchless Banking applications suitable for wide-scale implementation. Much of this expertise lies with overseas companies such as G-Xchange Inc, a subsidiary of Globe Telecom in the Philippines who are involved in the much touted G-Cash Branchless Banking application, and Fundamo Inc. of South Africa, who have provided the platform for MTN Banking in South Africa and Cel-Pay in Zambia. Nonetheless, stakeholders indicated that there is a preference (amongst banks and telecom operators) to be able to work with local firms, because development issues can be managed more effectively in face-to-face interaction. To this end, the Access Group has partnered with Fundamo and has served as the local agent in developing a Branchless Banking application for Tameer/Telenor, and is also the provider of choice for MCB Mobile. This technology could be used as a common platform for other MFBs (or banks also) who wish to participate. An added benefit of the Fundamo system is that it is modular and scalable, with the ability to start with basic functionality and adds components when they are needed and can be afforded. The Consultant understands that Access Group has had discussions with several operators and banks

Final Report

Page 32 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

6. PROJECTIONS AND ADVICE REGARDING BRANCHLESS BANKING REGULATION

6.1. OVERVIEW
As previously stated, the Consultant believes that the Branchless Banking Regulation represents a sound first step for the country, given SBPs desire to regulate firstly those clearly within its jurisdiction (i.e., licensed financial institutions) and its justifiable concern with the health of the banking sector, its short and medium term viability, and AML/CFT issues. Nevertheless, as also stated previously, Branchless Banking regulation must be made with an eye on the development of a new style of service that has tremendous promise for reaching out to segments of the population that are currently without financial services and particularly those in rural areas. This will ultimately require movement into regulatory areas that are relatively uncharted today. Inevitably it will require the entities with the overwhelming presence (i.e., the telecom operators) and who possess greater facility for innovation, to play a leading market role, while also encouraging banks who have the motivation to be present there (e.g., the MFBs) to be able to play a leading role. This opens up the need for a migration path in the regulation and investment / learning that is balanced and visionary. To this end, it is absolutely vital that while seeking the safety of secure regulation, the SBP should also take the additional steps, under continual consultation, to ensure that its regulation of this newly developing market segment is proportional to the actual AML/CFT risk. Furthermore, as soon as the key players who could contribute the most to its development are able to demonstrate the minimum amount of maturity required by the SBP, they should also be allowed, incrementally, greater encouragement to operate within evolving regulation and thus contribute to the sector and to the economic development of the target population. To this end, areas for eventual revision or development include the issues covered in the following two sub-sections.

6.2. POSSIBLE REVISIONS TO THE EXISTING BRANCHLESS BANKING REGULATION

The Consultant believes that the first and only revision that is most pressing is to make an adjustment to the Level 1 entry conditions (KYC requirements), to be better adapted to the realities of small, remote communities and remote transactions. Assuming such applications will be conducted by agents, remote from the physical reach of direct bank employees, the required conditions could make better use of existing technological capacity.

Final Report

Page 33 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

This could, in the Consultants view, involve some minor revision to the current Level 1 KYC / entry requirements. Specifically, it is not unusual for agents in other Branchless Banking cases internationally to be able to open customer accounts without the customer physically filling out a form or having a face-to-face contact with a designated employee of the financial institution as the Regulation states, but for the transaction still to have a good level of control. For example, in the MTN Banking example, the Fundamo technology platform (available in Pakistan) enables the agent to fill out a SMS or Java based standard form resident within the agents mobile phone at site, on behalf of the agent. The agent couples this with an on-the-spot photo of the applicant and of the applicants ID card and sends all three documents to MTN Banking HQ. In real-time, MTN Banking (which is actually the KYC department of Standard Bank) verifies the data, calling up independently the ID card information and photo from the online Government database (equivalent to NADRA / CNIC), and provides verification or otherwise while the applicant waits. As an additional security, only conditional approval is given on the spot; this is subject to a defined waiting period during which the customer is not able to access all facilities of the service until secondary verification and approval is given. A similar exemption to normal practice in urban markets is also allowed in the WIZZIT system, while SMART and M-Pesa also allow similar, though tightly controlled, remote sign-up in accordance with Central Bank requirements. Such an adjustment would provide indication that the Branchless Banking Regulation takes into consideration the fact that many of the target clientele might not even be literate, much less able to fill out a form, while they are nevertheless very capable of understanding what they need and making application for it. As noted in Section 1.4, after discussion with SBP on this matter, the Consultant understands that SBP will, on a case by case basis, consider all reasonable operational and technical proposals on this matter from banks and/or bank-operator partnerships, provided they meet the KYC requirements of the bank or banking partner.

6.3. FUTURE REGULATION

DIRECTION

OF

BRANCHLESS

BANKING

The shape of future regulation should include consideration of the following, in the Consultants view.

Final Report

Page 34 of 86

ADB TA 4894-PAK: Improving Access to Financial Services (i) Set and clarify legal boundaries between e-money, retail payments and related stored-value accounts and allow non-bank participation under defined terms, to be evolved. The Consultant understands that this may or may not require amendments to the Banking Bill or draft Payment System and Electronic Funds Transfer Act (PSEFT Bill) which we understand to define electronic money and permit a range of institutions beyond licensed financial institutions to issue it iv . Some further clarification may be required, however it is important to take the positive view that e-money should eventually have a role to play in the Branchless Banking field. While the Consultant has noted that almost all international BB cases involve a bank-telecom operator partnership with the bank playing the key security and accounting role, it is also true that several cases allow the lowest introductory form of BB account (i.e., with the lowest deposit and daily transaction limits) to be a form of stored value e-money account that does not require a formal bank account to be held by the user; Permit non-bank entities, especially those who have the credibility and security of having a banking partner in their Branchless Banking service (which we have demonstrated to be the international norm) and who demonstrate responsibility in their own KYC practices, to be able to offer a stored value account (e-money account) which does not necessarily involve customers having to have a direct contractual relationship with any bank. Several of the best international examples offer such a start-up option, while allowing customers to graduate to a full bank account when they wish, under relevant terms and conditions. This will of course have its own transaction and maximum account limit, following the pattern established in the current Section 4 of the Branchless Banking Regulation, perhaps with adjustments to the current Level 1 limits. Consider the addition of a new Level 0 which would reflect the suggestions in (ii) above and (iv), or adjust level 1 to have some more permissive conditions (new Level 0 is preferred). Evolve (perhaps through a Circular) appropriate regulations which reflect the reality of the future direction of Branchless Banking, while ensuring that the non-bank entities i.e., telecom operator and/or secondary agency manager fully meet the KYC due diligence and required AML/CFT standards. It is clear in the cases of G-Cash (Philippines) and M-Pesa (supported by the Telecom giant Vodaphone) that their Central Banks have evolved regulatory Circulars for non-bank entities to fully satisfy AML/CFT requirements that are reasonable and proportional to the need.

(ii)

(iii)

(iv)

With the above, aspects of the Branchless Banking Regulation Sections 5 (Key Roles and Responsibilities), 5 (Agent-Assisted Banking) and 8 (Risk

Final Report

Page 35 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Management Program) and 10 (Risk Management Procedures) would need to be revised.

Final Report

Page 36 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

7. ADVANCING BRANCHLESS BANKING DEVELOPMENT WITHIN THE CURRENT BRANCHLESS BANKING REGULATION
7.1. COMMERCIAL INEVITABILITY VERSUS PILOTING AND DEVELOPMENT ASSISTANCE
Research efforts have identified that stakeholders have very distinct views of what types of Branchless Banking are suitable for direct development assistance in piloting and implementation. More commercially based applications that mainly target banked and unbanked people in urban centres are considered commercially inevitable and require little involvement with formal development programs and projects. Genie and Orion are early examples. These will inevitably be expanded in scope and migrate more towards more innovative products that include entry level Branchless Banking applications with cash-in / cash-out facilities, with the competitive pressure created by MCBs m-banking entry and others. During the Consultants November 2007 visit that was prior to issuance of the Branchless Banking Regulation, these and other commercial stakeholders stated a preference not to participate in formal development projects for piloting purpose, but rather to complete this piloting on their own. They asserted that they were operating in a competitive environment where such things as timing of product launch and piloting efforts are key to success in marketing their services, testing and obtaining crucial consumer feedback on service preferences and demand. Administrative delays and competing priorities of development programs and projects would likely act as a hindrance to deployment plans and schedules. However, as stated in Section 4, it does appear that since the Branchless Banking Regulation was issued, the commercial banks and operators are now more interested in financial assistance, if they are to focus beyond the urban centres into rural areas. On the other hand, MFBs which already focus more on unbanked populations (e.g., Tameer and First MFB) are already increasingly moving their focus into rural and remote areas. Because they have fewer financial resources, these banks are more likely to welcome assistance. MFBs whose services target disadvantaged groups and socioeconomic development in remote and under served areas, stand to benefit from piloting activities and assistance. MFBs often have a greater portfolio of responsibilities and service offerings than commercial banks. These include risky micro-business loans and also include counselling and capacity development assistance to clients.

Final Report

Page 37 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Piloting and development assistance can provide important feedback on Branchless Banking activities from a number of perspectives beyond simply financial performance, but also socioeconomic benefits. Further, MFBs have experience in working with multiple development agencies and are better prepared to coordinate with requirements for piloting support from development organizations.

7.2. ACHIEVING FORWARD MOVEMENT

Given the new conditions since issuance of the Branchless Banking Regulation, in developing an optimal approach for piloting and assistance within the accepted Branchless Banking Regulatory framework, the following objectives have been developed: 1. Encourage accelerated entry to Branchless Banking / m-banking by both banks and MFBs; 2. Expand the frontiers of current reach, to the outreach target clientele, i.e., the unbanked and rural areas, and products of interest to the rural population; 3. Facilitate bank operator joint venturing and partnership, which is an essential ingredient; 4. Build experience and maturity (SBPs objective) in order to accelerate also the eventual expansion into new acceptable models (i.e., to nonbank led models) in a more liberal regulatory future. In this section, a pilot concept and family of supporting initiatives has been proposed, combining all of the above elements, by including a mandatory rural expansion, bank telecom operator partnership, but also majoring on products of specific interest to rural clientele, such as small scale savings and payments (Level 1) and remittances, by means of an m-banking platform. It was determined that a central objective of the project Improving Access to Financial Services must have a rural element, as well as inclusion for MFBs, provided the need for ongoing involvement by this project is judged to be needed.

7.3. COMMERCIAL TARGETING

VIABILITY

AND

SMART

SUBSIDY

It was proposed in the 2nd Interim Report that the SBP, in partnership with a funding agency, should offer financial support to accelerate commercial entry into Branchless Banking / m-banking with specified products, applications and performance targets, through a subsidy competition. In other words the method of assistance should not promote or prolong the life of noncommercially viable solutions.

Final Report

Page 38 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Banks and telecom operators would be invited to bid for one or more packages of subsidy / support against a specification that seeks out one or two best-case proposals from the industry, with good medium to long term prospects for success. 7.3.1. Financial sources for the competition Two types of sources for the competitive project could be tapped. These are: Various development finance sources, such as the ADB, DFID, CGAP, etc., who are known to be interested in accelerating viable m-banking models; or Pakistans own Universal Service Fund (USF) Company, which is a public-private partnership corporate entity that has been established for the sole and specific purpose of advancing telecommunications services and ICT related applications into unreached rural areas.

The Consultant proposed the USF approach since it has several very significant advantages and could potentially bring more rapid movement than the alternative routes. The advantages are as follows: (i) The USF is fully Pakistani, and could be viewed as representing a significant commitment to the Branchless Banking market from Government and private industry in the ICT sector, as well as using resources collected from the private sector itself; The USFs statement of purpose indicates that it has been . established by the Ministry of IT to spread the benefits of the telecom revolution to all corners of Pakistan. USF aims to promote development of telecommunication services in unserved and under-served areas throughout the length and breadth of the country, to make available affordable voice telephony and basic data services to progressively greater proportions of the country's population at their home locations. See [Link] The USF has more than sufficient financial resources available since it has been building these up for the last two years by levying 1.5 percent of the revenues of licensed operators in the telecommunications sector. The USF collects in excess of US$ 50 million per annum, largely from the operators who are the most interested in m-banking. Despite having a very active and efficient program, the USF has thus far distributed less than half its funds available, thus it is looking for good projects; The USF has a successful track record of holding least subsidy tender competitions for network roll-out and ICT services into rural areas;

(ii)

(iii)

(iv)

Final Report

Page 39 of 86

ADB TA 4894-PAK: Improving Access to Financial Services (v) The USF is commercial market based and offers only smart subsidy investments, i.e., the subsidies are given to commercial entities committed to rolling out self-sustaining service, while recognizing that some areas or projects need a kick-start to encourage investment in the first place. The awards are made on the basis of commercial proposals to meet specific targets developed by the USF Company; and The USF has a Special Projects category into which various ICT services and applications are supported, which could include e-commerce and m-banking applications.

(vi)

The Consultant has met with the CEO of the USF Company to present the concept of supporting one or more Branchless Banking / mBanking pilots. The CEO showed interest and suggested that the USFs Board of Directors would probably consider the proposal favourably if a formal approach was made by SBP. However, the CEO also expressed the view that the USF would most likely prefer to consider the proposal, as an investment focused on transformative BB operations in rural areas, after seeing a BB initiative already introduced into the urban market place and building up a successful track record there over several months.. In view of this and in view of the consultants assessment that up to three banks and operators are already planning to commence BB operations in Q1 2009, it was concluded to hold the USF based pilot as an initiative ready for implementation later in 2009 if required to increase the outreach into unbanked and rural areas, assuming initial commercial steps are taken by banking and telecom operators, as expected, early in the year. If it is determined that the initial commercial steps taken by banking and telecom operators need to be supplemented by support for more unbanked and rural outreach than observed to that date, then it is strongly recommended that this pilot project be implemented. In the meantime, it is recommended that SBP hold discussions with the USF in order to agree and set up the conditions and required environment for a go ahead, and the requirements for Terms of Reference, Specification and Bidding Documentation. 7.3.2. USF sponsored Branchless Banking project concept and process Should the concept of seeking the support of the USF be agreed for later in 2009, the following principles would be followed:

Final Report

Page 40 of 86

ADB TA 4894-PAK: Improving Access to Financial Services The framework of SBPs Branchless Banking Regulation would be used to define the permissible models; Bank Telecom partnership under a bank-led model would represent the minimum bidder requirement, since it is generally accepted by the Branchless Banking Regulation that telecom operator participation is required for successful Branchless Banking roll-out. Also, it should be recognized that the USF has been established to support telecom applications and has been created through financial contributions from the sector; The partnership model would not be limited to a specific form of bank-operator partnership, nor to a one-to-one model. Any of the three models permitted by the Branchless Banking Regulation would qualify for support; The Request for Proposal (RFP) would include operating specifications that require: Fully meeting the risk-based KYC due diligence and AML/CFT requirements of the Branchless Banking Regulation; Targeting a specified number of rural areas, communities or unbanked Branchless Banking customers; Targeting a range of services / products demanded by rural customers i.e., Cash-in / cash-out, savings, payments, remittances; Development, use and management of Branchless Banking agents within a range of specified types desired by SBP and industry for development e.g., post office outlets, retailers, telecom distributors; Include a defined program for agent recruitment, vetting, training and management;

The maximum allowable subsidy would be set by the USF in consultation with the SBP and supporting consultant. The actual negotiated subsidy amount would be the result of competitive offers. The winning bidder(s) would be the one(s) evaluated to have met all of the operational requirements and require the lowest subsidy. The subsidy would be distributed over a set period in accordance with the USFs established practice i.e., in several percentage tranches (declared in the RFP), upon meeting certain roll-out KPIs (key performance indicators) against the requirements of the RFP.

Final Report

Page 41 of 86

ADB TA 4894-PAK: Improving Access to Financial Services 7.3.3. Suggested target subsidy recipients, project size and outcomes It is suggested that under the USF tender, two awards would be made as follows: One award for a commercial bank / telecom operator proposed project, and One award for a microfinance bank / telecom operator proposed project.

It is expected that the total project size and duration should be of the order of maximum $5 million subsidy per project, distributed over a maximum of two years to the completion of set targets. However, the exact size of project and the project description and KPIs should be developed under a short term consultancy project.

7.4. PROJECT REMITTANCE

SUPPORT

MOBILE

BASED

FUND

This section provides a description of a remittance project concept, which is considered to be a minimum requirement for a rural-targeted Branchless Banking initiative. This could either be included as a requirement in the USF supported project RFP, or simply published to provide a guide on project expectations. 7.4.1. Basic objectives Branchless Banking applications in Pakistan will need to tap, among other possibilities, the widespread reach of mobile operators agent networks across the country; their numbers are in the tens of thousands. This is in comparison with banks, such as UBL which has approximately one thousand branches, or First MFB which has less than one hundred branches. The USF supported pilot project objectives (or those of any project supported by a funding agency) should address the issue of agency development, demanded rural products and greatly expand on existing Branchless Banking experience. Remittance transactions should be included. This would provide an example of potential rural outreach and providing new methods for accessing financial services and remittance funds, and also supporting ongoing microfinance and rural development initiatives. 7.4.2. Main players The key player(s) involved would include at least one financial organization, at least one mobile phone operator in partnership or

Final Report

Page 42 of 86

ADB TA 4894-PAK: Improving Access to Financial Services already involved in Branchless Banking activities, and a select group of retail agents of several kinds (e.g., mobile agents, grocers, other retailers, or post offices) for trial as banking agents. Key associations and development agencies, such as the Pakistan Bank Association (PBA) and the Pakistan Microfinance Network (PMN) could play an important supporting role in the pilot. Their assistance would not be in the delivery of services, but would include investigations of best practices in technologies, administration and risk management, all of which could be utilized by all participating organizations. The PMN or MFIs could possibly play an important role in supporting capacity building for rural agents and assist in promotion and education to rural beneficiaries regarding the Branchless Banking application, such as how to work with agents to apply for and use the services and financial opportunities including savings and mobile fund remittances. 7.4.3. Overview The project should be based on m-banking technology, and agents to be accredited as bank agents, to provide money transfer and remittance services. Financial partners enlisting the telecom operators as direct partners in the task - would be ultimately responsible for the training content for the agents, and accounts and liability for service delivery by the agents. To address due diligence concerns, the approach would require at least one party of the money transfer, most likely the receiver of funds, must apply for a streamlined Branchless Banking account and be reviewed through the KYC procedures. Figure 6-1 provides a schematic overview. 7.4.4. International remittances International remittances or domestic transfers could be supported through a variety of already established methods, such as cash deposits to remittance agents, e-banking, credit cards, bank transfers and other players such as Western Union. The transaction is then wired through existing banking network switches to a participating bank and its information network. An established Branchless Banking network that is linked with a mobile operator network would register the transaction information and send notification and verification information to a person on his/her mobile phone. A variety of communication approaches could be utilizedsuch as SMS and IVRto inform the recipient and verify identity. This approach is similar to the Philippine SMART Telecoms Padala system where anyone can remit funds using agents, e-banking and credit

Final Report

Page 43 of 86

ADB TA 4894-PAK: Improving Access to Financial Services cards with amounts verified via mobile operator and bank holding Branchless Banking account. 7.4.5. Extending the Reach of Financial Services Both the bank and mobile operator partners would train and manage a trial group of banking agents, to include merchants and mobile operator agents operating in peri-urban and rural areas that lack banking and basic infrastructure such as fixed line communications. Agents would be provided with an agent mobile phone for communicating and verifying transactions between the Branchless Banking network at headquarters and clients who have been transferred funds. Depending on the complexity of transactions piloted, agent mobile phones could operate using simple SMS technology for straightforward remittances or a more advanced second generation dedicated SIM applications. The type of process involved in sign-up and approval of applicants was described in Section 5.2. A user notified of a remittance on his/her mobile phone would travel to the nearest accredited agent to verify the transfer with the agent by providing them with the SMS verification codes they received. This information would be entered into the agents mobile phone and sent to the Branchless Banking network at headquarters for verification. The agent would then receive a confirmation message with an authorization code if transaction was successful. Once an agent disburses funds, a message would be sent to the Branchless Banking network confirming the disbursement and sending a record of the transaction to the agents and recipients mobile phones. Another approach suitable for a mobile/dispersed Branchless Banking application, such as in the MFB initiatives examined in this study, could be that funds are disbursed at ATMs once a person has been notified by SMS that money is available. A Mobile Remittance Fund pilot is flexible enough to be carried out as a stand alone Branchless Banking application by operators interested in pursuing Branchless Banking or to be built on existing or other proposed Branchless Banking services. 7.4.6. Involving MFBs Of the MFBs examined with potential for piloting support, both Tameer and First MFB are involved in establishing remittance services. This is often pursed in the traditional context as a branch-based service.

Final Report

Page 44 of 86

ADB TA 4894-PAK: Improving Access to Financial Services However, Tameers piloting of ATMs with biometric identification functionality shows promise as a potential channel for providing remittance transfers directly to the receiver from an ATM. Now that Tameer is majority owned by Telenor, mobile phones will inevitable be used as a communication channel to notify the client of an authorization code and inform them that a remittance has been made and is available for pick up at an ATM or agent. Further, First MFB may be interested in extending the number and types of agents from only MFB staff to others including merchants, postal outlets and other MFIs and development organizations with presence in the rural areas. 7.4.7. Conformance to Regulation A Mobile Fund Remittance pilot conforms to the Branchless Banking Regulation because it is based on the approved bank-led model. In all Branchless Banking models considered for pilot support, the financial organizations, be it commercial banks or MFBs, will hold responsibility and liability for the financial transactions of the Branchless Banking application and of the agents involved in the transactions with end clients. With their banking experience and existing conformance with SBP policies, procedures and risk management, the banks would also play an important role in training agents, ensuring compliance to regulations and management of banking activities. Telecom operators would also contribute to training and capacity building of agents and help with marketing and customer service aspects. In the Consultants opinion there is no reason why the operator could not receive a financial share or consideration for this role, to be negotiated with the financial institution. Telecom operator agents that are included as Branchless Banking agents would operate under relevant agency agreements with the banking partner and fulfill all the banking partner requirements (according to the SBP Regulation) to be authorized as a Branchless Banking agent. 7.4.8. Agent Authorization and Capacity Development In addition to technical backstopping, support for the authorization, capacity building and feasibility evaluation of potential Branchless Banking agents in dispersed areas is a critical component of piloting activities. Of all issues related to Branchless Banking activities, project stakeholders identified this issue (as well as the ability of agents to

Final Report

Page 45 of 86

ADB TA 4894-PAK: Improving Access to Financial Services process transactions efficiently and securely) as being key to the success and viability of Branchless Banking in Pakistan. The following are two major areas where pilot activities must focus: Conforming with SBP guidelines and necessary legal agreements between agents and banks; and, Training and development of agents in efficient management and administration processes, KYC requirements, risk mitigation and customer service in relation to financial transactions and addressing grievances.

In summary, as in the case of the USF Proposal (Section 7.3), in view of the Consultants assessment that up to three banks and operators are already planning to commence BB operations in Q1 2009, the Remittance Project guidelines should be held as an active proposal ready for implementation later in 2009 if it is determined that the initial commercial steps taken by banking and telecom operators, as expected early in the year, need to be supplemented by support for more applications and a driver related to rural outreach.

7.5. ADDITIONAL PROJECT SUPPORT ACTIVITIES

This section outlines technical assistance activities that could be undertaken outside of the specific confines of a USF Branchless Banking pilot project. 7.5.1. Consultancy to assist with feasibility analysis and project specification The proposal to undertake a Smart Subsidy tender project to support one or more bank-telecom operator partnership and project concepts (Sections 7.3 and 7.4) will require consultancy service to: Outline and scope the project, including project targets, key performance indicators, expected costs and revenues, likely financial gap and risks, and smart subsidy financing strategy; Outline the project process, including project selection criteria, evaluation and monitoring, in accordance with the USF normal procedures, with possible variations in accordance with the specific nature and requirements of the project; Assist with USF Company decision to support the project, and assist with negotiations between SBP and the USF Company to undertake the project, to negotiate respective responsibilities, expected outcomes, etc.; Tender documentation RfP, Service Agreement, etc;

Final Report

Page 46 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Tender evaluation principles and criteria, subsidy contract negotiation; Outline the implementation inspection, audit and subsidy disbursement plan.

The Consultant is prepared to discussion, explain and provide whatever description on these matters is required to assist with a final decision on program decision, whenever that decision is made. 7.5.2. Training and capacity building The Branchless Banking Regulation outlines specific responsibilities and risk management approaches that are required of FIs and other players in Branchless Banking activities. Many of the technical and risk oversight requirements will already be familiar to banking partners and already incorporated in their staff training and organizational development procedures. However, areas where both mobile operator and banking partners will need to build capacities are in relation to the special nature of Branchless Banking operation, which includes the use of non-standard banking agents and application system development and administration whose transactions span banking, banking switch, and telecommunication wireless networks. The following are capacity building requirements for Branchless Banking identified through discussion with stakeholders (in particular with MFBs) regarding potential Branchless Banking activities: Adapting company management and staff roles, responsibilities and procedures in financial and industry partner organizations for Branchless Banking service provision; Training of agents and agent staff in roles and responsibilities in areas of customer service, grievance redress and risk-based approaches to due diligence. Capacity building in Branchless Banking sponsor organizations to monitor and track vetting of agents; Training and capacity building for dispersed and remote banking agents; Building skills of rural workforces lacking education and training;

Analysis and studies of results and impacts of the service provision; Set up of streamlined administration and transaction processing work flows; Monitoring and updating workflows to minimize costs of processing transactions and providing services;

Final Report

Page 47 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Promotion of services and analysis of market demand for products and services; Training in marketing approaches and procedures; and, Assistance in measuring consumer response and demand for services

The development of appropriate service level agreements (SLAs) / Agency Agreements (AA) that outline responsibilities and risk management approaches between 1) FI and SBP; 2) FI and agents; and 3) between FI and third party technology providers;

As noted previously, as one example of the above needs, the Consultant received an approach from Tameer and Telenor to for technical assistance in the following specific areas: Agent training for rural franchisees of Telenor, Customer awareness marketing material development, Training videos for agents in general, and Development and printing of m-wallet user guides.

As a result of the several discussions held with Tameer and Telenor, the Consultant confirms this request to be reasonable and practical for critical inputs to success. These are therefore included in this report as specific suggestions for potential ADB contribution under the auspices of this project. 7.5.3. Service Level Agreements (SLA) / Agency Agreement (AA) The Branchless Banking Regulation identifies the type of agreement required between parties as the Service Level Agreement (SLA) / Agency Agreement (AA). Section 6.4 sets out their specific requirements. Agreements must be in place between SBP and the bank or financial institution partner of a Branchless Banking application, as well as between any agents, agency networks or third party technology providers involved. In an examination of these requirements, and international examples of SLAs used in agency and technology outsourcing by financial institutions, some key principles for inclusion in SLAs were identified. 7.5.4. Operator/Technology Provider SLAs Guideline suggestions for data security should be elaborated in SLAs to include specific assurances as to the following:

Final Report

Page 48 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Implementation of strong Access Control Measures, which include directory and network access control through staff security clearance levels and required use of traceable user IDs; and, Requirements for information security policy. Use of firewall configurations and no vendor supplied default passwords and security parameters; Assurances of the use and regular update of antivirus and security patches;

7.5.5. Operator / Agent SLAs Principles that need to be considered in SLAs between operators and agents beyond SBP risk-based requirements include the following: Processes to allow agents to refer customers to partner financial institution for further support in areas of grievance redress, information or special need in a timely manner; Methods by which agents can raise concerns with operators; Establishment of rights for operators to obtain data or visit facilities if needed; and, Ways in which the privacy of agent and business information will be maintained.

Ongoing discussion with SBP and MoIT and response to the proposals of this report, will determine whether external support (to SBP or to Branchless Banking players) are required, beyond normal monitoring of the implementation of the agreements enjoined on the key players in any Branchless Banking initiative to meet the requirements of the Branchless Banking Regulation. Guidelines for preparation of an SLA is provides in Annex A. The first document (Annex A1: Guidelines for Service Level Agreement between Bank, Operator and/or Customer) can be used as a general checklist for reviewing the draft of an SLA or for preparing an SLA. The second document (Annex A2: Guidelines for Service Level Agreement Template Examples) provides more specific examples for drafting of an actual SLA. 7.5.6. Payment system standardization Branchless banking platforms need to conform to various standards to ensure inter-operability and security. The Consultant investigated, studied and considered a range of standards in common use for branchless banking platforms.

Final Report

Page 49 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Although it is normal for variations to occur internationally in precisely to what extent standards are followed, the Consultant recommends that all players in the BB market in Pakistan should be required to indicate broad support the following three standards: Payment Card Industry Data Security Standard (PCI DSS).

An overview of this standard is attached in Annex B1. ISO 8583 Standard for Financial Transaction Card Originated Messages - Interchange message specifications An overview of this standard is provided in Annex B2Message Authentication Code (MAC)

While there are several kinds of MACs and related standards, this area is also generally covered under an ISO standard, namely ISO/IEC 9797-2:2002. An overview of MACs and of this standard is provided in Annex B3. 7.5.7. Service and Technological components (for consideration of minimum tax SRO) The government of Pakistan, including the PTA and Central Board of Revenue (CBR), have been active in reviewing options for taxation reform in telecommunication services, equipment and technologies as a means to encourage growth in the sector and increase the use of domestically produced technologies and services. According to CBR statistics v , imports of technology over the years have dramatically increased; with one period in 2004-2005 experiencing a 310% growth rate in imports. For technology-dependent industries, such as telecommunications, the related import taxes levied upon technical equipment can be a significant barrier to viability in the industry. It is estimated that the value of technical equipment and network investment in Pakistan between 2006 and 2010 will amount to approximately eight billion USD. Such concerns resulted in changes to import duties in order to stimulate and attract investment. For example, import duties charged on mobile phones were lowered from 25% in 2004-05 to 5% in 2005/06. Subsequently, competing interests for the promotion of domestically produced phones is creating pressure to increase import duties on certain technical components. This has the potential to constrain the development of much needed technologies to pursue Branchless Banking.

Final Report

Page 50 of 86

ADB TA 4894-PAK: Improving Access to Financial Services A recent decision by PTA indicates that license fees for VSAT and Spectrum Spread Technology were officially waved as of June 2008. Whereas this is relevant to BB in indicating that certain technological components can be subject to favourable tax conditions, there are no significant implications related to BB services as such. The Consultant was unable, under the terms and budget of this project, to pursue an further investigations or to make specific recommendations regarding actions related to Ministry of Finance categorization of Branchless Banking or m-Banking related to taxation, for example tax measures or reforms that could be required, or are feasible under current practices and policy, to promote Branchless Banking. However, it is clear that this area does need to be considered further and that questions regarding the categorization of the services and of all the technologies that are considered critical for Branchless Banking in particular the IT platforms that support the transaction accounting, KYC and security, need to be raised during ongoing subsequent discussion with stakeholders.

Final Report

Page 51 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

8. CONCLUDING REMARKS
The Consultant has conducted broad international investigations and local consultations in respect of branchless banking. The Consultant has noted a general acceptance and support for the BB Regulation which places banks in the critical role of responsibility. . The Consultant also highlights the fact that in the vast majority of international cases, considered to be leading examples of branchless banking, although the energy and market leadership usually comes from telecom operators, a banking partner invariably plays the key role of account hosting and financial management. Of six leading international cases studied in detail, one was initiated entirely by a bank, while all of the remainder were initiatives of telecom operators and all but one have a bank in the critical role of meeting the AML/CFT requirements of their respective central banks. It is argued that at least three of these cases could meet the requirements of the Branchless Banking Regulation, with the relevant agency agreements in place, and thus be labelled as bank-led even though the banks were not necessarily prominent in the start-up and marketing of the service. In the light of this, it is important to note that market and brand leadership (most often carried by the telecom operator) should not be confused with process and regulatory conformance. The key lesson is to encourage (and not to hinder) the evolution of Branchless Banking models to take place with whatever face or marketing approach the telecom banking partnership would like to use, provided the risk-based customer due diligence, relevant KYC requirements and AML/CFT controls are in place and vetted by the banking partner, either directly or through a tight agency agreement. The Consultant has noted, from contacts with key banks and telecom industry players, that there is likely to be at least three new BB initiatives in the market place during 2009. This has been confirmed with the entry of MCB Mobile, followed by Tameer/Telenors EP m-banking product in Q2 and Q4 / 2009 respectively. These are very good and promising developments, which should be monitored carefully. Despite the above developments however, the Consultant has developed nine separate recommendations of measures that are judged important to the accelerated and successful emergence of branchless banking in Pakistan. These can be classified as: Regulatory refinement and development, Piloting for optimal and accelerated BB roll-out to unbanked and rural areas, and Technical assistance for capacity development and support of technological standardization.

Final Report

Page 52 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

8.1 REGULATORY REFINEMENT & DEVELOPMENT

The following regulatory measures should be considered to encourage the evolution of Branchless Banking models and future implementation: 1. Existing BB Regulation - Allowance of modification to Level 1 KYC entry requirements in the implementation of BB initiatives, to reduce the necessity of face-to-face contact with prospective clients. International examples point to successful models of meeting KYC requirements. A new Level 0 could be considered for transitional or very low sum accounts. 2. Telecommunications Regulation - Recommendation on a revision to the Telecommunications Regulation on Branchless Banking that was issued by the Ministry of Information Technology (MoIT), through the Telecommunications Regulatory Authority), in order to remove or lighten a case of double regulation on telecom operators related to interconnection and inter-operability of BB systems; 3. Future (Next stage) BB Regulation - Set and clarify legal boundaries between e-money, retail payments and related stored-value accounts and allow non-bank participation under defined terms, to be evolved, with possible revision of relevant draft legislation, discussed in the report, if necessary; During the subsequent phase of development of BB regulation, permit nonbank entities, especially those who have the credibility and security of having a banking partner in their Branchless Banking service (which is demonstrated to be the international norm) and who demonstrate responsibility in their own KYC practices, to be able to offer a stored value account (e-money account) which does not necessarily involve customers having to have a direct contractual relationship with any bank. Several of the best international examples offer such a start-up option, while allowing customers to graduate to a full bank account when they wish, under relevant terms and conditions. Evolve appropriate regulations which reflect the reality of the future direction of Branchless Banking, while ensuring that the non-bank entities i.e., telecom operator and/or secondary agency manager fully meet the KYC due diligence and required AML/CFT standards. It is clear in the cases of G-Cash (Philippines) and M-Pesa (supported by the Telecom giant Vodaphone) that their Central Banks have evolved regulatory Circulars for non-bank entities to fully satisfy AML/CFT requirements that are reasonable and proportional to the need.

Final Report

Page 53 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

8.2. PILOTING FOR OPTIMAL AND ACCELERATED BB ROLLOUT TO UNBANKED AND RURAL AREAS
The Consultant has developed an approach for piloting and assistance within the accepted Branchless Banking Regulatory framework, with the following objectives: Encourage accelerated entry to Branchless Banking / m-banking by both banks and MFBs; Expand the frontiers of current reach, to the outreach target clientele, i.e., the unbanked and rural areas, and products of interest to the rural population; Facilitate bank operator joint venturing and partnership, which is an essential ingredient; Build experience and maturity (SBPs objective) in order to accelerate also the eventual expansion into new acceptable models (i.e., to non-bank led models) in a more liberal regulatory future.

A pilot using the principle of smart subsidy, with supporting recommendations is proposed for implementation, if judged necessary or beneficial late in 2009, to include financial support for rural expansion, and bank telecom operator partnerships. The pilot should major on products and services of specific interest to rural clientele, such as small scale savings and payments (Level 1) and remittances, by means of an m-banking platform. The principles of the pilot implementation are described in Section 7.3.A key BB user application - fund remittance has been further described in Section 7.4, to be used as a component of the pilot project in order to enable an application with very high demand and utility for rural users. Under the pilot, it is proposed that the SBP, in partnership with a funding agency, should consider offering financial support to accelerate commercial entry into Branchless Banking / m-banking with specified products, applications and performance targets, through a smart subsidy competition. Banks and telecom operators would be invited to bid for one or more packages of subsidy / support against a specification that seeks out one or two best-case proposals from the industry, with good medium to long term prospects for success. In the event that by mid/late 2009, the experience of commercial BB initiatives indicates the usefulness of the mentioned pilot concept, the Consultant proposes that SBP should approach Pakistans Universal Service Fund (USF) to support the pilot concept, since it has several very significant advantages and could potentially bring rapid movement. The advantages include, but are not limited to, the facts that:

Final Report

Page 54 of 86

ADB TA 4894-PAK: Improving Access to Financial Services The USF has been established by the Ministry of IT to spread the benefits of the telecom revolution to all corners of Pakistan, to promote development of telecommunication services in un-served and underserved areas, and to make available services to progressively greater proportions of the country's population. The USF has more than sufficient financial resources available built up over the last two years by levying 1.5 percent of the revenues of licensed operators in the telecommunications sector, and has a successful track record of holding least subsidy tender competitions for network roll-out and ICT services into rural areas; and The USF has a Special Projects category into which various ICT services and applications are supported, which could include e-commerce and mbanking applications.

As explained in the report, it is recommended to first allow the industry players to start up the commercial BB initiatives the currently have planned for Q1 and Q2 2009 and then to monitor the need for intervention to accelerate progress of the services into unbanked and rural territory.

8.3. TECHNICAL ASSISTANCE

As indicated in this report, several technical activities in support of the pilot concept and BB development generally could be pursued which would provide, among other things, the pilot project development, training and capacity building, and assistance with Service Level Agreements and Service Agreements (if required) as well as advice on technological standards related to system inter-operability.. The recommended or already concluded measures are the following: 1. Pilot implementation Development of the terms of reference, specifications and implementation of the pilot project, as described in Section 7.5.1; 2. Capacity building Focusing on key target operating entities or partnerships (e.g., micro-finance banks and telecom operators) which are ready for BB short-term implementation. These measures would be in the areas of management and staff development; BB agent training; focused market study; preparation of promotion and marketing materials and user guides. The recommendations are described in detail in Section 7.5.2; 3. BB Service level Agreements - Guidelines and template for service level agreements between bank, telecom operator and/or agents (attached as Annex A); and 4. Technical standards an outline of the three most relevant and recommended standards to be followed and specified in Pakistan (attached as Annex B), namely: Payment Card Industry Data Security

Final Report

Page 55 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Standard (PCIDSS); Standard for Financial Transaction Card originated Messages (ISO8583); and Message Authentication Codes (MAC).

Final Report

Page 56 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX A1: GUIDELINES FOR SERVICE LEVEL AGREEMENT BETWEEN BANK, OPERATOR AND / OR CUSTOMER
Definition: A Service Level Agreement (frequently abbreviated as SLA) is a part of a service contract where the level of service is formally defined. In practice, the term SLA is sometimes used to refer to the contracted delivery time (of the service) or performance. Or A service level agreement is a document which defines the relationship between two parties: the provider and the recipient. The Service Level Agreement: This is clearly an extremely important item of documentation for both parties. If used properly it should:

Identify and define the customers needs Provide a framework for understanding Simplify complex issues Reduce areas of conflict Encourage dialog in the event of disputes Eliminate unrealistic expectations

Specifically it should embrace a wide range of issues. Amongst these are usually the following: Services to be delivered Performance, Tracking and Reporting Problem Management Compensation Legal Compliance and Resolution of Disputes Customer Duties and Responsibilities Intellectual Property Rights Fees and Expenses Security IPR and Confidential Information Termination

Final Report

Page 57 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Definition of Services This is the most critical section of the Agreement as it describes the services and the manner in which those services are to be delivered. Standard services are often separated from customized services but this distinction is not critical. The information on the services must be accurate and contain detailed specifications of exactly what is being delivered. Performance Management A key part of a Service Level Agreement deals with monitoring and measuring service level performance. Essentially, every service must be capable of being measured and the results analyzed and reported. The benchmarks, targets and metrics to be utilized must be specified in the agreement itself. The service performance level must be reviewed regularly by the two parties. Problem Management The purpose of problem management is to minimize the adverse impact of incidents and problems. This usually specifies that there must be an adequate process to handle and resolve unplanned incidents and that there must also be preventative activity to reduce occurrence of unplanned incidents. Formal records and logs must be maintained of all incidents and problems. Customer Duties and Responsibilities It is important for the customer to understand that it also has responsibilities to support the service delivery process. The SLA defines the 'relationship' which of course is a two way entity. Typically, the customer must arrange for access, facilities and resources for the suppliers employees who need to work on-site. Warranties and Remedies This section of the SLA agreement typically covers the following key topics: Service quality Indemnities Third party claims Remedies for breaches Exclusions Force majeure

Security: Security is a particularly critical feature of any SLA. The customer must provide controlled physical and logical access to its premises and information. Equally, the supplier must respect and comply with the Clients security policies and procedures. Disaster Recovery and Business Continuity Disaster recovery and business continuity can be of critical importance. This fact should be reflected within the SLA. The topic of disaster recovery is usually

Final Report

Page 58 of 86

ADB TA 4894-PAK: Improving Access to Financial Services embraced within the security section. However, it is also frequently included within the Problem Management area. At the highest level, both these areas typically state that there must be adequate provision for disaster recovery and business continuity planning to protect the continuity of the services being delivered. Termination This section of the SLA agreement typically covers the following key topics: Termination at end of initial term Termination for convenience Termination for cause Payments on termination

Final Report

Page 59 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX A2: GUIDELINES FOR SERVICE LEVEL AGREEMENT

[TEMPLATE EXAMPLES] What a Service Level Agreement is An SLA sets the expectations between the consumer and service provider. It helps define the relationship between the two parties. It is the cornerstone of how the service provider sets and maintains commitments to the service consumer. A good SLA addresses five key aspects: What the provider is promising. How the provider will deliver on those promises. Who will measure delivery, and how. What happens if the provider fails to deliver as promised? How the SLA will change over time.

In the definition of an SLA, realistic and measurable commitments are important. Performing as promised is important, but swift and well communicated resolution of issues is even more important. The challenge for a new service and its associated SLA is that there is a direct relationship between the architecture and what the maximum levels of availability are. Thus, an SLA cannot be created in a vacuum. An SLA must be defined with the infrastructure in mind. An exponential relationship exists between the levels of availability and the related cost. Some customers need higher levels of availability and are willing to pay more. Therefore, having different SLAs with different associated costs is a common approach. The following section contains an example template of an SLA to show all of the important components one wants to address in such a document. This template is customized and augmented to reflect a Bank-Led model. By replacing the italicized text with specific service aspects the template can be customized to reflect a specific service offer. The insert service name is used be insert customer name to insert description of the service capability. The Bank / Operator guarantees that: The service name will be available insert percentage of the time from insert normal hours of operation including hours and days of the week. Any individual outage in excess of insert time period or sum of outage exceeding insert time period per month will continue a violation. Insert percentage of service name transactions will exhibit insert value seconds or less response time, defined as the interval from the time the user sends a

Final Report

Page 60 of 86

ADB TA 4894-PAK: Improving Access to Financial Services transaction to the time a visual confirmation of transaction completion is received. Missing the metric for business transactions measured over any business week will constitute a violation. The Bank Customer Care team will respond to service incidents that affect any users within insert time period, resolve the problem within insert time period, and update status every insert time period. Missing any of these metrics on an incident will constitute a violation. The Bank Customer Care team will respond to non-critical inquiries within insert time period, deliver an answer within insert time period, and update status every insert time period. Missing any of these metrics on an incident will constitute a violation. A non-critical inquiry is defined as a request for information that has no impact on the service quality if not answered or acted upon promptly. The external availability measurements are done by insert test company name or regulator name and reported on a monthly basis to insert customer name with the account report. The internal processes are measured and reported by the Bank to the insert customer name on a yearly basis. This service includes incident reporting. As violations are identified above, the Bank may be penalized as per below model Number of Penalty violations 1>5 Insert penalty. Typically a reduction in transaction fees. 5>10 Insert Penalty. Typically a reduction in fees plus some additional compensation and a corrective action plan. 10> Insert Penalty. Typically a removal of fees plus some additional compensation and a corrective action plan. As services and technologies change, the SLA may change to reflect the improvements and/or changes. This SLA will be reviewed every six months and updated as necessary. When updates are deemed necessary, the customer will be asked to review and approve the changes. Other areas that must be defined in an SLA are details on how the measurements are done, what usage limitation the service has with regard to number of concurrent users and so forth, and details on how and who receives reports and how conflicts are arbitrated. Because these topics are unique in each contract, they are not included further. This SLA is a short form of Service Level Agreement to illustrate essential aspects between a consumer and service provider in a Bank-Led context. Internal SLAs, between Cellular Operator and Bank are different and often contain more details and specifications. The main reason for this difference is that internal SLAs are driven by budget constraints and the business managements view of services, while external SLAs are driven by revenue, cost and earnings. The following template provides a general description of an internal SLA as well as the management approval and review process, and a definition of the terms used in the document.

Final Report

Page 61 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

1.0 1.1 1.2 1.3 2.0 2.1 2.2 3.0 3.1

Statement of Intent Approvals Review Dates Time and Percent Conventions About the Service Description User Environment About the Availability Normal Service Availability Schedule Scheduled Events That Impact Service Availability Non-emergency Enhancements Change Process

This section states the objectives of the document. All parties must agree on the SLA. This section contains a list of who approved the SLA. This section contains the track record of the SLA reviews. This section contains the descriptions of what time conventions and metrics are being used. This section introduces the service addressed by this SLA. This section describes the service in detail. This section describes the architecture and technologies that are used by the consumers of the service. This section introduces the availability concepts used in this SLA. This section describes what scheduled outages are to be expected, This section describes what scheduled outages are to be expected, This section describes the process that inserts enhancements into the infrastructure. This section describes the complete process of how changes are introduced in the service, including the associated availability impact. This section describes the provisioning process of new users/customers. This section contains a detailed description of how the service availability is measured and reported.

3.2

3.3 3.4

3.5 4.0

Requests for New Users About Service Measures

How an SLA Maps to Key Performance Indicators Below table uses the first example SLA and shows, in the right column, what key performance indicators result from the stated commitment. These indicators, in turn, drive what performance data and metrics are collected by the SLM process. The performance indicators in below table drive the internal SLAs and their associated metrics. Commitment The service name will be available insert percentage of the time from insert normal hours of operation including hours and days of the week. Any individual outage in excess of insert time period or sum of outages exceeding insert time period per month constitutes a violation. Insert percentage of service name transactions will exhibit insert value seconds or less response time, defined as the interval from the time the user sends a transaction to the time a visual Key Performance Indicator Service Availability as a Percentage of Normal Business hours. NoteWe must measure overall service availability. The maximum threshold is the maximum outage per incident and/or total sum of outage per month.

Percentage of transaction response times more than x seconds. NoteWe must measure transaction times against a threshold of x seconds

Final Report

Page 62 of 86

ADB TA 4894-PAK: Improving Access to Financial Services confirmation of transaction completion is received. Missing the metric for business transactions measured over any business week constitutes a violation The Bank Customer Care team will respond to service incidents that affect individual users within insert time period, resolve the problem within insert time period, and update status every insert time period. Missing any of these metrics on an incident constitutes a violation. The Bank Customer Care team will respond to non-critical inquiries within insert time period, deliver an answer within insert time period, and update status every insert time period. Missing any of these metrics on an incident constitutes a violation. The external availability measurements are done by insert test company name and reported on a monthly basis to customer name. The internal processes are measured and reported by the ISP to the customer name on a monthly basis. and measure the number of slower transactions as a percentage of the total.

Service Incident (affecting single users) Response times, resolution times and status updates. NoteWe must be able to create incident reports that track actions with timestamps. These are measured against the time thresholds. Inquiry response times, answer times and status updates. NoteWe must be able to create incident reports that track actions with timestamps. These are measured against the time thresholds. This is an example of an external management service that is managed by its own SLA between the Bank and the cellular operator that supports this commitment to the service consumer.

Why a Service Level Agreement is Important A good SLA is important because it sets boundaries and expectations for the following aspects of service provisioning Customer commitments. Clearly defined promises reduce the chances of disappointing a customer. These promises also help to stay focused on customer requirements and assure that the internal processes follow the right direction. Key performance indicators for the customer service. By having these indicators established, it is easy to understand how they can be integrated in a quality improvement process. By doing so, improved customer satisfaction stays a clear objective. Key performance indicators for the inter-organization agreement. An SLA drives internal processes by setting a clear, measurable standard of performance. Consequently, internal objectives become clearer and easier to measure. The price of non-conformance. If the SLA has penalties (something that many financial service providers prefer to avoid but should not) non-performance can be costly. However, by having penalties defined, the customer understands that the financial service provider truly believes in its ability to achieve the set performance levels. It makes the relationship clear and positive.

Final Report

Page 63 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

Benefits of Measuring Against an SLA This section describes why measuring against SLAs is so important to a successful service delivery and a healthy business. Key to success for a service is the ability to perform according to predefined standards. Performance is summarized as the ability to meet (or preferably exceed) the customers expectations. The first step is to set realistic expectations for both sides of the contract. An SLA is a great vehicle to communicate the expectations and create a level of trust by adding conditions and penalties when the promises are not met. The SLA defines a clear relationship between the customer and the service provider by setting boundaries, conditions, penalties and expectations. Because an SLA links the customer requirements to infrastructure requirements, it creates the ability to link service levels to service cost and, as a result, profitable pricing can be set. Moreover, by spending wisely on well defined requirements rather than rules of thumb or gut feeling, more efficient cost management can be achieved. The capability to segment service offerings with different pricing for different service levels benefits both the vendor and the customer. The vendor widens its target market by being able to customize its services and the customer only pays for what it needs. Having the ability to measure against key performance indicators facilitates the continuous quality improvement process. Being able to raise the performance bar at a steady pace helps the data center service provider to remain competitive. By tying the problem resolution process to an SLA, a service performance problem becomes an opportunity to structurally improve overall service quality and customer satisfaction, as opposed to just resolving the symptoms of the real issue. An SLA sets the standards to which the financial service provider committed. As a result, a set of common and/or global parameters is derived to which all organizational groups must be managed and measured. Requirements for success of the business are now directly translated to measurable requirements for the financial/technical teams. The SLA drives the definition of Key Performance Indicators (KPIs) at the service, application, system and network level. Defining these KPIs facilitates the proper tools selection, process definitions and skills (people, process and technology) for an organization. Knowing what to measure eliminates redundant data collection, which reduces the total overhead of the SLM system on the service infrastructure. A good SLM system collects data only once.

Final Report

Page 64 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX B: MOST IMPORTANT TECHNICAL STANDARDS ANNEX B1: PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)
Sources: [Link] [Categories: Payment systems Credit cards Electronic commerce Computer law Data privacy] See also: PCI DSS Standard PCI DSS stands for, and is a worldwide security standard assembled by the Payment Card Industry Security Standards Council (PCI SSC). The standard was created to help organizations that process card payments prevent credit card fraud, hacking and various other security vulnerabilities and threats. A company processing, storing, or transmitting payment card data must be PCI DSS compliant. Non-compliant companies who maintain a relationship with one or more of the card brands, either directly or through an acquirer risk losing their ability to process credit card payments and being audited and/or fined [1]. All in-scope companies must validate their compliance annually. This validation can be conducted by auditors - i.e. persons who are PCI DSS Qualified Security Assessors (QSAs), however smaller companies have the option to use a self-certification questionnaire. Whether this questionnaire needs to be validated by a QSA depends on the requirements of the card brands in that merchant's region. Requirements The current version of the standard (1.2) [2] specifies 12 requirements for compliance, organized into 6 logically related groups, which are called "control objectives." The control objectives and their requirements are:

Build and Maintain a Secure Network

o

Requirement 1: Install and maintain a firewall configuration to protect cardholder data Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Requirement 3: Protect stored cardholder data Requirement 4: Encrypt transmission of cardholder data across open, public networks Requirement 5: Use and regularly update anti-virus software Requirement 6: Develop and maintain secure systems and applications

Protect Cardholder Data

o o

Maintain a Vulnerability Management Program

o o

Implement Strong Access Control Measures

Final Report

Page 65 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

o

Requirement 7: Restrict access to cardholder data by business needto-know Requirement 8: Assign a unique ID to each person with computer access Requirement 9: Restrict physical access to cardholder data Requirement 10: Track and monitor all access to network resources and cardholder data Requirement 11: Regularly test security systems and processes Requirement 12: Maintain a policy that addresses information security

Regularly Monitor and Test Networks

o

Maintain an Information Security Policy

o

History PCI DSS originally began as five different programs: Visa Card Information Security Program, MasterCard Site Data Protection, American Express Data Security Operating Policy, Discover Information and Compliance, and the JCB Data Security Program. Each companys intentions were roughly similar: to create an additional level of protection for customers by ensuring that merchants meet minimum levels of security when they store, process and transmit cardholder data. The Payment Card Industry Security Standards Council (PCI SSC) was formed, and on 15 December 2004, these companies aligned their individual policies and released the Payment Card Industry Data Security Standard (PCI DSS). In September 2006, the PCI standard was updated to version 1.1 to provide clarification and minor revisions to version 1.0. PCI is one of multiple data security standards that have emerged over the past decade; BS7799, ISF Standards, Basel II, Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act of 2002, The next version 1.2 was released on October 1, 2008. [3]. Version 1.1 will be "sunset" on December 31, 2008. v1.2 did not change requirements, only enhanced clarity, improved flexibility, and addressed evolving risks/threats. Standards derived from the PCI DSS include PABP and PA-DSS. Updates and Supplemental The PCI SSC has released several supplemental pieces of information to clarify various requirements. These documents include the following

Information Supplement: Requirement 11.3 Penetration Testing[4] Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified[5] Navigating the PCI SSC - Understanding the Intent of the Requirements [6]

Compliance and Wireless LANs

Final Report

Page 66 of 86

ADB TA 4894-PAK: Improving Access to Financial Services The PCI DSS recognizes wireless LANs as public networks and automatically assumes they are exposed to vulnerabilities and threats. PCI DSS also provides two specific security guidelines to prevent breaches coming in from wireless networks used in any environments containing credit card data. They are:

Firewall segmentation between wireless networks and the point of sale networks or any network that comes in contact with credit card information. Use of wireless analyzers (a.k.a. Wireless Intrusion Detection System) to detect any unauthorized wireless devices and attacks

References (with http links) 1. In Data Leaks, Culprits Often Are Mom, Pop - [Link] 2. PCI DSS - PCI Security Standards Council 3. PCI SECURITY STANDARDS COUNCIL RELEASES VERSION 1.2 OF PCI DATA SECURITY STANDARD 4. Information Supplement: Requirement 11.3 Penetration Testing 5. Information Supplement: Requirement 6.6 Code Reviews and Application Firewalls Clarified 6. Navigating the PCI SSC - Understanding the Intent of the Requirements

Final Report

Page 67 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX B2: ISO 8583

ISO 8583 Standard for Financial Transaction Card Originated Messages Interchange message specifications - is the International Organization for Standardization standard for systems that exchange electronic transactions made by cardholders using payment cards. Sources: Wikipedia [Link] ISO [Link] 1628 Introduction A card-based transaction typically travels from a transaction acquiring device, such as a point-of-sale terminal or an ATM, through a series of networks, to a card issuing system for authorization against the card holder's account. The transaction data contains information derived from the card (e.g., the account number), the terminal (e.g., the merchant number), the transaction (e.g., the amount), together with other data which may be generated dynamically or added by intervening systems. The card issuing system will either authorize or decline the transaction and generate a response message which must be delivered back to the terminal in a timely manner. ISO 8583 defines a message format and a communication flow so that different systems can exchange these transactions. The vast majority of transactions made at Automated Teller Machines use ISO 8583 at some point in the communication chain, as do transactions made when a customer uses a card to make a payment in a store. In particular, both the MasterCard and Visa networks base their authorization communications on the ISO 8583 standard, as do many other institutions and networks. Cardholder-originated transactions include purchase, withdrawal, deposit, refund, reversal, balance inquiry, payments and inter-account transfers. ISO 8583 also defines system-to-system messages for secure key exchanges, reconciliation of totals, and other administrative purposes. Although ISO 8583 defines a common standard, it is not typically used directly by systems or networks. Instead, each network adapts the standard for its own use with custom fields and custom usages. The placement of fields in different versions of the standard varies; for example, the currency elements of the 1987 and 1993 versions are no longer used in the 2003 version, which holds currency as a sub-element of any financial amount element. ISO 8583:2003 has yet to achieve wide acceptance. An ISO 8583 message is made of the following parts:

Message Type Indicator (MTI)

Final Report

Page 68 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

One or more bitmaps, indicating which data elements are present Data elements, the fields of the message

Message Type Indicator (MTI) This is a 4 digit numeric field which classifies the high level function of the message. A Message Type Indicator includes the ISO 8583 version, the Message Class, the Message Function and the Message Origin, each described briefly in the following sections. ISO 8583 Version This refers to the 1987, 1993 or 3003 versions Message Class Position two of the MTI specifies the overall purpose of the message. Message Function Position three of the MTI specifies the message function which defines how the message should flow within the system. Requests are end-to-end messages (e.g., from acquirer to issuer and back with timeouts and automatic reversals in place), while advices are point-to-point messages (e.g., from terminal to acquirer, from acquirer to network, from network to issuer, with transmission guaranteed over each link, but not necessarily immediately). Message Origin Position four of the MTI defines the location of the message source within the payment chain.

Bitmaps Within ISO 8583, a bitmap is a field or subfield within a message which indicates which other data elements or data element subfields may be present elsewhere in a message. A message will contain at least one bitmap, called the Primary Bitmap which indicates which of Data Elements 1 to 64 are present. A secondary bitmap may also be present, generally as data element one and indicates which of data elements 65 to 128 are present. Similarly, a tertiary, or third, bitmap can be used to indicate the presence or absence of fields 129 to 192, although these data elements are rarely used. The bitmap may be transmitted as 8 bytes of binary data, or as 16 hexadecimal characters 0-9, A-F in the ASCII or EBCDIC character sets. A field is present when the specific bit in the bitmap is true, i.e. byte '82x is binary '1000 0010' which means fields 1 and 7 are present in the message Data Elements Data Elements are the individual fields carrying the transaction information. There are up to 128 data elements specified in the original ISO 8583:1987 standard, and

Final Report

Page 69 of 86

ADB TA 4894-PAK: Improving Access to Financial Services up to 192 data elements in later releases. The 1993 revision added new definitions, deleted some, while leaving the message format unchanged. While each data element has a specified meaning and format, the standard also includes some general purpose data elements and system- or country-specific data elements which vary enormously in use and form from implementation to implementation. Each data element is described in a standard format which defines the permitted content of the field (numeric, binary, etc) and the field length (variable or fixed).

Final Report

Page 70 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX B3: MESSAGE AUTHENTICATION CODE (MAC)

Sources: RSA Laboratories, Wikipedia Introduction A message authentication code (MAC) is an authentication tag (also called a checksum) derived by applying an authentication scheme, together with a secret key, to a message. MACs are important for m-banking applications where the system uses SMS to transmit private data. Other technology elements related to mbanking such as the SIM Toolkit and Java include capabilities to enable the use of MAC. There is not one MAC standard, there are many. Unlike digital signatures, MACs are computed and verified with the same key, so that they can only be verified by the intended recipient. The MAC value protects both a message's data integrity as well as its authenticity, by allowing verifiers (who also possess the secret key) to detect any changes to the message content. MACs differ from digital signatures, as MAC values are both generated and verified using the same secret key. This implies that the sender and receiver of a message must agree on keys before initiating communications, as is the case with symmetric encryption. For the same reason, MACs do not provide the property of non-repudiation offered by signatures: any user who can verify a MAC is also capable of generating MACs for other messages. Types of MAC There are many different types of MAC available, as follows: CMAC (cipher-based MAC) OMAC (one-key MAC) PMAC (parallelizable MAC) HMAC (keyed-hash MAC) Poly1305-AES

The International Organization for Standardization has a 2 part standard related to MACs, ISO / IEC9797 (ISO/IEC 9797-1:1999, Part 1: Mechanisms using a block cipher, and; ISO/IEC 9797-2:2002, Part 2: Mechanisms using a dedicated hashfunction). There isnt specific information on the Part 1 of the standard, but the abstract for Part 2 is below. ISO/IEC 9797-2:2002 specifies three MAC algorithms that use a secret key and a hash-function (or its round-function) with an n-bit result to calculate an m-bit MAC. These mechanisms can be used as data integrity mechanisms to verify that data has not been altered in an unauthorized manner. They can also be used as message authentication mechanisms to provide assurance that a message has been originated by an entity in possession of the secret key. The strength of the data integrity mechanism and message authentication mechanism is dependent on the

Final Report

Page 71 of 86

ADB TA 4894-PAK: Improving Access to Financial Services length (in bits) k and secrecy of the key, on the length (in bits) n of a hash-code produced by the hash-function, on the strength of the hash-function, on the length (in bits) m of the MAC, and on the specific mechanism. The three mechanisms specified in ISO/IEC 9797-2:2002 are based on the dedicated hash-functions specified in ISO/IEC 10118-3. The first mechanism specified in ISO/IEC 9797-2:2002 is commonly known as MDx-MAC. It calls the complete hash-function once, but it makes a small modification to the round-function by adding a key to the additive constants in the round-function. The second mechanism specified in ISO/IEC 9797-2:2002 is commonly known as HMAC. It calls the complete hash-function twice. The third mechanism specified in ISO/IEC 97972:2002 is a variant of MDx-MAC that takes as input only short strings (at most 256 bits). It offers a higher performance for applications that work with short input strings only. ISO/IEC 9797-2:2002 can be applied to the security services of any security architecture, process, or application.

Final Report

Page 72 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ANNEX C: SITUATIONAL ANALYSIS CARRIED OUT DURING FIRST & SECOND INTERIM PERIODS
SITUATIONAL ANALYSIS First Interim Phase INTRODUCTION This First Interim Report for the Project on Improving Access to Financial Services in Pakistan is the second deliverable in project activities outlined for the Technology Options Component. The report covers details of project activities completed by the technology consultant and initial analysis of outcomes for the Interim Phase 1 period of the project. Objectives for the first interim phase are to examine the most feasible models of Branchless Banking (BB) for implementation in Pakistan. Complementing this is the identification of potential partners and BB initiatives that would be ideal as pilot implementations and demonstrative of the feasibility of BB. In addition, the implications of the draft guidelines for BB recently issued by SBP are reviewed and integrated into report findings. The analysis provides recommendations to inform a final version of the Guidelines and to investigate feasible models for implementation and piloting efforts that are in compliance with the Guidelines. PROJECT ACTIVITIES In collaboration with the in-country technology specialist, initial meetings in Islamabad were held for the first phase of the inception mission, occurring the week of October 29, 2007. Interviews were carried out with key stakeholders, including representatives of mobile phone operators, the telecommunications regulatory authority (PTA) and the Ministry responsible for technology (MoIT). During the week of November 5, the team traveled to Karachi to meet with department representatives at the State Bank of Pakistan (SBP) to coordinate necessary meetings with regulatory and technology leads at the bank, as well as representatives of the commercial banking sector, Micro-Finance Banks (MFBs) and branchless banking (BB) technology providers. Once draft SBP guidelines for BB were released in November 2007, the consultant contacted key industry and banks interested in BB with detailed questions regarding feedback on the SBP guidelines. In January 2008, official request was made of Fincon and SBP for authorization to review official industry responses on the guidelines and integrate them into project analysis and feasibility studies. In late March 2008, the SBP project representative, Mr. Nawaz, indicated that comments could be forwarded for review once they were ready sometime in that month. To facilitate industry responses, additional questions and requests for clarification were forwarded to the projects local technology consultant in early February for follow-up interviews with stakeholders previously met in November 2007. Information from the local consultant review and SBP is still pending as of preparation of this interim report. STAKEHOLDER INTERVIEW RESULTS

Final Report

Page 73 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

Bank & Mobile Operators Observations on Branchless Banking Mobile Operators Currently, most operators participate in BB indirectly or through a technology-neutral method with banks that have established mobile phones as a channel by which bank customer transactions are limited mainly to account administration, intra-account transfers and bill payments. Mobile phone operators make returns on the airtime required for BB, in which the applications are developed by the banks and work on most any mobile phone network. Most operators view their future role in BB not just as a communication channel for BB, but as authorized agents able to provide a variety of financial services and products for transaction fees. Of the telecom operators with whom we met, Mobilink was the only one that had an enhanced BB application (discussed further in a following section on local BB examples) in collaboration with a local bank. Although other operators indicated they had plans for enhanced BB applications, none were willing to disclose these plans in any detail. A main reason cited was the lack of specific regulations and guidelines to address key issues such as banking/nonbanking agent roles, use of ecurrency, and security requirements. However, once regulations have been clarified, operators are poised to proceed with BB services with bank partners or subsidiaries to offer financial services with streamlined requirements that include remittances, transfers, deposits, etc. Initially they have indicated plans to first target and pilot these services to un-banked or under-banked urban populations with expectations that this will lead to interest in rural areas for their services. The operators agreed that piloting will be necessary but suggested this would likely be done by them self and that the potential for significant delays would limit their interest in any Asian Development Bank (ADB) support for piloting activities. Banks Banking representatives agreed that most banks have not yet fully embraced BB as a mainstream product or service channel. Many banks, such as MCB Bank (MCB), currently offer a service by which customers can perform simple account administration and, in some cases, make credit card or utility payments via mobile phones. Mostly these services are technology neutral, in that transactions can be carried out on any operator network using widely available SMS text functions, IVR voice and public internet technologies. Work with the SBP has proceeded in planning for the establishment of Remittance Desks that are staffed with IT and administration personnel who can facilitate remittance fund transfers and look at new technologies, such as branchless banking, that support this goal. United Bank (UBL) was one of first banks to offer a more enhanced BB service; called Orion, which includes e-remittance capability. As a result of these efforts, UBL has been successful in capturing approximately 5-10% all remittances made to Pakistan. Similar to the mobile operators, the banks would likely support their own initiatives for piloting of new BB services but are waiting for more clarity in the regulations
Final Report Page 74 of 86

ADB TA 4894-PAK: Improving Access to Financial Services before launching these enhanced products. Of particular concern to the banks are issues regarding roles and responsibilities for establishing banking agents. Microfinance Banks In general, the MFB representatives with whom we met are interested in the potential of BB services. They see them BB as a way to lower operational costs, to introduce new product lines, such as insurance and remittances, and to encourage a greater number of rural and nonserved clients to use and benefit from the MFBs services. Tameer and Pak-Oman Microfinance Banks in Karachi and First Microfinance Bank in Islamabad have all expressed interest in branchless approaches as a means to reduce operational costs and to increase the reach of their services. Pak-Oman and First Microfinance are currently involved in piloting mobile branches that travel in vans to remote sites and in establishing smaller branch service desks in local community facilities, such as postal outlets, to reach and serve clients. Tameer MFB is currently in piloting efforts to establish a debit-card system that uses merchants equipped with online Point of Sales (POS) machines to act as banking agents in limited cash in/cash out and payment transactions to clients. All MFBs indicated that because of their histories as microfinance organizations and roles in social development and capacity building, their organizations could benefit from the efficiencies and use of IT and mobile technologies that most commercial banks have adopted to reduce costs. Since MFBs specialize in providing rural and underserved clients with loans and financial services, they are very interested in technologies that will enable them to reach out to large, untapped markets, thereby encouraging people to apply for and benefit from the services. Further, the new technologies have the potential to facilitate the introduction of value-added services such as insurance and remittance transfers. MFB representatives acknowledged that BB is still very much at an inception stage in Pakistan and that it represents fundamental operational challenges for them, including the management and training of increased numbers of remote agents and/or branches. Piloting of BB approaches will be very important for testing the viability and needs of operational approaches, for gauging consumer demand, and for promoting the services. Thus, they view government or development agency assistance as beneficial and welcome opportunities for collaboration. Tameer MFB already initiated piloting of their system in Q4 of 2007 in collaboration with development organizations, such as the Consultative Group to Assist the Poor (CGAP) program of the World Bank and the Soros Foundation, to support efforts in agent training and performance assessment. Branchless Banking Technology Providers Branchless Banking Technology Providers refers to firms or agencies, such as the Karachi-based Access Group (Tameer Bank) and Evamp & Saanga (Mobilink Genie) of Islamabad, that provide services ranging from turnkey BB applications to customized system development of integrating technologies among banks, mobile operators and banking switch networks, enabling BB transactions that are secure, verifiable and do not disrupt existing system processes of the participants. As indicated by stakeholder feedback, many local IT companies are available to provide generic services to the sector. However, there are very few companies that
Final Report Page 75 of 86

ADB TA 4894-PAK: Improving Access to Financial Services specialize in BB applications suitable for wide scale implementation. Much of this expertise lies with overseas companies such as G-Xchange Inc, a subsidiary of Globe Telecom in the Philippines who are involved in the much touted G-Cash BB application, and Fundamo Inc. of South Africa, who have worked on Cel-Pay in Zambia and MTN in South Africa. Nonetheless, stakeholders indicated that there is a preference for banks and telecom operators able to work with local firms because development issues can be managed more effectively in face-to-face interaction. Further, existing licensing terms, requiring compensation on a percentage of transaction prices, are not ideal, especially for some of the MFBs. In the case of MFBs, additional transaction costs can be prohibitive given the fact that the current low number and values of branchless transactionsoften in remote locationsalready entail significant costs, including substantial bank switch fees in which MFBs pay the same price as the commercial banks that have greater transaction values and volumes. Alternatively, Access Group has partnered with Fundamo and serves as the local agent in developing a BB application for Tameer. Fundamo can be used as a common platform for other MFBs who wish to participate. An added benefit of the Fundamo system is that it is scalable with the ability to start with basic functionality and to add components when they are needed and can be afforded. EXAMPLES OF LOCAL BANK-LED BRANCHLESS BANKING ACTIVITIES During the in-country investigation, a number of BB initiatives were identified and discussed with stakeholders. The following are examples of current efforts that have proceeded as regulations in this sector continue to be finalized, as well as regional examples that hold potential as models for implementation and piloting. Mobilink Genie Mobilink was one of the first telecom operators in Pakistan to launch financial services via mobile phones in collaboration with partners KASB Bank and the CITIBank credit card service of Khushhali Bank. Mobilink Genie is a Mobilink network specific application where bank and credit card customers can use their mobile phones to make bill payments, conduct account-to-account transfers, and purchase mobile airtime credits at a cost of approximately 20 rupees per transaction. The application is encoded in a special SIM chip that is provided with password protection to customers for installation on their mobile phones. The initiative is bankled in that risks associated with cash handling are assumed by the financial partners. Money deposits can be completed at bank branches and as credit card payments, but the service does not permit cash in/cash out nor deposit acceptance through the extensive network of Mobilink agents because they lack required authorization as banking agents. UBL Orion UBLs Orion is another example of a bank-led approach, but it is technology-neutral. Transactions can be processed over any GSM mobile phone network. Touted as a mobile wallet, the system does not require a special SIM to operate but rather uses SMS text messages and IVR voice responses of a centralized information processing centre at UBL to make and confirm limited financial transactions, including deposits, money transfers between accounts and UBL mobile wallets,
Final Report Page 76 of 86

ADB TA 4894-PAK: Improving Access to Financial Services and branch withdrawals. Users without UBL accounts can make deposits, accept transfers and withdraw funds from Orion users with accounts, but non-account holders must conduct the transactions at UBL branches and are required to register with identification; which can be as simple as entering their national ID number with SMS commands on a mobile. The service is also interconnected with UBLs online internet banking and other money transfer services, enabling international remittances to be sent to an Orion account. Features of this service have resulted in UBLs handling 10-15% of all remittance transfers to Pakistan. Microfinance Banks Tameer MFB is collaborating with a third-party technology provider, the Karachibased Access Group, to develop a debit-card type application in which customers are served via a large network of branchless merchants (banking agents) equipped with on-line POS machines. In the early stages, clients will have to apply and verify their identity at regional Tameer centers to become participants in the microfinance program before an account is opened and a banking card is issued. Clients can then go to any participating merchant (banking agent) and use the card to carry out transactions, which include account deposits, payments for goods or utilities, limited cash withdrawal, and repayment of their microfinance loans, by swiping the POS, providing a security PIN and selecting options that provide real time processing and verification of transactions. This BB approach involves a significant investment and operating costs that necessitate piloting and phased approaches to development, but it has the potential to reach a very large number of unbanked clients. Another approach used by First Microfinance Bank (First MFB) is to extend their branch services into rural un-served areas through service desks housed in postal offices and mobile banking vans. They provide a variety of microfinance services such as savings, remittance and loan products that are typically group-based and that include health, education, housing and home improvement loans. Future products include loans for housing construction. To receive services, clients sign up for accounts at regional First MFB offices or via mobile van branches and are required to have only national identification cards (NIC) for verification. By using service desks instead of branches, First MFB is able to reduce the cost of service delivery, provide more local outlets, and increase client access, which would otherwise be possible only through traditional branches located in regional centers. The information system at the core of their branchless service is not real time online but rather functions on periodic batch updating of branch transactions on an end-of-day or lengthier basis, depending on how remote the location is. With approximately forty local branches, this approach works well when based upon current demand. However, once the number of local branches goes beyond forty (as it is expected to in Q3 or Q4 of 2008), they will need to begin developing a system with online capability. First MFB has developed its system in-house from various previous management information systems (MIS), established in collaboration with aid organizations and IBM, when they operated as part of the Aga Khan Rural Support Program. However they have avoided significant development and operational costs (such as software licensing and certain bank

Final Report

Page 77 of 86

ADB TA 4894-PAK: Improving Access to Financial Services switch fees) by taking this approach. They do indicate that this approach requires that in-house IT staff have a high competency for on-going development and operation of the system. Concurrent work by First MFB Afghanistan is in piloting a telecom operator-led mobile phone BB application, M-Paisa, which is similar to the M-PESA initiative in Kenya. Afghan telecom operator Roshan and First MFB Afghanistan are adapting a common MIS system to manage e-money credits that are stored on M-Paisa mobile phone accounts and available for customers to make payments, transfer funds, and make deposits and withdrawals in cash via a large network of Roshan agents. This work is providing an invaluable regional test of risks and viability of a model that could be considered in the future for application in Pakistan. If so, First MFB of Pakistan would be in good position to implement the approach. RELEVANCE OF VARIOUS ACCESS TECHNOLOGIES Of the various technical approaches to BB identified in this study, mobile technologies show the greatest potential for improving peoples access to banking services in rural and underserved areas. Technologies such as ATM and POS machines can be connected to existing fixed-line communication networks, which could prove easier to establish and less costly to maintain than wireless. However, there are considerable regional areas and populations without access to the fixed networks. Wireless technologiesspecifically the telecommunication networks such as GSM, CDMA and wireless local loop that are capable of both voice and datahave the greatest potential via use of mobile phone handsets in establishing a low-cost means of access virtually anywhere a signal is present. Other wireless initiatives such as WiMAX (to provide broadband internet access) have important contributions to make but are newly emerging and will take longer to reach a state where the entire country has universal access to the service; especially in relation to dramatic, recent expansion of mobile phone networks in Pakistan. VSAT technologies will remain important for banks and bank branches in relation to needs for secure, reliable and private communication channels. This technology is equally important due to the connectivity between their networks of ATMs and mobile banking initiatives. However, for BB applications, the relatively high operating costs of these networks and the initial lower transaction rates that can be expected in remote areas could be prohibitive to the viability of the BB service. RELATING PAKISTANS FINDINGS TO INTERNATIONAL DEVELOPMENTS IN BRANCHLESS BANKING A wide variety of systems are utilized in BB applications internationally. They vary according to IT platforms, management of currency, interaction with customers, and presentation of services. At their core, each system provides a number of common financial services to their customers that include the following: Account information on such items as balances, transactions, account status and history of account activities; Financial transfers that include moving funds to different accounts or people;

Final Report

Page 78 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Fund deposit and withdraw transactions also known as Cash-in/Cash out functionality; and, Payments involving transfer of funds for services such as utility bills, airtime credits and even an assortment of vending devices. With similar challenges of large territories, difficult geography and socioeconomic constraints, BB models from Africa and South East Asia (in particular, the Philippines) are particularly relevant to implementations and business models under consideration in Pakistan. The SMART Padala (Text-a-Payment) and MTN Banking in South Africa have similarities with many bank-led initiatives, such as UBLs ORION and Khushhali Bank/ Mobilinks Genie mobile phones are used as communication channels, simple account administration, and the bank branches handle settlement transaction. South Africas Capitec Banks mobile branches are similar to mobile banking vans employed by Pak-Oman and First Microfinance Banks. WIZZIT SA is especially relevant to BB activities based on debit cards with settlements carried out via ATMs or agents equipped with POS machines. Tameer Microfinance Bank is currently involved in piloting both POS and ATM approaches to BB. POLICY AND GUIDELINES FOR KEY REGULATORY BODIES This section outlines policies and guidelines of key government authorities involved in the regulatory oversight of BB in Pakistan. PAKISTAN TELECOMMUNICATIONS AUTHORITY (PTA) As the national telecommunications regulator, the PTA is responsible for regulating key aspects of mobile phone operation and delivery of services to public clients. Regulatory issues include pricing of tariffs, quality of service, frequency distribution, and telecom operator obligations for the delivery of telecommunication services. For many BB applications, mobile phones and telecommunication networks are mainly a communication channel by which financial transactions are transmitted from the client to the financial institution and visa versa. This is especially the case in Pakistan, where the preferred BB model involves all financial transactions to be administered by banks and therefore does not deal specifically with mobile phone technology risks, such as e-currencies or extensive networks of mobile operator agents handling cash in/cash out transactions. Given the role of telecommunications as a communication channel for BB, the PTA has not established policies or regulations specifically guiding activities in this area. From time to time, PTA has promoted informal guidelines and recommendations regarding the mitigation of risks in using mobile phones as a medium for financial transactions. Best practice recommendations such as consistent use of phone security PIN numbers, entering/displaying of private information securely and saving records of transactions that could be involved in BB transaction are provided by PTA as part of their role in promoting consumer protection, i.e., the overall secure use of mobile handsets. In June 2007, the PTA released a draft policy paper on a regulatory framework required to support BB. Specific technology issues mentioned

Final Report

Page 79 of 86

ADB TA 4894-PAK: Improving Access to Financial Services include the need for an established Grievance Redressal Function and transaction processing and recording system to ensure transactions can be verified. Representatives we spoke with in November 2007 suggested PTA is not interested in a greater regulatory role in BB for a number of reasons. First, they see that oversight in BB would likely develop into an entirely new branch of regulatory tasks in addition to their current, expanding responsibilities in telecommunication regulation, where they are already stretched as an organization. Second, there is concern over establishing multiple layers of regulation and regulatory oversight between, for example, PTA and SBP, and the potential adverse effects this would have on constraining commercial opportunities in the telecommunication sector. This makes sense given the recent international trend in telecommunication regulation moving toward minimizing special regulations outside the general regulation of commerce and those governing financial transactions which are in the domain of financial regulation. MINISTRY OF INFORMATION TECHNOLOGY (MOIT) MoIT is responsible for national IT and telecommunication issues and is involved in the promotion of BB in a number of areas. Within the MoIT the Division of IT and Telecommunication assumes the role of coordinating the development of guidelines with respect to technologies and software as part of all e-government and IT pursuits. Work includes an advocacy role in the promotion of IT and BB and guidance for delivery of service. As part of collaborative government efforts to promote BB, MoIT and the SBP formed the working group Joint Committee for Improvement of Access to Financial Services in November 2006. The mandate of the working group is to research BB and micro-payment systems with the goal of establishing regulatory certainty and guidelines as to which BB models and operational approaches would be permitted in Pakistan. Up until recently, the expansion of BB in Pakistan has been restrained due to uncertainty of commercial operators as how BB would be regulated. By the end of 2007, MoIT and its Joint Committee with SBP established that a bankled model would be utilized. Future work involves the support for developing guidelines for BB activities to be issued by the SBP and examining the feasibility of various BB applications that comply with the bank-led approach. MoITs oversight in BB applications also includes support for quality control and assurances in service delivery and increased collaboration with the PTA. MoIT will establish strategies and operational guidelines for mobile operators, banks and agent systems that include Quality of Service specifications, technology security standards and testing approaches. Expansion of BB in Pakistan is leading to increased integration of banking and telecommunication technologies that require additional effort and regulatory oversight as identified by MoIT. Options are being explored in an ongoing dialogue between stakeholders and the government to allocate responsibilities and resources to agencies that could assist in these activities. One proposal forwarded by MoIT is to have the PTA take additional regulatory responsibilities for BB technology and for third-party service providers that are telecommunications related.
Final Report Page 80 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

Through work on the Special Committee, MoIT has collaborated with SBP in the development of the BB Guidelines. Contributions include specific input on types of suitable technologies and an outline of major security risks faced by mobile operators, agents and third party networks/applications. MoIT is open to various approaches of bank-led models, including specific bankmobile operator approaches and mobile network neutral approaches. MoIT has shown particular support for a common BB network developed by an established BB technology provider that would support the BB applications of multiple bank and mobile operators. This approach is currently being explored by Tameer Microfinance Bank to adapt a BB product based on technology from the BB specialist FUNDAMO of South Africa that would allow multiple microfinance banks to participate. STATE BANK OF PAKISTAN (SBP) The SBP has the leading role in the promotion and regulation of BB in Pakistan. As a bank-led model has been determined to be, at least initially, the main approach for this type of banking, the SBP will be directly involved in regulatory aspects with bank and financial organization partners, as well as the banking agents over which they have responsibility. Based on an examination of the risks and potential regulatory mechanisms involved in BB conducted over the course of 2007, SBP issued a Draft version of Guidelines for Financial Institutions Desirous to Undertake Branchless Banking (BB Guidelines) in November 2007 for comment by stakeholders and industry. As of March 2008, many responses and feedback to the guidelines have been received so that a final version will soon be released by SBP. The overall purpose of the guidelines is to Define what activities are Branchless Banking; and, Establish minimum standards for network security, data management, customer protection and risk managements; especially with respect to financial institutions involved The Draft guidelines summarized the following essential points regarding activities and scope of BB that are permitted: Financial institutions can partner with one or more mobile operators as long as the financial institutions carry the responsibility for the financial transactions and banking agent activities; BB applications can provide a range of services from opening accounts, payments, transfers, cash in/cash out and loan disbursements; Agents such as merchants, mobile operator agents and post outlets can act as agents as long as they are under a legal agency agreement with the BB financial partner. Larger agent organizations can enter in agreements to manage subagents; Agent agreements must bind participant to critical service levels that include data security, customer due diligence and customer care;
Final Report Page 81 of 86

ADB TA 4894-PAK: Improving Access to Financial Services Agents can only sign up applications to restricted BB accounts using photo and CNIC Identification; and, Technology service providers, mobile operator and banking networks developers involved in BB must be bound by Service Level Agreements that outline responsibilities for such things as data security, mobile network risks and levels of service expected. Ongoing project activities related to policy development in this area will support SBP in obtaining and collating feedback from public and project stakeholders so results can be integrated into a final set of BB guidelines. SITUATIONAL ANALYSIS Second Interim Phase EXAMPLES OF LOCAL BANK-LED BRANCHLESS BANKING ACTIVITIES During the two in-country investigations, a number of Branchless Banking initiatives were identified and discussed with stakeholders; these are examples of current services that had proceeded prior to the finalization of the Branchless Banking Regulation. MOBILINK GENIE Mobilink was one of the first telecom operators in Pakistan to launch financial services via mobile phones in collaboration with partners KASB Bank and the CITI Bank credit card service of Kushali Bank. Mobilink Genie is a Mobilink network specific application where bank and credit card customers can use their mobile phones to make bill payments, conduct account to account transfers, and purchase mobile airtime credits for a transaction cost of approximately 20 rupees per transaction. The financial services are hosted by the banking partners; the current four partners are KASB Bank, Citibank, Atlas Bank and Adamjee Insurance. It is understood that UBL and HBL also plan to become hosts of the service. Genie has the following features: Platform offers payment options to existing account holders of participating banks; Account sign-ups are handled through the KYC of the participating banks; All account platforms are those of the banks; The Genie platform is a Java based communications channel interface It does not fall under the objectives of branchless banking, though it has some similarities with the international cases MTN Banking & Celpay.

The application is encoded in a special SIM chip that is provided with password protection to customers for installation on their mobile phones. The service is bankled in that risks associated with cash handling are assumed by the financial partners. Because it is nevertheless an initiative of Mobilink, it is a many-to-one model and does not fit with the SBP Branchless Banking regulation in more ways than one, although neither is it, in the opinion of the Consultant, conflicting with the Branchless Banking Regulation since its objectives are limited to existing customers,

Final Report

Page 82 of 86

ADB TA 4894-PAK: Improving Access to Financial Services nor does it permit cash-in / cash-out facilities nor deposit acceptance through the extensive network of Mobilink agents because they lack required authorization as banking agents. Hence it is not fulfilling any vision of reaching beyond the urban base of the participating banks. Money deposits can be completed at bank branches and as credit card payment. UBLORION UBLs Orion is another example of a bank-led approach, but it is operator-neutral (one-to-many); transactions can be processed over any GSM mobile phone network. Touted as a mobile wallet, the system does not require a special SIM to operate but rather uses SMS text messages and IVR voice responses of a centralized information processing centre at UBL to make and confirm limited financial transactions, including deposits, money transfers between accounts and UBL mobile wallets, and branch withdrawals. In summary, the Orion Mobile Wallet has the following features: A one-to-many service managed exclusively for UBL account holders; SMS based, available to subscribers of any mobile service; Sign-up by SMS, linked to UBL account, though the Mobile Wallet is a separate service; Cash-in / out are using conventional ATMs Users without UBL accounts can make deposits, accept transfers and withdraw funds from Orion users with accounts, but non-account holders must conduct the transactions at UBL branches and are required to register with identification; which can be as simple as entering their national ID number with SMS commands on a mobile. The service is also interconnected with UBLs online internet banking and other money transfer services, enabling international remittances to be sent to an Orion account. Features of this service have resulted in UBLs handling of 10-15% of all remittance transfers to Pakistan. MICROFINANCEBANKACTIVITIES Tameer Microfinance bank Tameer MFB has collaborated with a third-party technology provider, the Karachibased Access Group, to develop a debit card type application in which customers are served via a large network of branchless merchants (banking agents) equipped with on-line POS machines. In the early stages, clients have to apply and verify their identity at regional Tameer service centers to become participants in the microfinance program, before an account is opened and banking card issued. Clients can then go to any participating merchant (banking agent) and use the card to carry out transactions, that include account deposits, payments for goods or utilities, limited cash withdrawal, and repayment of their microfinance loans, by swiping the POS, providing a security PIN and selecting options that provide real time processing and verification of transactions. This Branchless Banking approach involves a significant investment and operating costs that necessitate piloting and phased approaches to development, but it has the potential to reach a very large number of unbanked clients.

Final Report

Page 83 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

In August 2008 Tameer reported that its POS network has been completely launched with several application modules including inter-bank transfers and domestic POS to POS remittances with mobile SMS notification. In August, Tameer also had 29 branches plus 22 service centers, which are typically 20 km from the nearest branch. By end of 2008, Tameer expects to have 32 branches and 40 service centers. It has placed 33 POS machines, including 8 mobile ones. Tameer is planning to move into Branchless Banking service with a telecom operator. They have held discussions with three operators and more than one technology supplier. It is believed that Tameer is likely to conclude a joint venture with, or to receive investment from Telenor, which would place it and Telenor (or any other operator with which it concludes a deal) in a good position from which to launch a co-branded Branchless Banking initiative in conformity with the Branchless Banking Regulation. First Microfinance Bank (FMFB) FMFB is associated with the Agha Khan Development Network (AKDN). It provides a variety of microfinance services such as savings, remittance and loan products that are typically group based and that include health, education, housing and home improvement loans. Future products include loans for housing construction. To receive services, clients sign up for accounts at regional FMFB offices or via mobile van branches and are required to have only national identification cards (NIC) for verification. By using service desks instead of branches, FMFB is able to reduce the cost of service delivery, provide more local outlets, and increase client access, which would otherwise be possible only through traditional branches located in regional centers. FMFB has grown by over 50 percent over the last year and reported having 158,000 active borrowers, with 200,000 expected by year end. The approach used by FMF B to now expand more into rural areas has been to conclude an agreement with Pakistan Post Office to place service desks housed in postal offices, and to use mobile banking vans. FMFB has a total of 83 branches, including 28 rural post office based branches. FMFB has also commenced to link up its branches through a VSAT satellite network. 29 are currently linked. It also has developed an open source JAVA based quasionline replicated and updatable (non-centralized) accounting platform, using the same software as AKDN. All local branch transactions are carried out locally on line, while a centralized database updates itself periodically through the communications network. Concurrent work related to FMFB is in piloting a telecom operator-led mobile phone Branchless Banking application tested out in Afghanistan, which is similar to the MPESA initiative in Kenya. Afghan telecom operator Roshan and First MFB Afghanistan are adapting a common MIS system to manage e-money credits that are stored on mobile phone accounts and available for customers to make payments, transfer funds, and make deposits and withdraws in cash via a large network of Roshan agents. This work is providing an invaluable regional test of risks and viability of a model that is being considered for application in Pakistan. In the
Final Report Page 84 of 86

ADB TA 4894-PAK: Improving Access to Financial Services meantime, FMFB is also in discussion with local telecom operators regarding the possibilities for launch of a Branchless Banking initiative. FMFB believes that its agreement with the Pakistan Post Office should place it in a good position for developing an agency model, in collaboration with a telecom operator that could meet the requirements of the Branchless Banking Regulation. However, it is recognized that more work needs to be done to develop the agency model and FMFB believes that the Pakistan Microfinance Network (PMN) could have an important role to play in facilitating such a model; that several microfinance banks might be able to use.

Final Report

Page 85 of 86

ADB TA 4894-PAK: Improving Access to Financial Services

ENDNOTES & REFERENCES

For example, CGAP clearly advocates a transformational approach, which it defines as focused more on the objective of extending BB to who would not be reached profitable with traditional branch-based financial services than on the traditional prudential regulations that have governed the banking industry. It defines additive regulation as merely adding to the range of choices available from the existing mainstream financial service institutions, or enhancing the convenience of their existing customers. See Regulating Transformational Branchless Banking: Mobile Phones and Other technology to Increase Access to Finance, CGAP Focus Note No. 43, January 2008. ii M-Pesa is also being trialed by the Agha Khan Foundation in Afghanistan and under consideration by the First Microfinance Bank in Pakistan iii Even G-Cash operates with a technical platform that emulates that of a bank and has instituted KYC procedures that satisfy the Central Bank of Philippines. It also has several rural banks as partners, who perform KYC / sign-up and cash-in / Out functions. iv Notes on Regulation of Branchless Banking in Pakistan, GGAP, June 2007. v CBR Quarterly Review, Vol. 5, No.3, January March 2006 found at Financial Board of Revenue website: [Link]
i

Final Report

Page 86 of 86