RESOLUTION OF BOARD OF CENTRAL BANK OF THE REPUBLIC OF UZBEKISTAN

of January 2, 2008 No. 1/4

About approval of Rules of the organization of the payment service providers using networks of telecommunications public

According to the laws of the Republic of Uzbekistan "About the Central bank of the Republic of Uzbekistan", "About electronic payments", "About electronic document management" and the resolution of the Cabinet of Ministers of the Republic of Uzbekistan "About measures for further enhancement of carrying out payments when implementing electronic commerce" the Board of the Central bank of the Republic of Uzbekistan decides No. 120 of June 12, 2007:

1. Approve Rules of the organization of the payment service providers using networks of telecommunications public according to appendix.

2. This resolution becomes effective after 10 days from the moment of its state registration in the Ministry of Justice of the Republic of Uzbekistan.

Approved by the Resolution of Board of the Central bank of the Republic of Uzbekistan of January 2, 2008 No. 1/4

Rules of the organization of the payment service providers using networks of telecommunications public

These rules according to the Laws of the Republic of Uzbekistan "About electronic payments", "About electronic document management", the Resolution of the Cabinet of Ministers of the Republic of Uzbekistan No. 120 of June 12, 2007 "About measures for further enhancement of carrying out payments when implementing electronic commerce" determine basic requirements to the organization of payment systems, mechanisms of ensuring information security in information systems in case of access through networks of telecommunications public, including on the Internet, and also structure of details in case of exchange of financial data between subjects of payment systems.

I. General provisions

1. In these rules the following concepts and determinations are used:

payment institute - the legal entity having the property right to the trademarks and (or) service marks identifying payment system, and establishing its rules;

the user of payment system - the legal entity or physical person using services of payment system when implementing electronic payments;

the member of payment service provider - the legal entity rendering to users of this payment system of service in implementation of electronic payments on the basis of the contract with payment institute;

means of cryptographic information security - hardware, program or the hardware and software performing cryptographic transformations of information for ensuring its safety including:

a) means of enciphering - hardware, program and the hardware and software realizing cryptographic algorithms of transformation of information and intended for information security from unauthorized access in case of its processing, storage and transfer on communication channels;

b) means of imitozashchita - hardware, program and the hardware and software realizing cryptographic algorithms of transformation of information and intended for protection against imposing of false information;

c) means of the digital signature - set technical and the software providing creation of the digital signature in the electronic document, confirmation of authenticity of the digital signature, creation of the opened and closed keys of the digital signature;

d) means of coding - the means realizing algorithms of cryptographic transformation of information with accomplishment of part of transformation by manual transactions;

e) means of production of key documents and key documents (irrespective of type of the carrier of key information).

2. The payment institute creating payment system shall develop and approve the rules of payment system specified in article 5 of the Law of the Republic of Uzbekistan "About electronic payments".

3. The organization of intra bank payment systems is performed on the basis of the license represented by the Central bank according to Regulations on order of registration and licensing of activities of banks (reg. No. 2014 of October 8, 2009).

Other payment resident organizations creating systems of retail payments shall be registered according to the legislation.

4. The payment institute shall keep the list of members of system of retail payments with whom it signs agreements, with assignment to each of them of sequence number with indication of all points of servicing (with addresses), numbers of the signed agreement and date of the agreement.

II. Rules of ensuring information security in information systems of payment systems

5. Rules of ensuring information security in the automated bank systems, including in banks are determined by the organization of server rooms according to the Instruction "About the organization of protection of electronic information in banks of the Republic of Uzbekistan" (reg. No. 1047 of July 9, 2001) and other regulatory legal acts of the Central bank.

6. For prevention of unauthorized access and leakage of the commercial information the following requirements to server rooms of the payment institutes which are not banks are established:

1) main walls, reliable overlappings and lattices;

2) the strong doors equipped with special coded or other safe locks;

3) remedies against external observation;

4) availability of the security fire alarm, if necessary the security alarm system is connected to the panel of department of protection of law-enforcement bodies.

7. For protection of servers of payment system against external impacts firewalls (Firewall) are established. In banks separate application servers for work in systems of active remote control of bank accounts and connections of other payment systems are installed.

8. Authentication of users of payment system in case of the admission to payment system is performed with the help:

1) login and the password (numerical and symbolical combination from at least 8 signs);

2) number and PIN code (usually symbolical combination from 14 signs), bank card;

3) login and the password in combination with disposable variable codes.

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info