Lesotho

Reg. 5 bars a company from issuing electronic payment instruments unless licensed under Part III or a financial institution under the Financial Institutions Act, 2012. The Central Bank may refuse a licence if the applicant lacks a Lesotho registered office, minimum core capital of M500,000 (Schedule 2) or fit-and-proper owners and officials (reg. 7). Licences run for one year (reg. 13).

Reg. 18(2) requires prior notice to the Central Bank of outsourcing, and reg. 18(4) keeps the issuer responsible for outsourced functions and agents. Reg. 7(1)(c)(viii)(cc) requires contingency arrangements for safety, security and operational reliability, and Schedule 1, Part B, item 6 requires ICT security policies and disaster recovery plans with an application. The regulations contain no cyber-incident reporting duty.

Reg. 35(1) requires issuers to deposit holder funds in a trust account at a Lesotho-licensed bank under Schedule 4. The trust balance must equal outstanding e-money at all times (Schedule 4, item 3(a)), funds may not be commingled (item 3(c)) and the Trust Deed needs Central Bank approval.