Digital Bank - License Suspension and Revocation

Overview

The checklist is not a substitute for specific legal advice, the requirements are complex, the details matter, and the consequences of non-compliance are severe. It is, however, a framework for ensuring that the principal legal obligations have been identified, assigned, and tracked throughout the establishment process.

Phase 1: Pre-Application (Before 30 June 2026)

Corporate Structure

• Decision on corporate structure confirmed Iraqi joint stock company to be established or used as the licensing vehicle
• Articles of association and internal regulations drafted to include all mandatory framework provisions (nomination restrictions, pledge prohibitions, tag-along rights, rights of first refusal)
• Shareholder agreement prepared with all mandatory provisions
• Related party mapping exercise completed all related party relationships identified and holdings confirmed within applicable limits
• QII confirmed in ownership structure with qualifying shareholding of minimum 9.999%; QII eligibility documentation compiled

Capital

• IQD 30 billion initial capital tranche paid and evidence of payment available for submission
• Funding commitments in place for second tranche (IQD 35 billion, due H2 2027) and third tranche (IQD 35 billion, due H2 2028)
• Capital structure confirmed to include at least 50% Tier 1 capital
• 15% non-releasable reserve mechanism understood and reflected in investor documentation

Governance

• Nine proposed board members identified; composition confirms at least six independent directors with at least three nominated by QII(s)
• At least three board members confirmed to have qualifying technical expertise in digital banking
• Board member qualifications and credentials compiled for fit and proper assessment
• Fit and proper assessment commissioned with CBI-approved independent firm
• All five mandatory board committees identified with proposed chairs confirmed as independent directors
• Senior management team identified; all positions filled or in active recruitment
• MLRO candidate identified confirmed as Iraqi national with required qualifications and certifications
• Senior management qualifications and credentials compiled for fit and proper assessment

Business Plan and Documentation

• Comprehensive business plan completed in Arabic and English covering strategy, products and pricing, target customers, operational model, five-year financial projections, technology plan, risk framework, and compliance programme
• Technology Plan and Architecture document completed with Tier 1 vendor names, software details, and preliminary contracts
• Policy framework completed: information security policy, risk management policy, compliance policy, AML/CFT policy, anti-fraud and anti-corruption policy
• AML/CFT and sanctions programme structure documented
• Physical headquarters within Iraq identified and confirmed to be for administrative use only

Application Preparation

• Application form completed and signed by all founders
• Commitment and declaration document signed by all founders
• Full application package assembled, all required documents compiled and reviewed
• Pre-submission review conducted by legal advisers against all documented requirements
• Application submitted to CBI banking supervision department by 30 June 2026

Phase 2: Preliminary Approval Stage (June–September 2026)

• No use of bank name, brand, or banking activity prior to receipt of preliminary approval
• Response to any CBI requests for additional information prepared and submitted within specified timelines
• Board and management team engaged and briefed on implications of preliminary approval
• Compliance programme for pilot phase designed and implementation commenced
• Vendor selection for core banking system and online banking platform finalized or in advanced negotiation

Phase 3: Pilot Operation  Assessment Cycle 1 (H2 2026 to H2 2027)

Capital

• Second capital tranche (IQD 35 billion) paid by H2 2027 deadline
• Capital adequacy ratio maintained at minimum 12.5% monthly monitoring and quarterly reporting to CBI
• LCR maintained at minimum 100% monthly calculation and quarterly reporting
• NSFR maintained at minimum 100% quarterly calculation and reporting
• CAR independently verified by CBI-approved firm

Technology

• Core banking system deployed and operational
• Online banking platform (web and mobile) deployed and operational for retail customers; web platform operational for corporate customers
• Core banking system independently assessed by CBI-approved technology auditor
• Integration with all mandatory national payment and regulatory platforms completed and tested
• Data classification framework implemented; encryption controls in place for Level 0/1 data
• Data centres confirmed within Iraq meeting Level 3 Uptime Institute specifications
• Cybersecurity framework operational including multilayered defences and Zero Trust model
• Payment systems independently assessed by CBI-approved technology auditor
• ISO 27001 and ISO 22301 implementation programmes underway
• BCP and DRP completed, board-approved, and tested

Governance

• Board fully constituted with all nine members in place; fit and proper assessments completed
• All five mandatory board committees constituted and operational
• All senior management positions filled; fit and proper assessments completed
• MLRO appointed and operational
• Board meeting schedule maintained, minimum six meetings per calendar year with CBI observer invited
• Board meeting audio-visual recordings and minutes provided to CBI

Operations and Compliance

• Pilot phase deposit caps (IQD 30M retail / IQD 50M corporate) actively monitored and enforced
• Credit product approvals obtained from CBI for any credit products being offered
• Card issuance limited to debit and prepaid cards only
• Investment activity restricted to permitted instruments within pilot phase limitations
• Founder and institutional investor share transfer prohibition maintained
• Any public offering limited to final capital tranche only with prior CBI approval
• AML/CFT programme fully operational, customer risk classification, KYC/EDD, transaction monitoring, sanctions screening all active
• MLRO filing STRs/SARs as required
• Deposit protection system registration completed; monthly guarantee premiums being paid
• Credit registry reporting operational
• ATM access arrangements operational minimum five ATMs accessible to customers
• Customer service centre operational 24/7 contact centre available
• Related party credit exposures within limits; quarterly reporting to CBI

Phase 4: Pilot Operation –  Assessment Cycle 2 (H2 2027 to H2 2028)

• Third capital tranche (IQD 35 billion) paid by H2 2028 deadline cumulative capital reaches IQD 100 billion
• ISO 27001 certification obtained
• ISO 22301 certification obtained
• Core banking system full compliance certified by CBI-approved technology auditor (including ISO certifications)
• Online banking platform full compliance certified
• Data infrastructure full compliance certified
• Business continuity plan annually tested and results reported to board and CBI
• Second year external audit completed by CBI-approved independent auditor under IFRS standards
• All governance standards in full compliance
• All AML/CFT standards in full compliance independent assessment completed
• All internal controls assessment completed by CBI-approved firm
• All outstanding compliance requirements addressed and evidence of full compliance prepared for submission to CBI

Phase 5: Full License and Post-License Operations

• Licensing fee of USD 200,000 paid at commencement of Cycle 1 (H2 2027)
• Full license received, CBI decision documented and archived
• Pilot phase operational restrictions lifted deposit caps, credit restrictions, card issuance limitations, and investment constraints no longer apply
• Founder and institutional investor exit restrictions lifted in accordance with CBI-prescribed conditions
• Any public share offering for capital raising purposes subject to prior CBI written approval
• Ongoing compliance programme maintained, all regulatory obligations continue post full license
• Annual external audit obligations continue
• Board member rotation and term limit tracking no board member to serve beyond eight years total
• Annual independent assessment of AML/CFT programme continues
• Annual independent assessment of technology systems continues
• Ongoing quarterly reporting to CBI on capital adequacy, liquidity ratios, and related party exposures