Banking (prudential standard) determination No. 6 of 2014
Prudential Standard APS 610 Prudential Requirements for Providers of Purchased Payment Facilities
 
Banking Act 1959
 
I, Wayne Byres, delegate of APRA:
(a)     under subsection 11AF(3) of the Banking Act 1959 (the Act) REVOKE Banking (prudential standard) determination No. 17 of 2012 including Prudential Standard APS 610 Prudential Requirements for Providers of Purchased Payment Facilities made under that Determination; and
(b)     under subsection 11AF(1) of the Act DETERMINE Prudential Standard APS 610 Prudential Requirements for Providers of Purchased Payment Facilities in the form set out in the attached Schedule, which applies to ADIs that are purchased payment facility providers.
This instrument takes effect on 1 January 2015.
 
Dated: 3 December  2014
[Signed]
 
Wayne Byres
Chair
Interpretation
In this instrument:
ADI has the meaning given in section 5 of the Act.
APRA means the Australian Prudential Regulation Authority.
purchased payment facility has the meaning given in section 7 of the Payment Systems (Regulation) Act 1998.
 
Schedule
Prudential Standard APS 610 Prudential Requirements for Providers of Purchased Payment Facilities comprises the 6 pages commencing on the following page.

Prudential Standard APS 610
Prudential Requirements for Providers of Purchased Payment Facilities
Objective and key requirements of this Prudential Standard
This Prudential Standard requires authorised deposit-taking institutions (ADIs) that have obtained an authority to provide purchased payment facilities (PPFs) to meet prudential requirements commensurate with their risk profile. These ADIs form a class of ADI known as purchased payment facility providers (PPF providers). They are not authorised to conduct general banking business.
This Prudential Standard sets out those ADI prudential standards that apply to PPF providers, as well as additional requirements applying to PPF providers that have stored value at risk. 
The key requirements of this Prudential Standard for PPF providers with stored value at risk are:
·                a minimum Tier 1 capital requirement that is the larger of the following two figures:
(i) the minimum start-up capital as determined by APRA; or
(ii) five per cent of stored value liabilities.
·                a PPF provider with stored value at risk must hold, at all times, high quality liquid assets equal to its stored value liabilities; and
·                a PPF provider with stored value at risk must meet certain operational risk requirements.
Authority
1.             This Prudential Standard is made under section 11AF of the Banking Act 1959 (Banking Act).
Application
2.             This Prudential Standard applies to authorised deposit-taking institutions (ADIs) that have obtained an authority under section 9 of the Banking Act to conduct banking business as defined by Regulation 3 of the Banking Regulations 1966. These ADIs form a class of ADIs called purchased payment facility providers (PPF providers).
Applicable ADI prudential standards
3.             Prudential standards that apply to PPF providers are:
(a)           Prudential Standard CPS 231 Outsourcing (CPS 231);
(b)          Prudential Standard CPS 232 Business Continuity Management (CPS 232);
(c)           Prudential Standard CPS 220 Risk Management (CPS 220);
(d)          Prudential Standard APS 310 Audit and Related Matters (APS 310);
(e)           Prudential Standard CPS 510 Governance (CPS 510); and
(f)           Prudential Standard CPS 520 Fit and Proper (CPS 520).
Definition of stored value and stored value liabilities
4.             Stored value refers to the balance of funds represented on purchased payment facility (PPF) devices or PPF accounts held by beneficiaries for the purpose of making payments.
5.             Stored value liabilities are the aggregate liabilities of a PPF provider to beneficiaries to complete payments made with PPF devices or PPF accounts, and the outstanding obligations to payees for payments made but not yet settled.
Prudential requirements for PPF providers with stored value at risk
6.             The remainder of this Prudential Standard sets out requirements that apply to all PPF providers with stored value at risk.
Stored value at risk
7.             A PPF provider is deemed not to have stored value at risk if the PPF provider can satisfy APRA that:
(a)           the PPF provider does not itself have any stored value liabilities; or
(b)          the PPF provider has stored value liabilities but:
(i)            the funds received in exchange for stored value on PPF devices or in PPF accounts are deposited in an account held with an ADI until settlement to payees occurs; and
(ii)          the PPF provider has no operational control of the account; and
(iii)        no creditors aside from the beneficiaries or payees of the stored value can have legal recourse to the assets held in this account in the event the PPF provider becomes insolvent or is wound-up.
Responsibility for capital adequacy
8.             The Board of Directors (Board) of a PPF provider must ensure that the PPF provider maintains an appropriate level of capital commensurate with the level and extent of risks to which the PPF provider is exposed from its activities. To this end, the PPF provider must:
(a)           have adequate systems and procedures in place to identify, measure, monitor and manage the risks arising from its activities to ensure that capital is held at a level consistent with the PPF provider’s risk profile; and
(b)          maintain and implement a capital management plan, consistent with the overall business plan, for managing its capital levels on an ongoing basis.  The plan must set out:
(i)            the PPF provider’s strategy for maintaining capital resources over time, for example, by outlining its capital needs for supporting the degree of risks involved in the PPF provider’s business, how the required level of capital is to be met, as well as the means available for sourcing additional capital where required; and
(ii)          actions and procedures for monitoring the PPF provider’s compliance with minimum capital adequacy requirements, including the setting of trigger ratios to alert management of, and avert, potential breaches to the minimum capital required by APRA.
Minimum capital adequacy requirements
9.             A PPF provider must, as a minimum, have at all times Tier 1 Capital equal to:
(a)           the minimum start-up capital as determined by APRA (Note: minimum start-up capital is ordinarily a condition on authorisation for PPF providers with stored value at risk. Refer to APRA’s Guidelines on Authorisation of Providers of Purchased Payment Facilities); or
(b)          5 per cent of total outstanding stored value liabilities,
whichever is the larger figure.
10.         Examples of Tier 1 Capital include paid-up ordinary shares and retained earnings. Prudential Standard APS 111 Capital Adequacy: Measurement of Capital detail the criteria instruments must meet to be classified as Tier 1 Capital.
11.         A PPF provider must continuously monitor its stored value liabilities. If a PPF provider is unable to do so, it must determine if paragraph 9(b) applies by using the highest value of stored value liabilities held over the preceding six month period, measured in a manner approved by APRA.
Liquidity and asset requirements
12.         A PPF provider must hold at all times high quality liquid assets equal to its stored value liabilities. High quality liquid assets must be free from encumbrances (except where approved for a prudential purpose by APRA).  Eligible assets include:
(a)           cash;
(b)          securities eligible for repurchase transactions with the Reserve Bank of Australia;
(c)           bank bills and CDs issued by ADIs provided the issue is rated at least ‘investment grade’ (refer to Attachment C to Prudential Standard APS 116 Capital Adequacy: Market Risk);
(d)          deposits (at call and any other deposits readily convertible into cash within two business days) held with other ADIs; and
(e)           any asset approved by APRA (subject to any conditions imposed by APRA) as a high quality liquid asset for the purposes of this Prudential Standard.
Operational risk
13.         The Board and senior management of a PPF provider must develop, implement and maintain a risk management framework to address operational risk that is appropriate to the size, complexity and business mix of the PPF provider.
14.         The management of operational risk must include, but is not limited to, the risks associated with:
(a)           the integrity of transaction data and timely processing of transactions;
(b)          appropriate back-up and disaster recovery plans and facilities, including resilient critical processing systems (refer to CPS 232);
(c)           regular testing of business continuity and disaster recovery arrangements (refer to CPS 232);
(d)          outsourcing risk management to any third-party service providers (refer to CPS 231);
(e)           internal and external fraud risk management, which must include the following elements:
(i)            risk identification and assessment;
(ii)          internal controls and mitigation strategies;
(iii)        segregation of duties at both an operational level and in relation to functional reporting lines;
(iv)        financial accounting controls; and
(v)          staff training and awareness;
(f)    controls against information security and physical security risks; and
(g)   compliance obligations regarding relevant laws and regulations, for example those relating to licensing requirements under the Corporations Act 2001.
15.         A PPF provider must have in place effective management information systems and monitoring mechanisms to assist with early detection and correction of deficiencies in procedures for managing operational risk.
16.         A PPF provider must consider the imposition of a limit on the amount of stored value that can be loaded, stored or paid on a device or account purchased from the PPF provider. APRA will closely examine any facility that allows a purchaser to load, store, or pay sizeable amounts of money to ensure that the integrity of the facility is not compromised. Where a PPF provider is involved with this type of facility, it must ensure that it has in place adequate systems for the identification of purchasers and the recording and tracing of transaction data.
17.         A PPF provider must not be involved in providing PPFs that do not have a reasonable limit on the amount that can be loaded, stored or paid on a device or account, or provide an audit trail of purchaser and transaction information.  Australia’s anti-money laundering regulator and specialist financial intelligence unit is the Australian Transaction Reports and Analysis Centre (AUSTRAC), and a PPF provider must comply with all anti-money laundering requirements, including customer due diligence, as administered by AUSTRAC.
Notification requirements
18.         A PPF provider must immediately inform APRA, in accordance with section 62A of the Banking Act, of:
(a)    any breach of the minimum capital adequacy requirements (refer to paragraph 9) and any potential breach of these requirements (e.g. breaches of trigger ratios set under paragraph 8(b)(ii)), including remedial actions taken/planned to deal with the problem; or
(b)   any breach of its minimum liquidity holdings, or concerns over the adequacy of its liquidity holdings.
Adjustments and exclusions
19.         APRA may, by notice in writing, adjust or exclude a specific prudential requirement in this Prudential Standard in relation to one or more specified ADIs or authorised NOHCs[1].

[1]           Refer to sub-section 11AF(2) of the Banking Act.