A Payment Solution Service Providers (PSSP) licence is a financial licence within the payments system which is issued by the Central Bank of Nigeria (CBN). A PSSP licence authorizes the licensee to provide and operate payment processing gateway and portals, solution/application development, and merchant service aggregation and collections services. A  PSSP license does not provide the authorization to hold customers’ funds or create and issue wallets. PSSPs are predominantly Financial Technology (FinTech) companies that enable  and facilitate  online and offline payments solutions which include collections, check-out, biller aggregation and payout services.

The CBN is the regulatory authority that issues PSSP licenses in Nigeria. The CBN also provides constant regulatory oversight over the activities of PSSP licensees in Nigeria.

Who can Apply for a PSSP Licence in Nigeria

Only a company that is duly registered with the Corporate Affairs Commission (CAC) in Nigeria and also meets the minimum share capital requirements and other regulatory requirements of the CBN can apply for a PSSP licence in Nigeria.

The Process of Obtaining a PSSP Licence from the CBN in Nigeria

A PSSP licence is processed in two stages viz:

• Approval-in-Principle (AIP): This is the preliminary stage of obtaining a PSSP license. During this stage, an application is to be made to the CBN for the grant of the license and they are expected to give an Approval-in-Principle or reject the application. Where an AIP is given, it is only valid for a period of six months. The AIP does not authorize the applicant to commence operation but only allows the applicant to take steps towards obtaining the final licence.
• Final Licence: The applicant is required to consolidate the AIP stage by taking steps to ensure its readiness for commencement of operation, notifying the CBN of its readiness to commence operation, by paying and applying for final licence. Upon the grant of the final licence, the applicant can commence its operations.

The process of obtaining a PSSP licence from the AIP stage to the final licence stage involves the following:

1. Write an application letter for a PSSP license which is addressed to the Director, Payments Systems Management Department of the CBN.
2. The application letter is accompanied with the required documents which include:

• Certificate of incorporation of the company with the Corporate Affairs Commission (CAC), with a share capital of N100,000,000 (One Hundred Million Naira)
• Memorandum and Articles of Association of the company
• Form CAC 2A (Return of Allotment of shares)
• Form CAC 7A (Particulars of Directors)
• Tax Clearance Certificate (TCC) and Tax Identification Number (TIN) of the Company
• Company’s profile
• Details of ownership
• Board structure
• Business plan
• Information Technology policy
• Dispute resolution framework
• Necessary certifications such as Payment Card Industry Data Security Standard (PCIDSS), Payment Terminal Service Aggregator (PTSA), etc.
• Evidence of payment of the non-refundable application fee of N100,000 (One Hundred Thousand Naira).
• Evidence of the deposit of the refundable minimum capital of N100,000,000 (One Hundred Million Naira). This is required to be made in full (one lump sum) and in the name of the applicant.

3. The CBN assesses the application for the PSSP licence and the accompanying documents and if it is satisfied with the application, it proceeds to grant an Approval-in-Principle.

4. Upon obtaining AIP from the CBN, the applicant then makes payment of the licence fee of N1,000,000 (One Million Naira) to the CBN designated account and proceeds to apply for a final licence within six months of obtaining AIP.

5. The CBN inspects the registered place of business of the applicant company and its readiness to commence operation and proceeds to issue the final licence if it is satisfied with the outcome of its inspection.

Validity and Renewal of PSSP Licence

PSSP licence validity period is as determined by the CBN and renewable if the operations of the PSSP licensee is satisfactory to the CBN. Recently, CBN renewed Cellulant’s PSSP licence and this shows the satisfaction of the CBN with the services of the company in providing payment solutions in Nigeria. Thus, the renewal of a PSSP licence by the CBN is a vote of confidence on the operation of a PSSP licensee.

Conclusion

A Payment Solution Service Providers (PSSP) licence is an important licence within the Nigerian payment systems which enables the provision of financial services such as the operation of payment processing gateway and portals which is utilized by merchants to accept debit or credit card purchases from customers. A PSSP licensee provides both online and offline payment solutions. A PSSP licence is obtainable from the CBN by submitting an application to the CBN and paying the required application and license fees within the stipulated timelines.

Please note that the contents of this article are for general guidance on the Subject Matter. It is NOT legal advice.

For further information or to see our other service offerings, please visit www.goldsmithsllp.com  or contact:

This article provides an insight into the provisions of the Guidelines.

What is Contactless Payment?

According to the Guidelines, contactless payment is a payment system that involves the use of contactless technology that enables an alternative payments method whereby payment instruments such as pre-paid, debit and credit cards, stickers, fobs, wearable devices, tokens and mobile electronic devices are used without physical contact with devices.

Aims of the Guidelines

The guidelines aim to provide the minimum standards and requirements for the operations of contactless  payments in Nigeria, and also specify the roles and responsibilities of the stakeholders involved in contactless payments in Nigeria.

Who are the Participating Stakeholders?

The participating stakeholders in contactless payments in Nigeria are:

1. Acquirers
2. Issuers
3. Payment Schemes
4. Card Schemes
5. Switching Companies
6. Payments Terminal Service Providers (PTSPs)
7. Payments Terminal Service Aggregator (PTSA)
8. Merchants
9. Terminal Owners
10. Customers
11. Any other stakeholder/participant(s) as may be designated by the CBN.

The stakeholders are required to obtain CBN’s approval for contactless payments products and for innovative use cases and value-added services.

Minimum Standards for Contactless Payments in Nigeria

The participating stakeholders that process and/or store customers’ information are obliged to ensure that their terminals, applications and processing systems comply with the below standards at the minimum:

1. PA DSS – Payment Application Data Security Standard
2. PCI PED – Payment Card Industry Pin Entry Device
3. PCI DSS – Payment Card Industry Data Security Standard
4. Triple DES – Data Encryption Standards shall be the benchmark for all data transmitted and authenticated between each party. The Triple DES algorithm is the minimum standard.
5. AES – Advanced Encryption Standards
6. EMV – the deployed infrastructure must comply with the minimum EMV requirements for Contactless acceptance
7. ISO27001 – Information Security Management System
8. Other standards as may be specified by CBN from time to time.

Each participating stakeholder (operator) is mandatorily required to maintain valid certification to the above standards and regularly review the status of its systems, applications, networks and devices, to ensure they remain compliant.

Roles and Responsibilities of Stakeholders

The Guidelines provide for the separate roles and responsibilities of the stakeholders as follows:

Acquirers

Some of the roles and responsibilities of acquirers with respect to contactless payments in Nigeria include:

1. Only CBN licensed institutions can serve as acquirers for contactless payments.
2. Acquirers shall ensure that their applications, instruments, tokens and devices meet current standards and specifications for contactless payments.
3. Acquirers shall execute contactless payments agreements with parties for utilizing contactless platforms for payments.
4. Acquirers shall be able to accept all cards or payments instruments used in Nigeria.

Issuers

Some of the roles and responsibilities of Issuers with respect to contactless payments in Nigeria include:

1. Only CBN licensed institutions shall serve as Issuers for contactless payments.
2. Issuers shall ensure that activation of contactless payment is at customer’s instance, and with full consent.
3. Issuers shall ensure that their applications, instruments, tokens and devices meet current standards and specifications for contactless payments.
4. Issuers shall activate only accounts and wallets with Bank Verification Number (BVN).
5. Issuers shall ensure that transaction limits are strictly adhered to.

Payment Schemes and Card Schemes

Payment Schemes and Card schemes have the same roles and responsibilities with respect to contactless payments in Nigeria. These roles and responsibilities include:

1. Ensuring that all contactless transactions are processed online or submitted via current processing specifications.
2. Implement a documented risk management process to identify and treat risks associated with contactless payments.

Switching Companies

Switching companies have the responsibility of ensuring that contactless transactions consummated by all payment instruments issued in Nigeria are successfully switched between acquirers and issuers.

Payment Terminal Service Providers (PTSPs)

Some of the roles and responsibilities of PTSPs with respect to contactless payments in Nigeria include:

1. Ensuring that all their terminals for contactless payments are functional at all times.
2. Ensure they have adequate support infrastructure that support coverage for merchants.
3. Ensure all deployed devices and terminals have support service contact information.
4. Prevent instrument clashes even when multiple contactless payments devices are present.

Payment Terminal Service Aggregator (PTSA)

The PTSA shall, on an annual basis, or more frequently, certify POS terminals for contactless payments to ensure POS terminals meet the approved standard for the industry and also put in place a risk management process.

Merchants

Some of the roles and responsibilities of merchants with respect to contactless payments in Nigeria include:

1. Ensuring that deployed devices and applications are available for contactless payments of goods and services.
2. Merchants shall be held liable for fraudulent contactless payments arising from negligence/connivance.
3. Contactless payment transaction value and associated charges shall be clearly communicated to the customer prior to consummation of the transaction.
4. Display the contactless symbol

Terminal Owners

Terminal owners are to ensure that all terminals and devices are compliant with appropriate minimum specifications and also ensure the implementation of a documented risk management process.

Customers

Customers have the option to opt-in by applying and consenting to applicable terms and conditions and can withdraw without prior notice to the issuer. Customers are also obliged to authenticate contactless payments transaction as may be required, exercise due diligence in carrying out contactless payments transactions and protect their payments instruments from unauthorized use.

Transaction Limit

The CBN is to determine the appropriate transaction and cumulative daily limits for contactless payments from time to time. However, stakeholders are permitted to set limits in line with CBN’s limits.

Contactless payment transactions below stipulated daily limits may not require customers’ authorization such as token, biometrics, pin, etc. while higher-value contactless payments shall require customer verification such as pin, mobile code, biometric, etc.

Sanctions and Penalties

Stakeholders are required to comply with the provisions of the Guidelines and other relevant regulations of the CBN. Failure to comply attract appropriate sanctions and penalties as may be determined by the CBN.

Conclusion

The Exposure Guidelines provides a regulatory framework for the activities and conduct of affairs of the stakeholders in the contactless payments system in Nigeria. When the Guidelines become operational, all stakeholders will be required to conduct their affairs and carry out their roles in accordance with the minimum set standards under the Guidelines.

Please note that the contents of this article are for general guidance on the Subject Matter. It is NOT legal advice.

For further information or to see our other service offerings, please visit www.goldsmithsllp.com  or contact: