Digital Banking Consumer Protection in Iraq
Digital Banking Consumer Protection in Iraq Consumer Protection for Iraqi Digital Banks: A Legal Obligation, Not a Marketing Choice When a digital bank has no branches, no tellers, and no physical touchpoints, the legal framework for consumer protection becomes the primary mechanism through which customers are safeguarded. Every interaction is digital, every contract is electronic, and every service failure happens remotely. This reality makes consumer protection obligations more not less consequential for a digital bank than for its traditional counterpart. The Central Bank of Iraq’s digital bank framework grounds consumer protection in three legal sources: Iraqi banking legislation requiring honest, transparent, and fair dealings with customers; the CBI’s Standards Booklet specifically Standard B6 on customer service which establishes minimum mandatory service levels; and internationally recognized principles for financial consumer protection developed by bodies including the G20 and the World Bank. 1. Mandatory Pre-Contract Disclosure: What Must Be Disclosed and When Every digital bank in Iraq is legally required to make complete and clear disclosures to customers before any contract is entered into or any service is activated. This disclosure obligation is not satisfied by burying information in lengthy terms and conditions, it requires active, prominent, and intelligible communication of material information. The following must be disclosed before any contract: All fees and commissions applicable to the product or service including interest rates on deposits and credit facilities, card issuance and renewal fees, transaction charges, currency conversion fees, and any administrative or maintenance charges Full terms and conditions in Arabic, drafted in clear and accessible language for non-specialists, with material terms and risks including cancellation conditions and default consequences prominently highlighted rather than embedded in standard text The customer’s rights and obligations, including cancellation rights within any applicable cooling-off period, complaint rights and the mechanism for exercising them, and the right to access their personal data and account statements The dispute resolution mechanisms available to the customer, including the bank’s internal complaints procedure and the customer’s right to escalate to the CBI Banking Supervision Department The scope of deposit guarantee coverage applicable to the customer’s accounts specifically, which accounts are covered, up to what limit, and what is excluded 2. Prohibited Commercial Practices The combination of Iraqi banking legislation and the CBI’s consumer protection standards prohibits a digital bank from engaging in the following practices in its dealings with customers: Misleading marketing and advertising: any promotional content whether on the bank’s digital platform, mobile application, social media, or any other channel that contains false or misleading information, conceals material fees or charges, makes promises that cannot be delivered, or creates a false impression of the bank’s products or services constitutes a legal violation Tied selling: requiring a customer to subscribe to an additional product or service as a condition for accessing the core service they have requested for example, requiring the purchase of insurance as a condition for a credit facility Unjustified discrimination: refusing service, imposing harsher terms, or providing inferior service to customer categories without a legitimate and objectively justifiable basis Exploiting customer financial vulnerability: targeting financially stressed customers with unsuitable high-cost credit products, or marketing products that are clearly inappropriate for the customer’s financial situation and capacity 3. CBI Standard B6: The 24/7 Contact Centre Requirement Standard B6 of the CBI’s Standards Booklet requires every digital bank to provide the minimum customer support coverage specified by the CBI. Full compliance with this standard is required from Assessment Cycle 1 meaning the support infrastructure must be fully operational before the bank’s first assessment in H2 2027. The minimum requirement under Standard B6 includes: A telephone contact centre available 24 hours a day, 7 days a week digital-only support channels including in-app chat, email, and automated responses do not satisfy this requirement Immediate emergency response capability for critical situations including suspected fraud on a customer’s account, card blocking, account freezing, and system outages affecting customer access A complaint tracking system that notifies customers of the status of their complaint at each processing stage Support available in Arabic A digital bank that launches pilot operations without a fully functional 24/7 telephone contact centre is in breach of Standard B6 from its first day of customer-facing operations. This is not a transitional requirement , it is a day-one obligation. 4. Responsible Lending: The Legal Obligation Before Every Credit Decision The principle of responsible lending, embedded in Iraqi banking legislation and reinforced by the CBI’s framework requires the digital bank to assess a customer’s ability to repay before extending any credit facility. This assessment must be based on objective data: income information provided by the customer and verified where practicable, existing financial obligations and debt service commitments, and the customer’s credit history as retrieved from the Iraqi credit registry. A credit facility extended without this assessment creates two categories of legal exposure for the bank: regulatory liability to the CBI for breach of the responsible lending standard, and civil liability to the customer if the facility causes financial harm that the assessment would have identified and prevented. In the digital banking context where credit decisions may be made algorithmically at scale, the responsible lending obligation applies to every individual credit decision, not just to decisions above a certain threshold. 5. Consumer Protection in the Digital Environment: Specific Risks The digital-only operating model creates specific consumer protection risks that traditional banks do not face to the same degree. The CBI’s framework addresses these risks directly: Digital identity verification: account opening procedures must be sufficiently robust to prevent the opening of fraudulent accounts in a customer’s name synthetic identity fraud and account takeover at onboarding are particular risks in digital banking environments Transaction security and real-time notification: customers must receive immediate notification of every transaction executed on their account, enabling rapid identification of unauthorized activity Digital account closure and data portability: customers have the right to close their account through digital means and to request their data in a portable format for transfer to another institution, the bank may not
Digital Bank Agent
Digital Bank Agent Overview The CBI’s digital bank licensing regulations introduce a specific legal category for the digital bank agent, a third party authorized by the digital bank to provide defined financial services on the bank’s behalf. This is a legally distinct arrangement from a mere vendor or technology provider relationship: the agent acts as a regulated extension of the bank’s service delivery capability, primarily for cash-in and cash-out transactions. This article examines the legal status of the digital bank agent under Iraqi law and the CBI’s framework, the scope of activities that agents are authorized to perform, the liability framework that governs the relationship between the bank and its agents, and the ongoing compliance obligations that apply to agent management. 1. Legal Basis and Definition The concept of the digital bank agent is established in the digital bank licensing regulations issued by the CBI. The regulations define the digital bank agent (وكيل المصرف الرقمي) as a person authorized by and acting on behalf of the digital bank, designated and approved by the CBI, with their appointment confirmed by the relevant regulatory authority. The CBI’s regulations are explicit that the agent must not be from among the non-banking financial institutions licensed under this framework. The agent relationship is therefore a licensed, regulated arrangement not a commercial relationship that can be entered into freely. The digital bank cannot appoint an agent without CBI involvement in the designation and approval process, and the agent must satisfy the CBI’s applicable qualification and compliance requirements. 2. Permitted Scope of Agent Activities The CBI’s regulations define the scope of agent activities by reference to the primary function that agents serve: enabling customers to conduct cash transactions through the agent’s physical presence. The permitted activities of the digital bank agent are focused principally on: Cash-in operations: accepting cash deposits from the digital bank’s customers and crediting those amounts to the customer’s account with the digital bank in real time. The agent does not hold deposits, it acts as a conduit for the customer’s cash to reach the digital bank. Cash-out operations: enabling the digital bank’s customers to withdraw cash from their accounts through the agent, in accordance with the controls and limits established by the CBI. The agent disburses cash from its own float, which is reimbursed by the digital bank through the settlement process. The agent’s permitted activities are limited to what the CBI specifies. The agent is not authorized to make credit decisions, open accounts, conduct AML/CFT assessments on behalf of the bank, or provide financial advice. Any activity outside the defined scope is unauthorized and may expose both the agent and the bank to regulatory sanction. 3. Bank’s Full Legal Responsibility for Agent Conduct The most significant legal feature of the agent framework from the perspective of the digital bank and its founders is the allocation of regulatory liability. The CBI’s regulations state in express terms that the digital bank bears full and unrestricted responsibility and accountability for compliance with the AML/CFT obligations, and further that the digital bank bears full legal responsibility for all actions of its agents in the performance of their authorized activities. This means that: If an agent breaches AML/CFT procedures for example, by accepting a cash deposit without completing the required customer identification, the bank, not the agent, bears the regulatory consequences of that breach. The agent’s conduct is imputed to the bank for regulatory purposes. If an agent misappropriates customer funds, the bank is responsible for making the customer whole. The bank’s legal relationship with the agent, including its right of recourse against the agent, is a matter for the commercial agreement between them but this does not affect the bank’s primary liability to the customer and to the regulator. All agents must operate exclusively through the digital systems and applications that are under the bank’s control and that implement the bank’s transaction limits and monitoring rules. Agents may not use independent or unauthorized systems. All first-level complaints from customers arising from agent transactions must be handled directly by the digital bank. The bank may not require customers to resolve complaints through the agent, the bank is responsible for the entire customer service chain. 4. Agent Selection and Ongoing Oversight Obligations The digital bank’s responsibility for agent conduct creates a corresponding obligation to exercise rigorous oversight over agent selection and ongoing performance. The CBI’s regulations require that the bank be responsible for and supervise agents in a manner that ensures they operate in accordance with the bank’s approved procedures and with the CBI’s regulatory requirements. Specifically, the bank must: Apply appropriate AML/CFT controls to the agent network, including conducting risk assessments of each agent location, implementing transaction monitoring rules specific to agent channels, and providing AML/CFT training to agent personnel. Ensure that agents operate only within the digital systems provided by the bank, which must enforce all applicable transaction limits, customer verification requirements, and reporting obligations. Conduct regular performance reviews and compliance assessments of each agent, with documented findings and remediation actions for any identified deficiencies. Immediately terminate the appointment of any agent that fails to comply with the bank’s operational standards or that presents unacceptable compliance risk. Notify the CBI of any material compliance failure by an agent within the timeframes prescribed by the CBI’s instructions. 5. The Commercial Agreement Framework While the regulatory framework establishes the legal basis for the agent relationship, the commercial terms of the arrangement between the bank and its agents are governed by a formal agency agreement. This agreement must be consistent with the CBI’s requirements and must, at a minimum, address: The specific scope of authorized activities and any applicable transaction limits The bank’s right to audit the agent’s compliance with the agreement and with regulatory requirements The agent’s obligations in relation to AML/CFT, customer data protection, and record-keeping The indemnification arrangements between the bank and the agent in respect of losses arising from agent conduct Termination provisions — including the bank’s right to
Digital Bank – Credit Registry Obligations
Digital Bank – Credit Registry Obligations Overview Standard B11 of the CBI’s Standards Booklet imposes a mandatory obligation on every digital bank to participate in Iraq’s credit registry system. This obligation has two dimensions: the bank must report its credit exposures to the registry, and it must query the registry before extending credit to customers. Both obligations arise from Assessment Cycle 1 and reflect the CBI’s commitment grounded in both Iraqi banking legislation and international supervisory principles to the responsible use of credit information in the lending process. This article examines the legal scope of the credit registry obligation, the specific requirements imposed by Standard B11 and Iraqi banking legislation, the bank’s data quality obligations, and the interaction of credit registry participation with the bank’s credit risk management framework. 1. Legal Basis The credit registry obligation arises from two legal sources. First, Iraqi banking legislation imposes obligations on all licensed banks to participate in credit information systems operated or designated by the CBI. Second, the digital bank framework’s Standard B11 reinforces and supplements these obligations with specific requirements calibrated to the digital bank model. The CBI operates or designates credit information services including the I-Score credit bureau through which lenders can access a borrower’s credit history across all regulated institutions. Participation in this system is not optional for licensed banks. The bank’s legal obligation extends both to querying the system before lending and to reporting its own exposures to the system so that other lenders can access accurate information. 2. Pre-Lending Inquiry Obligations Before extending any credit facility to a customer, the digital bank is legally required to query the credit registry and to obtain a credit report on the prospective borrower. This obligation applies regardless of the size or maturity of the credit product being offered. The legal significance of the pre-lending inquiry obligation is threefold: Risk management: the credit report informs the bank’s credit decision and pricing. A borrower with a poor credit history including defaults, restructured facilities, or multiple simultaneous credit exposures presents a materially higher credit risk. The bank’s credit policy must specify how credit history information is used in lending decisions. Responsible lending: the pre-lending inquiry obligation gives effect to the responsible lending principle embedded in Iraqi banking legislation, which requires banks to assess a borrower’s ability to repay before extending credit. A bank that extends credit without querying the registry cannot demonstrate compliance with this principle. Regulatory defence: in the event of a credit loss, a bank that failed to query the registry before extending the relevant facility may face supervisory action for breach of the lending standard. Evidence of registry queries maintained as part of the credit file is a key element of demonstrating compliance. All pre-lending queries must be documented in the customer’s credit file. The query result the credit report must be retained for the duration of the credit facility and for a defined period thereafter in accordance with data retention requirements. 3. Credit Data Reporting Obligations In addition to querying the registry, every digital bank must report its credit exposures to the registry on the schedule and in the format prescribed by the CBI. The reporting obligation covers: New credit facilities: every new credit facility extended by the bank must be reported to the registry within the timeframe prescribed by the CBI’s instructions. Late reporting is a breach of the credit registry obligations. Repayment performance: the bank must report on the repayment performance of each borrower including on-time payments, late payments, defaults, and partial payments. This reporting creates the credit history record that other lenders can access when the borrower seeks credit elsewhere. Facility changes: any material change to a credit facility including restructuring, extension of maturity, change of security, or write-off must be reported to the registry promptly. Closure of facilities: when a credit facility is repaid and closed, the bank must report the closure and the final repayment status to the registry. The registry record must accurately reflect the facility’s full lifecycle. Data accuracy is a legal obligation not merely a best practice. The bank is responsible for the accuracy of the data it reports to the registry. Inaccurate reporting whether through system failures, manual error, or intentional misreporting is a breach of both the credit registry obligations and the bank’s general obligation to maintain accurate records. 4. Interaction with the Credit Risk Framework The credit registry obligations are directly embedded in the digital bank’s credit risk management framework. The bank’s credit policy must specify how registry information is used in credit decisions, how registry query results are documented, and how the bank manages any discrepancy between the registry data and information provided by the borrower. During the pilot phase, where credit products are limited to small-value, short-term facilities subject to CBI case-by-case approval, the credit registry obligation applies in full from the first day the bank offers any credit product. The small value of permitted pilot phase credit facilities does not exempt them from the pre-lending query and reporting requirements. 5. International Standard Alignment The credit registry obligations reflect the internationally recognized importance of credit information systems in the sound management of bank credit risk. The World Bank’s General Principles for Credit Reporting Systems which represent the international benchmark for credit bureau governance require that credit reporting systems operate with comprehensive coverage, accurate data, fair access, and robust data protection. The CBI’s requirements are consistent with these principles. From a Basel perspective, the effective use of credit information including external credit assessments from recognized registries is a recognized component of the Internal Ratings-Based approach to credit risk measurement under the Basel Capital Framework. While Iraq’s digital banks will not initially apply advanced Basel approaches, the use of credit registry data as part of the credit assessment process aligns the bank with international credit risk management principles from day one.
Digital Bank – Deposit Protection
Digital Bank – Deposit Protection Overview Deposit protection is both a licensing condition and a structural feature of the digital bank framework in Iraq. Standard B10 of the CBI’s Standards Booklet makes participation in the national deposit protection system a mandatory requirement for every digital bank. This obligation is not aspirational and not phased full compliance must be demonstrated from Assessment Cycle 1, with the registration process completed before the bank commences pilot operations. This article examines the legal framework for deposit protection as it applies to digital banks in Iraq, the specific obligations imposed by Standard B10, the structure of the deposit guarantee system, and the critical distinction between the protections available to depositors and the absence of equivalent protection for investors and shareholders. 1. Legal Basis: CBI Standard B10 Under Standard B10, every digital bank is legally required to register with the Iraqi Deposit Guarantee Company and to comply with all applicable requirements of the deposit protection system. This requirement operates alongside and supplements the provisions of Iraqi banking legislation relating to depositor protection. The standard requires full compliance from Assessment Cycle 1 (H2 2027). In practice, because registration with the deposit guarantee company is itself a process that takes time, and because the bank must be registered before it can lawfully hold deposits from the public, registration must be initiated and completed well before the first assessment cycle at the point of preliminary approval at the latest. 2. Mandatory Participation Obligations Participation in the Iraqi deposit guarantee system imposes the following specific legal obligations on every digital bank: Registration: the digital bank must complete a formal registration with the Iraqi Deposit Guarantee Company. Registration requires the submission of specified organizational and financial information, including the bank’s ownership structure, paid-up capital, and corporate documents. Premium payments: the bank must pay monthly guarantee premiums to the Deposit Guarantee Company. The premium rate is calculated on the basis of the bank’s covered deposit base. These payments are a continuing legal obligation failure to pay premiums is a breach of the licensing conditions and may result in termination of coverage, which would itself be a ground for license cancellation. Depositor records: the digital bank must maintain depositor records in the format specified by the Deposit Guarantee Company, and must submit updated depositor data to the Company at the frequency and in the format prescribed. The accuracy of these records is a legal obligation inaccurate or incomplete depositor data is a compliance breach. Data sharing: the bank must share depositor data with the Deposit Guarantee Company on a regular basis in accordance with the Company’s instructions. This data-sharing obligation interacts with data protection requirements, the bank’s data sharing arrangements must be documented in its privacy policies and customer terms. Notification obligations: the bank must notify the Deposit Guarantee Company of any event that may affect the coverage of deposits, including changes in the bank’s financial position, changes in the category of accounts held, or any regulatory action taken against the bank. 3. Scope of Deposit Protection The deposit guarantee scheme protects retail depositors up to the limits established by the Iraqi Deposit Guarantee Company’s governing rules. The key legal features of the coverage are: Coverage limits: deposits are protected up to the guarantee limit per depositor per institution. Depositors with amounts above the limit are unprotected in respect of the excess above the limit. The guarantee limit is set by the Deposit Guarantee Company and may be adjusted by regulatory decision. Covered products: the scheme covers standard deposit accounts, current accounts, savings accounts, and term deposits. The coverage of other products, including accounts held in connection with payment services, depends on the specific rules of the scheme and how those products are classified under Iraqi law. Exclusions: certain categories of depositors and deposits are excluded from the scheme’s coverage. These typically include deposits held by financial institutions, deposits held by large corporate entities above a certain size threshold, and deposits that are themselves instruments of fraud. The specific exclusion categories are determined by the Deposit Guarantee Company’s rules. Timing of payout: in the event of a bank failure, the deposit guarantee fund pays out covered depositors within the timeframe specified in the Company’s rules. The fund’s ability to pay depends on the adequacy of the premiums collected from member banks. 4. Critical Legal Distinction: Depositors vs. Shareholders The most significant legal feature of the deposit protection system from the perspective of investors and founders is the distinction between depositor protection and shareholder protection. The deposit guarantee system protects depositors. It provides no equivalent protection to shareholders or equity investors. In the event of a digital bank’s license being cancelled and the bank being placed into liquidation, the legal priority of claims is as follows: Priority Claimant Category Protection First Secured creditors Secured claims paid from the assets over which security has been taken Second Covered depositors (up to guarantee limit) Paid from the Deposit Guarantee Fund, protected up to the guarantee limit Third Unsecured depositors above guarantee limit Claim as unsecured creditors in the liquidation, recovery depends on residual asset value Fourth Other unsecured creditors Paid from residual assets after depositors, no guarantee Fifth (last) Shareholders and equity investors Paid only from any remaining residual after all creditors, no guarantee, no protection mechanism This priority structure means that in a distressed wind-up scenario which is precisely the scenario in which a digital bank is most likely to be in liquidation equity investors may recover little or nothing from their investment. The risks of this outcome are magnified where the bank’s failure occurs during the pilot phase, before substantial business has been built and before the bank’s asset base has grown to a level that could support meaningful recovery by shareholders. 5. International Standard Alignment The CBI’s mandatory deposit protection requirement aligns with the International Association of Deposit Insurers (IADI) Core Principles for Effective Deposit Insurance Systems, which are the internationally recognized benchmark for deposit guarantee
Digital Bank- Payment Systems Integration
Digital Bank- Reporting Transparency, External Audit & Internal Controls Overview Two of the most consequential governance obligations imposed on digital banks in Iraq and among the least understood by founding groups are the related party transaction regime and the supermajority board approval requirement. These obligations are grounded in Iraqi banking legislation, reinforced by the CBI’s digital bank regulatory framework, and designed to prevent a class of institutional failure that is well documented internationally: the subordination of a bank’s interests to those of its controlling shareholders. This article examines both obligations in precise legal terms, sets out the CBI’s specific requirements as issued in its regulatory instruments, and explains how these requirements interact with international standards for related party governance in supervised financial institutions. 1. Legal Basis The digital bank framework expressly grounds its related party and governance requirements in Iraqi banking legislation. Standard D1 of the CBI’s Standards Booklet which governs related parties and conflicts of interest applies to all digital banks and must be in full compliance from Assessment Cycle 1. This standard operates in addition to, not instead of, the requirements under Articles 22 and 17 of Iraqi banking legislation, which set out foundational rules on bank ownership and board conduct. The framework’s instruction is explicit: its requirements supplement existing Iraqi law and do not displace it. A digital bank must therefore comply with both layers, the baseline requirements of Iraqi banking legislation and the additional, more demanding requirements of the CBI’s digital bank framework. 2. Definition of Related Party: CBI’s Comprehensive Scope The CBI has adopted a deliberately broad definition of related party, one that goes beyond conventional legal ownership concepts. Under the framework, a related party includes any individual or legal entity connected through family, business, or political relationships defined as follows: Family relationships: individuals connected by blood, marriage, or kinship to the fourth degree. The framework enumerates all four degrees explicitly: first degree (parents, children), second degree (siblings, grandparents, grandchildren), third degree (aunts, uncles), and fourth degree (first cousins). This means that shareholding and board membership analysis must extend across the full family network of each founder, director, and senior executive. Business relationships: individuals or entities currently in a commercial partnership, holding shares in the same institution, serving together on the same board, or where one party works for a company owned or controlled by the other party. Business connections are assessed on a substantive basis, formal corporate separation does not sever a related party relationship where common control or shared economic interest exists. Political relationships: individuals or entities connected by family or business ties to any person carrying political risk, or subject to the influence or control of any party exercising power or influence. This category is particularly significant given the specific political risk considerations applicable in Iraq. The legal consequence of this definition is material: all shareholding limits, board independence requirements, and transaction approval thresholds must be assessed on a consolidated basis that aggregates the holdings and positions of all related parties, not merely those of the individual or entity acting alone. 3. Related Party Transaction Obligations The framework requires that all digital banks maintain comprehensive internal policies governing transactions with related parties. These policies must address conflict of interest controls, market abuse and inside information procedures, professional conduct standards, and arrangements for approving and notifying transactions involving the personal accounts of directors and senior management. 3.1 Credit Facilities to Related Parties Credit extended to related parties is subject to the limits established under Iraqi banking legislation and the CBI’s regulatory framework. The key legal requirements are: All credit facilities to related parties must be approved by a supermajority of the board defined as approval by a proportion of votes equal to or exceeding two-thirds of board members. Credit extended to related parties must be reported to the CBI on a quarterly basis. The report must include a full list of all related party exposures, the terms of each facility, and the basis on which the board approved the transaction. Related party credit must be extended on market terms, no preferential pricing, security, or covenant arrangements are permitted. Any deviation from arm’s length terms requires enhanced board scrutiny and specific CBI notification. The aggregate exposure to all related parties must be maintained within the limits established by Iraqi banking legislation and any supplementary instructions issued by the CBI. Digital banks must monitor these limits continuously and have board-approved procedures for managing proximity to and breaches of such limits. 4. Supermajority Board Approval Requirement The CBI’s framework introduces a supermajority board approval requirement for a defined category of significant decisions. This requirement means that certain decisions cannot be taken by a simple majority of the board, they require the approval of at least two-thirds of all board members. The CBI defines supermajority approval as a proportion of votes equal to or exceeding two-thirds. The decisions that require supermajority board approval are: Removal of a board member Appointment or removal of the CEO, CTO, CFO, Chief Risk Officer, Compliance Officer, MLRO, or Head of Internal Audit subject to CBI approval for all relevant appointments Approval of mergers, acquisitions, or significant asset sales exceeding a threshold set by the CBI Changes to the bank’s internal regulations or articles of association, and the issuance of new shares Capital restructuring, or any action that would dilute existing shareholders Approval of any transaction with a related party, in accordance with Standard D1 of the framework 4.1 International Standard Background The supermajority requirement reflects a well-established international governance principle. The Basel Committee on Banking Supervision’s guidance on corporate governance for banks, and the Financial Stability Board’s principles on risk governance, both emphasize the importance of board-level controls that cannot be circumvented by a controlling shareholder acting through a simple majority of appointed directors. By requiring supermajority approval for related party transactions and key personnel decisions, the CBI has implemented a structural protection aligned with these international standards. For founders and investors, the practical implication
Digital Bank – License Suspension and Revocation
Digital Bank – License Suspension and Revocation Overview The checklist is not a substitute for specific legal advice, the requirements are complex, the details matter, and the consequences of non-compliance are severe. It is, however, a framework for ensuring that the principal legal obligations have been identified, assigned, and tracked throughout the establishment process. Phase 1: Pre-Application (Before 30 June 2026) Corporate Structure Decision on corporate structure confirmed Iraqi joint stock company to be established or used as the licensing vehicle Articles of association and internal regulations drafted to include all mandatory framework provisions (nomination restrictions, pledge prohibitions, tag-along rights, rights of first refusal) Shareholder agreement prepared with all mandatory provisions Related party mapping exercise completed all related party relationships identified and holdings confirmed within applicable limits QII confirmed in ownership structure with qualifying shareholding of minimum 9.999%; QII eligibility documentation compiled Capital IQD 30 billion initial capital tranche paid and evidence of payment available for submission Funding commitments in place for second tranche (IQD 35 billion, due H2 2027) and third tranche (IQD 35 billion, due H2 2028) Capital structure confirmed to include at least 50% Tier 1 capital 15% non-releasable reserve mechanism understood and reflected in investor documentation Governance Nine proposed board members identified; composition confirms at least six independent directors with at least three nominated by QII(s) At least three board members confirmed to have qualifying technical expertise in digital banking Board member qualifications and credentials compiled for fit and proper assessment Fit and proper assessment commissioned with CBI-approved independent firm All five mandatory board committees identified with proposed chairs confirmed as independent directors Senior management team identified; all positions filled or in active recruitment MLRO candidate identified confirmed as Iraqi national with required qualifications and certifications Senior management qualifications and credentials compiled for fit and proper assessment Business Plan and Documentation Comprehensive business plan completed in Arabic and English covering strategy, products and pricing, target customers, operational model, five-year financial projections, technology plan, risk framework, and compliance programme Technology Plan and Architecture document completed with Tier 1 vendor names, software details, and preliminary contracts Policy framework completed: information security policy, risk management policy, compliance policy, AML/CFT policy, anti-fraud and anti-corruption policy AML/CFT and sanctions programme structure documented Physical headquarters within Iraq identified and confirmed to be for administrative use only Application Preparation Application form completed and signed by all founders Commitment and declaration document signed by all founders Full application package assembled, all required documents compiled and reviewed Pre-submission review conducted by legal advisers against all documented requirements Application submitted to CBI banking supervision department by 30 June 2026 Phase 2: Preliminary Approval Stage (June–September 2026) No use of bank name, brand, or banking activity prior to receipt of preliminary approval Response to any CBI requests for additional information prepared and submitted within specified timelines Board and management team engaged and briefed on implications of preliminary approval Compliance programme for pilot phase designed and implementation commenced Vendor selection for core banking system and online banking platform finalized or in advanced negotiation Phase 3: Pilot Operation Assessment Cycle 1 (H2 2026 to H2 2027) Capital Second capital tranche (IQD 35 billion) paid by H2 2027 deadline Capital adequacy ratio maintained at minimum 12.5% monthly monitoring and quarterly reporting to CBI LCR maintained at minimum 100% monthly calculation and quarterly reporting NSFR maintained at minimum 100% quarterly calculation and reporting CAR independently verified by CBI-approved firm Technology Core banking system deployed and operational Online banking platform (web and mobile) deployed and operational for retail customers; web platform operational for corporate customers Core banking system independently assessed by CBI-approved technology auditor Integration with all mandatory national payment and regulatory platforms completed and tested Data classification framework implemented; encryption controls in place for Level 0/1 data Data centres confirmed within Iraq meeting Level 3 Uptime Institute specifications Cybersecurity framework operational including multilayered defences and Zero Trust model Payment systems independently assessed by CBI-approved technology auditor ISO 27001 and ISO 22301 implementation programmes underway BCP and DRP completed, board-approved, and tested Governance Board fully constituted with all nine members in place; fit and proper assessments completed All five mandatory board committees constituted and operational All senior management positions filled; fit and proper assessments completed MLRO appointed and operational Board meeting schedule maintained, minimum six meetings per calendar year with CBI observer invited Board meeting audio-visual recordings and minutes provided to CBI Operations and Compliance Pilot phase deposit caps (IQD 30M retail / IQD 50M corporate) actively monitored and enforced Credit product approvals obtained from CBI for any credit products being offered Card issuance limited to debit and prepaid cards only Investment activity restricted to permitted instruments within pilot phase limitations Founder and institutional investor share transfer prohibition maintained Any public offering limited to final capital tranche only with prior CBI approval AML/CFT programme fully operational, customer risk classification, KYC/EDD, transaction monitoring, sanctions screening all active MLRO filing STRs/SARs as required Deposit protection system registration completed; monthly guarantee premiums being paid Credit registry reporting operational ATM access arrangements operational minimum five ATMs accessible to customers Customer service centre operational 24/7 contact centre available Related party credit exposures within limits; quarterly reporting to CBI Phase 4: Pilot Operation – Assessment Cycle 2 (H2 2027 to H2 2028) Third capital tranche (IQD 35 billion) paid by H2 2028 deadline cumulative capital reaches IQD 100 billion ISO 27001 certification obtained ISO 22301 certification obtained Core banking system full compliance certified by CBI-approved technology auditor (including ISO certifications) Online banking platform full compliance certified Data infrastructure full compliance certified Business continuity plan annually tested and results reported to board and CBI Second year external audit completed by CBI-approved independent auditor under IFRS standards All governance standards in full compliance All AML/CFT standards in full compliance independent assessment completed All internal controls assessment completed by CBI-approved firm All outstanding compliance requirements addressed and evidence of full compliance prepared for submission to CBI Phase 5: Full License and Post-License Operations Licensing fee of USD 200,000 paid at
Digital Bank – Assessment Cycles
Digital Bank – Assessment Cycles Overview The path from preliminary approval to a full digital bank license in Iraq is structured around a series of formal assessment cycles conducted by the CBI. Each cycle evaluates the bank’s compliance with a defined subset of the licensing standards, in a progression designed to test compliance incrementally before committing to a full, unrestricted license. This article examines the legal structure of the assessment cycle framework, the specific standards assessed at each cycle, the evidence and verification requirements, the CBI’s assessment powers, and the legal consequences of failing an assessment cycle or failing to meet the prescribed compliance timelines. 1. Three Assessment Cycles The framework establishes three formal assessment cycles: Cycle Timing Purpose Initial Requirements Assessment Application deadline: 30 June 2026 Assessment of foundational conditions, first capital tranche, basic governance declarations, technology planning, initial policy framework, QII confirmation Assessment Cycle 1 H2 2027 Assessment of partial compliance with all standards, operational technology systems deployed and tested, full governance constituted, AML programme operational, second capital tranche paid Assessment Cycle 2 H2 2028 Assessment of full compliance with all standards, ISO certifications obtained, all capital paid, full operational compliance across all categories, gateway to full license grant The framework specifies, for each standard, which assessment cycle requires partial compliance and which requires full compliance. Legal advisers and compliance teams should construct a compliance matrix mapping each standard against the applicable assessment cycle requirement. 2. Standards and Compliance Requirements by Category 2.1 Ownership and Governance Standards The ownership and governance standards are assessed across all three cycles, with increasing levels of completeness required: Ownership structure (A1): Full compliance including confirmation of the Qualified Institutional Investor is required from the Initial Assessment Owner due diligence (A2): Partial compliance (all requirements except external auditor assessment) at Initial Assessment; full compliance at Cycle 1. Where new owners join, reassessment is required at Cycle 2 Board governance (A3): Partial compliance (all governance requirements except committee formation) at Initial Assessment; full compliance at Cycle 1 Board fit and proper (A4): Partial compliance (board member declarations including names and qualifications, excluding external auditor assessment) at Initial Assessment; full compliance at Cycle 1. Where new board members are elected, reassessment is required at Cycle 2 Governance structure (A5): Full compliance required from Cycle 1 Senior management fit and proper (A6): Partial compliance (management declarations including names and qualifications, excluding external auditor assessment) at Initial Assessment; full compliance at Cycle 1. Where new senior management is appointed, reassessment required at Cycle 2 2.2 Business Sustainability Standards The business sustainability standards (covering technology, infrastructure, and operational requirements) follow a phased compliance schedule: Business plan (B1): Full compliance required from the Initial Assessment, including submission of the Technology Plan and Architecture Core banking system (B2): Partial compliance at Initial Assessment (detailed technology plan submitted including vendor names, software, preliminary contracts); partial compliance at Cycle 1 (full technical compliance excluding ISO certifications, tested by CBI-approved technology auditor); full compliance at Cycle 2 (including ISO certifications) Online banking platform (B3): Same phased schedule as the core banking system standard Physical headquarters (B4): Full compliance required from Cycle 1 ATM coverage (B5): Full compliance required from Cycle 1 (partnership agreements with traditional banks may be used if the bank does not wish to own ATMs directly) Customer service (B6): Full compliance required from Cycle 1 Data infrastructure (B7): Same phased schedule as the core banking system standard Payment systems (B8): Full compliance required from Cycle 1 Business continuity (B9): Same phased schedule as the core banking system standard Deposit protection system (B10): Full compliance required at Cycle 1, including completion of registration with the Iraqi deposit guarantee company Credit registry (B11): Full compliance required from Cycle 1 2.3 Financial Standards The financial standards are assessed at each cycle with increasing capital requirements: Capital and composition (C1): Partial compliance, IQD 30 billion at Initial Assessment; partial compliance, IQD 65 billion at Cycle 1; full compliance, IQD 100 billion at Cycle 2 Capital adequacy ratio (C2): Full compliance (12.5% minimum) required from Cycle 1 Liquidity ratio (C3): Full compliance (LCR and NSFR minimum 100%) required from Cycle 1 2.4 Risk and Regulatory Compliance Standards The risk and compliance standards require full compliance from Cycle 1: Related party and conflicts of interest (D1): Full compliance required from Cycle 1 AML/CFT and sanctions (D2): Full compliance required from Cycle 1 Reporting transparency and audit (D3): Full compliance required from Cycle 1 Internal controls (D4): Full compliance required from Cycle 1 3. Assessment Process: What the CBI Does Before each assessment cycle, the CBI issues a formal letter specifying the timelines for submission of materials and the organizational details of the cycle. Compliance with these notifications is a legal obligation. During each assessment cycle, the CBI conducts a structured evaluation that may include: Documentary review of all submitted materials against the applicable standards Verification by independent, CBI-approved firms for standards that require external verification On-site inspections and interviews with board members, senior management, and technical staff Testing of technology systems and controls Review of financial statements, capital calculations, and liquidity positions Assessment of AML/CFT programme effectiveness The CBI has the power to require additional information or documentation at any point during an assessment cycle, and to commission additional independent assessments where it considers these necessary. 4. Path to Full License The grant of a full digital bank license follows the successful completion of Assessment Cycle 2. The CBI evaluates the bank’s technical, operational, and financial readiness against the full set of required standards before making its licensing decision. A full license is granted only to banks that have demonstrated complete compliance with all required standards, including the mandatory ISO certifications, full capital payment, and operational compliance across all categories. Banks that have not achieved full compliance by Assessment Cycle 2 will not receive a full license and will remain subject to the pilot phase restrictions. Upon the grant of a full license, the operational restrictions that applied during
Digital Bank – AML, Sanctions & Compliance
Digital Bank – AML, Sanctions & Compliance Overview Anti-money laundering, counter-terrorist financing, and sanctions compliance are among the most consequential legal obligations imposed on any licensed bank. For digital banks in Iraq, these obligations are defined in detail by the regulatory framework, which requires the establishment of a comprehensive AML/CFT and sanctions programme, structured governance oversight, rigorous customer due diligence procedures, systematic transaction monitoring, and specific reporting obligations to Iraqi regulatory authorities. This article examines the principal AML, sanctions, and compliance legal obligations, the governance and programme structure required, the customer due diligence framework, transaction monitoring requirements, sanctions screening obligations, the specific legal role and obligations of the Money Laundering Reporting Officer, and the legal consequences of programme failures. 1. AML/CFT Programme: A Mandatory Legal Obligation Every digital bank in Iraq is legally required to establish, maintain, and operate a comprehensive AML/CFT and sanctions programme. This programme must cover three interconnected dimensions: 1.1 Governance and Organisation The programme must be supported by a formal governance structure including a dedicated AML/CFT oversight committee, chaired or supervised by senior management, with clearly defined escalation, reporting, and decision-making arrangements. The committee must meet at defined intervals, with agendas, minutes, and charters maintained and subject to review. A Compliance Officer and a Money Laundering Reporting Officer (MLRO) must be appointed, each operating with sufficient independence and authority. Both must report directly to a board-level committee or the committee chair, with a secondary (dotted-line) reporting relationship to the CEO or CFO. The independence of these functions must be genuine, the framework requires structural independence, not merely nominal separation. The programme must be governed by formal, board-approved policies covering AML/CFT, sanctions, customer due diligence, transaction monitoring, investigation procedures, and training. These policies must be consistent with the requirements issued by Iraqi regulatory authorities and with applicable international standards. They must be updated regularly and embedded in operational manuals and business unit procedures. 1.2 Procedures and Controls The programme must include risk-based procedures covering customer risk classification, KYC/CDD processes, enhanced due diligence for high-risk customers, transaction monitoring and investigation, sanctions screening, and escalation and reporting protocols. These procedures must be proportionate to the bank’s risk profile, customer base, product offering, and delivery channels. 1.3 Enabling Systems and Data The programme must be supported by integrated technology systems capable of performing KYC, transaction monitoring, sanctions screening, and regulatory reporting functions. These systems must be integrated with the core banking system and must maintain comprehensive, auditable data records for a minimum of seven years, consistent with the data retention requirements established by Iraqi regulatory authorities. 2. Customer Due Diligence and KYC The framework requires a risk-based approach to customer due diligence. All customers must be risk-classified at onboarding and throughout the relationship, with the level of due diligence applied calibrated to the assessed risk level. 2.1 Standard Customer Due Diligence Standard CDD must be applied to all customers and must include identity verification, beneficial ownership determination for legal entities, and the collection of information sufficient to understand the customer’s expected transaction profile and source of funds. Digital onboarding is permitted and specifically contemplated by the framework. The bank must implement advanced verification technologies including optical character recognition for document data extraction, biometric verification against identity documents, liveness detection to confirm the customer’s physical presence during registration, and anti-fraud safeguards against deepfake technology and synthetic identities. 2.2 Enhanced Due Diligence Enhanced due diligence must be applied to all customers assessed as presenting elevated risk. The framework specifically identifies the following categories as requiring EDD: Politically Exposed Persons (PEPs) and their family members and close associates High-net-worth customers Customers involved in cross-border transactions Customers with complex ownership structures EDD measures must include verification of the source of funds, enhanced transaction scrutiny, and periodic reassessment of the customer’s risk profile. 2.3 Customer Risk Classification The risk classification methodology must incorporate factors including geographic risk, product and service type, transaction behaviour patterns, and shareholder or ownership structure. The methodology must be documented, consistently applied, and subject to regular review and calibration. 3. Transaction Monitoring Digital banks must deploy specialized electronic transaction monitoring systems designed to detect patterns of suspicious activity. These systems must support dynamic rule configuration, automated alert generation, and investigation workflow management, with regular calibration and quality assurance controls. All transaction monitoring alerts must be investigated by qualified staff. Investigation records must be maintained with clear audit trails, reflecting the escalation path, the decision reached, and where applicable, the determination of whether the matter is reportable. Investigations must be initiated and concluded within timeframes proportionate to the level of risk identified. 4. Sanctions Screening Digital banks must implement real-time sanctions screening tools covering customers, counterparties, and transactions. The screening must be conducted against the sanctions lists and requirements established by Iraqi regulatory authorities, and must comply with the timelines prescribed for resolution of potential matches. Where a potential match is identified, the bank must follow documented escalation procedures consistent with its internal protocol. All screening results, escalation decisions, and resolution outcomes must be recorded and available for regulatory review. 5. The Money Laundering Reporting Officer: Legal Role and Obligations The MLRO is a position of specific legal significance. The MLRO is the individual within the bank who bears primary legal responsibility for the bank’s AML/CFT reporting obligations to the relevant Iraqi authorities. 5.1 Qualification Requirements The MLRO must satisfy the following requirements: Must be an Iraqi national, this is an absolute requirement with no exceptions Must be at least 30 years of age Must hold a university degree in law, public administration, financial management, accounting, financial and banking sciences, statistics, bank management, quality management, investment and resources management, or financial and accounting supervision or a related specialization Must have at least five years of experience in banking, financial, or regulatory fields Must have completed a minimum of 75 hours of formal training in AML/CFT practices Must be proficient in English Must hold one of the following certifications: the Certified Anti-Money Laundering and Counter-Terrorism Financing Specialist
Digital Bank – Governance & Board Obligations
Digital Bank – Governance & Board Obligations Overview Governance is one of the most legally demanding areas of the digital bank licensing framework. The requirements go significantly beyond what is prescribed by general Iraqi banking legislation, imposing specific rules on board composition, director independence, the qualifications required for technical roles, the structure and functioning of board committees, the conduct of board meetings, and the personal liability of directors and senior management for the bank’s compliance failures. This article examines these governance obligations in legal terms, with particular focus on the elements that are most significant for founders, investors, and their advisers, the board composition requirements, the fit and proper assessment process, the committee structure, and the consequences of governance failures. 1. Board Composition: The Legal Requirements The board of directors of a digital bank in Iraq must satisfy the following composition requirements: The board must consist of exactly nine members All board members must be non-executive directors meaning they must not hold any full-time or part-time employment with the bank with the sole exception of the CEO (Managing Director) At least six of the nine board members must be independent directors Of the six independent directors, at least three must be nominated by the Qualified Institutional Investor(s) in the ownership structure Where there is more than one QII in the ownership structure, the board must include at least one representative of each QII At least three board members must have sufficient technical expertise in the field of digital banking If the chairman of the board is not an independent director, the chairman may not hold membership of any board committee 1.1 Independence Requirement An independent director is one who has no current or recent affiliation, financial relationship, or material connection with the bank or its subsidiaries, other than affiliations or connections expressly permitted by the CBI. The independence criteria are defined in detail in the CBI’s ESG and institutional governance guidelines for banks. Legal advisers preparing governance documentation should ensure that the independence analysis is conducted on a substantive basis, not merely a formal one. 1.2 Technical Expertise in Digital Banking The requirement for at least three board members with technical expertise in digital banking is defined in detail in the assessment guidelines. To satisfy this requirement, a board member must have a demonstrable practical or academic background in one or more of the following areas: Banking information technology systems Digital payment systems Banking cybersecurity Development and operation of platforms and applications related to digital banking Management and operation of electronic banking services This expertise must be evidenced by a minimum of seven years of relevant experience, during which the individual held a senior leadership or supervisory position (such as department head, unit chief, or equivalent) at a licensed financial institution or licensed fintech company. 2. Board Tenure and Term Limits Board members are appointed by the bank’s general assembly for a term not exceeding four years. Board members may be reappointed for one additional term of equal duration, meaning the maximum total tenure of a board member is eight years (two four-year terms). Reappointment for a third or subsequent term is not permitted. The board must hold a minimum of six meetings per calendar year. A meeting counts toward the minimum only if two conditions are satisfied: the legally required quorum is present (at minimum 50% of members, including at least three independent directors), and an audio-visual recording of the meeting is provided to the CBI by the board secretary, together with copies of the meeting minutes and an invitation to the CBI’s designated observer to attend. 3. Fit and Proper Requirements All board members are subject to a fit and proper assessment. This assessment must be conducted by an independent, CBI-approved firm. The assessment covers: Criminal record and history of disciplinary proceedings Character, integrity, and professional conduct including personal and professional behaviour, reputation, and transparency in previous appointments Confirmation that the board member is at least 30 years of age Confirmation that the board member has not previously been convicted of a criminal offence or an offence involving dishonesty or breach of trust, and is not subject to local or international sanctions Absence of conflicts of interest that could compromise the integrity of management or create risks to the separation of shareholder and management functions Academic qualifications, all board members must hold at minimum a university degree (bachelor’s level) consistent with the standards prescribed by the CBI Professional experience, board members must have at least 10 years of leadership or management experience in relevant fields (finance, law, accounting, technology), preferably at institutions of comparable size and complexity Financial soundness, including personal financial position, history of insolvency or bankruptcy, and compliance with tax and debt obligations Regulatory and legal compliance history Future board members must obtain approval through the fit and proper assessment before they are formally appointed. Board members must also undergo the fit and proper assessment upon re-election at the end of each term. 4. Board Committee Requirements In addition to the audit committee mandated by Iraqi banking legislation, digital banks must establish the following board-level committees: Committee Legal Basis / Purpose Audit Committee Required by Iraqi banking legislation; oversees financial reporting integrity, compliance with applicable laws, and the internal audit function Risk Management Committee Responsible for identifying, assessing, and mitigating risks across the institution; oversees risk management policies and the maintenance of financial stability ICT Governance Committee Oversees the bank’s technology direction; ensures effective use of technology with appropriate risk management and regulatory compliance ESG & Sustainability Committee Oversees the bank’s compliance with sustainable practices, environmental and social regulatory requirements, and integration of sustainability into strategic decision-making Nominations & Remuneration Committee Responsible for nominating and approving new members of the management team (excluding internal and Sharia auditors); reviewing all board candidates; overseeing new independent directors and the approval process All committees must be constituted and organized in accordance with the CBI’s ESG and institutional governance guidelines. The chair of each
Digital Bank – Pilot Operation Phase
Digital Bank – Pilot Operation Phase Overview The pilot operation phase is the period between the grant of a preliminary approval and the award of a full digital bank license. It is a legally distinct operational phase, the digital bank is authorized to operate, but its activities are subject to specific restrictions that would not apply to a fully licensed bank. The pilot phase serves a defined regulatory purpose: it allows the CBI to monitor the bank’s real-world performance across governance, technology, financial management, and compliance before committing to a full, unrestricted license. For the digital bank, it is the period during which remaining licensing standards must be progressively satisfied. This article sets out the legal framework for the pilot operation phase, the restrictions on deposits, credit, cards, and investments that apply during this period, the restrictions on share transfers and capital raising, the assessment cycles that govern the path to full licensing, and the legal consequences of non-compliance during the pilot phase. 1. Duration of the Pilot Phase The pilot operation phase is planned to run for approximately two years from the date of preliminary approval. Based on the framework’s timeline, preliminary approvals are expected to be issued by September 2026, with the pilot phase running until approximately late 2028. The framework contemplates two assessment cycles during the pilot phase, the first in the second half of 2027 and the second in the second half of 2028. Successful completion of the second assessment cycle is the gateway to the grant of a full license. 2. Restrictions on Deposit-Taking During the pilot phase, a digital bank’s deposit-taking activities are subject to specific caps: Individual (retail) deposits: the maximum deposit that may be held by a single individual customer is IQD 30 million (thirty million Iraqi dinars) Corporate deposits: the maximum deposit that may be held by a single corporate customer is IQD 50 million (fifty million Iraqi dinars) These caps are per-customer limits, not aggregate limits. The bank may accept deposits from an unlimited number of customers, but no individual customer’s total deposits may exceed the applicable cap. These restrictions are lifted upon the successful completion of the pilot phase and the grant of a full license. 3. Restrictions on Credit and Lending Credit activities during the pilot phase are significantly restricted. The framework imposes both product restrictions and a case-by-case approval requirement: 3.1 Permitted Credit Products During the pilot phase, only small-value, short-term credit products are permitted. These products must be: Loans of small value and short maturity Limited to maturities of between three and six months Subject to CBI approval on a case-by-case basis before any credit product is offered The case-by-case approval requirement means that the bank cannot simply design a credit product and offer it to customers, each product or product category requires specific CBI authorization before it can be launched. The approval is valid for six months and must be renewed by the CBI for the bank to continue offering the approved product. 3.2 Prohibited Credit Products The following credit products are prohibited during the pilot phase: Complex credit services, including documentary letters of credit (LCs) and letters of guarantee (LGs) Credit cards, the issuance of credit cards is expressly prohibited during the pilot phase 3.3 Credit Limits All credit extended during the pilot phase must be funded from the bank’s paid-up capital. The framework limits credit products to those consistent with the bank’s capital base, preventing over-extension during the establishment period. 4. Card Issuance: Permitted and Prohibited During the pilot phase, card issuance is restricted to: Debit cards Prepaid cards Credit card issuance is expressly prohibited during the pilot phase. International usage of permitted cards is subject to the controls established by the CBI. An important legal condition applies to cards issued during the pilot phase: all cards issued during this period expire at the end of the pilot phase, unless renewed following the bank’s successful completion of the pilot phase. This means that if the bank fails to progress to a full license, all cards issued to customers become invalid at the end of the pilot period. 5. Investment Restrictions During the pilot phase, the bank’s investment activities are significantly restricted. Permitted investments are limited to: Instruments issued or approved by the CBI, including CBI bills and government treasury instruments Instruments whose maturity does not exceed the duration of the pilot phase Deposit-type investments only, no equity or ownership investments are permitted With the exception of these permitted instruments, the only investments permitted during the pilot phase are investments in technology development and the building of institutional capabilities and capacity. Capital and equity investments of any other kind are not permitted. 6. Restrictions on Share Transfers and Capital Raising As examined in Article 2 of this series, the pilot phase imposes significant restrictions on the mobility of equity: 6.1 Prohibition on Founder Exits Founders and institutional investors are prohibited from selling shares, reducing their shareholdings, or exiting their investment fully or partially during the pilot phase. Only the entry of new investors is permitted. This restriction applies regardless of the CBI’s discretion. 6.2 Public Share Offerings Public share offerings during the pilot phase are restricted to the purpose of completing the final capital tranche only. Offerings to complete the first or second tranches are not permitted. All public offerings require prior CBI approval before the offering is opened. 7. The Assessment Cycles: Progressive Compliance The path from preliminary approval to full license is structured around three assessment cycles, each of which evaluates compliance with a defined subset of the framework’s standards: Assessment Cycle Timing Focus Initial Requirements Assessment June 2026 (application deadline) Basic conditions, capital first tranche, foundational governance, technology planning, initial policy framework Assessment Cycle 1 H2 2027 Partial compliance with all standards, technology systems operational but not yet ISO certified, governance fully constituted, AML programme in place Assessment Cycle 2 H2 2028 Full compliance with all standards, ISO certifications obtained, all capital